Windows 7 Driver - Only Runs Once then Requires a Reboot - c

Lately, I have been playing with drivers in Windows 7. So far, I have built a driver that can talk with a user mode application.
However, I keep having a problem starting and stopping the driver.
First, I install the driver and start it, and it works just fine. I stop it, and it stops fine as well. However, when I go to start it again, it errors out with an error 2 code "Can't find the file specified".
In order to fix this, I have to uninstall the driver, then reboot. Once I have rebooted, I can install it again, and run it once, and then the process starts all over.
So my question is how do I work around this problem? I really hate having to reboot every time I rebuild and test my driver, so I was wondering if I am doing something wrong in my build and deployment process.
I am using the standard DDK command line build for the build process, and I am using an app called OSR Driver Loader to load the driver. I can, however, use the SC command line to install it as well.

I solved it. I needed to delete the symbolic link that I was creating, and to delete the Device instance.
Here is the code I out into the OnUnload function:
// this deletes the symbolic link for the driver
IoDeleteSymbolicLink(&deviceLinkUnicodeString);
// this deletes the device
IoDeleteDevice(g_RootkitDevice);
So In full, I needed to have this as my OnUnload function:
VOID OnUnload(IN PDRIVER_OBJECT DriverObject)
{
// this deletes the symbolic link for the driver
IoDeleteSymbolicLink(&deviceLinkUnicodeString);
// this deletes the device
IoDeleteDevice(g_RootkitDevice);
}

Related

Problems writing to USB drive from _www process

I have a macOS C program which is a helper app. It runs as root and has sticky permissions.
One of the jobs of this program is to backup files to an external USB drive.
When I run the program from a terminal window... it works perfectly.
However, when invoked via a web admin page (eg., via the web server), it fails to run with an "operation not permitted".
This is on the latest macOS. I've set the drive to be "ignore ownership on this volume". The drive in /Volumes is also 777.
So... when the process is invoked via the web, the user/group is both _www. It appears that no matter what, the process invoked via _www can't write to the USB stick.
To be more specific... it can't create any new files. It CAN overwrite existing ones. It can't mkdir either.
I've googled my brains out and no solutions seem to work.
Any help would be appreciated!
Ok, I found the solution here.
Open System Preferences and go to Security/Privacy and then click Full Disk Access from the left side and enable the httpd access from the right side.
Thanks!

Fixing corrupted WinCE 6.0 from USB or SD card

I have an ARM v4 device with touchscreen running Windows Embedded 6.0.
I am developing new app for it (as a replacement for the old one). Everything worked correctly but I accidentally renamed file that was intended to run at startup (if it helps it is autorun.exe in /NAND folder) and now the Win does not start.
At startup error is shown and after clicking OK the process is stuck.
I need to revert this change (rename file back) but how to do it?
I cannot connect to the device anymore with Visual Studio, Remote File/Registry Viewer or similar tool as the conman is not running and I cannot run them (because Windows is not started yet, obviously).
Is there any way how to run cmd line or some tool from SD Card or USB or Ethernet where I can execute some command to rename file back?
I do not have the OS image or the knowledge to build it from scratch, that is too complicated for me.

