seems to have been asked, but...

[Ian Levy]

> > You would do this best using a filter driver, since filter drivers inherit
> > the parent driver's function table, thus removing the need to patch large
> > numbers of calls.
> 
> Any details or references on exactly how to do that?

I sent a mail to Wez about this and forgot to copy the list. The problem here is 
that a video filter driver (AFAIK) isn't as simple as a file system driver 
because it doesn't use the DriverObject->MajorFunction dispatch table as much.
Plus, you'd still have to save the original functions in the dispatch table. 
You'll need to hook all the functions anyway so that the VNC-driver thingy can 
work out what's going on. I still reckon that you'd need to call EngLoadImage 
and work out the entry points for *some* functions anyway.

> Furthermore how would you get the info from the driver (which would be running 
in
> kernel mode, right?) back out to the server, which is running in user mode?

Allocate memory from the non-paged pool and let the user mode application 
retrieve the data in it by a DeviceIOControl (IOCTL) command.

		Cheers
			Ian.
--  
Dr. Ian Levy, Dept Of Computer Science, University of Warwick, Coventry
  CV4 7AL  eMail: ian "at" dcs.warwick.ac.uk   SMS/Phone: +44370 428779
     FAX: +44370 429016    Urgent eMail: ian "at" emobile.co.uk  
         Err, that's DOCTOR short, fat bastard to you!


---------------------------------------------------------------------
The VNC mailing list     -   see http://www.orl.co.uk/vnc/intouch.html
---------------------------------------------------------------------