Solved

Calling NtQueryInformationProcess From C Program

Posted on 2001-09-10
11
1,030 Views
Last Modified: 2013-12-03
Hi

I'm currently debugging a crash in a Windows application, and I?ve been using Strace to monitor the exact system calls being made.  I've discovered that just before NtOpenKey is called to open the AeDebug registry key and generate the error message there are two calls to NtQueryInformationProcess as shown below:

NtQueryInformationProcess (-1, 7, 1239636, 4, 0)
NtQueryInformationProcess (-1, 12, 1238980, 4, 0)

As you can see the handle for these two calls is -1, which could well be the cause of the crash. I wanted to confirm this by writing a short C program that made NtQueryInformationProcess calls using a negative handle, but quickly realised I didn't know how to access system calls directly from the ntdll.dll file.

I did see the below code on one web site, but I have no idea what it means and pasting it into my program just causes a lot of errors.

// create entry point for 'NtQueryInformationProcess()'
CREATE_DYNFUNC_5 ( NtQueryInformationProcess,
  NtQueryInformationProcess,
  ntdll, NTSTATUS,
  __stdcall,
  HANDLE,
  PROCESSINFOCLASS,
  PVOID,
  ULONG,
 PULONG );

I'd be extremely grateful if someone could tell me how to call NtQueryInformationProcess from a C program.  If you want to see what I've done so far, the short program I wrote to try and call NtQueryInformationProcess is available here:

http://www.geocities.com/craigrjatn/CrashTest.c

Thanks for any help you can offer.
0
Comment
Question by:Plague1392
  • 5
  • 4
  • 2
11 Comments
 
LVL 20

Accepted Solution

by:
Madshi earned 150 total points
ID: 6470287
Why don't you simply search on google? It's so easy...  :-)

Here is the first search result from google when searching for "NtQueryInformationProcess":

http://www.codeguru.com/win32/ntparent.shtml

You can download a full demo which calls NtQueryInformationProcess there.

Regards, Madshi.
0
 
LVL 20

Expert Comment

by:Madshi
ID: 6470288
Here's the third link from the same google search, also with downloadable code:

http://www.microsoft.com/msj/defaultframe.asp?page=/msj/0197/hood/hood0197.htm&nav=/msj/0197/newnav.htm
0
 
LVL 86

Expert Comment

by:jkr
ID: 6470476
:o)
0
 
LVL 20

Expert Comment

by:Madshi
ID: 6470594
(O:
0
 
LVL 86

Expert Comment

by:jkr
ID: 6470618
BTW,

>>As you can see the handle for these two calls is -1,
>>which could well be the cause of the crash

-1 == INVALID_HANDLE_VALUE - if this would cause a crash, NT wouldn't be very stable at all...
0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 
LVL 86

Expert Comment

by:jkr
ID: 6470963
Another thing, the two calls to that API are hardly related to your app - the 1st one is related to 'ProcessDebugPort' (value == 7, meaning 'is a debugger attached?') and the 2nd one to 'ProcessDefaultHardErrorMode' (value == 12, meaning 'what should we do upon an exception?')
0
 

Author Comment

by:Plague1392
ID: 6470976
Thanks for the information.  I did search Google but I was confused about how to make the call and still am.  Basically, the program compiles but won?t link, presumably because I don?t have an import library for NTDLL.DLL.  I?m be very grateful if you could tell me where to get this and what to do with it.  It doesn?t seem to be installed with Visual Studio, it?s not on the NT CD and I can?t find where to download it from.

Sorry for the trouble and thanks for your help.
0
 
LVL 20

Expert Comment

by:Madshi
ID: 6471025
Those NtBlaBla APIs are for the biggest part undocumented. So you won't find an import library for those APIs on your Visual Studio, nor on the MSDN CDs. But why don't you download one of those demos I've linked you to. I guess they're prepared in a way that you can directly compile them, so this way you should be able to find out what you need to do to get access to those APIs.
I can't help you with the C++ related part of this problem, because I'm working in Delphi. I do have all those APIs running in Delphi, and they work perfectly fine. I'm using dynamic linking (calling LoadLibrary + GetProcAddress).
But as jkr already pointed out, it's not very probable, that those Nt* APIs are buggy themselves, if the problem is related to those APIs, then the caller of those APIs makes something wrong...

Regards, Madshi.
0
 
LVL 86

Expert Comment

by:jkr
ID: 6471974
>>I?m be very grateful if you could tell me where to get
>>this and what to do with it

It comes with the DDK - http://www.microsoft.com/hwdev/ddk/

But, if you keep up with the approach made in http://www.codeguru.com/win32/ntparent.shtml , you don't need an import library...
0
 
LVL 20

Expert Comment

by:Madshi
ID: 6473322
Does it really come with the DDK? I know some of the Nt* APIs are defined there, but I always thought, only a few. Most of them are not included there, or am I wrong?
0
 

Author Comment

by:Plague1392
ID: 6473647
Thanks a lot to both of you for your help.  I don't know who to give the points to since you were both very helpful.  I suppose I'll just have to choose randomly.

Thanks again.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article describes how to programmatically preset the "Pages per Sheet" option that's available with most printer drivers.   This setting lets you do "n-Up" printing, where two, four, or more pages are printed on each sheet of paper. If your …
Entering time in Microsoft Access can be difficult. An input mask often bothers users more than helping them and won't catch all typing errors. This article shows how to create a textbox for 24-hour time input with full validation politely catching …
This Micro Tutorial will give you a basic overview how to record your screen with Microsoft Expression Encoder. This program is still free and open for the public to download. This will be demonstrated using Microsoft Expression Encoder 4.
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now