c++windowsnt-native-api

Windows native development: debuggee tries to load werkernel.sys from system32


I'm investigating the Windows Native API now, Nt*/Zw* methods. I downloaded the WDK, installed it and successfully compiled an application (x64, under Win 8.1 x64, VS2013). The only thing it does is a call to NtOpenFile().

To successfully compile/link it, I had to make the following changes to project properties (template Application For Drivers):

Unexpectedly, upon running a debugger, I'm presented with error message "The program can't start because C:\Windows\SYSTEM32\werkernel.sys is missing from your computer. Try reinstalling the program to fix this problem." The werkernel.sys obviously exists in system32\drivers.

EDIT: To be clear, the mentioned error also occurs when launching the app by doubleclicking the icon.

This load happens before any of my code, I can't find anything anywhere in internet nor in project properties on the file in question. So, to summarize, I have the following questions so far:

  1. Why werkernel.sys is being loaded at all for my application?
  2. Why is it being loaded from System32?

I understand that it is possible to mklink werkernel.sys drivers\werkernel.sys, but it feels like I'm doing somethig terribly wrong.


Solution

  • Linking ntdll.lib rather than ntoskrnl.lib worked for me when I had a similar problem.