Re: malloc,free,mbtow problem

Tech-Archive recommends: Fix windows errors by optimizing your registry



well mr don
i am working on a project which will restrict the malicious movement of
files across network or any physical media
in which i will apply policy like "block delete access of txt files"
"block copy paste access of pdf"
to do so what i got is just hook the functions.
i know now that i cant use it in vista.
now do guide me what shud i adopt to work bcoz i have to rewrite things again.


"Don Burn" wrote:

No, you can allocate memory and do conversion, but you have to use the
correct API's not the c runtimes. What are you trying to do, and why do you
insist on hooking? As you are obviously a newbie, the odds of your hooking
without destroying the system are probably slim to none.


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply




"Hasber" <Hasber@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:FEF49D69-D136-4E65-A390-A84080BAA98E@xxxxxxxxxxxxxxxx

I m happy that i got such a fast response
well i am only working for windows XP
whatever harmfull....the main thing is task which i have to accomplish
ok if i cant allocate memory then can u tell me what to do for that.
now do i have to use arrays.
and whats about conversion of char data to wide character
"Don Burn" wrote:

Well you are far from done for a lot of reasons. First you cannot use
malloc, free or other user space calls in a kernel driver, so essentially
all the code you have listed is not going to work in the kernel.

But that is not the worst thing, you are hooking two calls that are
easily
intercepted by approved means. Hooking is extremely dangerous, and is
blocked for 64-bit systems. Also, hooking drivers are flagged as
MALWARE,
so you have created something that is going to be looked at with disdain.

Get the WDK, and some good books such as Walter Oney's "Programming the
Windows Driver Model, Second Edition" and plan to take some time to
understand the environment.



--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply


"Hasber" <Hasber@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:98B386A7-214B-4708-8EAD-455FE2397339@xxxxxxxxxxxxxxxx
hi
i m working on file hooking
i had applied two basic hooks i.e NTCreateFile and NtOpenFile
i am almost finish but with very simple error and i am unable to
resolve:

i am allocating dynamic memory to char pointer i.e.
char *cPtrDst ;
cPtrDst = (char*)malloc(size);
and deallocating it by free:
free(cPtrDst);

and i am converting this array into wchar_t variable
using :
wchar_t dir[10];//suppose its an array
result = mbtowc(dir,cPtrDst,size);


when i compile the driver it gives error:
error LNK2019: unresolved external symbol __imp__free referenced in
function
_freePolicyData@0

unresolved external symbol __imp__malloc referenced in function
_policyWriteNeither@8

i had included stdlib.h

but in vain.........
any idea about error?








.



Relevant Pages

  • Re: malloc,free,mbtow problem
    ... No, you can allocate memory and do conversion, but you have to use the ... As you are obviously a newbie, the odds of your hooking ... Windows 2k/XP/2k3 Filesystem and Driver Consulting ...
    (microsoft.public.development.device.drivers)
  • Re: malloc,free,mbtow problem
    ... insist on hooking? ... Don Burn ... Windows 2k/XP/2k3 Filesystem and Driver Consulting ...
    (microsoft.public.development.device.drivers)
  • Re: WDK v. 7 for USB
    ... Don Burn ... Windows Filesystem and Driver Consulting ... I'm very-very new to this and XP DDK books are all I have. ...
    (microsoft.public.development.device.drivers)
  • Re: DDK > How to use windows function (GetModuleFileName ...)
    ... Given that the data is going to user mode, the approach of getting the name in user mode is a lot simpler. ... Don Burn ... Windows Filesystem and Driver Consulting ...
    (microsoft.public.win32.programmer.kernel)
  • Re: Filter Hook
    ... Don Burn ... Windows 2k/XP/2k3 Filesystem and Driver Consulting ... What IRQL are you running at when you crash, ...
    (microsoft.public.development.device.drivers)