Re: What's the closest thing to an anonymous struct/array I can achieve that compiles with GCC? - C / C++ / MFC Discussion Boards

Re: What's the closest thing to an anonymous struct/array I can achieve that compiles with GCC?

Mircea Neacsu9-Sep-20 12:11

Mircea Neacsu

9-Sep-20 12:11

Your question had this code:

C++

MyClass.MyMethod1(new byte[]{0, 1, 2, 3});

Here you a calling a method (also called member function) of an object. So your code is already object oriented.

Maybe you should revise/clarify what you want to accomplish.

Mircea

Re: What's the closest thing to an anonymous struct/array I can achieve that compiles with GCC?

arnold_w9-Sep-20 12:28

arnold_w

9-Sep-20 12:28

That was a C# example, to indicate that I was looking for the corresponding C/C++ syntax for my ARM-project. I try to keep my ARM-code as close to pure C-programming as possible (this will obviously be an exception) and never use classes in the ARM-project. Is anything in your example dependent on the classes or will it compile just fine without classes? I'm not at work so I can't try it for myself right now, but I plan to work on this first thing in the morning.

Re: What's the closest thing to an anonymous struct/array I can achieve that compiles with GCC?

Randor 9-Sep-20 12:44

Randor

9-Sep-20 12:44

arnold_w wrote:
I try to keep my ARM-code as close to pure C

arnold_w wrote:
I plan to work on this first thing in the morning.

When you get back into the office please print out __STDC_VERSION__ so we know which language version you are working under. The C99 language and below had no support for anonymous structures or unions. But the GCC compiler has a non-standard extension -std=gnu99 that enables it.

Support for anonymous structures or unions was added in C11[^] back in 2011

If your __STDC_VERSION__ is 199901L or above then you should be able to use anonymous objects.

Best Wishes,
-David Delaune

Re: What's the closest thing to an anonymous struct/array I can achieve that compiles with GCC?

Joe Woodbury9-Sep-20 12:38

Joe Woodbury

9-Sep-20 12:38

You could do something like:

C++

void Function(const std::vector<uint8_t>& values)

Call it as follows:

Function(std::vector<uint8_t>{ 5, 4, 3});

(Works with VC++ 2017. Should work with GCC.)

Re: What's the closest thing to an anonymous struct/array I can achieve that compiles with GCC?

arnold_w9-Sep-20 14:35

arnold_w

9-Sep-20 14:35

Joe Woodbury wrote:
void Function(const std::vector<uint8_t>& values)

Is there anything preventing me from having an override pure C-function (in addition to your C++ function) as follows:

C++

void Function(uint8_t* values)

?
I'm thinking that in that case I would have functions that can be called both from files with .c-extension and .cpp-extension? I'd image const std::vector<uint8_t> stores bytes in memory exactly the same way uint8_t* (or uint8_t[]) does, right?

Re: What's the closest thing to an anonymous struct/array I can achieve that compiles with GCC?

Joe Woodbury9-Sep-20 15:14

Joe Woodbury

9-Sep-20 15:14

In C++, you could overload Function, but you'd have to do the normal #ifdef stuff to call Function from C. (Yes, by standard std::vector stores data contiguously.)

The problem is that the C function is rather dangerous.

Re: What's the closest thing to an anonymous struct/array I can achieve that compiles with GCC?

Stefan_Lang15-Sep-20 3:34

Stefan_Lang

15-Sep-20 3:34

Note that C arrays do not include length information! So unless your function Function(uint8_t*) somehow knows how many elements there are, you'd also have to pass the number of elements as a separate parameter! And even if it does know how many elements to expect, there's always a chance someone calls it accidentally with a different number of elements.

The class std::vector behaves like an array, but internally it does store the array length which makes the code examples above feasible. You could of course write a C++ wrapper that calls a C function internally, like this:

C++

void Function(uint8_t* values, unsigned long int size); //normal C function implemented elsewhere
void Function(const std::vector<uint8_t>& values) {
    Function(values.data(), values.size());
}
int main() {
    Function({1, 2, 3});
    return 0;
}

Otherwise, you'd have to think of another way to pass the element number reliably.

GOTOs are a bit like wire coat hangers: they tend to breed in the darkness, such that where there once were few, eventually there are many, and the program's architecture collapses beneath them. (Fran Poretto)

Re: What's the closest thing to an anonymous struct/array I can achieve that compiles with GCC?

arnold_w11-Sep-20 12:46

arnold_w

11-Sep-20 12:46

Today I saw the following syntax:

C++

uint16_t getUint16Value(int someParameter) {
    // Unimportant implementation
}

void myFunction() {
    uint16_t destArray[2];
    memcpy(destArray, (uint16_t[2]){getUint16Value(0), getUint16Value(1)}, sizeof(uint16_t[2]));
}

Now, what made me really surprized about this code is that it was inside a .c-file, not a .cpp-file! I looked in the GCC documentation and tried to find examples of clever syntax like this, but I couldn't find any. Does anybody know where I can examples of anonymuous "things" (arrays, structs, function-pointers, etc) that GCC allows in C-code?

modified 11-Sep-20 18:53pm.

