我正在接触NtCreateFile函数,但我不是因为一些错误。我的代码是 如下所示.am得到两个错误 1)未解析的外部符号_NtCreateFile和 2)1个未解决的外部。 请帮帮我。
#include "stdafx.h"
#include "MinHook.h"
#include <Winternl.h>
#if defined _M_X64
#pragma comment(lib, "libMinHook.x64.lib")
#elif defined _M_IX86
#pragma comment(lib, "libMinHook.x86.lib")
#endif
typedef NTSTATUS(WINAPI *NtCreateFileNext)(PHANDLE FileHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes,
PIO_STATUS_BLOCK IoStatusBlock,PLARGE_INTEGER AllocationSize,ULONG FileAttributes,
ULONG ShareAccess,ULONG CreateDisposition,ULONG CreateOptions,PVOID EaBuffer,ULONG EaLength);
NtCreateFileNext Real_NtCreateFileData = NULL;
NTSTATUS WINAPI NtCreateFileCallback(PHANDLE FileHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes,
PIO_STATUS_BLOCK IoStatusBlock,PLARGE_INTEGER AllocationSize,ULONG FileAttributes,
ULONG ShareAccess,ULONG CreateDisposition,ULONG CreateOptions,PVOID EaBuffer,ULONG EaLength)
{
MessageBoxA(NULL,"NtCreateFile Called","Info",MB_OK);
return(FileHandle, DesiredAccess, ObjectAttributes,IoStatusBlock, AllocationSize, FileAttributes,
ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
}
BOOL APIENTRY DllMain(HMODULE hModule,DWORD ul_reason_for_call,LPVOID lpReserved)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
if (MH_CreateHook(&NtCreateFile, &NtCreateFileCallback, reinterpret_cast<void**>(&Real_NtCreateFileData)) != MH_OK)
{
MessageBoxW(NULL,L"Failed CreateHook NtCreateFile",L"Info!",MB_ICONWARNING|MB_OK);
}
if (MH_EnableHook(&NtCreateFile) != MH_OK)
{
MessageBoxW(NULL,L"Failed EnableHook NtCreateFile",L"Info!",MB_ICONWARNING|MB_OK);
}
break;
case DLL_PROCESS_DETACH:
if (MH_Uninitialize() != MH_OK)
{
}
if (MH_DisableHook(&NtCreateFile) != MH_OK)
{
}
break;
}
return TRUE;
}
先谢谢
答案 0 :(得分:1)
Kantesh:您需要获取Windows驱动程序工具包并在链接器/输入属性页中包含NtDll.lib作为附加依赖项.HTH的