c++ kernel mode driver - unresolved external symbol error

anshul_makkar · March 12, 2012, 8:24am

I am working on a project where the code is in .cpp files… Now I need to call kernel mode APIs like
IOCallDriver,
IoGetDeviceObjectPointer,
IoGetNextIrpStackLocation
KeWaitForSingleObject
ObReferenceObject

I have linked to wdm.lib and Ntoskrnl.lib, but still getting following errors

unresolved external symbol __imp__KeWaitForSingleObject referenced
unresolved external symbol __imp__IoBuildDeviceIoControlRequest
unresolved external symbol __imp__KeInitializeEvent referenced in function _callParport

while no unresolved error is thrown for IOCallDriver or ObReferenceObject. Please let me know why these error and how can I resolve them.

Observation:
Earlier I was getting unresolved external symbol error for all kernel APIs, but inclusion of " extern “c” { #include<wdm.h> }, resolved most of them apart from these 3. Are these symbols not available in wdm.lib or Ntoskrnl.lib

Please suggest.

Thanks
Anshul Makkar
www.justkernel.com</wdm.h>

Peter_Viscarola_OSR · March 12, 2012, 10:19am

Posts like this really confuse and concern me.

Build your driver just like any other driver using the WDK in C. You don’t need to specify any specific or special libraries against which to link. You DO want to include WDM.H or NTDDK.H in an extern C block, as you’ve done. Likewise, you will want to be sure the name “DriverEntry” is not name-mangled.

It should “just work”,

Peter
OSR

OSR_Community_User · March 12, 2012, 10:34am

On 3/12/2012 10:19 AM, xxxxx@osr.com wrote:

You DO want to include WDM.H or NTDDK.H in an extern C block

Actually, not so if you are using the latest RELEASED version of the WDK
as wdm.h and ntddk.h already enclose their contents in a conditional
extern “C” block. The OP must be using an old version of the WDK.

Doron_Holan · March 12, 2012, 10:57am

Are you sure those libs are on the cmd line? Did you verify it in the log file?

d

debt from my phone

From: xxxxx@justkernel.com
Sent: 3/12/2012 5:24 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] c++ kernel mode driver - unresolved external symbol error

I am working on a project where the code is in .cpp files… Now I need to call kernel mode APIs like
IOCallDriver,
IoGetDeviceObjectPointer,
IoGetNextIrpStackLocation
KeWaitForSingleObject
ObReferenceObject

I have linked to wdm.lib and Ntoskrnl.lib, but still getting following errors

unresolved external symbol __imp__KeWaitForSingleObject referenced
unresolved external symbol __imp__IoBuildDeviceIoControlRequest
unresolved external symbol __imp__KeInitializeEvent referenced in function _callParport

while no unresolved error is thrown for IOCallDriver or ObReferenceObject. Please let me know why these error and how can I resolve them.

Observation:
Earlier I was getting unresolved external symbol error for all kernel APIs, but inclusion of " extern “c” { #include<wdm.h> }, resolved most of them apart from these 3. Are these symbols not available in wdm.lib or Ntoskrnl.lib

Please suggest.

Thanks
Anshul Makkar
www.justkernel.com http:

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</http:></wdm.h>

anshul_makkar · March 12, 2012, 11:05am

Yes, those libs are in the command line otherwise I should get unresolved references for all the kernel APIs. I have confirmed this from the logs also.

As I have mentioned this file is a part of broader project and we use kbuild command to build win kernel stuff…

?
Thanks
Anshul Makkar
www.justkernel.com

From: Doron Holan
To: Windows System Software Devs Interest List
Sent: Monday, 12 March 2012 8:26 PM
Subject: RE: [ntdev] c++ kernel mode driver - unresolved external symbol error

Are you sure those libs are on the cmd line? Did you verify it in the log file?

d

debt from my phone

________________________________
From: xxxxx@justkernel.com
Sent: 3/12/2012 5:24 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] c++ kernel mode driver - unresolved external symbol error

I am working on a project where the code is in .cpp files… Now I need to call kernel mode APIs like
IOCallDriver,
IoGetDeviceObjectPointer,
IoGetNextIrpStackLocation
KeWaitForSingleObject
ObReferenceObject

I have linked to wdm.lib and Ntoskrnl.lib, but still getting following errors

unresolved external symbol__imp KeWaitForSingleObject referenced
unresolved external symbol imp IoBuildDeviceIoControlRequest
unresolved external symbol imp__KeInitializeEvent referenced in function _callParport

while no unresolved error is thrown for IOCallDriver or ObReferenceObject. Please let me know why these error and how can I resolve them.

