CopyFromMode - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// usermode_accessors.h
VOID CopyFromMode(
VOID *Destination,
const VOID *Source,
SIZE_T Length,
KPROCESSOR_MODE Mode
);
View the official Windows Driver Kit DDI referenceNo description available.
The CopyFromMode function safely copies data from either kernel or user-mode memory to kernel memory based on the specified processor mode.
Destination[out] A pointer to the kernel memory location where the data will be copied.
Source[in] A pointer to the memory location from which to copy the data.
Length[in] The number of bytes to copy.
Mode[in] The processor mode that determines how the memory access is performed. Mode can be one of the following values.
| Value | Meaning |
|---|---|
| KernelMode | Source points to kernel-mode memory. The function performs a direct memory copy with memory_order_relaxed semantics. See Remarks for more details. |
| UserMode | Source points to user-mode memory. The function raises an exception if Source doesn't point to user-mode memory; otherwise it performs a copy from the specified address with memory_order_relaxed semantics. |
This function provides a safe way to copy data from either kernel or user-mode memory to kernel memory, with the copy mechanism determined by the specified processor mode. This allows for flexible memory operations that can adapt to different execution contexts.
When Mode is KernelMode:
The function performs a volatile copy using memory_order_relaxed semantics.
The function isn't recognized as a compiler intrinsic so the compiler will never optimize away the call (either entirely or replace the call with an equivalent sequence of instructions).
When the call returns, the data has been copied from Source to Destination. This function's memory accesses to the Source and Destination will only be performed within the function (for example, the compiler can't move memory accesses out of this function).
The function might perform unaligned memory accesses if the platform allows for it.
The function might access memory locations more than once as part of its copy operation.
The function doesn't support copy operations when Source and Destination overlap each other.
If you are copying from a fixed-sized structure, you should use ReadStructFromMode instead, so as to avoid the risk of passing the wrong size.
This function will never be optimized away by the compiler, nor will the compiler create additional accesses to this memory location before the function is called or after the function returns (unless the source code explicitly performs these accesses).
This function works on all versions of Windows, not just the latest. You need to consume the latest WDK to get the function declaration from the usermode_accessors.h header. You also need the library (umaccess.lib) from the latest WDK. However, the resulting driver will run fine on older versions of Windows.