Simple Kernel Mode Driver

Question

I'm creating simple Kernel Mode Driver (Empty Project) to try some

read/write memory operations on user mode apps.

I'm getting errors while compiling the project On these lines :

NTSTATUS NTAPI MmCopyVirtualMemory(PEPROCESS SourceProcess, PVOID 
SourceAddress, PEPROCESS TargetProcess, PVOID TargetAddress, SIZE_T 
BufferSize, KPROCESSOR_MODE PreviousMode, PSIZE_T ReturnSize);

NTSTATUS PsLookupProcessByProcessId(_In_ HANDLE ProcessId, _Outptr_ 
PEPROCESS *Process);

KernelWPM(Process, &Writeval, 0x010F29B0, sizeof(__int32));

VS Compiling errors :

Severity    Code    Description Project File    Line    Suppression State
Error   C2371   'PEPROCESS': redefinition; different basic types    INR 
C:\Program Files (x86)\Windows Kits\10\Include\10.0.16299.0\km\ntifs.h  85  
Warning C4022   'GetProcessByID': pointer mismatch for actual parameter 1           
INR C:\Users\NAKEDRAT\Desktop\INR\INR\main.c    62  
Error   C2371   'PETHREAD': redefinition; different basic types INR     
C:\Program Files (x86)\Windows Kits\10\Include\10.0.16299.0\km\ntifs.h  86  
Warning C4047   'function': 'PEPROCESS' differs in levels of indirection     
from 'PEPROCESS **' INR C:\Users\NAKEDRAT\Desktop\INR\INR\main.c    62  
Warning C4024   'GetProcessByID': different types for formal and actual     
parameter 2 INR C:\Users\NAKEDRAT\Desktop\INR\INR\main.c    62  
Warning C4047   'function': 'PEPROCESS' differs in levels of indirection     
from 'PEPROCESS *'  INR C:\Users\NAKEDRAT\Desktop\INR\INR\main.c    64  
Warning C4024   'KernelWPM': different types for formal and actual parameter 
1   INR C:\Users\NAKEDRAT\Desktop\INR\INR\main.c    64  
Warning C4022   'KernelWPM': pointer mismatch for actual parameter 3    INR 
C:\Users\NAKEDRAT\Desktop\INR\INR\main.c    64

Here is my code : Also using the same SDK & WDK version

#include <ntddk.h>
#include <ntdef.h>
#include <ntifs.h>


DRIVER_INITIALIZE DriverEntry;

#pragma alloc_text(INIT, DriverEntry)

NTSTATUS NTAPI MmCopyVirtualMemory(PEPROCESS SourceProcess, PVOID 
SourceAddress, PEPROCESS TargetProcess, PVOID TargetAddress, SIZE_T 
BufferSize, KPROCESSOR_MODE PreviousMode, PSIZE_T ReturnSize);

NTSTATUS PsLookupProcessByProcessId(_In_ HANDLE ProcessId, _Outptr_ 
PEPROCESS *Process);

NTSTATUS KernelRPM(PEPROCESS Process, PVOID SourceAddress, PVOID         
TargetAddress, SIZE_T Size)
{
PEPROCESS SourceProcess = Process;
PEPROCESS TargetProcess = PsGetCurrentProcess();
SIZE_T Result;
if (NT_SUCCESS(MmCopyVirtualMemory(SourceProcess, SourceAddress,     
TargetProcess, TargetAddress, Size, KernelMode, &Result)))
    return STATUS_SUCCESS; 
else
    return STATUS_ACCESS_DENIED;
}

NTSTATUS KernelWPM(PEPROCESS Process, PVOID SourceAddress, PVOID 
TargetAddress, SIZE_T Size)
{
PEPROCESS SourceProcess = PsGetCurrentProcess();
PEPROCESS TargetProcess = Process;
SIZE_T Result;

if (NT_SUCCESS(MmCopyVirtualMemory(SourceProcess, SourceAddress, 
TargetProcess, TargetAddress, Size, KernelMode, &Result)))
    return STATUS_SUCCESS;
else
    return STATUS_ACCESS_DENIED;
}


NTSTATUS DriverEntry(_In_  struct _DRIVER_OBJECT *DriverObject, _In_  
PUNICODE_STRING RegistryPath)
{
int Writeval = 666;

PEPROCESS *Process; 

GetProcessByID(4872, &Process);

KernelWPM(Process, &Writeval, 0x010F29B0, sizeof(__int32));

DbgPrint("Value of int i: %d", Writeval);

return STATUS_SUCCESS;
}

What am i doing wrong? How i could improve that, Any suggestions ? Thanks.

score 4 · Answer 1 · answered Jun 03 '18 at 23:45

4

You are including nttdk and ntifs in the same file. Its going to raise conflicts.

answered Jun 03 '18 at 23:45

This does not provide an answer to the question. Once you have sufficient [reputation](https://stackoverflow.com/help/whats-reputation) you will be able to [comment on any post](https://stackoverflow.com/help/privileges/comment); instead, [provide answers that don't require clarification from the asker](https://meta.stackexchange.com/questions/214173/why-do-i-need-50-reputation-to-comment-what-can-i-do-instead). – Tim Diekmann Jun 04 '18 at 00:12

score 2 · Answer 2 · answered Feb 19 '20 at 15:45

2

Including ntifs.h before ntddk.h fixed it for me.

answered Feb 19 '20 at 15:45

Omer

1,050
11
14

Simple Kernel Mode Driver

2 Answers2