怎样调用ZwQuerySystemInformation还需要

[adu699]

在内核级使用ZWQuerySystemInformation需要链接特别的头文件或库吗，还是特殊什么声明。老是报error LNK2019: unresolved external symbol "__declspec(dllimport) long __stdcall ZwQuerySystemInformation(enum _SYSTEM_INFORMATION_CLASS,void *,unsigned long,unsigned long *)" (__imp_?ZwQuerySystemInformation@@YGJW4_SYSTEM_INFORMATION_CLASS@@PAXKPAK@Z) referenced in function "long __stdcall EnumProcess(void)" (?EnumProcess@@YGJXZ)objchk\i386\forbidqq.sys() : error LNK1120: 1 unresolved externals

有那位高手给看一下。跨求答案！源代码如下：
//-------------------------1.h头文件----------------------------
#pragma once

#ifdef __cplusplus

extern "C"
{
#endif
#include <ntddk.h>
#ifdef __cplusplus
}
#endif

#define PAGEDCODE code_seg("PAGE")
#define LOCKEDCODE code_seg()
#define INITCODE code_seg("INIT")

#define PAGEDDATA data_seg("PAGE")
#define LOCKEDDATA data_seg()
#define INITDATA data_seg("INIT")


#define DWORD unsigned long
#define BOOL int

//---------系统信息结构---------
typedef enum _SYSTEM_INFORMATION_CLASS {
SystemBasicInformation,
SystemProcessorInformation,
SystemPerformanceInformation,
SystemTimeOfDayInformation,
SystemNotImplemented1,
SystemProcessesAndThreadsInformation,
SystemCallCounts,
SystemConfigurationInformation,
SystemProcessorTimes,
SystemGlobalFlag,
SystemNotImplemented2,
SystemModuleInformation,
SystemLockInformation,
SystemNotImplemented3,
SystemNotImplemented4,
SystemNotImplemented5,
SystemHandleInformation,
SystemObjectInformation,
SystemPagefileInformation,
SystemInstructionEmulationCounts,
SystemInvalidInfoClass1,
SystemCacheInformation,
SystemPoolTagInformation,
SystemProcessorStatistics,
SystemDpcInformation,
SystemNotImplemented6,
SystemLoadImage,
SystemUnloadImage,
SystemTimeAdjustment,
SystemNotImplemented7,
SystemNotImplemented8,
SystemNotImplemented9,
SystemCrashDumpInformation,
SystemExceptionInformation,
SystemCrashDumpStateInformation,
SystemKernelDebuggerInformation,
SystemContextSwitchInformation,
SystemRegistryQuotaInformation,
SystemLoadAndCallImage,
SystemPrioritySeparation,
SystemNotImplemented10,
SystemNotImplemented11,
SystemInvalidInfoClass2,
SystemInvalidInfoClass3,
SystemTimeZoneInformation,
SystemLookasideInformation,
SystemSetTimeSlipEvent,
SystemCreateSession,
SystemDeleteSession,
SystemInvalidInfoClass4,
SystemRangeStartInformation,
SystemVerifierInformation,
SystemAddVerifier,
SystemSessionProcessesInformation
} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;
//------------------------------

//---------线程信息结构---------
typedef struct _SYSTEM_THREAD {
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER CreateTime;
ULONG WaitTime;
PVOID StartAddress;
CLIENT_ID ClientId;
KPRIORITY Priority;
LONG BasePriority;
ULONG ContextSwitchCount;
ULONG State;
KWAIT_REASON WaitReason;
} SYSTEM_THREAD, *PSYSTEM_THREAD;
//------------------------------

//---------进程信息结构---------
typedef struct _SYSTEM_PROCESS_INFORMATION {
ULONG NextEntryOffset; //NextEntryDelta 构成结构序列的偏移量
ULONG NumberOfThreads; //线程数目
LARGE_INTEGER Reserved[3];
LARGE_INTEGER CreateTime; //创建时间
LARGE_INTEGER UserTime; //用户模式(Ring 3)的CPU时间
LARGE_INTEGER KernelTime; //内核模式(Ring 0)的CPU时间
UNICODE_STRING ImageName; //进程名称
KPRIORITY BasePriority; //进程优先权
HANDLE ProcessId; //ULONG UniqueProcessId 进程标识符
HANDLE InheritedFromProcessId; //父进程的标识符
ULONG HandleCount; //句柄数目
ULONG Reserved2[2];
ULONG PrivatePageCount;
VM_COUNTERS VirtualMemoryCounters; //虚拟存储器的结构
IO_COUNTERS IoCounters; //IO计数结构
SYSTEM_THREAD Threads[1]; //进程相关线程的结构数组
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;

//typedef SYSTEM_PROCESSES SYSTEM_PROCESS_INFORMATION;
//typedef PSYSTEM_PROCESSES PSYSTEM_PROCESS_INFORMATION;
//MSDN此结构定义在SDK的winternl.h中，以上部分信息未文档化
//_SYSTEM_PROCESS_INFORMATION = _SYSTEM_PROCESSES
//------------------------------

//---------函数声明-------------

/*NTSYSAPI
NTSTATUS
NTAPI*/
NTKERNELAPI
NTSTATUS
NtQuerySystemInformation(IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
OUT PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength OPTIONAL);
//------------------------------


