Everhart, Glenn
From:	Vodicka, Michal [MVodicka@rkk.cz]
Sent:	Thursday, August 27, 1998 1:04 PM
To:	'ntdev@atria.com'; 'Samuel DELPLACE'
Subject:	RE: [ntdev] Linking pbs
NTDLL.DLL exports ZwQueryDirectoryFile, ZwQueryInformationFile and
ZwQueryDirectoryObject. NTOSRKNL.EXE contains all three functions but
doesn't export ZwQueryDirectoryObject (microsoft forgot it, send many
thanks there).

As a workaround you can look for this function code and simply implement
your own. It is easy:

ZwQueryDirectoryObject from NTOSKRNL.EXE:

	mov eax,66h		; system call number
	lea edx,[esp+4]		; pointer to parameters on stack
	int 2eh			; system call	
	ret 1ch			; clear parameters (7) from stack

Or you could find this function address (ZwQueryDirectoryFile + 10h) and
call it via pointer.

BTW, NTDLL.DLL doesn't implement Win32 functions but NT native
functions. User mode != Win32.

Best regards,

Michal Vodicka
RKK Informationssysteme s r.o.
:We support your  Future

> ----------
> From: 	Samuel DELPLACE[SMTP:S.DELPLACE@archimed.fr]
> Sent: 	Thursday, August 27, 1998 9:01 AM
> To: 	'Vodicka, Michal'; 'ntdev@atria.com'
> Subject: 	RE: [ntdev] Linking pbs
> 
> Ok, but in NTDLL.LIB you can found ZwQueryDirectoryFile,
> ZwQueryInformationFile... but there isn't ZwQueryDirectoryFile.
> This function is only in the NTDLL.LIB.
> So my question is : Is it only a Win32 function ?
> 
> ----------------------------------------------------------------
>                    Samuel DELPLACE
>        Software and Computer Graphics Engineer      
>  Archimed - 2 place du concert - 59800 Lille - France
> Tél : (33) 03 20 13 10 60 - FAX : (33) 03 20 13 10 70
>             Url : http://www.archimed.fr
>            E-Mail : S.Delplace@archimed.fr
> ----------------------------------------------------------------
> 
> > -----Original Message-----
> > From:	Vodicka, Michal [SMTP:MVodicka@rkk.cz]
> > Sent:	Wednesday, August 26, 1998 8:32 PM
> > To:	'ntdev@atria.com'; 'Samuel DELPLACE'
> > Subject:	RE: [ntdev] Linking pbs
> > 
> > You have to link driver it with NTOSKRNL.LIB. NTDLL.LIB is for user
> > mode
> > applications.
> > 
> > Best regards,
> > 
> > Michal Vodicka
> > RKK Informationssysteme s r.o.
> > :We support your  Future
> > 
> > > ----------
> > > From: 	Samuel DELPLACE[SMTP:S.DELPLACE@archimed.fr]
> > > Sent: 	Wednesday, August 26, 1998 10:25 AM
> > > To: 	'ntdev@atria.com'
> > > Subject: 	[ntdev] Linking pbs
> > > 
> > > Hello everyone,
> > > 
> > > I've done a driver that uses the function ZwQueryDirectoryObject
> > > that is define in ntdll.lib.
> > > So I've done a "source" file that includes this lib.But when I
> start
> > > my
> > > driver
> > > on my target computer, the system said to me that it can't load my
> > > driver
> > > because the adress of the function wasn't found in the DLL
> > > (NTDLL.DLL).
> > > I've looked in the NTDLL.DLL and I've found the
> > ZwQueryDirectoryObject
> > > entry.
> > > My target computer is running under NT 4 Service Pack 3.
> > > And SP3 changes the NTDLL.DLL.
> > > I've done the test with a debug and release driver.
> > > Perhaps my NT DDK is a old version (what is the latest version ?)
> > > 
> > > Any idea ?
> > > 
> > > Thx in adv,
> > > 
> > > Samuel
> > > 
> > > ----------------------------------------------------------------
> > >                    Samuel DELPLACE
> > >        Software and Computer Graphics Engineer      
> > >  Archimed - 2 place du concert - 59800 Lille - France
> > > Tél : (33) 03 20 13 10 60 - FAX : (33) 03 20 13 10 70
> > >             Url : http://www.archimed.fr
> > >            E-Mail : S.Delplace@archimed.fr
> > > ----------------------------------------------------------------
> > > 
> > >  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> > > [ To unsubscribe, send email to ntdev-request@atria.com with body
> > > UNSUBSCRIBE (the subject is ignored). ]
> > > 
>  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> [ To unsubscribe, send email to ntdev-request@atria.com with body
> UNSUBSCRIBE (the subject is ignored). ]
> 
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[ To unsubscribe, send email to ntdev-request@atria.com with body
UNSUBSCRIBE (the subject is ignored). ]