Solved

Calling NtQueryInformationProcess From C Program

Posted on 2001-09-10
11
1,062 Views
Last Modified: 2013-12-03
Hi

I'm currently debugging a crash in a Windows application, and I?ve been using Strace to monitor the exact system calls being made.  I've discovered that just before NtOpenKey is called to open the AeDebug registry key and generate the error message there are two calls to NtQueryInformationProcess as shown below:

NtQueryInformationProcess (-1, 7, 1239636, 4, 0)
NtQueryInformationProcess (-1, 12, 1238980, 4, 0)

As you can see the handle for these two calls is -1, which could well be the cause of the crash. I wanted to confirm this by writing a short C program that made NtQueryInformationProcess calls using a negative handle, but quickly realised I didn't know how to access system calls directly from the ntdll.dll file.

I did see the below code on one web site, but I have no idea what it means and pasting it into my program just causes a lot of errors.

// create entry point for 'NtQueryInformationProcess()'
CREATE_DYNFUNC_5 ( NtQueryInformationProcess,
  NtQueryInformationProcess,
  ntdll, NTSTATUS,
  __stdcall,
  HANDLE,
  PROCESSINFOCLASS,
  PVOID,
  ULONG,
 PULONG );

I'd be extremely grateful if someone could tell me how to call NtQueryInformationProcess from a C program.  If you want to see what I've done so far, the short program I wrote to try and call NtQueryInformationProcess is available here:

http://www.geocities.com/craigrjatn/CrashTest.c

Thanks for any help you can offer.
0
Comment
Question by:Plague1392
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
  • 2
11 Comments
 
LVL 20

Accepted Solution

by:
Madshi earned 150 total points
ID: 6470287
Why don't you simply search on google? It's so easy...  :-)

Here is the first search result from google when searching for "NtQueryInformationProcess":

http://www.codeguru.com/win32/ntparent.shtml

You can download a full demo which calls NtQueryInformationProcess there.

Regards, Madshi.
0
 
LVL 20

Expert Comment

by:Madshi
ID: 6470288
Here's the third link from the same google search, also with downloadable code:

http://www.microsoft.com/msj/defaultframe.asp?page=/msj/0197/hood/hood0197.htm&nav=/msj/0197/newnav.htm
0
 
LVL 86

Expert Comment

by:jkr
ID: 6470476
:o)
0
PeopleSoft Has Never Been Easier

PeopleSoft Adoption Made Smooth & Simple!

On-The-Job Training Is made Intuitive & Easy With WalkMe's On-Screen Guidance Tool.  Claim Your Free WalkMe Account Now

 
LVL 20

Expert Comment

by:Madshi
ID: 6470594
(O:
0
 
LVL 86

Expert Comment

by:jkr
ID: 6470618
BTW,

>>As you can see the handle for these two calls is -1,
>>which could well be the cause of the crash

-1 == INVALID_HANDLE_VALUE - if this would cause a crash, NT wouldn't be very stable at all...
0
 
LVL 86

Expert Comment

by:jkr
ID: 6470963
Another thing, the two calls to that API are hardly related to your app - the 1st one is related to 'ProcessDebugPort' (value == 7, meaning 'is a debugger attached?') and the 2nd one to 'ProcessDefaultHardErrorMode' (value == 12, meaning 'what should we do upon an exception?')
0
 

Author Comment

by:Plague1392
ID: 6470976
Thanks for the information.  I did search Google but I was confused about how to make the call and still am.  Basically, the program compiles but won?t link, presumably because I don?t have an import library for NTDLL.DLL.  I?m be very grateful if you could tell me where to get this and what to do with it.  It doesn?t seem to be installed with Visual Studio, it?s not on the NT CD and I can?t find where to download it from.

Sorry for the trouble and thanks for your help.
0
 
LVL 20

Expert Comment

by:Madshi
ID: 6471025
Those NtBlaBla APIs are for the biggest part undocumented. So you won't find an import library for those APIs on your Visual Studio, nor on the MSDN CDs. But why don't you download one of those demos I've linked you to. I guess they're prepared in a way that you can directly compile them, so this way you should be able to find out what you need to do to get access to those APIs.
I can't help you with the C++ related part of this problem, because I'm working in Delphi. I do have all those APIs running in Delphi, and they work perfectly fine. I'm using dynamic linking (calling LoadLibrary + GetProcAddress).
But as jkr already pointed out, it's not very probable, that those Nt* APIs are buggy themselves, if the problem is related to those APIs, then the caller of those APIs makes something wrong...

Regards, Madshi.
0
 
LVL 86

Expert Comment

by:jkr
ID: 6471974
>>I?m be very grateful if you could tell me where to get
>>this and what to do with it

It comes with the DDK - http://www.microsoft.com/hwdev/ddk/

But, if you keep up with the approach made in http://www.codeguru.com/win32/ntparent.shtml , you don't need an import library...
0
 
LVL 20

Expert Comment

by:Madshi
ID: 6473322
Does it really come with the DDK? I know some of the Nt* APIs are defined there, but I always thought, only a few. Most of them are not included there, or am I wrong?
0
 

Author Comment

by:Plague1392
ID: 6473647
Thanks a lot to both of you for your help.  I don't know who to give the points to since you were both very helpful.  I suppose I'll just have to choose randomly.

Thanks again.
0

Featured Post

Enroll in May's Course of the Month

May’s Course of the Month is now available! Experts Exchange’s Premium Members and Team Accounts have access to a complimentary course each month as part of their membership—an extra way to increase training and boost professional development.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article describes how to add a user-defined command button to the Windows 7 Explorer toolbar.  In the previous article (http://www.experts-exchange.com/A_2172.html), we saw how to put the Delete button back there where it belongs.  "Delete" is …
As more and more people are shifting to the latest .Net frameworks, the windows presentation framework is gaining importance by the day. Many people are now turning to WPF controls to provide a rich user experience. I have been using WPF controls fo…
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

740 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question