Unloading Windows driver

some time ago I decided to learn how to write drivers. Unfortunatelly I didn't get too far because for testing the driver it is kinda important for you to be able to unload it without the need of restarting the machine. Now I got back to it but I am just not able to get past this on my own.
Now I suppose just to make the question more straight forward you sure want to see this:
VOID Unload(PDRIVER_Object DriverObject)
{
DbgPrint("Unload\r\n");
}
and
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)
{
DbgPrint("Entry\r\n");
pDriverObject->DriverUnload = Unload;
return STATUS_SUCCESS;
}
In DbgView it prints the "Entry" message, but when unloading the driver it doesn't print the "Unload" one. Actually trying to stop the driver service changes it's status to NOT_STOPPABLE.
Then I have to restart if I want another try.
I work with Windows 7 and with same outcomes I have tried to do it booting up with TESTSIGNING ON and with no signiture required too. A little bit odd thing is the load doesn't work either unless I create device in the entry function. Only then I can find my driver with winobj in the \Driver directory. I have also tried it out on another machine with Win7 installation but it turned out local settings are not the issue. If you recognize this kind of kernel behaviour I would really like to hear it, thanks.
Actually if know about some programm that can load .sys and then is able to unload it, drop a link or name. Source codes not required, the executable should do.. or vice versa.. thanks.
Driver development - use OSR Driver Loader
Ok the problem was I linked with /driver:wdm because I read an older tutorial. That is wrong nowadays, you can only IoCreateDevice in DriverEntry in legacy drivers that means proper option is just /driver. Sorry I dont understand the behaviour of I/O manager, but if you are having the same problem, just get rid of that wdm flag and it will unload.

ld.exe: cannot open output file ... : Permission denied

I recently installed CodeBlocks with mingw32 on Windows 7 Ultimate 32bit in order to dust off my c skills, but this problem has me somewhat stumped.
I decided to fire off a short Fibonacci generator to make sure my setup was working, but I ran into a hurdle.
The program compiles, links and whatnot like a charm and I get a corresponding executable which runs as expected.
The problems occur if I try to compile again, then I get the following:
c:/codeblocks/mingw/bin/../lib/gcc/mingw32/4.4.1/../../../../mingw32/bin/ld.exe: cannot open output file bin\Debug\Fibonacci.exe: Permission denied
I can't even edit the permissions of the generated executable.
I've checked the usual suspects:
Executable is verily not running.
Path to executable is read/writable to mingw32 (otherwise it wouldn't be able to build in the first place)
I'm not running cygwin in any shape or form.
And now for the funny bit: Usually after a few minutes, any executables generated by mingw32 which are displaying this Access Denied behaviour will automatically vanish without any intervention from me.
I've googled this somewhat, but most of the other results were either vague or inapplicable.
I wonder whether there is some Windows 7 security setting playing havoc with my .exe's, but I'm not that knowledgeable about Win 7 as to know where to begin searching.
Any one have any ideas?
I had exactly the same problem right after switching off some (in my opinion unneccessary) Windows services. It turned out that when I switched ON again the "Application Experience" everything resumed working fine.
May be you simply have to turn on this service? To switch ON Application Experience:
Click the Windows start buttonn.
In the box labeled "Search programs and files" type services.msc and click the search button. A new window with title "Services" opens.
Right click on "Application Experience" line and select "Properties" from popup menu.
Change Startup type to "Automatic (delayed start)".
Restart computer.
Application Experiences should prevent the problem in the future.
Your program is still running. You have to kill it by closing the command line window.
If you press control alt delete, task manager, process`s (kill the ones that match your filename).
If you think the executable is locked by a process, try Process Explorer from SysInternals. In the File/handle, enter Fibonacci.exe and you should see who holds the file.
If it is not enough, you can use Process Monitor (from SysInternals, again) to follow the activity of all processes on your system on Fibonacci.exe.
With a little bit of analysis (call stacks), you'll may find out why the access to the file is denied and what make it disappear.
Problem Cause :
The process of the current program is still running without interuption.
(This is the reason why you haven't got this issue after a restart)
The fix is simple :
Go to cmd and type the command taskkill -im process_name.exe -f
Eg:
taskkill -im demo.exe -f
here,
demo - is my program name
The Best solution is go to console in eclipse IDE and click the red button to terminate the program.
You will see the your program is running and output can be seen there. :) !!
I had the same behaviour, and fixed it by running Code::Blocks as administrator.
Open task manager -> Processes -> Click on .exe (Fibonacci.exe) -> End Process
if it doesn't work
Close eclipse IDE (or whatever IDE you use) and repeat step 1.
I had a similar problem. Using a freeware utility called Unlocker (version 1.9.2), I found that my antivirus software (Panda free) had left a hanging lock on the executable file even though it didn't detect any threat. Unlocker was able to unlock it.
Got the same issue. Read this. Disabled the antivirus software (mcaffee). Et voila
Confirmed by the antivirus log:
Blocked by Access Protection rule d:\mingw64\x86_64-w64-mingw32\bin\ld.exe d:\workspace\cpp\bar\foo.exe User-defined Rules:ctx3 Action blocked : Create
It may be your Antivirus Software.
In my case Malwarebytes was holding a handle on my program's executable:
Using Process Explorer to close the handle, or just disabling antivirus for a bit work just fine.
i experienced a similar issue. Bitdefender automatically quarantined each exe-file i created by MinGW g++. Instead of the full exe-file i found a file with a weird extension 'qzquar'
testAutoPtr1.exe.48352.gzquar
When i opened quarantined items in Bitdefender i found my exe-file quarantined there.
I got this error when using the Atom editor and mingw (through a package called gpp-compiler) for C++. Closing the open console window fixed my issue.

