Stack Overflow
Stack Overflow

Questions tagged [ntdll]

NtDll.dll is the Windows system DLL exposing the Native API to user mode.

NtDll.dll is the Windows system DLL exposing the (Windows) Native API to user mode.

155 questions
3
votes
0 answers

How to solve ntdll.dll!RtlpLogHeapFailure() in Visual Studio 2015?

I am currently working on an AI project. It's about that puzzle you need to move the board pieces numbered from 1 to 8 (and the empty space is labelled as 0) in order to let it sorted at the end. However I got a weird problem when I try to debug…
stamblew
  • 138
  • 1
  • 11
3
votes
2 answers

Get filename by process

I'm trying to retrieve the filename of a current process. ie: If i have the file "test.txt" opened in Notepad, I need to get something like "c:\folder\test.txt" The code below returns process informations, including the software path. (ie:…
Andre Felipe
  • 169
  • 1
  • 7
3
votes
2 answers

Why can't get process id that more than 65535 by 'ntQuerySystemInformation' in Win7 64bit?

I used the 'ntQuerySystemInformation' to get all the handle information like: NtQuerySystemInformation(SystemHandleInformation, pHandleInfor, ulSize,NULL);//SystemHandleInformation = 16 struct of pHandleInfor is: typedef struct…
cyongji
  • 31
  • 2
3
votes
1 answer

getting a list of kernel objects windows

HI! I bet more than a week and I can not form a complete picture of how you can get a list of kernel objects .My algorithm is as follows : 1) Connecting NTDLL.dll (LoadLibrary) 2) GetProcAddress (variable_Library_name,…
Sleeeper
  • 179
  • 1
  • 9
3
votes
1 answer

Java program runnin in Eclipse causes EXCEPTION_ACCESS_VIOLATION (0xc0000005)

I'm experiencing a problem with a Java application running in Eclipse. At arbitrary times during execution, the application crashes with the following error and dump. Some further information that may help: the errors first started occurring after…
phex
  • 104
  • 3
  • 10
3
votes
1 answer

Delphi - Exception in ntdll.dll on closing after both connection to Oracle and calling a web service method

In Delphi 2009 I'm finding that any time I do perform both a connection to Oracle (via OCI.dll) and a call to a web service method I get an exception in ntdll.dll when closing my application in the IDE. For the connection to Oracle I tried using…
Marco
  • 51
  • 5
2
votes
1 answer

StyleCop 4.7 crashing in Visual Studio 2010

Morning, I don't know if anyone else has experienced the following. Up until this morning my Windows 7/Visual Studio 2010 Ultimate/StyleCop 4.7.11.0 setup was working fine. However when I booted my PC this morning, started Visual Studio 2010 and…
mminns
  • 41
  • 1
  • 2
  • 10
2
votes
1 answer

Control Flow Guard Exception When Using Outlook Object Model

We're seeing multiple clients of ours experiencing outlook crashing after upgrading Outlook to any of the November 9th updates across at least two of the update channels (Monthly Enterprise 2209 (15629.20258) and Semi-Annual Enterprise: 2202…
Corith Malin
  • 1,505
  • 10
  • 18
2
votes
1 answer

Process not suspending (NtSuspendProcess) -> What is going on?

I have adapted a 32-bit memory scanner in C# to 64-bit. Before scanning a program (read: live program), it is supposed to suspend the process. I am using NtSuspendProcess at this point to attempt to achieve this end. The funny thing is, I have this…
user3799003
  • 21
  • 7
2
votes
0 answers

IO_STATUS_BLOCK reference

When calling functions in ntdll.dll it sometimes returns an IO_STATUS_BLOCK e.g. NtCreateFile: MSDN. I however am not able to find a reference to, for example a table, what any of the returned values mean. When calling a function such as…
Gertjan Brouwer
  • 996
  • 1
  • 12
  • 35
2
votes
0 answers

External dll SEHException ntdll crash

Patient is a C# application compiled using VS 2008. Application runs on multiple client computers using Windows 7 64bit and Windows 10 Pro 64. On June 11 they reported problems with application, probably after some windows update or another…
MattW
  • 21
  • 1
2
votes
1 answer

c# - Trouble with a pointer of an array of structures

I want to get the infos about the perfomance of each processor by using NtQuerySystemInformation from ntdll. Now i have the problem that it just runs trough all 5 tries and then returns. NtQuerySystemInformation returns a NtStatus which is always…
Tom
  • 194
  • 1
  • 1
  • 8
2
votes
0 answers

Hooking dll loaded to memory

I'm trying to write a program, which will catch the event of a dll load into memory. For that purpose I put a hook on LdrLoadDll API. That works very fine, but the problem is that this API doesn't catch dlls which loaded as dependencies. For…
macro_controller
  • 1,469
  • 1
  • 14
  • 32
2
votes
0 answers

Finding who calls a system function

I have a C++ application, developed with VisualStudio 2015 (update 2). Profiling with AMD Code XL shows that the program spends almost 20% of its time in the function RtlUpcaseUnicodeToMultiByteN, from the module ntdll.dll. Apparently it converts…
Francesco Dondi
  • 1,064
  • 9
  • 17
2
votes
0 answers

Hello World with direct system calls under Windows. Without ntdll.dll, kernel32.dll, ... Any solution?

To make the question more clear I will post a short example for Linux 32 bit. void _start() { const char text[] = "hello world\n"; long rv = 0; long exit_code = 0; // write system call to standard output asm volatile ("push %%ebx ;…
user1047271
  • 311
  • 2
  • 9
1
2
3
…
10 11