A forum for reverse engineering, OS internals and malware analysis 

Ask your beginner questions here.
 #6216  by josaga
 Fri May 06, 2011 4:19 am
I write .pas by delphi and compile in Meekat
I don't know why.when I use "Inttostr" it will error with "Undeclared identifier". but somehow can use "Strlen".

I guess nt_status or ntoskrnl or macros have a "strlen" and not have a "Inttostr".

So,My question is
1.What the func I can use to convert Int to str Instead "Inttostr".
2.How I saw func in Lib Like nt_status, ntoskrnl ,macros


May be it very stupid question for many , but It very helpful for me if you preachy that.
Last edited by josaga on Fri May 06, 2011 6:49 am, edited 2 times in total.
 #6223  by josaga
 Fri May 06, 2011 12:12 pm
nullptr wrote:Could you post some code that shows the problem you're having?
Code: Select all
function ReadDispatch(DeviceObject: PDEVICE_OBJECT; Irp: PIRP):NTSTATUS;stdcall;
var
  pIoStackIrp :PIO_STACK_LOCATION;
  pReadDataBuffer: PAnsiChar;
  dwDataSize,dwDataRead:ULONG;
  pReturnData : PAnsiChar;
begin
  DbgPrint('DirectIO: ReadDispatch'#13#10);
  dwDataRead := 0;
  pReturnData := Inttostr('1234');
  dwDataSize := strlen(pReturnData);

  pIoStackIrp := IoGetCurrentIrpStackLocation(Irp);
  if pIoStackIrp <> nil Then
  begin
    if Irp^.MdlAddress <> nil then
      pReadDataBuffer := MmGetSystemAddressForMdlSafe(Irp^.MdlAddress, NormalPagePriority)
    else
      pReadDataBuffer := Irp^.UserBuffer;
    if pReadDataBuffer = nil then
    begin
      pReadDataBuffer := Irp^.AssociatedIrp.SystemBuffer;
    end;
    DbgPrint('DirectIO: pReadDataBuffer=%08X'#13#10, pReadDataBuffer);
    if (pReadDataBuffer <> nil) and (pIoStackIrp^.Parameters.Read.Length >= dwDataSize) Then
    begin
      RtlCopyMemory(pReadDataBuffer, pReturnData, dwDataSize);
      dwDataRead := dwDataSize;
      DbgPrint('DirectIO: %s'#13#10, pReadDataBuffer);
    end;
  end;

  Irp^.IoStatus.Status := STATUS_SUCCESS;
  Irp^.IoStatus.Information := dwDataRead;
  IoCompleteRequest(Irp, IO_NO_INCREMENT);
  Result:= STATUS_SUCCESS;
End;
Problem is this function I want to use Inttostr but don't know what func.when I use Inttostr will error with Undeclared identifier

Thank you so much
 #6225  by Buster_BSA
 Fri May 06, 2011 2:27 pm
Wrong:

pReturnData := Inttostr('1234');

Correct:

pReturnData := Inttostr(1234);

You are converting from integer to string, not from string to integer.
 #6226  by josaga
 Fri May 06, 2011 2:45 pm
Buster_BSA wrote:Wrong:

pReturnData := Inttostr('1234');

Correct:

pReturnData := Inttostr(1234);

You are converting from integer to string, not from string to integer.
Thank you,I was wrong but I still cant compile with error "Undeclared identifier" for Inttostr Func.

can you told me.what function use to convert Int to str.
 #6228  by nullptr
 Fri May 06, 2011 4:31 pm
IntToStr is in the SysUtils unit, so make sure it's in the uses

