Error in compiling first driver.

NTDEV
1

Hi All,
I am no sure that is this right forum to raise the problem,
so posting here.
I have just start reading book, “Rootkitsubverting the Windows Kernel”, in chap 2 : where where we are building first rootkit, I am having the unexpected error, where as author says there should not be any error.
here is error I am getting while building.

C:\myrootkit>build
path contains nonexistant c:\program files\xlview, removing
BUILD: Compile and Link for x86
BUILD: Loading c:\winddk\7600.16385.0\build.dat…
BUILD: Computing Include file dependencies:
BUILD: Start time: Thu Feb 25 12:32:30 2010
BUILD: Examining c:\myrootkit directory for files to compile.
c:\myrootkit Invalidating OACR warning log for ‘root:x86chk’
BUILD: Saving c:\winddk\7600.16385.0\build.dat…
BUILD: Compiling and Linking c:\myrootkit directory
Configuring OACR for ‘root:x86chk’ -
_NT_TARGET_VERSION SET TO WINXP
1>errors in directory c:\myrootkit
1>NMAKE : fatal error U1073: don’t know how to make ‘c:\myrootkit\objchk_wxp_x86
\i386\version.obj’
1>nmake.exe /nologo BUILDMSG=Stop. -i BUILD_PASS=PASS2 LINKONLY=1 NOPASS0=1 MAKE
DIR_RELATIVE_TO_BASEDIR= failed - rc = 2

BUILD: Finish time: Thu Feb 25 12:32:31 2010
BUILD: Done

0 files compiled - 2 Warnings - 2 Errors

I have the same code as shown in book,
same folder in am in while building (C:\myrootkit)
Right now I am clueless, can anyone point out where I am doing wrong. any comments will be appreciated.
Thanks in advance.

Can anyone help.

2

There should be a text file called buildchk_wxp_x86.wrn in the folder.
Check the contents of that file.

3

I am so eager to help you in your endeavors I just cannot contain myself.

Please wait for further instructions.

Mark Roddy

On Tue, Mar 2, 2010 at 2:58 AM, wrote:

> Hi All,
> I am no sure that is this right forum to raise the problem,
> so posting here.
> I have just start reading book, “Rootkitsubverting the Windows Kernel”, in
> chap 2 : where where we are building first rootkit, I am having the
> unexpected error, where as author says there should not be any error.
> here is error I am getting while building.
> -----------------------------
> C:\myrootkit>build
> path contains nonexistant c:\program files\xlview, removing
> BUILD: Compile and Link for x86
> BUILD: Loading c:\winddk\7600.16385.0\build.dat…
> BUILD: Computing Include file dependencies:
> BUILD: Start time: Thu Feb 25 12:32:30 2010
> BUILD: Examining c:\myrootkit directory for files to compile.
> c:\myrootkit Invalidating OACR warning log for ‘root:x86chk’
> BUILD: Saving c:\winddk\7600.16385.0\build.dat…
> BUILD: Compiling and Linking c:\myrootkit directory
> Configuring OACR for ‘root:x86chk’ -
> _NT_TARGET_VERSION SET TO WINXP
> 1>errors in directory c:\myrootkit
> 1>NMAKE : fatal error U1073: don’t know how to make
> ‘c:\myrootkit\objchk_wxp_x86
> \i386\version.obj’
> 1>nmake.exe /nologo BUILDMSG=Stop. -i BUILD_PASS=PASS2 LINKONLY=1 NOPASS0=1
> MAKE
> DIR_RELATIVE_TO_BASEDIR= failed - rc = 2
>
> BUILD: Finish time: Thu Feb 25 12:32:31 2010
> BUILD: Done
>
> 0 files compiled - 2 Warnings - 2 Errors
> -------------------------------------
>
> I have the same code as shown in book,
> same folder in am in while building (C:\myrootkit)
> Right now I am clueless, can anyone point out where I am doing wrong. any
> comments will be appreciated.
> Thanks in advance.
>
> Can anyone help.
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

4

Hi,

Looking in the public database, I see there is someone just to handle
technical support for questions like yours. You can contact him at:

Registrant:
Hoglund, Greg
16115 Mays Ave
Monte Sereno, CA 95030
US

Domain Name: ROOTKIT.COM

Administrative Contact :
Hoglund, Greg
xxxxx@hbgary.com
16115 Mays Ave
Monte Sereno, CA 95030
US
Phone: 408-529-4370
Fax: 408-626-9005

Feel free to call him, I’m sure he will want to hear from you.

Jan

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-403609-
xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Monday, March 01, 2010 11:59 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Error in compiling first driver.

Hi All,
I am no sure that is this right forum to raise the problem,
so posting here.
I have just start reading book, “Rootkitsubverting the Windows Kernel”,
in chap 2 : where where we are building first rootkit, I am having the
unexpected error, where as author says there should not be any error.
here is error I am getting while building.

C:\myrootkit>build
path contains nonexistant c:\program files\xlview, removing
BUILD: Compile and Link for x86
BUILD: Loading c:\winddk\7600.16385.0\build.dat…
BUILD: Computing Include file dependencies:
BUILD: Start time: Thu Feb 25 12:32:30 2010
BUILD: Examining c:\myrootkit directory for files to compile.
c:\myrootkit Invalidating OACR warning log for ‘root:x86chk’
BUILD: Saving c:\winddk\7600.16385.0\build.dat…
BUILD: Compiling and Linking c:\myrootkit directory
Configuring OACR for ‘root:x86chk’ -
_NT_TARGET_VERSION SET TO WINXP
1>errors in directory c:\myrootkit
1>NMAKE : fatal error U1073: don’t know how to make
‘c:\myrootkit\objchk_wxp_x86
\i386\version.obj’
1>nmake.exe /nologo BUILDMSG=Stop. -i BUILD_PASS=PASS2 LINKONLY=1
NOPASS0=1 MAKE
DIR_RELATIVE_TO_BASEDIR= failed - rc = 2

BUILD: Finish time: Thu Feb 25 12:32:31 2010
BUILD: Done

0 files compiled - 2 Warnings - 2 Errors

I have the same code as shown in book,
same folder in am in while building (C:\myrootkit)
Right now I am clueless, can anyone point out where I am doing wrong.
any comments will be appreciated.
Thanks in advance.

Can anyone help.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

5

Let me help you: This is not “the right forum to raise the problem.”


Right now I am clueless

Agreed. But also, as of right NOW you are on moderation.

And this thread is locked.

Peter
OSR