eversinc33 / Banshee

Experimental Windows x64 Kernel Rootkit.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Cannot open include file 'ntifs.h'

johnjohnsp1 opened this issue · comments

Hi, thanks for sharing the project, i can manage to compile fine the bansheeclient but i get this error with banshee

Error | C1083 | Cannot open include file: 'ntifs.h': No such file or directory | Banshee | C:\temp\Banshee\Banshee\Driver.cpp | 1 |  

using windows 10 22h2 build 19045.3086
and
Microsoft Visual Studio Community 2022
Version 17.6.3
VisualStudio.17.Release/17.6.3+33801.468
Microsoft .NET Framework
Version 4.8.04084
Installed Version: Community
Visual C++ 2022 00482-90000-00000-AA404
Microsoft Visual C++ 2022
ASP.NET and Web Tools 17.6.326.62524
ASP.NET and Web Tools
Azure App Service Tools v3.0.0 17.6.326.62524
Azure App Service Tools v3.0.0
C# Tools 4.6.0-3.23259.8+c3cc1d0ceeab1a65da0217e403851a1e8a30086a
C# components used in the IDE. Depending on your project type and settings, a different version of the compiler may be used.
Cookiecutter 17.0.23087.1
Provides tools for finding, instantiating and customizing templates in cookiecutter format.
Dotfuscator Community Edition 6.5.3+7f0b0a9d18
PreEmptive Protection - Dotfuscator CE
Microsoft JVM Debugger 1.0
Provides support for connecting the Visual Studio debugger to JDWP compatible Java Virtual Machines
NuGet Package Manager 6.6.0
NuGet Package Manager in Visual Studio. For more information about NuGet, visit https://docs.nuget.org/
Python - Profiling support 17.0.23087.1
Profiling support for Python projects.
Python with Pylance 17.0.23087.1
Provides IntelliSense, projects, templates, debugging, interactive windows, and other support for Python developers.
Syntax Visualizer 1.0
An extension for visualizing Roslyn SyntaxTrees.
Test Adapter for Boost.Test 1.0
Enables Visual Studio's testing tools with unit tests written for Boost.Test. The use terms and Third Party Notices are available in the extension installation directory.
Test Adapter for Google Test 1.0
Enables Visual Studio's testing tools with unit tests written for Google Test. The use terms and Third Party Notices are available in the extension installation directory.
TypeScript Tools 17.0.20329.2001
TypeScript Tools for Microsoft Visual Studio
Visual Basic Tools 4.6.0-3.23259.8+c3cc1d0ceeab1a65da0217e403851a1e8a30086a
Visual Basic components used in the IDE. Depending on your project type and settings, a different version of the compiler may be used.
Visual F# Tools 17.6.0-beta.23174.5+0207bea1afae48d9351ac26fb51afc8260de0a97
Microsoft Visual F# Tools
Visual Studio IntelliCode 2.2
AI-assisted development for Visual Studio.

any ideas ? i do something wrong ?
thanks

Hi! For kernel programming you need the Windows Driver Kit (WDK): https://learn.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk

Did you install this?

yes have installed them.

Screen_capture_ 2023-06-16 alle 09 17 32 Screen_capture_ 2023-06-16 alle 09 17 22

Might be just a pathing issue. Maybe try this: https://stackoverflow.com/questions/35777922/cannot-open-include-file-ntddk-h

Or maybe your Windows SDK and WDK versions are different? Did the WDK complain somehow on installation?

actually i have all of those installed
will try remove and reinstall them both

thanks

Screen_capture_ 2023-06-16 alle 09 29 31

Hope it works. I would suggest you download just the ones directly linked here (Win 11, works on Win 10 too). These are the ones I use and they are definitely compatible.

https://learn.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk

perfect, thanks for the link, will do the same as you

little step forward, now with both SDK and WDK same version when i compile will throw this error

Warning | C4996 | 'ExAllocatePoolWithTag': ExAllocatePoolWithTag is deprecated, use ExAllocatePool2. | Banshee | C:\temp\Banshee\Banshee\IOCTLS.hpp | 240 |  
Error | C2065 | 'NUL': undeclared identifier | Banshee | C:\temp\Banshee\Banshee\Misc.hpp | 88 |  

sorry, found out that NUL that is missing a "L" .. now it works but since i cloned the repo i think it came down as NUL.
Screen_capture_ 2023-06-16 alle 13 58 18

just checked and original file Misc.hpp is ok, probably just my bad, sorry about the previuos comment, everything is really really appreciate the help, can close the issue

This was an error in a previous commit, your repo was probably not up to date. Please pull again, I just fixed a bug in the kernel callback enumeration. Glad it worked out!