Welcome to SystemExplorer Discussions!

[zodiacon]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[BeneficialCode]

Thanks for Pavel's invitation. I have been programming for five years now since I enter the university. I find that I'm interested in system and kernel programming. It's very cool! SystemExplorer helps me understand what the windows process, thread, memory are. I highly recommend pavel's books on leanpub.com. They have many system technologies, e.g. COM, driver, IRP and so on. With this community, I'll study with members together and share the probles we will encounter in the future.

[alexagil]

Dear Pavel,
It would be interesting a guide on how to compile this program SystemExplorer or one already compiled program
available to download.
I try it myself and got Windows WindowsKernelModeDriver10.0 missing

[zodiacon]

You will need to install the Windows Driver Kit, since there is a driver project. Or remove the KObjExp project from the solution.
Alternatively, you can find a compiled version at https://github.com/zodiacon/AllTools

[alexagil]

I have already the windows driver kit installed, SDK but still got the error

[zodiacon]

Do you have the WDK extension installed in VS?
You may also need to regenerate a test certificate by going to KObjExp project properties / Driver / Signing.

[alexagil]

I made a mistake when trying to install the WDK for the first time. Now I installed it correct and it worked. Next error in the error chain was
I had to include the ntifs.h in the include path | C/C++ -> General -> Additional Include Directories
C:\Program Files (x86)\Windows Kits\10\Include\10.0.14393.0\km\ . Next error and now I am still stuck is

1>------ Build started: Project: KObjExp, Configuration: ReleaseSigned x64 ------
1>KObjExp.cpp
1>C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\shared\ntdef.h(197,1): error C1189: #error: "No Target Architecture"
1>(compiling source file 'KObjExp.cpp')
1>Done building project "KObjExp.vcxproj" -- FAILED

[BeneficialCode]

Your SDK version must match your wdk version. 10.0.14393.0 and 10.0.22621.0 are not the same version.

[knowhatamine]

Id like to add the drivers hash to my dbstore. Where can I find the driver? Bit lazy here. Thanks so much for all of your tools. I your take on procmon too, advanced mode is neat

[knowhatamine]

Youve invested so much time into this, I can at least try. So I suppose KObjExp.sys is the driver. Since it's already signed I suppose my bios will take extract the hash if I just add it.