driver-comm

Usermode↔kernel driver communication: IOCTL design, shared sections, events, security descriptors, stealth IOCTL.

SKILL.md

GitHub

Driver communication

Channels

  • DeviceIoControl IOCTL
  • Shared memory sections + events
  • Ports/ALPC (rare)

Design

  • Validate IRQL, buffer methods (METHOD_BUFFERED preferred)
  • ACL device object; avoid \Device\EasyToFind names
  • Version handshake; deny unknown clients