Work on a remote project with Eclipse via SSH

I have the following boxes:
a) A Windows box with Eclipse CDT,
b) A Linux box, accessible for me only via SSH.
Both the compiler and the hardware required to build and run my project is only on machine B.
I'd like to work "transparently" from a Windows box on that project using Eclipse CDT and be able to build, run and debug the project remotely from within the IDE.
How do I set up that:
The building will work? Any simpler solutions than writing a local makefile which would rsync the project and then call a remote makefile to initiate the actual build? Does Eclipse managed build have a feature for that?
The debugging will work?
Preferably - the Eclipse CDT code indexing will work? Do I have to copy all required header files from machine B to machine A and add them to include path manually?
Try the Remote System Explorer (RSE). It's a set of plug-ins to do exactly what you want.
RSE may already be included in your current Eclipse installation. To check in Eclipse Indigo go to Window > Open Perspective > Other... and choose Remote System Explorer from the Open Perspective dialog to open the RSE perspective.
To create an SSH remote project from the RSE perspective in Eclipse:
Define a new connection and choose SSH Only from the Select Remote System Type screen in the New Connection dialog.
Enter the connection information then choose Finish.
Connect to the new host. (Assumes SSH keys are already setup.)
Once connected, drill down into the host's Sftp Files, choose a folder and select Create Remote Project from the item's context menu. (Wait as the remote project is created.)
If done correctly, there should now be a new remote project accessible from the Project Explorer and other perspectives within eclipse. With the SSH connection set-up correctly passwords can be made an optional part of the normal SSH authentication process. A remote project with Eclipse via SSH is now created.
The very simplest way would be to run Eclipse CDT on the Linux Box and use either X11-Forwarding or remote desktop software such as VNC.
This, of course, is only possible when you Eclipse is present on the Linux box and your network connection to the box is sufficiently fast.
The advantage is that, due to everything being local, you won't have synchronization issues, and you don't get any awkward cross-platform issues.
If you have no eclipse on the box, you could thinking of sharing your linux working directory via SMB (or SSHFS) and access it from your windows machine, but that would require quite some setup.
Both would be better than having two copies, especially when it's cross-platform.
I'm in the same spot myself (or was), FWIW I ended up checking out to a samba share on the Linux host and editing that share locally on the Windows machine with notepad++, then I compiled on the Linux box via PuTTY. (We weren't allowed to update the ten y/o versions of the editors on the Linux host and it didn't have Java, so I gave up on X11 forwarding)
Now... I run modern Linux in a VM on my Windows host, add all the tools I want (e.g. CDT) to the VM and then I checkout and build in a chroot jail that closely resembles the RTE.
It's a clunky solution but I thought I'd throw it in to the mix.
My solution is similar to the SAMBA one except using sshfs. Mount my remote server with sshfs, open my makefile project on the remote machine. Go from there.
It seems I can run a GUI frontend to mercurial this way as well.
Building my remote code is as simple as: ssh address remote_make_command
I am looking for a decent way to debug though. Possibly via gdbserver?
I tried ssh -X but it was unbearably slow.
I also tried RSE, but it didn't even support building the project with a Makefile (I'm being told that this has changed since I posted my answer, but I haven't tried that out)
I read that NX is faster than X11 forwarding, but I couldn't get it to work.
Finally, I found out that my server supports X2Go (the link has install instructions if yours does not). Now I only had to:
download and unpack Eclipse on the server,