//--------------------------------1.cpp--------------------------

#include "1.h"

#pragma comment (lib,"ntdll.lib")

//---------列举进程---------
#pragma PAGEDCODE
NTSTATUS EnumProcess()
{
int iCount = 1; //进程计数
NTSTATUS status; //返回值
PVOID pSi = NULL; /*指向SystemInformationClass的指针，此处为SystemProcessesAndThreadsInformation，即我们所要获取的信息*/
PSYSTEM_PROCESS_INFORMATION pSpiNext = NULL; //同上
ULONG uSize; //pSi的大小，以BYTE为单位
ULONG pNeededSize = 0; //系统返回所需长度，因在WIN2000下不会返回，故不使用，设置为0
BOOL bOver = FALSE; //标识是否列举完成

//设定pSi大小uSize初始为32K，并为pSi分配uSize的内存，根据返回值逐步累加uSize，步长为32K
for (uSize = 0x8000; ((pSi = ExAllocatePoolWithTag(NonPagedPool, uSize, 'tag1')) != NULL); uSize += 0x8000)
{
//检索指定的系统信息，这里是有关进程的信息
status = NtQuerySystemInformation(SystemProcessesAndThreadsInformation,
pSi,
uSize,
&pNeededSize);
if (STATUS_SUCCESS == status) //NtQuerySystemInformation返回成功
{
DbgPrint("[Aliwy] SUCCESS uSize = 0x%.8X, pNeededSize = 0x%.8X, status = 0x%.8X\n", uSize, pNeededSize, status);
pSpiNext = (PSYSTEM_PROCESS_INFORMATION)pSi; /*使用pSpiNext操作，pSi要留到后面释放所分配的内存*/
while (TRUE)
{
if (pSpiNext->ProcessId == 0)
{
DbgPrint("[Aliwy] %d - System Idle Process\n", pSpiNext->ProcessId); /*进程标识符为0的是System Idle Process，需手动标明*/
}
else
{
DbgPrint("[Aliwy] %d - %wZ\n", pSpiNext->ProcessId, &pSpiNext->ImageName); /*打印出进程标识符和进程名称*/
}
if (pSpiNext->NextEntryOffset == 0) //如果NextEntryOffset为0即表示进程已列举完
{
DbgPrint("[Aliwy] EnumProcess Over, Count is: %d\n", iCount);
bOver = TRUE; //标识进程列举已完成
break; //跳出列举循环（while循环）
}
pSpiNext = (PSYSTEM_PROCESS_INFORMATION)((ULONG)pSpiNext + pSpiNext->NextEntryOffset); //指向下一个进程的信息
iCount++; //计数累加
}
ExFreePool(pSi); //释放为sPi分配的内存
if (bOver) //进程列举完成
{
break; //跳出内存分配循环（for循环）
}
}
else
{
DbgPrint("[Aliwy] FAILURE uSize = %.8X, pNeededSize = %.8X, status = %.8X\n", uSize, pNeededSize, status);
}
}
return STATUS_SUCCESS;
}
//------------------------------

//---------DriverUnload---------
#pragma PAGEDCODE
VOID OnUnload( IN PDRIVER_OBJECT DriverObject )
{
DbgPrint("[Aliwy] OnUnload\n");
}
//------------------------------

//----------DriverEntry---------
#pragma INITCODE
extern "C"
NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath )
{
DbgPrint("[Aliwy] DriverEntry\n");

EnumProcess();

theDriverObject->DriverUnload = OnUnload;

return STATUS_SUCCESS;
}



//--------------------------错提示----------------------------
1.obj : error LNK2019: unresolved external symbol "__declspec(dllimport) long __stdcall NtQuerySystemInformation(enum _SYSTEM_INFORMATION_CLASS,void *,unsigned long,unsigned long *)" (__imp_?NtQuerySystemInformation@@YGJW4_SYSTEM_INFORMATION_CLASS@@PAXKPAK@Z) referenced in function "long __stdcall EnumProcess(void)" (?EnumProcess@@YGJXZ)
objchk\i386\EmptyDriver1.sys : fatal error LNK1120: 1 unresolved externals


//--------------------------日志文件内容------------------------

-out:objchk\i386\EmptyDriver1.sys
objchk\i386\1.obj
d:\WINDDK\2600\lib\wxp\i386\ntoskrnl.lib
d:\WINDDK\2600\lib\wxp\i386\hal.lib
d:\WINDDK\2600\lib\wxp\i386\wmilib.lib
1.obj : error LNK2019: unresolved external symbol "__declspec(dllimport) long __stdcall NtQuerySystemInformation(enum _SYSTEM_INFORMATION_CLASS,void *,unsigned long,unsigned long *)" (__imp_?NtQuerySystemInformation@@YGJW4_SYSTEM_INFORMATION_CLASS@@PAXKPAK@Z) referenced in function "long __stdcall EnumProcess(void)" (?EnumProcess@@YGJXZ)
objchk\i386\EmptyDriver1.sys : fatal error LNK1120: 1 unresolved externals
echo.

Skip Binplace:

[skyworth98]

你需要链接到ntdll.dll

[dengqibin]

问了这么多次

GetProcAddress(LoadLibry(_T("Ntdll.dll"),"ZWQuerySystemInformation")