Re: What do ZwXXX and RtlXXX functions link against?

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Doron Holan [MS] (doronh_at_nospam.microsoft.com)
Date: 04/23/04 

Date: Thu, 22 Apr 2004 21:53:06 -0700

link /dump /exports <binary> will also tell you all of the imports you are
making.

d 

-- 
This posting is provided "AS IS" with no warranties, and confers no rights.
Please reply to newsgroups only.
"Peter Wieland [MSFT]" <peterwie@online.microsoft.com> wrote in message
news:up88lKKKEHA.620@TK2MSFTNGP10.phx.gbl...
> Both sets of functions are exported from the kernel.  You might try using
> depends.exe to make sure you're getting the exports from ntoskrnl.exe
rather
> than ntdll.dll (which may not be available when the kernel loads yoru
> driver)
>
> -p
>
> -- 
> This posting is provided "AS IS" with no warranties, and confers no
rights.
> "Brian Minier" <brian_minier@no-spam.iisvr.com> wrote in message
> news:uskgjwJKEHA.2660@TK2MSFTNGP09.phx.gbl...
> > Ok, so I'm calling a ZwXXX or an RtlXXX  function in a kernel mode dll.
> > I'de like to know what happens when I do that?  What I'm seeing is this,
> > if
> > I don't include either of those functions (basically call no functions)
> > than
> > my display driver is able to do an EngLoadImage successfull on the dll.
> > If
> > however I include either an Zw or Rtl funciton, the EngLoadImage call
> > fails.
> > This is very perplexing and I've been looking at this and just cant get
> > it.
> >
> > Can anyone help
> >
> >
>
>

Relevant Pages