ntdll functions

[dr-NHA]

Some NTDLL Functions Are Currently Not Working

Tested Not Generating:
NtDuplicateObject
RtlZeroMemory
LdrGetProcedureAddress
LdrLoadDll
NtMapViewOfSection
NtUnmapViewOfSection
NtProtectVirtualMemory
RtlCreateUserThread
NtCreateThreadEx
NtQueueApcThread
NtOpenThread
NtSuspendProcess
NtResumeProcess

Expected behavior

These Should Be Generating,
Ive Generated Other Imports With 100% Successrate,
But The Above List Doesnt Generate Anything!

Repro steps

1. NativeMethods.txt content:

//Working
NtOpenProcess
NtOpenFile
RtlGetVersion
NtCreateSection
NtQueryObject
NtQueryVirtualMemory
NtQuerySystemInformation
NtQueryInformationProcess
NtWaitForSingleObject
RtlInitUnicodeString
RtlUnicodeStringToAnsiString
//Not Working
NtDuplicateObject
RtlZeroMemory
LdrGetProcedureAddress
LdrLoadDll
NtMapViewOfSection
NtUnmapViewOfSection
NtProtectVirtualMemory
RtlCreateUserThread
NtCreateThreadEx
NtQueueApcThread
NtOpenThread
NtSuspendProcess
NtResumeProcess

Context

• CsWin32 version: 0.1.42.13748
• Runtime Version: v4.0.30319
• Target Framework: .NETFramework,Version=v4.8

[elachlan]

Probably missing from: https://github.com/microsoft/wdkmetadata

@mikebattista should this be moved there?

[AArnott]

Spot checking this, I see 2 kinds of results:

1. The members are in fact in the WDK (e.g. NtOpenFile) and therefore CsWin32 should be able to generate it, although CPU architecture filters may apply.
2. I don't see the method in metadata or documented anywhere (e.g. NtDuplicateObject) leading me to wonder why you think it should be available.

[dr-NHA]

I Mean I Did Recheck And It Is 100% A Real Function And Is Importable Via Other Means

[AArnott]

I suspect not all functions in the header files are part of the public Windows SDK or WDK, and that may be why the metadata omits them. Or it may be a mistake, I don't know. @mikebattista would have to comment.

[riverar]

The WDK metadata is still new/green, we'll make sure we get all the public APIs listed above. It's a tricky situation right now with the different driver models, ability to call these APIs from both user and kernel modes, etc.

We can probably forward this issue to the WDK metadata repository for tracking.

[AArnott]

@riverar The WDK metadata repo is just win32metadata, right?

[riverar]

@AArnott WDK metadata has a home at https://github.com/microsoft/wdkmetadata

[AArnott]

I guess I don't have permissions to that repo sufficient to transfer this issue to it.

[riverar]

@AArnott Feel free to send it to win32metadata to cleanup your issues list here and one of us can handle moving it from there

[mikebattista]

These all look like inline macros or undocumented functions. We can't/don't include those here.