[grechkoed]

Hello!

I'm writing windows driver and want to use undocumented function from ntoskrnl.lib (PsSuspendProcess). (I know that it's not the best thing to do, but nevertheless I want to try)
So I declared it by myself:

Code: Select all

NTSTATUS
PsSuspendProcess(
	IN PEPROCESS Process
);

Found it in ntoskrnl.lib: dumpbin.exe /EXPORTS .\ntoskrnl.lib

Code: Select all

Dump of file .\ntoskrnl.lib

File Type: LIBRARY

     Exports
...
                  PsSuspendProcess
...

Also I added this file into Visual Studio project. Path to the library directory (C:\Program Files (x86)\Windows Kits\10\Lib\10.0.15063.0\km) was already in the project properites. But I got this error while compiling driver:

Code: Select all

unresolved external symbol "long __cdecl PsSuspendProcess(struct _KPROCESS *)"

So, what am I doing wrong?

[raiden]

Add extern "C" __declspec(dllimport) and calling convention to your definition, something like this:

Code: Select all

extern "C"
NTSYSAPI
NTSTATUS
NTAPI
PsSuspendProcess (
  PEPROCESS Process
);

[Vrtule]

Hello,

what about something like this?

Code: Select all

__declspec(dllimport) NTSTATUS
PsSuspendProcess(
   IN PEPROCESS Process
);

The project should automatically link against ntoskrnl.lib since you can hardly avoid using any of its routines.

I would recommend you, howerver, to find this symbol dynamically (MmGetSystemRoutineAddress) because you have no guarantee that it stays exported in the future (or is exported by all ntoskrnl.exe you wish to support). You are currently using ntoskrnl.lib for Windows 10.

[grechkoed]

Thanks guys!

The problem was that source file name was Source.cpp not Source.c, So as I think compiler tried to find mangled name. Probably your solutions will work too.

[tangptr]

If you are writing C code in *.cpp file, you may specify "/TC" parameter for cl to inform compiler to compile it into C code regardless of the file extension name. Likewise, you may specify "/TP" parameter for cl to inform compiler to compile it into C++ code regardless of the file extension name. In some cases, something like "extern C" could be unnecessary to use. This could be set via Visual Studio(Properties -> C/C++ -> Advanced -> Compile As,) but I, considering that I could specify definitions of macros and other advanced user-defined parameters for different source code files when compiling, prefer using Batch in spite of the complicated operation.

When declaring functions from other libraries, you should specify "__declspec(dllimport)"(__declspec, i.e, Declaration Specified). To make it looks more like designed for kernel-mode driver, you may specify "NTKERNELAPI" before "NTSTATUS".
FOR EXAMPLE:
NTKERNELAPI NTSTATUS PsSuspendProcess(IN PEPROCESS Process);