|
Hi,
I am new to this device driver development field.
I am asked to write a Windows device driver for capturing the kernel system calls for any particular Win32 API call.
For example,
There is one MFC Dialog based application which will call the Win32 API(Ex: CreateFile() with proper arguments)
At the same time the device driver should capture all the Kernel system calls which are called corresponding to the CreateFile() API. Those Kernel system call I need to display on the GUI of my appllication at real time.
Please share any Article or the guide me in acheiveing this.
Any help will be of great help.
Thanks in advance.
|
|
|
|
|
|
|
Thanks Eddy,
I tried to explore WinAPIOverride.
Will this application display Kernel System calls? I doubt. It is showing some addresses in the call stack, but not the actual system calls name. Is is possible to get the names of the kernel system calls?
Thanks in advance.
|
|
|
|
|
|
class CObject
{
public:
bool SetInt(string strPropName,int nValue);
private:
map<string,VARIANT> m_properties;
private:
std::string m_strClassName;
};
for example,If CObject has a "Hello" property,I can set it's value like this:
CObject* pObject = new CObject("switch");
pObject->SetInt("Hello",123);
but It is not very good enough,if I code like this:
pObject->SetInt("Helloooooooo",123);
here,I write the wrong property name ,but the code wouldn't generate any error at compile time.
*******************************************************************
1 there is a lot class defined by string
2 there may be a lot of objects defined by any class
3 there is a lot of properties for each object
My question is how could I avoid the above mistake at compile time?
Thank you all
|
|
|
|
|
One pretty obvious way is make a set of strings of valid property strings
std::set<std::string> s;
s.insert("Hello");
Then all you need to do is use the standard set find call to know if its there
std:string TestCmd = "Hellooooooooo";
if (s.find(TestCmd) == s.end()){
}
Personally I wouldn't use a string for the property it's not going to be fast to enumerate but that is an exact description of what you are asking.
I would do the same as windows use something like a CRC to hash the strings to integer. Much faster to search for an integer ID than a string.
However if you want to google away the question is
"Fastest way to check if a string exists in a set of strings"
In vino veritas
|
|
|
|
|
Thank you
I could check whether a property is in the set or not at run time.
but I want to check it at compile time.
I just write "Helloooooooo" instead of "Hello" by mistake.
I want to find out this mistake when I compile it.
|
|
|
|
|
If you are on a C++11 compiler you are defining a compile time helper function. If you aren't you are dead in the water.
Search "function that accepts only compile time known expressions"
If you are on Visual Studio, I have never played with it but I think you want this.
<type_traits>[^]
In vino veritas
modified 11-Nov-16 1:55am.
|
|
|
|
|
The only way to provoke a compiler error would be to pass the knowledge of the full list of class properties to the compiler, at compile time. That would defeat the purpose of a generic class definition, and you could just as well define simple member variables instead.
This raises the question: where do your requirements come from, i. e the two requirements to define a generic class, and to force compile time errors when accessing an incorrectly labeled property? One of them has to go.
GOTOs are a bit like wire coat hangers: they tend to breed in the darkness, such that where there once were few, eventually there are many, and the program's architecture collapses beneath them. (Fran Poretto)
|
|
|
|
|
Hello Experts!
There is a certain window, about which we know hDC & hWnd.
By the window is used function SwapBuffer(hDC). I understand that the double buffer, and that buffer contains a certain image that is drawn in the window.
Question!
Is it possible in any way to copy the contents of the buffer to a compatible Bitmap or Image for Saving it into graphic file format?
?
Regards,
Onic777
onic@inbox.ru
|
|
|
|
|
That is all you need .. you can then get the window size
RECT r;
GetWindowRect(hWnd, &r);
int Wth = r.right - r.left;
int Ht = r.bottom - r.top;
You also have the wonderful function CreateDIBSection which just needs a DC
CreateDIBSection function (Windows)[^]
You will need to allocate memory to hold the bits. That size is slightly tricky it depends on what color depth you are going to ask for in bits. Typically you want RGB24 or RGB32 and the size also needs to be aligned to a 4 byte boundary. Anyhow long story short its a funny maths calc and we need to setup a bitmap header info for the call ... Lets do 24 bit colour.
BITMAPINFOHEADER BMIH;
BMIH.biSize = sizeof(BITMAPINFOHEADER);
BMIH.biBitCount = 24;
BMIH.biPlanes = 1;
BMIH.biCompression = BI_RGB;
BMIH.biWidth = Wth;
BMIH.biHeight = Ht;
BMIH.biSizeImage = ((((BMIH.biWidth * BMIH.biBitCount)+ 31) & ~31) >> 3) * BMIH.biHeight;
See that funny calc at end well BMIH.biSizeImage now has the memory size you need to allocate. So allocate it and then call CreateDIBSection
char* myBits = malloc(BMIH.biSizeImage);
CreateDIBSection(hDC, (CONST BITMAPINFO*)&BMIH, DIB_RGB_COLORS, (void**)&myBits, NULL, 0);
myBits now has all your image data from the DC now all you need to do is save it!!!!
