c - 如何使用 LoadLibrary() 和 GetProcAddress() 函数将 ntdll.dll 添加到项目库中？

Question

我想用 获取线程的起始地址NtQueryInformationThread，但我需要添加它的库。我怎样才能做到这一点？

Answer 1

我更喜欢将 ntdll.lib（您可以在 Windows DDK/WDK 中找到它）添加到项目中。在这种情况下，您不需要 GetProcAddress 的东西。

Answer 2

我使用NtQueryInformationThread不需要加载ntdll（我认为它是自动加载的）。我只需要准备一个包含此类内容的特殊头文件：http: //pastebin.com/ieEqR0eL并将其包含在我的项目中。之后，我能够做这样的事情：

NTSTATUS status;
THREAD_BASIC_INFORMATION basicInfo;
typedef NTSTATUS ( WINAPI *NQIT )( HANDLE, LONG, PVOID, ULONG, PULONG );

/* Open thread */
HANDLE thread = OpenThread(THREAD_ALL_ACCESS, false, threadId);
/* Get the address of NtQueryInformationThread function. */ 
NQIT NtQueryInformationThread = ( NQIT )GetProcAddress( GetModuleHandle(TEXT("ntdll.dll")), "NtQueryInformationThread" );
/* Get basic thread information */
status = NtQueryInformationThread(thread, 0, &basicInfo, sizeof(basicInfo), NULL);
CloseHandle(thread);

/* Get address of the Thread Environment Block, stack start address and last stack address */
tebAddress = (DWORD)basicInfo.TebBaseAddress;
DWORD pebAddress = *((DWORD*)(tebAddress+0x30));
/* For example to get stack base address */
stackBase = *((DWORD*)(tebAddress+4));
stackLimit = *((DWORD*)(tebAddress+8));