CWinThread for background processing

Richard Andrew x645-Sep-20 10:13

Richard Andrew x64

5-Sep-20 10:13

I have a dilemma over whether I should create a User Interface thread or a Background thread to process my background operations.

The docs for the function SHGetFileInfo say that it should not be called from the application's main thread because it can lock up the UI.

So I will use a secondary thread. And I will post messages to the thread to prompt it to process stuff.

But should I use the UI thread version of AfxBeginThread because it includes a message pump, or should I use the background thread version and implement my own message pump?

I ask because I do not want the application to terminate when the secondary thread terminates. My understanding of the docs is that that could happen if I use a UI thread.

Thank you

The difficult we do right away...
...the impossible takes slightly longer.

Re: CWinThread for background processing

Mircea Neacsu5-Sep-20 16:18

Mircea Neacsu

5-Sep-20 16:18

I don't have personal experience with this function but Microsoft doc seems pretty specific:

Quote:
You should call this function from a background thread. Failure to do so could cause the UI to stop responding.

So background thread it is! Smile | :)

Mircea

Re: CWinThread for background processing

Richard Andrew x645-Sep-20 17:03

Richard Andrew x64

5-Sep-20 17:03

Yes, I was taken aback when I first saw that.

The difficult we do right away...
...the impossible takes slightly longer.

Re: CWinThread for background processing

Randor 5-Sep-20 16:44

Randor

5-Sep-20 16:44

Hi,

Richard Andrew x64 wrote:
I ask because I do not want the application to terminate when the secondary thread terminates. My understanding of the docs is that that could happen if I use a UI thread.

Could you show me what you are referring to? The only way that I am aware of... where a CWinThread can terminate the main thread is if you reach across threads to execute code. If a WM_QUIT arrives during that short period I believe it gets posted to the main threads message queue.

Don't do this:

C++

ThreadA->ThreadB_DoSomething();
ThreadB->ThreadA_Dosomething();

Instead post a message WM_THREAD_A_DOSOMETHING

As long as ThreadA never touches ThreadB you shouldn't have any problems. Also don't create any windows or enter any modal modal loops from your CWinThread worker thread... do all window management from your main thread.

Follow these rules:
1.) Do all window creation in your main thread.
2.) Don't reach across threads to execute code.
3.) Use PostMessage to communicate between threads.

You *can* break these rules but make sure that you fully understand the consequences and how to get around them. Raymond Chen explains how you can get around messages are eaten by modal loops[^] here.

Best Wishes,
-David Delaune

Re: CWinThread for background processing

Richard Andrew x645-Sep-20 17:01

Richard Andrew x64

5-Sep-20 17:01

Thank you for the detailed response.

So you would recommend the UI version of CWinThread because it has a message pump already?

The difficult we do right away...
...the impossible takes slightly longer.

Re: CWinThread for background processing

Randor 5-Sep-20 17:29

Randor

5-Sep-20 17:29

Well,

Richard Andrew x64 wrote:
So you would recommend the UI version of CWinThread because it has a message pump already?

Even if you used a non-gui thread.... the Windows kernel auto-promotes a thread via KiConvertToGuiThread and increases the thread stack-size and gives it a message queue immediately when it makes a syscall[^] above 0x1000.

In other words... as soon as you make your call to SHGetFileInfo[^] your thread will become a UI thread. You could prevent the auto-promotion by setting PROCESS_CREATION_MITIGATION_POLICY_WIN32K_SYSTEM_CALL_DISABLE_ALWAYS_ON but that would break your SHGetFileInfo and a myriad of other win32k system calls.

You can use CWinThread and just follow the rules I laid out in my previous response.

Best Wishes,
-David Delaune

Re: CWinThread for background processing

CPallini7-Sep-20 1:33

CPallini

7-Sep-20 1:33

Wow!

Group policy editor api

Member 1487268130-Aug-20 23:13

Member 14872681

30-Aug-20 23:13

Hello.

I need your help.

First of all, I hope you understand that the sentence structure can be strange as I ask questions using a translator machine.

I'm looking for group policy editor api.

Especially, Local Computer Policy/Computer Configuration/Administrative Templates/System/Removable Stroage Access area.

When I changed this part, I found a registry that was created or disappeared.

But what I want is to be able to modify this group policy directly.

Because even if the registry is modified, as a result, the registry is changed to data corresponding to the group policy.

If you know the api that can modify the group policy editor, please let me know.

