HookZwCreateProcess例程的实现放在了Process.c中,
形式如下:
VOID NTAPI HookZwCreateProcess()
{
。。。。
}
HookZwCreateProcess例程的声明放在了Process.h中,
形式如下:
VOID NTAPI HookZwCreateProcess();
而真正的调用,放在了Main.c中,
形式如下:
NTSTATUS
DeviceControl(
IN PFILE_OBJECT FileObject,
IN BOOLEAN Wait,
IN PVOID InputBuffer,
IN ULONG InputBufferLength,
OUT PVOID OutputBuffer,
IN ULONG OutputBufferLength,
IN ULONG IoControlCode,
OUT PIO_STATUS_BLOCK IoStatus,
IN PDEVICE_OBJECT DeviceObject
)
{
IoStatus->Status = STATUS_SUCCESS;
IoStatus->Information = 0;
switch( IoControlCode )
{
case CTL_CODE_LSR_HOOK_ZWCREATEPROCESS:
{
HookZwCreateProcess();
}
break;
default:break;
}
return IoStatus->Status;
}
编译时,出现了:
error LNK2019: unresolved external symbol _HookZwCreateProcess@0 referenced in function _DeviceControl@36
错误提示,如何解决?
谢谢大侠
在Process.h中声明“VOID NTAPI HookZwCreateProcess();”时要明确给定函数参数,函数无参数也要加个Void。像下面这样声明应该没有问题了:“VOID NTAPI HookZwCreateProcess(void);”
在Main.c中包含Process.h,并确定编译路径包含了Process.h所在的文件夹(如果Process.h不在Main.c同一个文件夹下的话)。