install X2Go on my local machine (sudo apt-get install x2goclient on Ubuntu),
configure the connection (host, auto-login with ssh key, choose to run Eclipse).
Everything is just as if I was working on a local machine, including building, debugging, and code indexing. And there are no noticeable lags.
I had the same problem 2 years ago and I solved it in the following way:
1) I build my projects with makefiles, not managed by eclipse
2) I use a SAMBA connection to edit the files inside Eclipse
3) Building the project:
Eclipse calles a "local" make with a makefile which opens a SSH connection
to the Linux Host. On the SSH command line you can give parameters which
are executed on the Linux host. I use for that parameter a makeit.sh shell script
which call the "real" make on the linux host.
The different targets for building you can give also by parameters from
the local makefile --> makeit.sh --> makefile on linux host.
The way I solved that one was:
For windows:
Export the 'workspace' directory from the Linux machine using samba.
Mount it locally in windows.
Run Eclipse, using the mounted 'workspace' directory as the eclipse workspace.
Import the project you want and work on it.
For Linux:
Mount the 'workspace' directory using sshfs
Run Eclipse.
Run Eclipse, using the mounted 'workspace' directory as the eclipse workspace.
Import the project you want and work on it.
In both cases you can either build and run through Eclipse, or build on the remote machine via ssh.
For this case you can use ptp eclipse https://eclipse.org/ptp/ for source browsing and building.
You can use this pluging to debug your application
http://marketplace.eclipse.org/content/direct-remote-c-debugging
How to edit in Eclipse locally, but use a git-based script I wrote (sync_git_repo_from_pc1_to_pc2.sh) to synchronize and build remotely
The script I wrote to do this is sync_git_repo_from_pc1_to_pc2.sh.
Readme: README_git-sync_repo_from_pc1_to_pc2.md
Update: see also this alternative/competitor: GitSync:
How to use Sublime over SSH
https://github.com/jachin/GitSync
This answer currently only applies to using two Linux computers [or maybe works on Mac too?--untested on Mac] (syncing from one to the other) because I wrote this synchronization script in bash. It is simply a wrapper around git, however, so feel free to take it and convert it into a cross-platform Python solution or something if you wish
This doesn't directly answer the OP's question, but it is so close I guarantee it will answer many other peoples' question who land on this page (mine included, actually, as I came here first before writing my own solution), so I'm posting it here anyway.
I want to:
develop code using a powerful IDE like Eclipse on a light-weight Linux computer, then
build that code via ssh on a different, more powerful Linux computer (from the command-line, NOT from inside Eclipse)
Let's call the first computer where I write the code "PC1" (Personal Computer 1), and the 2nd computer where I build the code "PC2". I need a tool to easily synchronize from PC1 to PC2. I tried rsync, but it was insanely slow for large repos and took tons of bandwidth and data.
So, how do I do it? What workflow should I use? If you have this question too, here's the workflow that I decided upon. I wrote a bash script to automate the process by using git to automatically push changes from PC1 to PC2 via a remote repository, such as github. So far it works very well and I'm very pleased with it. It is far far far faster than rsync, more trustworthy in my opinion because each PC maintains a functional git repo, and uses far less bandwidth to do the whole sync, so it's easily doable over a cell phone hot spot without using tons of your data.
Setup:
Install the script on PC1 (this solution assumes ~/bin is in your $PATH):
git clone https://github.com/ElectricRCAircraftGuy/eRCaGuy_dotfiles.git
cd eRCaGuy_dotfiles/useful_scripts
mkdir -p ~/bin
ln -s "${PWD}/sync_git_repo_from_pc1_to_pc2.sh" ~/bin/sync_git_repo_from_pc1_to_pc2
cd ..
cp -i .sync_git_repo ~/.sync_git_repo