For a BMP file that is trivial
FILE *pFile = fopen( , "wb");
BITMAPFILEHEADER bmfh;
int nBitsOffset = sizeof(BITMAPFILEHEADER) + BMIH.biSize;
LONG lImageSize = BMIH.biSizeImage;
LONG lFileSize = nBitsOffset + lImageSize;
bmfh.bfType = 'B'+('M'<<8);
bmfh.bfOffBits = nBitsOffset;
bmfh.bfSize = lFileSize;
bmfh.bfReserved1 = bmfh.bfReserved2 = 0;
UINT nWrittenFileHeaderSize = fwrite(&bmfh, 1, sizeof(BITMAPFILEHEADER), pFile);
UINT nWrittenInfoHeaderSize = fwrite(&BMIH, 1, sizeof(BITMAPINFOHEADER), pFile);
UINT nWrittenDIBDataSize = fwrite(myBits, 1, lImageSize, pFile);
fclose(pFile);
Now don't forget to free myBits when you are done that is alot of memory to bleed if you forget 
In vino veritas
modified 11-Nov-16 0:33am.
|
|
|
|
|
Hi
I am getting ERROR_INVALID_HANDLE on GetLastError after WaitForSingleObject returns -1
I more or Less followed the MSDN example Using Mutex
My main thread does muthandle = CreateMutex(NULL,FALSE,NULL);
Second parameter is FALSE indicating it is not owned
Later a second Thread calls WaitForSingleObject(muthandle,INFINITE) and gets a -1 which
GetLastError retuns ERROR_INVALID_HANDLE
THANKS
|
|
|
|
|
what does CreateMutex return?
|
|
|
|
|
Well it's not NULL some low number like X'00000010' or X'00000030' now running x64 a handle is 64 bits I was looking at the RAX register
I tried the last parameter For CreateMutex NULL and with a string didn't matter the createmutex and WaitForSigleIbject are different threads
|
|
|
|
|
Hi,
The function returning the error does not lie.
The first parameter you are passing to the WaitForSingleObject function[^] is not a valid HANDLE.
If I were a gambling man... I would bet that you are attempting to pass the pointer to a HANDLE.
Best Wishes,
-David Delaune
|
|
|
|
|
It's the handle I guess the next step is to go to disassembly mode and see
|
|
|
|
|
ForNow wrote: go to disassembly mode
Shouldn't be necessary. You should be able to step through with your debugger to check if the handle is valid. Remember, it could easily have been corrupted by your (or someone's) code.
|
|
|
|
|
For some reason i am not able to display certain data areas on quick watch
That's the only reason I got intobinto disassembly mode
Thanks
|
|
|
|
|
You are inside a thread the debugger doesn't always have access to all the memory.
In vino veritas
|
|
|
|
|
That's it I was never able to display the global block storage with quick watch
I think it was build as a DLL on its own
Thanks
|
|
|
|
|
ForNow wrote: It's the handle I guess the next step is to go to disassembly mode and see
Since you are such an expert at x86/x64 assembler perhaps you should utilize WinDbg:
Common WinDBG Commands Reference[^]
!handle displays information about a handle or handles that one or all processes in the target system own.
0:000> !handle c0dedbad f
Handle 38
Type Mutant
Attributes 0
GrantedAccess 0x1f0001:
Delete,ReadControl,WriteDac,WriteOwner,Synch
QueryState
HandleCount 1
PointerCount 96605
Name <none>
Object Specific Information
Mutex is Owned
Mutant Owner 11bc.1418
Here are some other ideas in case you don't know how to use WinDbg:
BOOL IsValidHandle(HANDLE h)
{
DWORD dwFlags = 0;
return GetHandleInformation(h,&dwFlags);
}
BOOL IsValidHandle(HANDLE h)
{
return CompareObjectHandles(h,h);
}
use it like this to debug your code:
if (IsValidHandle(h))
{
DWORD dwResult = ::WaitForSingleObject(h, INFINITE);
DWORD dwError = GetLastError();
}
Best Wishes,
-David Delaune
|
|
|
|
|
How are you passing muthandle to your second thread? ...is it possible that you're not passing that correctly (for example, if you passed by pointer that you're not dereferencing your pointer)?
|
|
|
|
|
There is a global block accessible to all the threads
This is one of the fields
I going to double check that
The handle has the value initialized by CreateMutex later in tonite
|
|
|
|
|
Since it's a different thread... also check that the thread going to the wait state isn't waiting on a handle that hasn't been created yet.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
