So, my question is: does anyone know how the "timeout" argument to the NtReplyWaitReceivePortEx function works ? Is it perhaps a record that
needs a special setup ? If so, what ? Anything else ?
Secondary question : what is the function of NtListenPort ? NtReplyWaitReceivePort seems to do something quite similar ...
Don't you hate it when you post a question and than you find the answer
mere minutes later ?
So, my question is: does anyone know how the "timeout" argument to the
NtReplyWaitReceivePortEx function works ? Is it perhaps a record that
needs a special setup ? If so, what ? Anything else ?
It turns out it was a double problem.
1) Some further google-hunting showed that there is also an "NtCreateWaitablePort" function. Although I could not find any
description the "Waitable" in its name suggest that would need it.[1]
2) A quick test with "NtCreateWaitablePort" and "NtWaitForSingleObject" showed that the latter still failed the same way. However, "WaitForSingleObject" did actually wait the set time. So, after disassembling it it turns out that the timeout argument for "NtWaitForSingleObject" is in 100 nSec increments, and needs to be the *negative* of the desired value.
[1]Indeed, "NtCreatePort" with the correct timeout value for "NtWaitForSingleObject" also still failed.
Doing the same for the "NtReplyWaitReceivePortEx" shows it works there
too.
In short: Victory! :-)
Secondary question : what is the function of NtListenPort ?
NtReplyWaitReceivePort seems to do something quite similar ...
I could still use an answer to this one though ...
Have you seen the book "Windows NT/2000 Native API Reference"
by Gary Nebbett? I found a PDF of it years ago.
Timeout...
"Optionally points to a value that
Substitute Nt for Zw (most of the native functions are doubly
nameed - makes no difference from user mode).
ZwListenPort...
Remarks
The message type of the received message is
LPC_CONNECTION_REQUEST.The message data is the
connect data specified in the call to ZwConnectPort.
Apd,
Have you seen the book "Windows NT/2000 Native API Reference"
by Gary Nebbett? I found a PDF of it years ago.
Nope. And a google search just now shows its rather unavailable in /any/ form (pdf, text, other). Any chance you can share your copy of it ?
Timeout...
"Optionally points to a value that
I wish I could have found that info. But no. The best I got was this : http://undocumented.ntinternals.net/helpcontents.html
Substitute Nt for Zw (most of the native functions are doubly
nameed - makes no difference from user mode).
I noticed that when extracting function names from a DLL. Didn't think of /remember searching for the "Zw" name though. :-\
ZwListenPort...
Remarks
The message type of the received message is
LPC_CONNECTION_REQUEST.The message data is the
connect data specified in the call to ZwConnectPort.
Ah, so that is the whole difference: where NtReplyWaitReceivePort waits for /any/ message, NtListenPort filters out a specific one. Good to know. Thanks.
Sure:
[Snip]
The introduction, contents and index are missing.
The best I got was this :
[Snip]
Yes, I've seen that before. Nebbett's book is better.
Didn't think of /remember searching for the "Zw" name
though. :-\
It's a weird way of doing things and the difference is in the way
kernel code handles calls from user mode.
I don't know why both types are available from user mode.
I guess so. I've never used these functions. Isn't the
win32 WaitForSingleObject good enough?
The introduction, contents and index are missing.
Lol. My first thought was "with even the contents gone, what, if anything, will be left ?".
Luckily when I opened the PDF there was still enough to read there ...
Didn't think of /remember searching for the "Zw" name
though. :-\
It's a weird way of doing things and the difference is in the way
kernel code handles calls from user mode.
The code itself determines in which mode it called its called and than responds differently ? Thats ... interresting.
I don't know why both types are available from user mode.
If most of the code is the same with only the pre- and postamble different (setting up for kernel or usermode call) I can see it as a good decision (de-duplicating code).
That both the Nt* and Zw* names still exists is than probably a legacy thing (where both origionally pointed to different routines).
I guess so. I've never used these functions. Isn't the
win32 WaitForSingleObject good enough?
:-) I only used that kernel32 function on a hunch to test.
The target was to get the NtReplyWaitReceivePortEx function to work (I'm trying to write some local IPC), but thought it would be a good idea to isolate the "wait for" functionality to make things easier to check. I
first tried the NtWaitForSingleObject, but after that one failed too I wondered if maybe the "higher level" function in Kernel32 might be doing something extra that might make it work. And it did.
My understanding from other sources is that drivers
should use Zw
Those prefixes didn't exist in pre-NT versions of Windows.
So you need to go down to the native ntdll level to get things
to work.
Not sure I completely understand why the win32 API won't
do what you want, but Ok!
Drivers don't - they call Zw funcs exported from ntoskrnl.exe
I could only imagine that its either legacy, or that the name
prefix is ment as a "warning, you are writing kernel-mode
stuff".
Warning: Here be dragons!
Having now read the start of the section dealing with ports, I can
see why it uses native funcs.
It's one thing knowing that but another finding out how the
half-documented NT API works.
