Question

I have a strange problem that i didn’t encounter before i must mention that my main programming language is delphi not c++ and i might do a stupid mistake and don’t realise it.

I have the following code :

ULONG myret;
PROCESS_BASIC_INFORMATION PRC;
...
NtQueryInformationProcess(hProcess,ProcessBasicInformation,(PVOID)(&PRC),sizeof(PROCESS_BASIC_INFORMATION),(PULONG)(&myret));
...

I get the following error message :

GetCommandArgs.obj : error LNK2019: unresolved external symbol
_NtQueryInformationProcess@20 referenced in function _wmain

What is the problem ? Thanks very much.

Answer 1

This is by design. Microsoft wasn’t very happy about having to document the function, forced to by the Department of Justice settlement. It is clearly spelled out in the MSDN article for it:

The NtQueryInformationProcess function and the structures that it
returns are internal to the operating system and subject to change
from one release of Windows to another. To maintain the compatibility
of your application, it is better to use public functions mentioned in
the description of the ProcessInformationClass parameter instead.

If you do use NtQueryInformationProcess, access the function through
run-time dynamic linking. This gives your code an opportunity to
respond gracefully if the function has been changed or removed from
the operating system. Signature changes, however, may not be
detectable.

This function has no associated import library. You must use the
LoadLibrary and GetProcAddress functions to dynamically link to
Ntdll.dll.

The last line tells you what you have to do. The first line tells you why you shouldn’t.