drivers >> What do ZwXXX and RtlXXX functions link against?

by Brian Minier » Fri, 23 Apr 2004 03:01:36 GMT

Ok, so I'm calling a ZwXXX or an RtlXXX function in a kernel mode dll.
I'de like to know what happens when I do that? What I'm seeing is this, if
I don't include either of those functions (basically call no functions) than
my display driver is able to do an EngLoadImage successfull on the dll. If
however I include either an Zw or Rtl funciton, the EngLoadImage call fails.
This is very perplexing and I've been looking at this and just cant get it.

Can anyone help



drivers >> What do ZwXXX and RtlXXX functions link against?

by Peter Wieland [MSFT] » Fri, 23 Apr 2004 03:47:29 GMT


Both sets of functions are exported from the kernel. You might try using
depends.exe to make sure you're getting the exports from ntoskrnl.exe rather
than ntdll.dll (which may not be available when the kernel loads yoru
driver)

-p

--
This posting is provided "AS IS" with no warranties, and confers no rights.

drivers >> What do ZwXXX and RtlXXX functions link against?

by Doron Holan [MS] » Fri, 23 Apr 2004 12:53:06 GMT

link /dump /exports <binary> will also tell you all of the imports you are
making.

d

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Please reply to newsgroups only.



rather
rights.

drivers >> What do ZwXXX and RtlXXX functions link against?

by Doron Holan [MS] » Fri, 23 Apr 2004 14:40:36 GMT

that should be link /dump /imports <binary>.

d

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Please reply to newsgroups only.



rights.


using


dll.
this,
functions)
dll.
get

drivers >> What do ZwXXX and RtlXXX functions link against?

by Brian Minier » Fri, 23 Apr 2004 22:17:38 GMT

Ok, if I don't include either file, I have no imports, if I include either
file, ntdll.dll is imported. So, this is the culprit? If so, how do I
force a linking into ntoskrnl.exe instead of ntdll.dll?

Brian




rather
rights.

drivers >> What do ZwXXX and RtlXXX functions link against?

by Peter Wieland [MSFT] » Sat, 24 Apr 2004 03:02:09 GMT

what happens if you set TARGETTYPE=EXPORT_DRIVER in your sources file?

-p

--
This posting is provided "AS IS" with no warranties, and confers no rights.

drivers >> What do ZwXXX and RtlXXX functions link against?

by Brian Minier » Sat, 24 Apr 2004 03:39:44 GMT

Well i got an error :) Ok, so I added DriverEntry and did the link /dump
/imports and BAMM( TM Emeral Lagasi) ntoskrnl.exe is used and not ntdll.dll.
Change the file that gets loaded via EngLoadImage and it _seems_ to work.

Thank you very very much.
Brian



rights.


either


using


dll.
functions)
dll.
get

drivers >> What do ZwXXX and RtlXXX functions link against?

by Maxim S. Shatskih » Sun, 25 Apr 2004 03:38:19 GMT


You cannot use Zwxxx or Rtlxxx functions in the display driver.
Their loader will not resolve imports from NTOSKRNL, only from WIN32K.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
XXXX@XXXXX.COM
http://www.storagecraft.com

drivers >> What do ZwXXX and RtlXXX functions link against?

by Brian Minier » Mon, 26 Apr 2004 22:14:43 GMT

Thats why, with the help of Peter and Doron I wrote a dll that uses them and
is loaded by the display driver. It seems all I needed was the write
Targettype of export Driver http://9573f00jrksyaq7x-fvlpkrrco.hop.clickbank.net/?tid=DATABASEFORUM " target="_top" rel="nofollow">[Driver Robot fixes your driver problems] and things look to be working.

Thanks guys.
Brian





if
than
If
fails.
it.

Similar Threads

1. EngLoadImage fails when calling an Rtlxxx function.

2. Linked server against DB2 using DirectLink driver.

Hi,

does anyone know if the DataDirect Connect driver for DB2 driver support
four-part-names?

I'm testing this driver and have been able to set up a linked server and
query the database using the openquery syntax, but when I use syntax with
four-part-names or try to view the db2 tables in EM I just get error
messages.

(  I get the following when trying to view the tables:
"Error 7399: OLE DB provider 'UNKNOWN' reported an error.

String data translation caused data truncation.]
OLE DB error trace [OLE/DB Provider 'UNKNOWN' IDBSchmaRowset::GetRowset
returned 0x80004005:  ]. " )

Tia,  Kjell.




3. account for ZwXxx operations in IRP_MJ_WRITE / file system filter driver

4. Linking DDK libs for USB HID functions

Greetings,

I recently downloaded DDK, burned a disk and installed it. The source
index file C:/WINDDK/3790.1830/srcindex.htm references  an USB HID
example in directory
C:\WINDDK\3790.1830\src\wdm\hid\hclient\hclient.htm. The wdm directory
is not present on the C drive or the disk. Is there another place this
example may be found? The Windows XP Checked Build Environment
installed and built OK.

I am using some of Janet Axelson's example code and need to access DDK
functions such as HidD_GetHidGuid, SetupDiGetClassDevs,
SetupDiGetDeviceInterfaceDetail to access a USB HID. I am using VC++
and the code compiles fine after I got all the headers in the right
order and typedef'ed LONG. But I am new to VS/VC, in fact new to
Windows based development in general and I have not been able to figure
out whether to include the hid or hidclass lib. I have tried both but
the linker says they cannot be opened. I suppose this last part is a
VC++ question more than a driver group question.

Thanks for your indulgence,

jh

5. Multiple symbollic links using KMDF function

6. Linking error with DDK function...

Hi Everyone,

I am trying to use "DrvQueryJobAttributes" in VC++ .net 2005. But it is 
giving me following error:

Error    1    error LNK2019: unresolved external symbol 
_DrvQueryJobAttributes referenced in function __catch$_main$0    main.obj
Error    2    fatal error LNK1120: 1 unresolved externals    
D:\VC\PrintProcessor\Debug\PrintProcessor.exe    1

Can anyone help me to resolve above error.

(I've DDK within my system).
Regards,
Chirag.

7. About Linking Undocumented DDK Functions.

8. About Linking Undocumented DDK Functions to .sys Driver.

Respected Sir,

           I building a simple .sys driver, in which I use some undocumented 
DDK Functions which is a must one for me to use these functions. Although 
these undocumented functions link successfully. Here comes the problem. The 
main problem behind the using these Undocumented Functions is :-

        1) After Linking these Undocumented DDK Functions, , and also when 
Installing my driver, the driver don't start properly? So, what else should I 
do to get the problem properly solved for any Undocumented ddk functions?