I'm investigating the Windows Native API now, Nt*/Zw*
methods. I downloaded the WDK, installed it and successfully compiled an application (x64, under Win 8.1 x64, VS2013). The only thing it does is a call to NtOpenFile()
.
To successfully compile/link it, I had to make the following changes to project properties (template Application For Drivers):
Unexpectedly, upon running a debugger, I'm presented with error message "The program can't start because C:\Windows\SYSTEM32\werkernel.sys is missing from your computer. Try reinstalling the program to fix this problem." The werkernel.sys obviously exists in system32\drivers.
EDIT: To be clear, the mentioned error also occurs when launching the app by doubleclicking the icon.
This load happens before any of my code, I can't find anything anywhere in internet nor in project properties on the file in question. So, to summarize, I have the following questions so far:
I understand that it is possible to mklink werkernel.sys drivers\werkernel.sys
, but it feels like I'm doing somethig terribly wrong.
Linking ntdll.lib
rather than ntoskrnl.lib
worked for me when I had a similar problem.