You could also have:
Code: Select all
var
  ReturnData : String;

begin
  ReturnData:= '1234';
  // then just cast ReturnData as PAnsiChar, wherever type PAnsiChar is required.
  RtlCopyMemory(pReadDataBuffer, PAnsiChar(ReturnData), dwDataSize);
end; 
...or completely do away with Delphi strings and the SysUtils unit and write your own Functions.
 #6229  by josaga
 Fri May 06, 2011 4:35 pm
Buster_BSA wrote:What "uses" are you using?
this is my uses
Code: Select all
uses
  nt_status, ntoskrnl, macros, SysUtils;
Actualy I just add Inttostr to simplecode(DirectIO) for learn.I already copy SysUtils.dcu to /include in meekat.then I compile by meekat.

this is my code
(1.44 KiB) Downloaded 28 times
I'm sorry for credit I don't know where I load from this board.

thank you so much for try to help me.

Code: Select all
unit DirectIO;

interface

uses
  nt_status, ntoskrnl, macros, SysUtils;

function _DriverEntry(DriverObject:PDriverObject;RegistryPath:PUnicodeString):NTSTATUS; stdcall;

implementation

var
  DeviceName, SymbolicLinkName: UNICODE_STRING;

//********************************************************************************//
Function Example_IsStringTerminated(pString:PAnsiChar; uiLength: ULONG):Boolean; stdCall;
var
  bStringIsTerminated:Boolean;
  uiIndex:ULONG;
begin
  bStringIsTerminated:= False;
  uiIndex := 0; { here, uiIndex must be initialized! }
  while(uiIndex < uiLength) and (bStringIsTerminated = False) do
  begin
    if pString[uiIndex] = #0 then
      bStringIsTerminated := True
    else
      Inc(uiIndex);
  end;
  Result:= bStringIsTerminated;
end;

//********************************************************************************//
procedure DriverUnload(DriverObject:PDriverObject); stdcall;
begin
  IoDeleteSymbolicLink(@SymbolicLinkName);
  IoDeleteDevice(DriverObject^.DeviceObject);
  DbgPrint('DirectIO: Driver UnLoaded'#13#10);
end;

function CreateDispatch(const DeviceObject : PDEVICE_OBJECT;
         const Irp : PIRP) : NTSTATUS; stdcall;
begin
  DbgPrint('DirectIO: CreateDispatch'#13#10);
  Irp^.IoStatus.Status:= STATUS_SUCCESS;
  Irp^.IoStatus.Information:= 0;
  IoCompleteRequest(Irp,IO_NO_INCREMENT);
  Result:=STATUS_SUCCESS;
end;

function CloseDispatch(const DeviceObject : PDEVICE_OBJECT;
                const Irp : PIRP) : NTSTATUS; stdcall;
begin
  DbgPrint('DirectIO: CloseDispatch'#13#10);
  Irp^.IoStatus.Status := STATUS_SUCCESS;
  Irp^.IoStatus.Information:= 0;
  IoCompleteRequest(Irp,IO_NO_INCREMENT);
  Result:=STATUS_SUCCESS;
end;

function WriteDispatch(DeviceObject: PDEVICE_OBJECT;Irp: PIRP):NTSTATUS;stdcall;
var
  pIoStackIrp :PIO_STACK_LOCATION ;
  pWriteDataBuffer: PAnsiChar ;
begin
  DbgPrint('DirectIO: WriteDispatch'#13#10);
  pWriteDataBuffer := nil;
  pIoStackIrp := IoGetCurrentIrpStackLocation(Irp);
  if pIoStackIrp <> nil then
  begin
    if Irp^.MdlAddress <> nil then
      pWriteDataBuffer:= MmGetSystemAddressForMdlSafe(Irp^.MdlAddress, NormalPagePriority)
    else
      pWriteDataBuffer := Irp^.UserBuffer;
    if pWriteDataBuffer = nil then
    begin
      pWriteDataBuffer := Irp^.AssociatedIrp.SystemBuffer;
    end;
    if pWriteDataBuffer <> nil then
      if Example_IsStringTerminated(pWriteDataBuffer,
                                    pIoStackIrp^.Parameters.Write.Length) then
        DbgPrint('DirectIO: %s'#13#10, pWriteDataBuffer);
  end;
  Irp^.IoStatus.Status:= STATUS_SUCCESS;
  Irp^.IoStatus.Information:= 0;
  IoCompleteRequest(IRP,IO_NO_INCREMENT);
  Result:=STATUS_SUCCESS;
end;


