-
Notifications
You must be signed in to change notification settings - Fork 22
Open
Description
Basically similar issue to this https://stackoverflow.com/questions/7051558/ntqueryinformationprocess-wont-work-in-visual-studio-2010
The reason was due to linking an internal API (ie. Ntdll.dll) directly, where internal APIs are subject to change from one release of Windows to the next.
| NtQueryInformationProcess(Process, ProcessBasicInformation, &BasicProcessInfo, sizeof(BasicProcessInfo), nullptr); |
Best practice is by importing it dynamically using GetProcAddress.
For example:
typedef NTSTATUS(NTAPI* TFNNtQueryInformationProcess)(
IN HANDLE ProcessHandle,
IN PROCESSINFOCLASS ProcessInformationClass,
OUT PVOID ProcessInformation,
IN ULONG ProcessInformationLength,
OUT PULONG ReturnLength OPTIONAL
);
TFNNtQueryInformationProcess pfnNtQueryInformationProcess = nullptr;
pfnNtQueryInformationProcess = (TFNNtQueryInformationProcess)GetProcAddress(GetModuleHandle(TEXT("Ntdll.dll")), "NtQueryInformationProcess");
if (!pfnNtQueryInformationProcess) {
// Experimental only, should probably print this on the debug output and fallback to another version of NtQueryInformationProcess (if any)
MessageBox(NULL, TEXT("Failed to get NtQueryInformationProcess"), TEXT("Error"), MB_OK);
}Metadata
Metadata
Assignees
Labels
No labels