Now edit the "~/.sync_git_repo" file you just copied above, and update its parameters to fit your case. Here are the parameters it contains:
# The git repo root directory on PC2 where you are syncing your files TO; this dir must *already exist*
# and you must have *already `git clone`d* a copy of your git repo into it!
# - Do NOT use variables such as `$HOME`. Be explicit instead. This is because the variable expansion will
# happen on the local machine when what we need is the variable expansion from the remote machine. Being
# explicit instead just avoids this problem.
PC2_GIT_REPO_TARGET_DIR="/home/gabriel/dev/eRCaGuy_dotfiles" # explicitly type this out; don't use variables
PC2_SSH_USERNAME="my_username" # explicitly type this out; don't use variables
PC2_SSH_HOST="my_hostname" # explicitly type this out; don't use variables
Git clone your repo you want to sync on both PC1 and PC2.
Ensure your ssh keys are all set up to be able to push and pull to the remote repo from both PC1 and PC2. Here's some helpful links:
https://help.github.com/en/github/authenticating-to-github/connecting-to-github-with-ssh
https://help.github.com/en/github/authenticating-to-github/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent
Ensure your ssh keys are all set up to ssh from PC1 to PC2.
Now cd into any directory within the git repo on PC1, and run:
sync_git_repo_from_pc1_to_pc2
That's it! About 30 seconds later everything will be magically synced from PC1 to PC2, and it will be printing output the whole time to tell you what it's doing and where it's doing it on your disk and on which computer. It's safe too, because it doesn't overwrite or delete anything that is uncommitted. It backs it up first instead! Read more below for how that works.
Here's the process this script uses (ie: what it's actually doing)
From PC1: It checks to see if any uncommitted changes are on PC1. If so, it commits them to a temporary commit on the current branch. It then force pushes them to a remote SYNC branch. Then it uncommits its temporary commit it just did on the local branch, then it puts the local git repo back to exactly how it was by staging any files that were previously staged at the time you called the script. Next, it rsyncs a copy of the script over to PC2, and does an ssh call to tell PC2 to run the script with a special option to just do PC2 stuff.
Here's what PC2 does: it cds into the repo, and checks to see if any local uncommitted changes exist. If so, it creates a new backup branch forked off of the current branch (sample name: my_branch_SYNC_BAK_20200220-0028hrs-15sec <-- notice that's YYYYMMDD-HHMMhrs--SSsec), and commits any uncommitted changes to that branch with a commit message such as DO BACKUP OF ALL UNCOMMITTED CHANGES ON PC2 (TARGET PC/BUILD MACHINE). Now, it checks out the SYNC branch, pulling it from the remote repository if it is not already on the local machine. Then, it fetches the latest changes on the remote repository, and does a hard reset to force the local SYNC repository to match the remote SYNC repository. You might call this a "hard pull". It is safe, however, because we already backed up any uncommitted changes we had locally on PC2, so nothing is lost!
That's it! You now have produced a perfect copy from PC1 to PC2 without even having to ensure clean working directories, as the script handled all of the automatic committing and stuff for you! It is fast and works very well on huge repositories. Now you have an easy mechanism to use any IDE of your choice on one machine while building or testing on another machine, easily, over a wifi hot spot from your cell phone if needed, even if the repository is dozens of gigabytes and you are time and resource-constrained.
Resources:
The whole project: https://github.com/ElectricRCAircraftGuy/eRCaGuy_dotfiles
See tons more links and references in the source code itself within this project.
How to do a "hard pull", as I call it: How do I force "git pull" to overwrite local files?
Related:
git repository sync between computers, when moving around?

Resources