data transfer between user and kernel mode

[abhijit mohanta]

I am new to device driver programming.I was going through the following link http://www.codeproject.com/KB/system/hide-driver.aspx NtQueryDirectoryfile in the diagram in the section named "NT Function Call Scheme and Hook" returns an process list.

Can anybody tell me how does the list transferred to user mode.

Please give me a little detailed description like how irp wud be filled with data etc.

Edited April 6, 2011 by abhijit mohanta

[Krishnaa]

Strange topic title.

[abhijit mohanta]

it was a copy paste mistake bro.sorry for the inconvinience

Strange topic title.