Portability and re-defining datatypes

Thread View: borland.public.cppbuilder.nativeapi

6 messages

[T] Back to Threads [V] Tree View [G] Group Articles

6 total messages Started by Mike Collins Thu, 13 Sep 2007 00:01

#1397

Author: Mike Collins
Date: Thu, 13 Sep 2007 00:01

41 lines
2570 bytes

Hi all, in the middle of writting an article for the BCB Journal on Dll 
injeciton and API hooking and ran into a very strange problem.  Was 
wondering if anyone had any explaination of this.  Basically in my example, 
i was hooking a native api called NtCreateProcessEx.  The prototype for this 
(taken from Windows NT / 2000 Native API reference by Gary Nebbett - 
www.amazon.com/Windows-2000-Native-API-Reference/dp/1578701996 and the 
Undocumented NT Internals undocumented.ntinternals.net/) state that it is 
defined thus:

NTSTATUS NTAPI
  NtCreateProcessEx(
  PHANDLE ProcessHandle,
  ACCESS_MASK DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes,
  HANDLE InheritFromProcessHandle,
  BOOLEAN InheritHandles,
  HANDLE SectionHandle,
  HANDLE DebugPort,
  HANDLE ExceptionPort,
  DWORD dwSaferFlags
);


However, if i define it this way, the system fails to launch new processes 
(when hooked) reporting that the parameter are incorrect.  I found an delphi 
example where the author had define the prototype using a Cardinal for the 
PHANDLE and DWORD's for both the HANDLES and BOOLEAN values.  This 
implimentation seems to work when i copy it.  Having looked at the winnt.h 
the definition for a HANDLE changes depending upon the STRICT directive but 
is either a void or PVOID.

Can anyone explain this i.e. why the supposidly correct data types fail but 
re-defining them works?  Also, is it possible to redefine a HANDLE or 
override the orginal definition.  I have lots of example code where the 
prototypes are already define and it would be handy to simply redefine a 
HANDLE at the begining.

Many thank in advance,


Mike Collins

Re: Portability and re-defining datatypes

#1298

Author: Remy Lebeau (TeamB)
Date: Thu, 13 Sep 2007 00:08

28 lines
1762 bytes

"Mike Collins" <its@TheBottomOfThePost> wrote in message
news:46e87087@newsgroups.borland.com...

> Actually, on careful examination, it appears to only be the
> BOOLEAN value that effect the system, leaving the orginal
> prototype as it is, and changing this to a DWORD, makes
> the whole system work.

BOOLEAN is defined in wtypes.h as follows:

    typedef boolean BOOLEAN;

However, 'boolean' is not a native data type.  It is a typedef in rpcndr.h:

    typedef unsigned char boolean;

Microsoft usually uses BOOL (in wtypes.h) instead of BOOLEAN for API
functions, though:

    typedef long BOOL;

So I'm assuming that since sizeof(BOOLEAN) is not the same as sizeof(BOOL),
the use of BOOLEAN instead of BOOL is probably throwing off the alignment of
the stack parameters, causing the error.


Gambit

Re: Portability and re-defining datatypes

#1396

Author: Mike Collins
Date: Thu, 13 Sep 2007 00:15

7 lines
1254 bytes

Actually, on careful examination, it appears to only be the BOOLEAN value 
that effect the system, leaving the orginal prototype as it is, and changing 
this to a DWORD, makes the whole system work.

- will have to write it all up now - lol

Mike

Re: Portability and re-defining datatypes

#1300

Author: Bob Gonder
Date: Thu, 13 Sep 2007 00:23

9 lines
1207 bytes

Mike Collins wrote:

>  Having looked at the winnt.h 
>the definition for a HANDLE changes depending upon the STRICT directive but 
>is either a void or PVOID.

Just to be clear, the HANDLE difference with STRICT is between
	void*  and  PVOID
which is essentially the same thing.

Re: Portability and re-defining datatypes

#1301

Author: Bob Gonder
Date: Thu, 13 Sep 2007 00:30

15 lines
1486 bytes

Remy Lebeau (TeamB) wrote:

>BOOLEAN is defined in wtypes.h as follows:
>
>    typedef boolean BOOLEAN;

Also defined in winnt.h as

typedef BYTE  BOOLEAN;

>So I'm assuming that since sizeof(BOOLEAN) is not the same as sizeof(BOOL),
>the use of BOOLEAN instead of BOOL is probably throwing off the alignment of
>the stack parameters, causing the error.

Something like that.

Re: Portability and re-defining datatypes

#1310

Author: Mike Collins
Date: Sat, 15 Sep 2007 04:42

18 lines
1661 bytes

Yeh, thats what i found, it's is declaired in the documentation as being a 
BOOLEAN but who know how this is defined in kernel land.  I've changed it to 
a BOOL and it works fine.  Just one of the risks of playing with the 
semi-undocumented stuff.

Thanks again,

Mike


"Remy Lebeau (TeamB)" <no.spam@no.spam.com> wrote in message 
news:46e87f99$1@newsgroups.borland.com...
>
> "Mike Collins" <its@TheBottomOfThePost> wrote in message
> news:46e87087@newsgroups.borland.com...
>
>> Actually, on careful examination, it appears to only be the
>> BOOLEAN value that effect the system, leaving the orginal

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads