• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1178
  • Last Modified:

Calling NtQueryInformationProcess From C Program

Hi

I'm currently debugging a crash in a Windows application, and I?ve been using Strace to monitor the exact system calls being made.  I've discovered that just before NtOpenKey is called to open the AeDebug registry key and generate the error message there are two calls to NtQueryInformationProcess as shown below:

NtQueryInformationProcess (-1, 7, 1239636, 4, 0)
NtQueryInformationProcess (-1, 12, 1238980, 4, 0)

As you can see the handle for these two calls is -1, which could well be the cause of the crash. I wanted to confirm this by writing a short C program that made NtQueryInformationProcess calls using a negative handle, but quickly realised I didn't know how to access system calls directly from the ntdll.dll file.

I did see the below code on one web site, but I have no idea what it means and pasting it into my program just causes a lot of errors.

// create entry point for 'NtQueryInformationProcess()'
CREATE_DYNFUNC_5 ( NtQueryInformationProcess,
  NtQueryInformationProcess,
  ntdll, NTSTATUS,
  __stdcall,
  HANDLE,
  PROCESSINFOCLASS,
  PVOID,
  ULONG,
 PULONG );

I'd be extremely grateful if someone could tell me how to call NtQueryInformationProcess from a C program.  If you want to see what I've done so far, the short program I wrote to try and call NtQueryInformationProcess is available here:

http://www.geocities.com/craigrjatn/CrashTest.c

Thanks for any help you can offer.
0
Plague1392
Asked:
Plague1392
  • 5
  • 4
  • 2
1 Solution
 
MadshiCommented:
Why don't you simply search on google? It's so easy...  :-)

Here is the first search result from google when searching for "NtQueryInformationProcess":

http://www.codeguru.com/win32/ntparent.shtml

You can download a full demo which calls NtQueryInformationProcess there.

Regards, Madshi.
0
 
MadshiCommented:
Here's the third link from the same google search, also with downloadable code:

http://www.microsoft.com/msj/defaultframe.asp?page=/msj/0197/hood/hood0197.htm&nav=/msj/0197/newnav.htm
0
 
jkrCommented:
:o)
0
Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

 
MadshiCommented:
(O:
0
 
jkrCommented:
BTW,

>>As you can see the handle for these two calls is -1,
>>which could well be the cause of the crash

-1 == INVALID_HANDLE_VALUE - if this would cause a crash, NT wouldn't be very stable at all...
0
 
jkrCommented:
Another thing, the two calls to that API are hardly related to your app - the 1st one is related to 'ProcessDebugPort' (value == 7, meaning 'is a debugger attached?') and the 2nd one to 'ProcessDefaultHardErrorMode' (value == 12, meaning 'what should we do upon an exception?')
0
 
Plague1392Author Commented:
Thanks for the information.  I did search Google but I was confused about how to make the call and still am.  Basically, the program compiles but won?t link, presumably because I don?t have an import library for NTDLL.DLL.  I?m be very grateful if you could tell me where to get this and what to do with it.  It doesn?t seem to be installed with Visual Studio, it?s not on the NT CD and I can?t find where to download it from.

Sorry for the trouble and thanks for your help.
0
 
MadshiCommented:
Those NtBlaBla APIs are for the biggest part undocumented. So you won't find an import library for those APIs on your Visual Studio, nor on the MSDN CDs. But why don't you download one of those demos I've linked you to. I guess they're prepared in a way that you can directly compile them, so this way you should be able to find out what you need to do to get access to those APIs.
I can't help you with the C++ related part of this problem, because I'm working in Delphi. I do have all those APIs running in Delphi, and they work perfectly fine. I'm using dynamic linking (calling LoadLibrary + GetProcAddress).
But as jkr already pointed out, it's not very probable, that those Nt* APIs are buggy themselves, if the problem is related to those APIs, then the caller of those APIs makes something wrong...

Regards, Madshi.
0
 
jkrCommented:
>>I?m be very grateful if you could tell me where to get
>>this and what to do with it

It comes with the DDK - http://www.microsoft.com/hwdev/ddk/

But, if you keep up with the approach made in http://www.codeguru.com/win32/ntparent.shtml , you don't need an import library...
0
 
MadshiCommented:
Does it really come with the DDK? I know some of the Nt* APIs are defined there, but I always thought, only a few. Most of them are not included there, or am I wrong?
0
 
Plague1392Author Commented:
Thanks a lot to both of you for your help.  I don't know who to give the points to since you were both very helpful.  I suppose I'll just have to choose randomly.

Thanks again.
0

Featured Post

Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

  • 5
  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now