My understanding from other sources is that drivers
should use Zw
That is what I read too. Knowing that both call the same NTDLL
function
I could only imagine that its either legacy, or that the name prefix
is ment as a "warning, you are writing kernel-mode stuff".
So you need to go down to the native ntdll level to get things
to work.
Not quite. At some point in my looking thru IPC methods read that
there is also a Local IPC (or LPC) method. From there I landed on a
webpage showing some example code, which used the Nt* functions.
While searching for information on LPC and subsequently on the
different NtCreatePort family of functions I have not seen any
mentioning of the existence of Win32 API counterparts
A bit of disclosure: My programming language of choice is Assembly.
Which might explain why I was (and am) not bothered by using low-level functions. :-)
Apd,
Drivers don't - they call Zw funcs exported from ntoskrnl.exe
Doesn't that end in the same difference ?
Having now read the start of the section dealing with ports, I can
see why it uses native funcs.
Can you tell a bit about that ? I've got no idea about why that is,
and I'm intending two wrap code using those NT port functions up in an
API DLL. Is there perhaps a reason why I should not be doing that ?
It's one thing knowing that but another finding out how the
half-documented NT API works.
Indeed. I'm currently trying to figure out which datagram functions need to be used in which order to send and receive a stream of data.
And in that direction having contradicting documentation doesn't really help either :Like the second argument to NtAcceptConnectPort. The PDF I got from you named it "PortIdentifier". The info on the undocumented.ntinternals.net website describes it as "AlternativeReceivePortHandle". Without a usage description I've decided to just name it "UserValue".
What I don't undersand is the need for ntdll to export them
since user mode doesn't need them at all, and kernel mode
gets them from ntoskrnl.
Sorry, all I know is what it says about there being no
Win32 equivalents.
Might also be worth checking how/if these native routines
are implemented in ReactOS.
How about using rpcrt4.dll?
Apd,
What I don't undersand is the need for ntdll to export them
since user mode doesn't need them at all, and kernel mode
gets them from ntoskrnl.
Ehrmmm ... no, I can't think of such a reason either. On the other hand .... Didn't you say that ntdll has a few more Nt* functions than ntoskrnl ? Is that perhaps why they "shortcutted" the other functions into ntdll too ?
Apd,
How about using rpcrt4.dll?
Somehow I forgot to mention that I did take a look at the functions the DLL exposed, and must say that those names do not really hint at what they are for.
Don't forget the example in the API book.
How about another book?
Undocumented Windows NT
Chapter 8 LPC
All the other chapters can be found there, too.
Apd,
Don't forget the example in the API book.
The API book ? I take it you mean the PDF link you just provided ?
The first one did have some code, but no example that I could see.
Undocumented Windows NT
Chapter 8 LPC
Fun. It looks like thats same as the webpage I found containing the
example code I started with :
https://web.archive.org/web/20080612141354/http://www.windowsitlibrary.com/Content/356/08/toc.html
All the other chapters can be found there, too.
I don't know why, but pretty-much my first thought after downloading the
PDF was to see what would happen if I would remove the PDF filename
part, to see if I would drop into the folder and what would be there.
:-)
The first one did have some code, but no example that I could see.
The debug example 4 in the Appendix. Search the pdf for ZwReplyWaitReceivePort.
was to see what would happen if I would remove the PDF filename part, to
see if I would drop into the folder and what would be there. :-)
That's how I found it!
I certainly can use everything there is. I'm having a blast of a time
trying to figure out what message types the different "request" and "reply" functions send and wish to accept[1] (trying to find working client/server combinations). I also got a fair share of STATUS_INVALID_PARAMETER (0xC000000D) errors, until I figured out that the (optional) reply message needed to have its Client and Server ID's filled in.
[1] I just tried to have the *server* close the connection, but in response the client (using NtRequestWaitReplyPort) just threw an error (STATUS_LPC_REPLY_LOST, 0xC0000253). I can understand why that that happened, but as there does not seem to be an NtRequestWaitReceivePort function available ...
I downloaded the lot for further reference. Did you notice that chaper 7 is missing ? Not that I think I will ever need it (adding services to the kernel) though.
[1] I just tried to have the *server* close the connection, but in
response
the client (using NtRequestWaitReplyPort) just threw an error
(STATUS_LPC_REPLY_LOST, 0xC0000253). I can understand why that that
happened, but as there does not seem to be an NtRequestWaitReceivePort
function available ...
Maybe these:
ReplyWaitReceivePort ReplyWaitReceivePortEx
Maybe these:
ReplyWaitReceivePort ReplyWaitReceivePortEx
It's at the Wayback Machine web archive link you gave earlier if you
follow the book table of contents.
Sysop: | Keyop |
---|---|
Location: | Huddersfield, West Yorkshire, UK |
Users: | 379 |
Nodes: | 16 (2 / 14) |
Uptime: | 42:46:53 |
Calls: | 8,141 |
Calls today: | 4 |
Files: | 13,085 |
Messages: | 5,857,851 |