S
S
sddvxd2018-06-23 20:07:16
C++ / C#
sddvxd, 2018-06-23 20:07:16

When compiling undefined reference to?

Hello
, I am trying to find out the address of a function from an NtDLL module:

pOrigMBAddress_1 = (pNtCreateFile)
       GetProcAddress(GetModuleHandle("NtDLL.dll"),               // get address of original
               "NtCreateFile");

The compiler issues
С:\Users\...main.cpp:(.text+0x394): undefined reference to 'NtCreateFile'
collect2.exe: error: id returned 1 exit status

Also, there are such lines in the code, the compiler does not swear at them (the address of the function is located)
pOrigMBAddress_2 = (pMoveFileExW)
         GetProcAddress(GetModuleHandle("Kernel32.dll"),               // get address of original
                 "MoveFileExW");

Answer the question

In order to leave comments, you need to log in

1 answer(s)
J
jcmvbkbc, 2018-06-24
@jcmvbkbc

Here is this piece of code in the MyNtCreateFile function:

retValue = NtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize,
                            FileAttributes, ShareAccess, CreateDisposition, CreateOptions,
                            EaBuffer, EaLength);       // get return value of original function

Directly accesses NtCreateFile. Of course, this will not link without implib for ntdll.
Why not use the address obtained through GetProcAddr instead of a direct call to the function?

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question