User mode/Kernel Mode context question

There is article in the IFS called "take it to the limit" about switching
contexts. The point of the article is that as long as you are sure you are
in the correct user mode context, you can call a user mode function from
kernel mode.

In the article they show how to use DeviceIoControl() from User mode to call
the kernel mode and to be sure of the context. DeviceIoControl passes in a
pointer to a function, and that function be it a user mode or kernel mode
function can be called from the kernel, ... and it will work!

Following their suggestion, I've done I'm doing just what they suggest and
I'm getting hosed. Specifically this is the function I'm calling.


void TestFunc()

{MessageBox(NULL,L"ThisIsaTest",L"SeemsToWork",MB_ OK);

}


So I get a pointer to this function, and all is well initially. BUT
MessageBox works its way along, making a few calls and ends up executing
"sysenter" instruction. This is where it breaks.

The OSR article was probably written in the era of INT 2E. So is the OSR
article incorrect or obsolete, or perhaps have I missed something?


--
Gak -
Finecats

It is definitely obsolete, and even when it was written it could break with
recursion into the kernel, as well as the fact that you are blowing all the
security of the system out of the water. I've known and respected the folks
at OSR for 10 years, but I always thought that was a stupid article to
write.


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply



"finecats" <> wrote in message
news:73B9E906-617C-4ADF-976F-...
>
> There is article in the IFS called "take it to the limit" about switching
> contexts. The point of the article is that as long as you are sure you
> are
> in the correct user mode context, you can call a user mode function from
> kernel mode.
>
> In the article they show how to use DeviceIoControl() from User mode to
> call
> the kernel mode and to be sure of the context. DeviceIoControl passes in
> a
> pointer to a function, and that function be it a user mode or kernel mode
> function can be called from the kernel, ... and it will work!
>
> Following their suggestion, I've done I'm doing just what they suggest and
> I'm getting hosed. Specifically this is the function I'm calling.
>
>
> void TestFunc()
>
> {MessageBox(NULL,L"ThisIsaTest",L"SeemsToWork",MB_ OK);
>
> }
>
>
> So I get a pointer to this function, and all is well initially. BUT
> MessageBox works its way along, making a few calls and ends up executing
> "sysenter" instruction. This is where it breaks.
>
> The OSR article was probably written in the era of INT 2E. So is the OSR
> article incorrect or obsolete, or perhaps have I missed something?
>
>
> --
> Gak -
> Finecats