I'm investigating the Windows Native API now, Nt*/Zw*
methods. I downloaded the WDK, installed it and successfully compiled an application (x64, under Win 8.1 x64, VS2013). The only thing it does is a call to NtOpenFile()
.
To successfully compile/link it, I had to make the following changes to project properties (template Application For Drivers):
- Add includes folder from WDK
- Add Lib folder from WDK
- Tell linker to use ntoskrnl.lib
Unexpectedly, upon running a debugger, I'm presented with error message "The program can't start because C:\Windows\SYSTEM32\werkernel.sys is missing from your computer. Try reinstalling the program to fix this problem." The werkernel.sys obviously exists in system32\drivers.
EDIT: To be clear, the mentioned error also occurs when launching the app by doubleclicking the icon.
This load happens before any of my code, I can't find anything anywhere in internet nor in project properties on the file in question. So, to summarize, I have the following questions so far:
- Why werkernel.sys is being loaded at all for my application?
- Why is it being loaded from System32?
I understand that it is possible to mklink werkernel.sys drivers\werkernel.sys
, but it feels like I'm doing somethig terribly wrong.