Question

I need to call RtlQueryProcessHeapInformation in Delphi.
RtlQueryProcessHeapInformation is a function exported from ntdll.dll.
I don’t have a prototype for this function. I get “Undeclared identifier” error.

asm 
 ...
 xchg ebx, eax
 pop ebp
 call RtlQueryProcessHeapInformation
 dec ebp
 ...
end;

Thank you for your help.

Answer 1

A bit of websearch leads to this page or this one which indicate that the function looks like this:

NTSTATUS NTAPI RtlQueryProcessHeapInformation( 
    IN OUT PRTL_DEBUG_INFORMATION Buffer 
);

You already know what NTSTATUS from your previous question. As for NTAPI, that’s __stdcall. So that means the function declaration in Delphi is:

function RtlQueryProcessHeapInformation(
    Buffer: PRTL_DEBUG_INFORMATION
): NTSTATUS; stdcall; external 'ntdll.dll';

The page I link to also includes a declaration for PRTL_DEBUG_INFORMATION and I’m sure you can translate that yourself. You’ll still have to reverse engineer what the parameters mean since this is an implementation private, undocumented function.

---

This is the second question that you have asked that has been almost identical. In both questions you present the question as being an assembler question. But it’s not. In both questions you needed to work out the declaration of the function, and how to import it from the external DLL. What you should take away from this is that when you need to call a function in another DLL you can do one of two things:

1. Import it implicitly with the external code that I have shown in both your questions. This is the simpler approach.
2. Use LoadLibrary and GetProcAddress to explicitly import it. This is the more laborious approach.

Please don’t take this the wrong way – I’m just trying to show you what you need to know to be able to solve such problems for yourself.