A forum for reverse engineering, OS internals and malware analysis 

 #3198  by driverobject
 Sat Oct 23, 2010 11:50 pm
Hi all,

I'm %100 newbie in the kernel and I'm having trouble compiling the below code with the latest 7.1 version of the winddk ,using the x86 free winxp environment for the build.
Code: Select all

#include <ntddk.h>
#include <windef.h>


.....

void GetNtAddress(PVOID bufOutput, ULONG outputBufferLength)
{
	DbgPrint("Enter GetNtAddress\n");
                PEPROCESS ntProc = PsInitialSystemProcess;
	DbgPrint("");
	return;
}

This line
Code: Select all
  PEPROCESS ntProc = PsInitialSystemProcess;
Where I'm trying to get the address of the EPROCESS object of the System process fails miserably. It gives me the below error:
Code: Select all
BUILD: Compile and Link for x86
BUILD: Start time: Sun Oct 24 03:48:45 2010
BUILD: Examining c:\tstdrv\sys directory for files to compile.
    c:\tstdrv\sys Invalidating OACR warning log for 'root:x86fre'
BUILD: Compiling and Linking c:\tstdrv\sys directory
Configuring OACR for 'root:x86fre' - <OACR on>
_NT_TARGET_VERSION SET TO WINXP
Compiling - tstdrv.c
1>errors in directory c:\tstdrv\sys
1>c:\tstdrv\sys\tstdrv.c(63) : error C2275: 'PEPROCESS' : illegal use of thi
s type as an expression
1>c:\tstdrv\sys\tstdrv.c(63) : error C2146: syntax error : missing ';' befor
e identifier 'ntProc'
1>c:\tstdrv\sys\tstdrv.c(63) : error C2065: 'ntProc' : undeclared identifier

Linking Executable - objfre_wxp_x86\i386\tstdrv.sys
1>link : error LNK1181: cannot open input file 'c:\tstdrv\sys\objfre_wxp_x86\i
386\tstdrv.obj'
BUILD: Finish time: Sun Oct 24 03:48:46 2010
BUILD: Done

    3 files compiled - 1 Warning - 3 Errors
    1 executable built - 1 Error
This is not making sense and I am a stupid person. Thanks for any replies.
 #3199  by GamingMasteR
 Sun Oct 24, 2010 12:33 am
Hi,

This is C language not C++, you declare your local variables in the beginning of code blocks (braces { }) :
Code: Select all
void GetNtAddress(PVOID bufOutput, ULONG outputBufferLength)
{
    PEPROCESS ntProc;
    DbgPrint("Enter GetNtAddress\n");
    ntProc = PsInitialSystemProcess;
}
 #3666  by gglittle
 Tue Nov 23, 2010 10:59 pm
You can however use C++ as a superset for compiling C code. By doing so you get stronger type checking as well the ability to define variables other than at the beginning of a scope. You can compile with C++ by either defining the source file with CPP or setting /TP in the C_FLAGS. You will also have to use extern "C" {} around most of, if not all of the WDK header files.

But do remember that you are still developing a C program and NOT C++.

Gary