How to use Ntdll.h and Ntdll.lib in Kernel Mode?

Question

0.00/5 (No votes)

See more:

hi , i want to use Ntdll.lib and Ntdll.h for use of undocumented function , i download ntdll.h and ntdll.lib and Add these files to my project , but when i want to use undocumented function i see this error , for example :

Quote:
Error 1 error C3861: 'ZwCreateProcess': identifier not found

please tell me how to use these file to run nt undocumented routine , thanks ,

Posted 9-Aug-12 5:36am

casa cargo

Updated 9-Aug-12 5:37am

v3

Add a Solution

Comments

[no name] 9-Aug-12 11:41am

Well I could only point you back to the asnwer you already got...

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Richard MacCutchan · Answer 1 · 2012-08-09T07:22:00

Solution 1

See here[^]; you do not have a definition of ZwCreateProcess() anywhere in your compilation unit. If it is not defined in Ntdll.h then I guess you cannot use it.

Posted 9-Aug-12 7:22am

Richard MacCutchan

Member 10010262 · Answer 2 · 2013-09-27T07:23:00

Here is a proto-type for ZwCreateToken

NTSYSAPI
NTSTATUS
NTAPI
ZwCreateToken(
OUT PHANDLE TokenHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN TOKEN_TYPE Type,
IN PLUID AuthenticationId,
IN PLARGE_INTEGER ExpirationTime,
IN PTOKEN_USER User,
IN PTOKEN_GROUPS Groups,
IN PTOKEN_PRIVILEGES Privileges,
IN PTOKEN_OWNER Owner,
IN PTOKEN_PRIMARY_GROUP PrimaryGroup,
IN PTOKEN_DEFAULT_DACL DefaultDacl,
IN PTOKEN_SOURCE Source
);