Solved

Calling NtQueryInformationProcess From C Program

Posted on 2001-09-10
11
994 Views
Last Modified: 2013-12-03
Hi

I'm currently debugging a crash in a Windows application, and I?ve been using Strace to monitor the exact system calls being made.  I've discovered that just before NtOpenKey is called to open the AeDebug registry key and generate the error message there are two calls to NtQueryInformationProcess as shown below:

NtQueryInformationProcess (-1, 7, 1239636, 4, 0)
NtQueryInformationProcess (-1, 12, 1238980, 4, 0)

As you can see the handle for these two calls is -1, which could well be the cause of the crash. I wanted to confirm this by writing a short C program that made NtQueryInformationProcess calls using a negative handle, but quickly realised I didn't know how to access system calls directly from the ntdll.dll file.

I did see the below code on one web site, but I have no idea what it means and pasting it into my program just causes a lot of errors.

// create entry point for 'NtQueryInformationProcess()'
CREATE_DYNFUNC_5 ( NtQueryInformationProcess,
  NtQueryInformationProcess,
  ntdll, NTSTATUS,
  __stdcall,
  HANDLE,
  PROCESSINFOCLASS,
  PVOID,
  ULONG,
 PULONG );

I'd be extremely grateful if someone could tell me how to call NtQueryInformationProcess from a C program.  If you want to see what I've done so far, the short program I wrote to try and call NtQueryInformationProcess is available here:

http://www.geocities.com/craigrjatn/CrashTest.c

Thanks for any help you can offer.
0
Comment
Question by:Plague1392
  • 5
  • 4
  • 2
11 Comments
 
LVL 20

Accepted Solution

by:
Madshi earned 150 total points
ID: 6470287
Why don't you simply search on google? It's so easy...  :-)

Here is the first search result from google when searching for "NtQueryInformationProcess":

http://www.codeguru.com/win32/ntparent.shtml

You can download a full demo which calls NtQueryInformationProcess there.

Regards, Madshi.
0
 
LVL 20

Expert Comment

by:Madshi
ID: 6470288
Here's the third link from the same google search, also with downloadable code:

http://www.microsoft.com/msj/defaultframe.asp?page=/msj/0197/hood/hood0197.htm&nav=/msj/0197/newnav.htm
0
 
LVL 86

Expert Comment

by:jkr
ID: 6470476
:o)
0
 
LVL 20

Expert Comment

by:Madshi
ID: 6470594
(O:
0
 
LVL 86

Expert Comment

by:jkr
ID: 6470618
BTW,

>>As you can see the handle for these two calls is -1,
>>which could well be the cause of the crash

-1 == INVALID_HANDLE_VALUE - if this would cause a crash, NT wouldn't be very stable at all...
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 
LVL 86

Expert Comment

by:jkr
ID: 6470963
Another thing, the two calls to that API are hardly related to your app - the 1st one is related to 'ProcessDebugPort' (value == 7, meaning 'is a debugger attached?') and the 2nd one to 'ProcessDefaultHardErrorMode' (value == 12, meaning 'what should we do upon an exception?')
0
 

Author Comment

by:Plague1392
ID: 6470976
Thanks for the information.  I did search Google but I was confused about how to make the call and still am.  Basically, the program compiles but won?t link, presumably because I don?t have an import library for NTDLL.DLL.  I?m be very grateful if you could tell me where to get this and what to do with it.  It doesn?t seem to be installed with Visual Studio, it?s not on the NT CD and I can?t find where to download it from.

Sorry for the trouble and thanks for your help.
0
 
LVL 20

Expert Comment

by:Madshi
ID: 6471025
Those NtBlaBla APIs are for the biggest part undocumented. So you won't find an import library for those APIs on your Visual Studio, nor on the MSDN CDs. But why don't you download one of those demos I've linked you to. I guess they're prepared in a way that you can directly compile them, so this way you should be able to find out what you need to do to get access to those APIs.
I can't help you with the C++ related part of this problem, because I'm working in Delphi. I do have all those APIs running in Delphi, and they work perfectly fine. I'm using dynamic linking (calling LoadLibrary + GetProcAddress).
But as jkr already pointed out, it's not very probable, that those Nt* APIs are buggy themselves, if the problem is related to those APIs, then the caller of those APIs makes something wrong...

Regards, Madshi.
0
 
LVL 86

Expert Comment

by:jkr
ID: 6471974
>>I?m be very grateful if you could tell me where to get
>>this and what to do with it

It comes with the DDK - http://www.microsoft.com/hwdev/ddk/

But, if you keep up with the approach made in http://www.codeguru.com/win32/ntparent.shtml , you don't need an import library...
0
 
LVL 20

Expert Comment

by:Madshi
ID: 6473322
Does it really come with the DDK? I know some of the Nt* APIs are defined there, but I always thought, only a few. Most of them are not included there, or am I wrong?
0
 

Author Comment

by:Plague1392
ID: 6473647
Thanks a lot to both of you for your help.  I don't know who to give the points to since you were both very helpful.  I suppose I'll just have to choose randomly.

Thanks again.
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

This tutorial is about how to put some of your C++ program's functionality into a standard DLL, and how to make working with the EXE and the DLL simple and seamless.   We'll be using Microsoft Visual Studio 2008 and we will cut out the noise; that i…
In this article, I will show how to use the Ribbon IDs Tool Window to assign the built-in Office icons to a ribbon button.  This tool will help us to find the OfficeImageId that corresponds to our desired built-in Office icon. The tool is part of…
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now