Thank you.

Re: Group policy editor api

Richard MacCutchan31-Aug-20 1:27

Richard MacCutchan

31-Aug-20 1:27

First Google result: Group Policy API - Win32 apps | Microsoft Docs[^]

Re: Group policy editor api

Member 1487268131-Aug-20 17:08

Member 14872681

31-Aug-20 17:08

Thanks your reply.

I checked the link you gave me.

But I'm not sure which method to use in the meantime.

I don't see any method to change the content of Group Policy anywhere.

Of course there is a 100 percent chance that I will not find it.

A little more specific, I would really appreciate if you let me know which method I should use.

Thank you.

Re: Group policy editor api

Richard MacCutchan31-Aug-20 20:57

Richard MacCutchan

31-Aug-20 20:57

Take a look at IGroupPolicyObject (gpedit.h) - Win32 apps | Microsoft Docs[^]

modified 1-Sep-20 3:09am.

Re: Group policy editor api

Member 1487268131-Aug-20 21:33

Member 14872681

31-Aug-20 21:33

Thanks to reply.

I went to the link you gave me, but what method should I use there?

If I knew after seeing the answer, I would not request received the answer again.

I don't really know what to use at that link.

There is no setting method anywhere.

I want to set 'Local Computer Policy/Computer Configuration/Administrative Templates/System/Removable Stroage Access' this area below.

Thanks.

Re: Group policy editor api

Richard MacCutchan31-Aug-20 21:40

Richard MacCutchan

31-Aug-20 21:40

Sorry, I have not used this API, you will need to study the documentation. Alternatively use Google to find sample code.

Re: Group policy editor api

Randor 1-Sep-20 23:24

Randor

1-Sep-20 23:24

Hi,

You should add more error handling, this is just a code sample:

C++

#include <guiddef.h>
#include <initguid.h>
#include <windows.h>
#include <comdef.h>
#include <cguid.h>
#include <atlcomcli.h>
#include <gpedit.h>
#include <Iaccess.h>

#pragma comment(lib,"gpedit.lib")

int main()
{
	HKEY key;
	HKEY pol;
	DWORD val = 1;
	DWORD disp = 0;
	GUID ext = REGISTRY_EXTENSION_GUID;

	CoInitializeEx(NULL, COINIT_APARTMENTTHREADED);
	CComPtr<IGroupPolicyObject> lgp;
	HRESULT hr = CoCreateInstance(CLSID_GroupPolicyObject, NULL, CLSCTX_INPROC_SERVER, IID_IGroupPolicyObject, (LPVOID*)&lgp);	
	if (SUCCEEDED(lgp->OpenLocalMachineGPO(GPO_OPEN_LOAD_REGISTRY)))
	{
		if (SUCCEEDED(lgp->GetRegistryKey(GPO_SECTION_MACHINE, &key)))
		{
			//All Removable Storage classes: Deny All access
			RegCreateKeyExW(key, L"SOFTWARE\\Policies\\Microsoft\\Windows\\RemovableStorageDevices", 0, NULL, REG_OPTION_NON_VOLATILE, KEY_WRITE | KEY_QUERY_VALUE, NULL, &pol, &disp);
			RegSetValueEx(pol, L"Deny_All", 0, REG_DWORD, (BYTE*)&val, sizeof(val));
			
			RegCreateKeyExW(key, L"SOFTWARE\\Policies\\Microsoft\\Windows\\RemovableStorageDevices\\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", 0, NULL, REG_OPTION_NON_VOLATILE, KEY_WRITE | KEY_QUERY_VALUE, NULL, &pol, &disp);
			//Removable Disks: Deny write access
			RegSetValueEx(pol, L"Deny_Write", 0, REG_DWORD, (BYTE*)&val, sizeof(val));
			//Removable Disks: Deny read access
			RegSetValueEx(pol, L"Deny_Read", 0, REG_DWORD, (BYTE*)&val, sizeof(val));
			//Removable Disks: Deny execute access
			RegSetValueEx(pol, L"Deny_Execute", 0, REG_DWORD, (BYTE*)&val, sizeof(val));

			RegCloseKey(key);
			hr = lgp->Save(TRUE, TRUE, &ext, const_cast<GUID*>(&CLSID_GPESnapIn));
			_com_error err(hr);
			wprintf(L"%s", err.ErrorMessage());
		}
	}
	lgp.Release();
	CoUninitialize();
	return 0;
}

It will set the following policies:

- All Removable Storage classes: Deny All access
- Removable Disks: Deny execute access
- Removable Disks: Deny read access
- Removable Disks: Deny write access

Best Wishes,
-David Delaune

[Edit two days later]
You can also add an attack surface reduction policy via Windows Defender that requires anything that executes from USB to be signed:

powershell.exe Add-MpPreference -AttackSurfaceReductionRules_Ids b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 -AttackSurfaceReductionRules_Actions Enabled

modified 4-Sep-20 17:57pm.

