Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

Problem with "this" pointer with NT4 Ring 3 CPP driver code

OSR_Community_UserOSR_Community_User Member Posts: 110,217
Hello all,

I'm porting a customer's video capture dll, which was written in C++. I
realize that the official Microsoft position frowns on C++ for NT4 drivers,
but I have never heard anyone say it could not be done.

The problem I'm having involves the "this" pointer. It appears that some
system calls, like CopyMemory and CreateEvent to name two, are zeroing the
ECX register and leaving it zeroed. The trouble is that the ECX register is
the "this" pointer. So suddenly my code is running with a NULL "this"
pointer. As an experiment I wrapped a couple of the calls with a "_ASM push
ECX" and "_ASM pop ECX" and those particular code segments behaved better.
This is a hack, of course; I shouldn't have to be doing this.

So is there a compiler setting for preserving the registers during system
calls, or is there some other setting that is missing that tells the
compiler that we are dealing with C++ files?

I'm using MSDEV SP3, NT4 SP 6 and SoftIce 4.01. All this code runs in ring
3.

Thanks for any help,


Evan Hillman

Comments

  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    > So is there a compiler setting for preserving the registers during system
    > calls, or is there some other setting that is missing that tells the
    > compiler that we are dealing with C++ files?

    Use __stdcall calling convention for C++ methods instead of default
    __thiscall. You will end with "this" being an on-stack local variable
    instead of
    ECX.

    Max
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 24 January 2022 Live, Online
Internals & Software Drivers 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online
Developing Minifilters 23 May 2022 Live, Online