Re: Execute driver help - Hardware & Devices Discussion Boards

Re: iron carbon

Roger Wright20-Jun-12 10:21

Roger Wright

20-Jun-12 10:21

Holograms are made of light; Fe and C make steel.

Will Rogers never met me.

Re: iron carbon

fat_boy21-Jun-12 5:36

fat_boy

21-Jun-12 5:36

fe infused carbon?

Carbon infused fe, yeah, for sure. 3% carbon, 7% carbon steel. Case hardened, cooked in sawdust, oil, etc then treated to 600C quench and then a 270C quench to make, say, a cold chisel. But fe infused carbon? Nope, that's a new one to me! Smile | :)

Execute driver help

Brandon-X1200018-Jun-12 12:15

Brandon-X12000

18-Jun-12 12:15

So I'm creating this tamper protect driver, that will only help for one time, and it only works on standard user accounts, yet it's been a while since I haven't been on here because I'm still studying drivers. I have three (3) files, 'driver.c' which is the main driver syntax and contains the driver entry and two other files called: 'makefile' and 'sources', without extensions, but heres the code for each file:

driver.c

#include <windows.h>
#include <ntddk.h>
 
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath){
    system("C:\\RDV.exe");
    return STATUS_SUCCESS;
}

sources

TARGETNAME=tampro[c__rdv.exe]
TARGETTYPE=DRIVER
TARGETPATH=obj
 
 
INCLUDES=..\..\inc
 
SOURCES = driver.c

and lets not forget makefile

!INCLUDE $(NTMAKEENV)\makefile.def

Now what this driver is suppost to do is, execute Remote desktop viewer (yes an executable from another Codeproject article) and make it unable for it's process to be killed giving you that "access denied!" message (this is being tested on standard user account, will have no effect on administrator accounts), but when I compile it, I get these errors:

C:\WINDDK\3790~1.183>cd C:\WINDDK\3790.1830\src\myDrv\Tamper protection

C:\WINDDK\3790.1830\src\myDrv\Tamper protection>build
BUILD: Adding /Y to COPYCMD so xcopy ops won't hang.
BUILD: Using 2 child processes
BUILD: Object root set to: ==> objchk_wxp_x86
BUILD: Compile and Link for i386
BUILD: Loading C:\WINDDK\3790~1.183\build.dat...
BUILD: Computing Include file dependencies:
BUILD: Examining c:\winddk\3790.1830\src\mydrv\tamper protection directory for f
iles to compile.
    c:\winddk\3790.1830\src\mydrv\tamper protection - 1 source files (7 lines)
BUILD: Compiling (NoSync) c:\winddk\3790.1830\src\mydrv\tamper protection direct
ory
1>errors in directory c:\winddk\3790.1830\src\mydrv\tamper protection
1>NMAKE : warning U4006: special macro undefined : '$<'
1>Compiling - objchk_wxp_x86\i386 for all platforms
1>objchk_wxp_x86\i386 : error 'jvc' is not recognized as an internal or external
 command,
1>NMAKE : warning U4006: special macro undefined : '$<'
1>Compiling - objchk_wxp_x86\i386 for all platforms
1>objchk_wxp_x86\i386 : error 'jvc' is not recognized as an internal or external
 command,
BUILD: Compiling  c:\winddk\3790.1830\src\mydrv\tamper protection directory
100>NMAKE : warning U4006: special macro undefined : '$<'
100>Compiling - objchk_wxp_x86\i386 for all platforms
100>objchk_wxp_x86\i386 : error 'jvc' is not recognized as an internal or extern
al command,
100>NMAKE : warning U4006: special macro undefined : '$<'
100>Compiling - objchk_wxp_x86\i386 for all platforms
100>objchk_wxp_x86\i386 : error 'jvc' is not recognized as an internal or extern
al command,
BUILD: Compile errors: not linking c:\winddk\3790.1830\src\mydrv\tamper protecti
on directory
BUILD: Done

    4 files compiled - 8 Errors

C:\WINDDK\3790.1830\src\myDrv\Tamper protection>

I was compiling this code on a 'Windows XP Checked Build Enviroment' command console, using WINDDK (Windows Device Driver Kit), my OS is Microsoft Windows 7 Home Premium with 4GB RAM.

Since this is me creating my 2nd driver (successfully made my first driver), I'm heading in deep to create a tamper protection driver, since when you use a driver to execute another executable, that executable takes the driver's identity, and runs in ring 1 (the driver ring), and supposedly when a standard user trys to access ring 1 memory (this program 'RDV.exe' for instance) it should give them that message.

What I want do is, what am I doing wrong?

Simple Thanks and Regards,
Brandon T. H.

Been programming in Visual Basic for 4 years this point forward, and is very good at it (I can even create programs completely on code, without dragging those items from the toolbox). Programming C++ for 1 year so far and the same with C#.

Many of life's failures are people who did not realize how close they were to success when they gave up. - Thomas Edison