Calling exported functions from a driver

NTFSD
1

Hi,
I need to call some functions exported by a driver. I do not have the lib
file for the driver, but I know that the driver exports these functions.

Does any one know how to get the address of the functions that I need to
call ? (I know the name of the function).

Thanks,
Prashant Parikh

Get Your Private, Free Email at http://www.hotmail.com

2

I have some questions for you…

  1. Are u trying to call these exported fuctions from
    kernel mode.

  2. Is your driver of Type EXPORT.

Girish

— Prashant Parikh wrote:
> Hi,
> I need to call some functions exported by a driver.
> I do not have the lib
> file for the driver, but I know that the driver
> exports these functions.
>
> Does any one know how to get the address of the
> functions that I need to
> call ? (I know the name of the function).
>
> Thanks,
> Prashant Parikh
>
>
____
> Get Your Private, Free Email at
> http://www.hotmail.com
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> $subst(‘Email.Unsub’)
>
>

Do You Yahoo!?
Talk to your friends online with Yahoo! Messenger.
http://im.yahoo.com

3

>Subject: Calling exported functions from a driver

From: “Prashant Parikh”
>Date: Mon, 13 Mar 2000 09:02:30 EST
>
>Hi,
>I need to call some functions exported by a driver. I do not have the lib
>file for the driver, but I know that the driver exports these functions.
>
>Does any one know how to get the address of the functions that I need to
>call ? (I know the name of the function).

Is the driver’s name “static” (known at compile time)? And the function
names? If so, this is not difficult. Often all you have to do is make a .def
file:
EXPORTS
Foo
Bar
make sure there is a space before each function name and EXPORTS is in all
capital letters.
then do
lib -def:foo.def

and you’ll get the import library foo.lib and just link to that.

Sometimes there is difficulty related to “C name mangling” at least on x86,
@nn suffixed for stdcall, and possibly leading underscores. Like,
kernel32.dll’s functions are stdcall but don’t have this “mangling” in the
exported named but they do have them in the “internal” names the linker
sees. This is tricky to duplicate, you have to use the .def file and make a
dummy implementation .c file:

__declspec(dllexport) void__stdcall Foo(int a, int b, int c) { }
__declspec(dllexport) void__stdcall Bar(int a) { }
int main() {return 0; }

and use the .def file above:
cl foo.c -link -def:foo.def

Given the dummy implementation
cl foo.c
also gives you an import .lib that migth work, again depending on what is
mangled how where. It’s all just a little more confusing than it should be…
I think on other than x86, and definitely if everything is __cdecl, this
confusion is absent.

Linking by ordinal is just a little more work. Linking dynamically a la
Win32 LoadLibrary/GetProcAddress is nearly impossible, unless you are
writing a printer or video driver in which case its easy. (I imagine you
could get the win32k.sys exports to a regular kernel mode driver by writing
a dummy printer driver with an Escape that exposes them…)

- Jay