Skip to main content
GameDev.net gamedev.net
🔒 Locked

problem using NtQueryInformationProcess()

Started by nuclear123 Sep 13, 2010 at 8:19 PM 9 replies 13.2k views
Original Post
nuclear123
nuclear123
i am currently trying to retrieve the status of a debugport on a specific module.
Any help on what i am doing wrong? i am currently getting a linker error..

BYTE buffer[10];
DWORD StatusValue = NtQueryInformationProcess(handleModule,ProcessBasicInformation,&buffer,10,NULL);

1>Check_Debug_Port.obj : error LNK2019: unresolved external symbol _NtQueryInformationProcess referenced in function _wmain
1>C:\Users\debugger\Desktop\projects\Check_Debug_Port\Debug\Check_Debug_Port.exe : fatal error LNK1120: 1 unresolved externals
taby
taby
There is no import library for this function. That is, you can't just statically link in a .lib file and expect things to work, like you can with the other 99% of the Win32 API's functions. The reason Microsoft is making it so difficult to use this function is because it's been flagged as "a private component, internal to Windows only" and is likely to change/vanish from Windows altogether in the future. If that happens, your code will break. Why the heck they published this private function in a public document in the first place confuses me, but that's beside the point.

The page http://msdn.microsoft.com/en-us/library/ms684280%28VS.85%29.aspx indicates which alternative "public" functions to use instead.

[Edited by - taby on September 13, 2010 8:34:23 PM]
nuclear123
nuclear123
oh ok so i need to load the library into my address space dynamically at run time. and make a pointer to the function i want to use??
taby
taby
Seeing how you want to go the masochistic route, I'll help you out a bit. :)

As far as I can tell, the following code is loading the DLL/function correctly. You'll have to play around with the function parameters to get it to do anything useful though. When you import a function this way, you must give it a nickname. The example here uses the nickname "ProcAdd", though I could have called it "Turkey" or even "QueryInformationProcess".

// A simple program that uses LoadLibrary and // GetProcAddress to access NtQueryInformationProcess from ntdll.dll.  #include <windows.h> #include <stdio.h>#include <winternl.h>#include <iostream>using std::cout;// Function pointer declaration. VERY IMPORTANT!typedef NTSTATUS (*MYPROC)(HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG);  int main(void) {     HINSTANCE hinstLib;     MYPROC ProcAdd;     BOOL fFreeResult, fRunTimeLinkSuccess = FALSE;      // Get a handle to the DLL module.    hinstLib = LoadLibrary(TEXT("ntdll.dll"));      // If the handle is valid, try to get the function address.    if (hinstLib != NULL)     {         ProcAdd = (MYPROC) GetProcAddress(hinstLib, "NtQueryInformationProcess");          // If the function address is valid, call the function.        if (NULL != ProcAdd)         {            fRunTimeLinkSuccess = TRUE;            HANDLE h = GetModuleHandle(0); // fill this in yourself            PROCESS_BASIC_INFORMATION pbi;            DWORD data_length = 0;            (ProcAdd)(h, ProcessBasicInformation, &pbi, sizeof(pbi), &data_length);            cout << data_length;        }        // Free the DLL module.        fFreeResult = FreeLibrary(hinstLib);     }    return 0;}
nuclear123
nuclear123
ok so i've gotten that but i am having trouble linking the address of the function in the dll with my user created pointer!

typedef NTSTATUS (*_NtQueryInformationProcess)(HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG);

HMODULE jo = LoadLibrary(L"ntdll.dll");
NTSTATUS ProcAdd = (_NtQueryInformationProcess) GetProcAddress(jo, "NtQueryInformationProcess");


: error C2440: 'initializing' : cannot convert from '_NtQueryInformationProcess' to 'NTSTATUS' is my last error message
taby
taby
Quote:
Original post by nuclear123
...

The reason you can look up the function "NtQueryInformationProcess" inside of ntdll.dll by name like this is simply because Microsoft has made things easy. You could instead look up the function "NtQueryInformationProcess" by it's identifying number (ordinal) within the ntdll.dll file, but that's just ridiculously difficult and a general pain in the ass. What's the ordinal of this function? Who knows... who cares... we already have its string-based identifier instead! :)

Your GetProcAddress call is not quite correct. It should be:
// Note the difference! ProcAdd is a function pointer, not an NTSTATUS. :)_NtQueryInformationProcess ProcAdd = (_NtQueryInformationProcess) GetProcAddress(jo, "NtQueryInformationProcess");
nuclear123
nuclear123
sorry for still bugging you :( but i'm still getting error LNK2019: unresolved external symbol _NtQueryInformationProcess referenced in function _wmain!
taby
taby
Quote:
Original post by nuclear123
sorry for still bugging you :( but i'm still getting error LNK2019: unresolved external symbol _NtQueryInformationProcess referenced in function _wmain!


That shouldn't be happening. LOL, don't worry about bugging me. Dynamic runtime linking is actually a useful skill for you to learn, even if using NtQueryInformation is well-known to be a bad idea. ;)

Can you please post the whole code?

Please wrap the code in source tags like this ...

[ source ]
some C++ code here...
[ /source ]

... but make sure to remove the spaces between the [, source, and ] tokens. I had to put those spaces in there so it wouldn't interpret them as actual source tags while I demonstrated them to you.
nuclear123
nuclear123
wow nvm it worked.... i forgot to comment out my old code below it! thanks so much i really appreciate your time and effort in helping me. ;) have a great night and happy codeing my friend
taby
taby
Quote:
Original post by nuclear123
wow nvm it worked.... i forgot to comment out my old code below it! thanks so much i really appreciate your time and effort in helping me. ;) have a great night and happy codeing my friend


No problem. Glad to have helped.
CrazyCdn
CrazyCdn
I have to repeat what taby said about how bad this idea is. I don't think nuclear understands that Microsoft could release a minor release tomorrow that removes this feature and his code starts getting weird errors if he isn't logging well.

I highly recommend against doing this, as the docs state. Use other methods.
"Those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety." --Benjamin Franklin

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.

Sign in to reply to this topic.