function ReadDispatch(DeviceObject: PDEVICE_OBJECT; Irp: PIRP):NTSTATUS;stdcall;
var
  pIoStackIrp :PIO_STACK_LOCATION;
  pReadDataBuffer: PAnsiChar;
  dwDataSize,dwDataRead:ULONG;
  pReturnData : PAnsiChar;
begin
  DbgPrint('DirectIO: ReadDispatch'#13#10);
  dwDataRead := 0;

  pReturnData := '1234';
  dwDataSize := strlen(pReturnData);

  pIoStackIrp := IoGetCurrentIrpStackLocation(Irp);
  if pIoStackIrp <> nil Then
  begin
    if Irp^.MdlAddress <> nil then
      pReadDataBuffer := MmGetSystemAddressForMdlSafe(Irp^.MdlAddress, NormalPagePriority)
    else
      pReadDataBuffer := Irp^.UserBuffer;
    if pReadDataBuffer = nil then
    begin
      pReadDataBuffer := Irp^.AssociatedIrp.SystemBuffer;
    end;
    DbgPrint('DirectIO: pReadDataBuffer=%08X'#13#10, pReadDataBuffer);
    if (pReadDataBuffer <> nil) and (pIoStackIrp^.Parameters.Read.Length >= dwDataSize) Then
    begin
      RtlCopyMemory(pReadDataBuffer, pReturnData, dwDataSize);
      dwDataRead := dwDataSize;
      DbgPrint('DirectIO: %s'#13#10, pReadDataBuffer);
    end;
  end;

  Irp^.IoStatus.Status := STATUS_SUCCESS;
  Irp^.IoStatus.Information := dwDataRead;
  IoCompleteRequest(Irp, IO_NO_INCREMENT);
  Result:= STATUS_SUCCESS;
End;

function _DriverEntry(DriverObject:PDriverObject;RegistryPath:PUnicodeString):NTSTATUS; stdcall;
var
  pDeviceObject: TDeviceObject;
begin
  DbgPrint('DirectIO: Driver Loaded'#13#10);
  RtlInitUnicodeString(@DeviceName, '\Device\devDirectIO');
  RtlInitUnicodeString(@SymbolicLinkName, '\??\slDirectIO');
  Result:=IoCreateDevice(DriverObject, 0, @DeviceName,
                         FILE_DEVICE_UNKNOWN,0, False, @pDeviceObject);
  if Result = STATUS_SUCCESS then
  begin
    if (IoCreateSymbolicLink(@SymbolicLinkName, @DeviceName) = STATUS_SUCCESS) then
    begin
      DriverObject^.MajorFunction[IRP_MJ_CREATE] := @CreateDispatch;
      DriverObject^.MajorFunction[IRP_MJ_CLOSE] := @CloseDispatch;
      DriverObject^.MajorFunction[IRP_MJ_WRITE] := @WriteDispatch;
      DriverObject^.MajorFunction[IRP_MJ_READ] := @ReadDispatch;
      DriverObject^.DriverUnload := @DriverUnload;
    end else
    begin
      DbgPrint('DirectIO: IoCreateSymbolicLink fail!'#13#10);
      IoDeleteDevice(@pDeviceObject);
    end;
  end else
    DbgPrint('DirectIO: IoCreateDevice Fail!'#13#10);
  result := STATUS_SUCCESS;
end;

end.
 #6237  by josaga
 Sat May 07, 2011 9:49 am
Buster_BSA wrote:Try this:

pReturnData := PChar(IntToStr(1234));

It still Undeclared identifier. ><