CODEWITHSUNDEEP
cwindowswinapint
Mehrdad Bahri
Mehrdad Bahri

Reputation: 718

How to add ntdll.dll to project libraries with LoadLibrary() and GetProcAddress() functions?

I want to get the thread's start address with NtQueryInformationThread, but I need to add its library. How can I do that?

Upvotes: 3

Views: 5379

Answers (2)

Sergey Podobry
Sergey Podobry

Reputation: 7199

I prefer adding ntdll.lib (you can find it in Windows DDK/WDK) to a project. In that case you don't need GetProcAddress stuff.

Upvotes: 5

Adam Sznajder
Adam Sznajder

Reputation: 9216

I used NtQueryInformationThread without any need of loading ntdll (which in my opinion is loaded automatically). I had only to prepare a special header file with such content: http://pastebin.com/ieEqR0eL and include it in my project. After that I was able to do something like this:

NTSTATUS status;
THREAD_BASIC_INFORMATION basicInfo;
typedef NTSTATUS ( WINAPI *NQIT )( HANDLE, LONG, PVOID, ULONG, PULONG );

/* Open thread */
HANDLE thread = OpenThread(THREAD_ALL_ACCESS, false, threadId);
/* Get the address of NtQueryInformationThread function. */ 
NQIT NtQueryInformationThread = ( NQIT )GetProcAddress( GetModuleHandle(TEXT("ntdll.dll")), "NtQueryInformationThread" );
/* Get basic thread information */
status = NtQueryInformationThread(thread, 0, &basicInfo, sizeof(basicInfo), NULL);
CloseHandle(thread);

/* Get address of the Thread Environment Block, stack start address and last stack address */
tebAddress = (DWORD)basicInfo.TebBaseAddress;
DWORD pebAddress = *((DWORD*)(tebAddress+0x30));
/* For example to get stack base address */
stackBase = *((DWORD*)(tebAddress+4));
stackLimit = *((DWORD*)(tebAddress+8));

Upvotes: 4

Related Questions