Observation:
Earlier I was getting unresolved external symbol error for all kernel APIs, but inclusion of " extern “c” { #include<wdm.h> }, resolved most of them apart from these 3. Are these symbols not available in wdm.lib or Ntoskrnl.lib

Please suggest.

Thanks
Anshul Makkar
www.justkernel.com

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</wdm.h>

Pavel_A1 · March 12, 2012, 11:21am

On 12-Mar-2012 17:04, anshul makkar wrote:

As I have mentioned this file is a part of broader project and we use
kbuild command to build win kernel stuff…

So file a bug against kbuild.

– pa

Tim_Roberts · March 12, 2012, 1:05pm

anshul makkar wrote:

Yes, those libs are in the command line otherwise I should get
unresolved references for all the kernel APIs. I have confirmed this
from the logs also.

Kids today – don’t know how to use the tools.

C:\DDK\7600\lib\wlh\i386>link /dump /linkermember ntoskrnl.lib | grep KeWa
5E11A _KeWaitForSingleObject@20
5E11A __imp__KeWaitForSingleObject@20
5E192 _KeWaitForMutexObject@20
5E192 __imp__KeWaitForMutexObject@20
5E208 _KeWaitForMultipleObjects@32
5E208 __imp__KeWaitForMultipleObjects@32
44D _KeWaitForMultipleObjects@32
44C _KeWaitForMutexObject@20
44B _KeWaitForSingleObject@20
44D __imp__KeWaitForMultipleObjects@32
44C __imp__KeWaitForMutexObject@20
44B __imp__KeWaitForSingleObject@20

They are present, but with __stdcall linkage. I perceive that you are
“doing your own thing” here, by building in Visual Studio instead of
using the supported process. I suspect you have the default calling
convention set to the wrong state. You need /Gz to make __stdcall the
default calling convention.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

Mark_Roddy · March 12, 2012, 1:58pm

Right - so that is a nightmare. What your kbuild project should do is
what ddkbuild.bat does, use the toolchain from a supported WDK using
the supported tools. If your kbuild project is at all like vbox kbuild
project(s), for example, it does nothing of the sort and everything is
broken for everyone except one developer somewhere who has all the
right bits with all the right patches.

Mark Roddy

On Mon, Mar 12, 2012 at 11:04 AM, anshul makkar
wrote:
> Yes, those libs are in the command line otherwise I should get unresolved
> references for all the kernel APIs. I have confirmed this from the logs
> also.
>
> As I have mentioned this file is a part of broader project and we use kbuild
> command to build win kernel stuff…
>
> Thanks
> Anshul Makkar
> www.justkernel.com
>
>
> From: Doron Holan
> To: Windows System Software Devs Interest List
> Sent: Monday, 12 March 2012 8:26 PM
> Subject: RE: [ntdev] c++ kernel mode driver - unresolved external symbol
> error
>
> Are you sure those libs are on the cmd line? Did you verify it in the log
> file?
>
> d
>
> debt from my phone
>
> From: xxxxx@justkernel.com
> Sent: 3/12/2012 5:24 AM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] c++ kernel mode driver - unresolved external symbol error
>
> I am working on a project where the code is in .cpp files… Now I need to
> call kernel mode APIs like
> IOCallDriver,
> IoGetDeviceObjectPointer,
> IoGetNextIrpStackLocation
> KeWaitForSingleObject
> ObReferenceObject
>
> I have linked to wdm.lib and Ntoskrnl.lib, but still getting following
> errors
>
> unresolved external symbol imp KeWaitForSingleObject referenced
> unresolved external symbol imp IoBuildDeviceIoControlRequest
> unresolved external symbol imp KeInitializeEvent referenced in function
> _callParport
>
> while no unresolved error is thrown for IOCallDriver or ObReferenceObject.
> Please let me know why these error and how can I resolve them.
>
> Observation:
> Earlier I was getting unresolved external symbol error for all kernel APIs,
> but inclusion of " extern “c” { #include<wdm.h> }, resolved most of them
> apart from these 3. Are these symbols not available in wdm.lib or
> Ntoskrnl.lib
>
> Please suggest.
>
> Thanks
> Anshul Makkar
> www.justkernel.com
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer</wdm.h>