Windows XP Convert SystemDrive Variable e.g. %SystemDrive% - into equivelant C++ code

jackngill30-Aug-20 12:01

jackngill

30-Aug-20 12:01

To anyone who can help me Please?

I apologise in advance if my question seems confusing noobish but I have no clue about coding in C++ hence the apparent ignorance & difficulty to me (& for some it may be a very basic question). First of all I have these lines of code that I would like to amend slightly like so:

typedef DWORD(__stdcall *CPP) (DWORD param1, PWCHAR param2, DWORD param3);

void Disable_WFP() {
    hmod=LoadLibrary("sfc_os.dll");
    CPP SetSfcFileException;
    // the function is stored at the fifth ordinal in sfc_os.dll
    SetSfcFileException=(CPP)GetProcAddress(hmod,(LPCSTR)5);
    SetSfcFileException(0, L"c:\\windows\\system32\\calc.exe",-1);
    // Now we can modify the system file in a complete stealth.
}

It is not my code it belongs to Abdellatif_El_Khlifi & all credit belongs to him but I would like to make a small amendmant to his code but have no clue how to do this the alteration I would like to change this line:

SetSfcFileException(0, L"c:\\windows\\system32\\calc.exe",-1);

and alter to: (this is obviously not C++ but just trying to illustrate what I am trying to do)

SetSfcFileException(0, L"%SystemDrive%\\windows\\system32\\calc.exe",-1);

My question is there a equivelent C++ code for the SystemDrive variable & could someone re-code this to make the small amendmant Please to suit my needs? The reason is it will make the program more generic for me just in case say for instance my OS XP is installed on D:\\ drive instead of C:\\ drive. I have found this snippet of code that may be of help but have no clue as to how I would incorporate in the given scenario above. char *sysDrive = getenv ("SystemDrive"); or this

sysdrive = getenv("SYSTEMDRIVE");
    if (sysdrive == NULL || *sysdrive == NUL)
	sysdrive = "C:\\";
}

Best Regards,
Jackngill

Re: Windows XP Convert SystemDrive Variable e.g. %SystemDrive% - into equivelant C++ code

Mircea Neacsu30-Aug-20 16:47

Mircea Neacsu

30-Aug-20 16:47

Funny that someone who admits having little programming experience wants to explore an issue that has been linked to malware in the past.

Can you explain what legitimate purpose you have?

BTW the article you mention is here on CP. Also I don’t see what useful purpose it serves.

Mircea

modified 30-Aug-20 23:38pm.

Re: Windows XP Convert SystemDrive Variable e.g. %SystemDrive% - into equivelant C++ code

jackngill30-Aug-20 22:26

jackngill

30-Aug-20 22:26

Hi Mircea,

I suppose as with all things in life you can use any tool for either a positive outcome or negative outcome & I am not very happy that I am being targeted as a possible Malware code writer as I am absolutely not. For one thing I would not post a question like this here it would be on the dark web (Whatever that is as I have never been there) And who & what has been linked to malware? If it has been linked to malware why has the code by Abdellatif_El_Khlifi been allowed to remain posted for as long as it has, that to me is what is funny?

As to my personal reasons to undertake this task I will try to explain. Firstly I am still using XP & I like to carry operations like creating mini windows varients of XP Which is not negative in its self. I will chop and change from a good XP system to a Mini XP system on different drives so the code altered re the SystemDrive makes it easier for generic drives not being hardcoded to C:\\ & to me is a legitimate reason. The portion of code suits my needs very well in that I can selectively stop Windows File Protection on individual files to carry out removal or adjustment so that I do not get error messages being reported back. There is a way already of disabling WFP but it is more of a shotgun shampoo approach in that it switches off WFP wholesale but I digress. This code would facilitate me in selectively disarming WFP on a selective file(s) in a quick manner without rebooting etc etc. I stated & came clean about who wrote the original code & I hinted in my original post the reason for it. My motives are honourable & not for negative reasons to me it would prove very useful! XP as an OS is becoming a niche market there is no longer any support for it so if I was a malware code writer I would surely opt for something like Windows 10 for greater kudos YES/NO?

If it is a problem & is considered to be useful for malware can someone private post me the amended code so I can carry out what I want to do quietly for my own purposes? My preferences are set to recieve emails I do not want to cause trouble or engage in arguments, life is too short for that. I am asking for help can someone help Please?

P.S. I was going to ask if there could be an undo portion of code to undo the changes in a separate file that I could compile but I think that is going to be too ambitious as a request.

Best Regards,

Jackngill

modified 31-Aug-20 8:07am.

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.