1

I have a strange problem that i didn't encounter before i must mention that my main programming language is delphi not c++ and i might do a stupid mistake and don't realise it.

I have the following code :

ULONG myret;
PROCESS_BASIC_INFORMATION PRC;
...
NtQueryInformationProcess(hProcess,ProcessBasicInformation,(PVOID)(&PRC),sizeof(PROCESS_BASIC_INFORMATION),(PULONG)(&myret));
...

I get the following error message :

GetCommandArgs.obj : error LNK2019: unresolved external symbol _NtQueryInformationProcess@20 referenced in function _wmain

What is the problem ? Thanks very much.

opc0de
  • 11,557
  • 14
  • 94
  • 187

1 Answers1

7

This is by design. Microsoft wasn't very happy about having to document the function, forced to by the Department of Justice settlement. It is clearly spelled out in the MSDN article for it:

The NtQueryInformationProcess function and the structures that it returns are internal to the operating system and subject to change from one release of Windows to another. To maintain the compatibility of your application, it is better to use public functions mentioned in the description of the ProcessInformationClass parameter instead.

If you do use NtQueryInformationProcess, access the function through run-time dynamic linking. This gives your code an opportunity to respond gracefully if the function has been changed or removed from the operating system. Signature changes, however, may not be detectable.

This function has no associated import library. You must use the LoadLibrary and GetProcAddress functions to dynamically link to Ntdll.dll.

The last line tells you what you have to do. The first line tells you why you shouldn't.

Hans Passant
  • 922,412
  • 146
  • 1,693
  • 2,536