Question

我最近在Windows中遇到了一种允许驱动程序响应低内存条件的机制，并想知道我的应用程序是否有可能响应类似于（通过其他机制）定义的标准事件对象的事件：

https://msdn.microsoft.com/en-us/library/windows/hardware/ff563847(v=vs.85).aspx

HighMemoryCondition
LowMemoryCondition
HighPagedPoolCondition
LowPagedPoolCondition
HighNonPagedPoolCondition
LowNonPagedPoolCondition
LowCommitCondition
HighCommitCondition
MaximumCommitCondition

这听起来非常适合我在应用程序中执行的操作，因为我需要检测油门条件并做出相应的响应。

但是，似乎这些都在内核中，那么用户域中的应用程序应该如何响应相同的条件呢？

感谢您的任何指示 - Laythe

Answer 1

您也可以在用户模式下轻松使用此事件。只需使用ZwOpenEvent和所有内容打开它。例如

HANDLE hEvent;
STATIC_OBJECT_ATTRIBUTES(ke,"\\KernelObjects\\LowMemoryCondition") ;
ZwOpenEvent(&hEvent, SYNCHRONIZE|EVENT_QUERY_STATE, &ke);
WaitForSingleObject(hEvent, INFINITE);

STATIC_OBJECT_ATTRIBUTES - 我的宏用于静态初始化Unicode字符串。您可以编写自己的实现 - 使用RTL_CONSTANT_STRING作为提示或在运行时

初始化Unicode字符串

发现\KernelObjects目录

的示例

void TestKO()
{
    STATIC_OBJECT_ATTRIBUTES(soa, "\\KernelObjects");

    OBJECT_ATTRIBUTES oa = { sizeof(oa) };

    if (0 <= ZwOpenDirectoryObject(&oa.RootDirectory, DIRECTORY_QUERY, &soa))
    {

        ULONG Context = 0, rcb;
        PVOID buf = alloca(PAGE_SIZE);

        NTSTATUS status, s;

        do 
        {
            if (0 <= (status = ZwQueryDirectoryObject(oa.RootDirectory, buf, PAGE_SIZE, FALSE, FALSE, &Context, &rcb)))
            {
                DIRECTORY_BASIC_INFORMATION* pdbi = (DIRECTORY_BASIC_INFORMATION*)buf;

                while (pdbi->ObjectTypeName.Length)
                {
                    //DbgPrint("%wZ %wZ\n", &pdbi->ObjectTypeName, &pdbi->ObjectName);

                    STATIC_UNICODE_STRING_(Event);

                    if (RtlEqualUnicodeString(&Event, &pdbi->ObjectTypeName, TRUE))
                    {
                        oa.ObjectName = &pdbi->ObjectName;

                        HANDLE hEvent;
                        if (0 <= (s = ZwOpenEvent(&hEvent, READ_CONTROL|EVENT_QUERY_STATE, &oa)))
                        {
                            EVENT_BASIC_INFORMATION ebi;
                            if (0 <= (s = ZwQueryEvent(hEvent, EventBasicInformation, &ebi, sizeof(ebi), &rcb)))
                            {

                                PCSTR szEventType;
                                switch (ebi.EventType)
                                {
                                case NotificationEvent: 
                                    szEventType = "Notification   ";
                                    break;
                                case SynchronizationEvent: 
                                    szEventType = "Synchronization";
                                    break;
                                default:
                                    char cc[16];
                                    sprintf(cc, "%x", ebi.EventType);
                                    szEventType = cc;
                                }
                                DbgPrint("%x %s %wZ\n", ebi.EventState, szEventType, &pdbi->ObjectName);
                            }
                            else
                            {
                                DbgPrint("QueryEvent(%wZ)=%x\n", &pdbi->ObjectName, s);
                            }

                            DumpAccess(hEvent);// not lisred here
                            NtClose(hEvent);
                        }
                        else
                        {
                            DbgPrint("OpenEvent(%wZ)=%x\n", &pdbi->ObjectName, s);
                        }
                    }
                    pdbi++;
                }
            }
        } while (status == STATUS_MORE_ENTRIES);

