I'm currently working on meshing together some declarations for ntdll functions from various exploit-db files in order to create a keylogger (educationally). I tried searching around on here, and the general web. I couldn't find anything similar enough to where I could understand how to use it to fix my issue. I apologize if there's a duplicate, I couldn't find anything related.
I put these in a header file, and when trying to compile them I get all sorts of errors related to the typedefs within the header, I get error messages mentioning decltype, and I'll admit I can't seem to understand it at all. I've never really messed with header stuff or with decltype, I searched around, but still can't really understand it. The errors occur with this:
typedef (NTSTATUS) (WINAPI *LPFUN_NtCreateThreadEx)
(
OUT PHANDLE hThread,
IN ACCESS_MASK DesiredAccess,
IN LPVOID ObjectAttributes,
IN HANDLE ProcessHandle,
IN LPTHREAD_START_ROUTINE lpStartAddress,
IN LPVOID lpParameter,
IN BOOL CreateSuspended,
IN DWORD StackZeroBits,
IN DWORD SizeOfStackCommit,
IN DWORD SizeOfStackReserve,
OUT LPVOID lpBytesBuffer
);
typedef NTSTATUS(NTAPI *lNtAllocVirtMem)(
IN HANDLE ProcessHandle,
IN PVOID *BaseAddress,
IN PULONG ZeroBits,
IN PSIZE_T RegionSize,
IN ULONG AllocationType,
IN ULONG Protect
);
The other error in the main.cpp is: (sorry about the long line)
lNtAllocVirtMem pNtAllocateVirtualMemory=(lNtAllocVirtMem)GetProcAddress(LoadLibaryA("ntdll.dll"),"NtAllocateVirtualMemory");
My errors are(I get a double of both):
error: expected primary-expression before '__attribute__'
error: typedef 'NTSTATUS' is initialized (use decltype instead)
I would like to know how to solve these (as I plan on adding more), and more importantly, how can I make sure I don't get these from here on out?
The type NTSTATUS
is defined in the Windows SDK header file winternl.h :
typedef _Return_type_success_(return >= 0) LONG NTSTATUS;
You need to include that header file instead of trying to define NTSTATUS
yourself. The SDK provided definition differs in two ways: 1
It contains SAL annotations that allow you do run static code analysis. 2
It provides the correct alias, irrespective of platform. It should be a 32-bit integer value on both x86 and x64 platforms. long
may be longer than that.
The answer was incredibly simple. To the header I added:
typedef long NTSTATUS;
It seems to have compiled correctly, and one of the functions works fine from my understanding. I thank those who helped for sending me on the right thought process and in the right direction a TON :).
Edit: By using visual studios, i have access to winternl.h, where NTSTATUS is properly defined, my original answer is not a solution.
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.