Solved

Calling NtQueryInformationProcess From C Program

Posted on 2001-09-10
11
1,036 Views
Last Modified: 2013-12-03
Hi

I'm currently debugging a crash in a Windows application, and I?ve been using Strace to monitor the exact system calls being made.  I've discovered that just before NtOpenKey is called to open the AeDebug registry key and generate the error message there are two calls to NtQueryInformationProcess as shown below:

NtQueryInformationProcess (-1, 7, 1239636, 4, 0)
NtQueryInformationProcess (-1, 12, 1238980, 4, 0)

As you can see the handle for these two calls is -1, which could well be the cause of the crash. I wanted to confirm this by writing a short C program that made NtQueryInformationProcess calls using a negative handle, but quickly realised I didn't know how to access system calls directly from the ntdll.dll file.

I did see the below code on one web site, but I have no idea what it means and pasting it into my program just causes a lot of errors.

// create entry point for 'NtQueryInformationProcess()'
CREATE_DYNFUNC_5 ( NtQueryInformationProcess,
  NtQueryInformationProcess,
  ntdll, NTSTATUS,
  __stdcall,
  HANDLE,
  PROCESSINFOCLASS,
  PVOID,
  ULONG,
 PULONG );

I'd be extremely grateful if someone could tell me how to call NtQueryInformationProcess from a C program.  If you want to see what I've done so far, the short program I wrote to try and call NtQueryInformationProcess is available here:

http://www.geocities.com/craigrjatn/CrashTest.c

Thanks for any help you can offer.
0
Comment
Question by:Plague1392
  • 5
  • 4
  • 2
11 Comments
 
LVL 20

Accepted Solution

by:
Madshi earned 150 total points
ID: 6470287
Why don't you simply search on google? It's so easy...  :-)

Here is the first search result from google when searching for "NtQueryInformationProcess":

http://www.codeguru.com/win32/ntparent.shtml

You can download a full demo which calls NtQueryInformationProcess there.

Regards, Madshi.
0
 
LVL 20

Expert Comment

by:Madshi
ID: 6470288
Here's the third link from the same google search, also with downloadable code:

http://www.microsoft.com/msj/defaultframe.asp?page=/msj/0197/hood/hood0197.htm&nav=/msj/0197/newnav.htm
0
 
LVL 86

Expert Comment

by:jkr
ID: 6470476
:o)
0
Gigs: Get Your Project Delivered by an Expert

Select from freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely and get projects done right.

 
LVL 20

Expert Comment

by:Madshi
ID: 6470594
(O:
0
 
LVL 86

Expert Comment

by:jkr
ID: 6470618
BTW,

>>As you can see the handle for these two calls is -1,
>>which could well be the cause of the crash

-1 == INVALID_HANDLE_VALUE - if this would cause a crash, NT wouldn't be very stable at all...
0
 
LVL 86

Expert Comment

by:jkr
ID: 6470963
Another thing, the two calls to that API are hardly related to your app - the 1st one is related to 'ProcessDebugPort' (value == 7, meaning 'is a debugger attached?') and the 2nd one to 'ProcessDefaultHardErrorMode' (value == 12, meaning 'what should we do upon an exception?')
0
 

Author Comment

by:Plague1392
ID: 6470976
Thanks for the information.  I did search Google but I was confused about how to make the call and still am.  Basically, the program compiles but won?t link, presumably because I don?t have an import library for NTDLL.DLL.  I?m be very grateful if you could tell me where to get this and what to do with it.  It doesn?t seem to be installed with Visual Studio, it?s not on the NT CD and I can?t find where to download it from.

Sorry for the trouble and thanks for your help.
0
 
LVL 20

Expert Comment

by:Madshi
ID: 6471025
Those NtBlaBla APIs are for the biggest part undocumented. So you won't find an import library for those APIs on your Visual Studio, nor on the MSDN CDs. But why don't you download one of those demos I've linked you to. I guess they're prepared in a way that you can directly compile them, so this way you should be able to find out what you need to do to get access to those APIs.
I can't help you with the C++ related part of this problem, because I'm working in Delphi. I do have all those APIs running in Delphi, and they work perfectly fine. I'm using dynamic linking (calling LoadLibrary + GetProcAddress).
But as jkr already pointed out, it's not very probable, that those Nt* APIs are buggy themselves, if the problem is related to those APIs, then the caller of those APIs makes something wrong...

Regards, Madshi.
0
 
LVL 86

Expert Comment

by:jkr
ID: 6471974
>>I?m be very grateful if you could tell me where to get
>>this and what to do with it

It comes with the DDK - http://www.microsoft.com/hwdev/ddk/

But, if you keep up with the approach made in http://www.codeguru.com/win32/ntparent.shtml , you don't need an import library...
0
 
LVL 20

Expert Comment

by:Madshi
ID: 6473322
Does it really come with the DDK? I know some of the Nt* APIs are defined there, but I always thought, only a few. Most of them are not included there, or am I wrong?
0
 

Author Comment

by:Plague1392
ID: 6473647
Thanks a lot to both of you for your help.  I don't know who to give the points to since you were both very helpful.  I suppose I'll just have to choose randomly.

Thanks again.
0

Featured Post

Live: Real-Time Solutions, Start Here

Receive instant 1:1 support from technology experts, using our real-time conversation and whiteboard interface. Your first 5 minutes are always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article describes how to programmatically preset the "Pages per Sheet" option that's available with most printer drivers.   This setting lets you do "n-Up" printing, where two, four, or more pages are printed on each sheet of paper. If your …
Whether you've completed a degree in computer sciences or you're a self-taught programmer, writing your first lines of code in the real world is always a challenge. Here are some of the most common pitfalls for new programmers.
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now