        NtClose(oa.RootDirectory);
    }
}

和结果（事件状态，类型和访问权限）：

0 Notification    MemoryErrors
T FL AcessMsK Sid
0 00 00120001 S-1-1-0 Everyone
0 00 001F0003 S-1-5-32-544 Administrators
0 00 001F0003 S-1-5-18 SYSTEM
0 00 00120001 S-1-15-2-1 ALL APPLICATION PACKAGES
0 Notification    LowNonPagedPoolCondition
T FL AcessMsK Sid
0 00 00120001 S-1-1-0 Everyone
0 00 001F0003 S-1-5-32-544 Administrators
0 00 001F0003 S-1-5-18 SYSTEM
0 00 00120001 S-1-15-2-1 ALL APPLICATION PACKAGES
1 Notification    SuperfetchScenarioNotify
T FL AcessMsK Sid
0 00 001F0003 S-1-5-32-544 Administrators
0 00 001F0003 S-1-5-18 SYSTEM
0 Synchronization SuperfetchParametersChanged
T FL AcessMsK Sid
0 00 001F0003 S-1-5-32-544 Administrators
0 00 001F0003 S-1-5-18 SYSTEM
0 Notification    PhysicalMemoryChange
T FL AcessMsK Sid
0 00 00120001 S-1-1-0 Everyone
0 00 001F0003 S-1-5-32-544 Administrators
0 00 001F0003 S-1-5-18 SYSTEM
0 00 00120001 S-1-15-2-1 ALL APPLICATION PACKAGES
0 Notification    HighCommitCondition
T FL AcessMsK Sid
0 00 00120001 S-1-1-0 Everyone
0 00 001F0003 S-1-5-32-544 Administrators
0 00 001F0003 S-1-5-18 SYSTEM
0 00 00120001 S-1-15-2-1 ALL APPLICATION PACKAGES
1 Notification    HighNonPagedPoolCondition
T FL AcessMsK Sid
0 00 00120001 S-1-1-0 Everyone
0 00 001F0003 S-1-5-32-544 Administrators
0 00 001F0003 S-1-5-18 SYSTEM
0 00 00120001 S-1-15-2-1 ALL APPLICATION PACKAGES
1 Notification    HighMemoryCondition
T FL AcessMsK Sid
0 00 00120001 S-1-1-0 Everyone
0 00 001F0003 S-1-5-32-544 Administrators
0 00 001F0003 S-1-5-18 SYSTEM
0 00 00120001 S-1-15-2-1 ALL APPLICATION PACKAGES
0 Notification    SystemErrorPortReady
T FL AcessMsK Sid
0 00 00120001 S-1-2-0 LOCAL
0 00 00120001 S-1-15-2-1 ALL APPLICATION PACKAGES
0 00 001F0003 S-1-5-18 SYSTEM
0 00 00120001 S-1-1-0 Everyone
0 Notification    MaximumCommitCondition
T FL AcessMsK Sid
0 00 00120001 S-1-1-0 Everyone
0 00 001F0003 S-1-5-32-544 Administrators
0 00 001F0003 S-1-5-18 SYSTEM
0 00 00120001 S-1-15-2-1 ALL APPLICATION PACKAGES
1 Notification    LowCommitCondition
T FL AcessMsK Sid
0 00 00120001 S-1-1-0 Everyone
0 00 001F0003 S-1-5-32-544 Administrators
0 00 001F0003 S-1-5-18 SYSTEM
0 00 00120001 S-1-15-2-1 ALL APPLICATION PACKAGES
1 Notification    HighPagedPoolCondition
T FL AcessMsK Sid
0 00 00120001 S-1-1-0 Everyone
0 00 001F0003 S-1-5-32-544 Administrators
0 00 001F0003 S-1-5-18 SYSTEM
0 00 00120001 S-1-15-2-1 ALL APPLICATION PACKAGES
0 Notification    LowMemoryCondition
T FL AcessMsK Sid
0 00 00120001 S-1-1-0 Everyone
0 00 001F0003 S-1-5-32-544 Administrators
0 00 001F0003 S-1-5-18 SYSTEM
0 00 00120001 S-1-15-2-1 ALL APPLICATION PACKAGES
0 Notification    LowPagedPoolCondition
T FL AcessMsK Sid
0 00 00120001 S-1-1-0 Everyone
0 00 001F0003 S-1-5-32-544 Administrators
0 00 001F0003 S-1-5-18 SYSTEM
0 00 00120001 S-1-15-2-1 ALL APPLICATION PACKAGES
1 Synchronization PrefetchTracesReady
T FL AcessMsK Sid
0 00 001F0003 S-1-5-32-544 Administrators
0 00 001F0003 S-1-5-18 SYSTEM

用户登陆内核陆地驱动程序系统通知

1 个答案: