Strange thing: CmRegisterCallback is:
-
imported by wdmsec.lib from ntoskrnl.exe for w2k, but is not present (not just not exported but not present) in ntoskrnl.exe for w2k;
-
is present in ntoskrnl.exe for wxp and above;
-
wdmsec.lib for w2k (in its i386 incarnation) and for wxp and wnet are the same (and therefore they all import CmRegisterCallback and CmUnRegisterCallback, in all 3 cases!):
C:\WINDDK\3790.1830\lib\w2k\i386\
wdmsec.lib 571116 02/18/05 08:34
C:\WINDDK\3790.1830\lib\wnet\i386\
ntoskrnl.lib 394990 02/18/05 08:34
wdm.lib 208272 02/18/05 08:34
wdmsec.lib 571116 02/18/05 08:34
C:\WINDDK\3790.1830\lib\wxp\i386\
ntoskrnl.lib 369322 07/17/04 11:38
wdm.lib 206242 07/19/04 19:34
wdmsec.lib 571116 02/18/05 08:34
Comments, anyone?
Regards,
Alex Shvedov
Take a look at the recent discussion on NTFSD entitled “Older O/S version
questions WRT filtering” this was covered.
–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply
“xxxxx@Home” wrote in message news:xxxxx@ntdev…
Strange thing: CmRegisterCallback is:
- imported by wdmsec.lib from ntoskrnl.exe for w2k, but is not present (not
just not exported but not present) in ntoskrnl.exe for w2k;
- is present in ntoskrnl.exe for wxp and above;
- wdmsec.lib for w2k (in its i386 incarnation) and for wxp and wnet are the
same (and therefore they all import CmRegisterCallback and
CmUnRegisterCallback, in all 3 cases!):
C:\WINDDK\3790.1830\lib\w2k\i386\
wdmsec.lib 571116 02/18/05 08:34
C:\WINDDK\3790.1830\lib\wnet\i386\
ntoskrnl.lib 394990 02/18/05 08:34
wdm.lib 208272 02/18/05 08:34
wdmsec.lib 571116 02/18/05 08:34
C:\WINDDK\3790.1830\lib\wxp\i386\
ntoskrnl.lib 369322 07/17/04 11:38
wdm.lib 206242 07/19/04 19:34
wdmsec.lib 571116 02/18/05 08:34
Comments, anyone?
Regards,
Alex Shvedov
I just looked at the sources for wdmsec.lib, there are no references to CmRegisterCallback at all. A lib typically is not the one who forces the import, a lib just has a function name reference that is unresolved. The linker resolves the name as animport when the final binary (your driver) is being built and linked. I would also look at your own driver to see if you refer to these imports.
What exactly is the issue here…is your driver not working on a specific platform? Or is this something you just stumbled upon and were curious?
d
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@Home
Sent: Wednesday, October 19, 2005 8:12 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] w2k and Cm[Un]RegisterCallback
Strange thing: CmRegisterCallback is:
?
- imported by wdmsec.lib from ntoskrnl.exe for w2k, but is not present (not just not exported but not present) in ntoskrnl.exe for w2k;
?
- is present in ntoskrnl.exe for wxp and above;
?
- wdmsec.lib for w2k (in its i386 incarnation) and for wxp and wnet?are the same (and therefore they all import CmRegisterCallback and CmUnRegisterCallback, in all 3 cases!):
?
?
C:\WINDDK\3790.1830\lib\w2k\i386????
? wdmsec.lib??? 571116??? 02/18/05?? 08:34
?
C:\WINDDK\3790.1830\lib\wnet\i386????
? ntoskrnl.lib??? 394990??? 02/18/05?? 08:34
? wdm.lib??? 208272??? 02/18/05?? 08:34
? wdmsec.lib??? 571116??? 02/18/05?? 08:34
?
C:\WINDDK\3790.1830\lib\wxp\i386????
? ntoskrnl.lib??? 369322??? 07/17/04?? 11:38
? wdm.lib??? 206242??? 07/19/04?? 19:34
? wdmsec.lib??? 571116??? 02/18/05?? 08:34
?
Comments, anyone?
?
?
Regards,
Alex Shvedov
?
—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
> Take a look at the recent discussion on NTFSD entitled "Older O/S version
questions WRT filtering" this was covered.
I’ll check that.
Thanks for the hint, Don.
A lib typically is not the one who forces the import
It’s good to know how it works:-) At last:-)
What exactly is the issue here…
The issue is very simple [now that we know how it works]:
if a driver links against a set of *.lib’s, it should at least load.
I built a driver in a w2k environment and hit ERROR_PROC_NOT_FOUND on load.
“depends mydriver.sys” immediately showed the reason.
Not much of a trouble anyway, I was just curious.
Regards,
Alex Shvedov
> if a driver links against a set of *.lib’s, it should at least
load.
In an ideal world yes, but in reality, no. Typically you have the libs
from the latest release which contain the import information for the
latest version and not previous versions. I find that even in a win2k
build environment, not all the libs are from the win2k release, there
are some that are mixed in from the current release. Unfortunately,
this mixture leads to this type of problem.
d
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@Home
Sent: Wednesday, October 19, 2005 8:58 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] w2k and Cm[Un]RegisterCallback
Take a look at the recent discussion on NTFSD entitled “Older O/S
version
questions WRT filtering” this was covered.
I’ll check that.
Thanks for the hint, Don.
A lib typically is not the one who forces the import
It’s good to know how it works:-) At last:-)
What exactly is the issue here…
The issue is very simple [now that we know how it works]:
if a driver links against a set of *.lib’s, it should at least load.
I built a driver in a w2k environment and hit ERROR_PROC_NOT_FOUND on
load.
“depends mydriver.sys” immediately showed the reason.
Not much of a trouble anyway, I was just curious.
Regards,
Alex Shvedov
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: xxxxx@microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
> are some that are mixed in from the current release. Unfortunately,
this mixture leads to this type of problem.
Exactly.
IMHO, it’s just laziness…
There still is something that I do not understand: why on earth
mydrv.sys LINKED successfully under w2k?
- w2k’s ntoskrnl.lib does not export WhateverCall();
- w2k::wdmsec.lib imports it - fine;
but how can it be that the linker is happy [and I am not:-),
and depends is not]?
This time it’s just my laziness - to enable all messages
in linker and see…
Regards,
Alex Shvedov
----- Original Message -----
From: “Doron Holan”
To: “Windows System Software Devs Interest List”
Sent: Wednesday, October 19, 2005 12:12 PM
Subject: RE: [ntdev] w2k and Cm[Un]RegisterCallback
> if a driver links against a set of *.lib’s, it should at least
load.
In an ideal world yes, but in reality, no. Typically you have the libs
from the latest release which contain the import information for the
latest version and not previous versions. I find that even in a win2k
build environment, not all the libs are from the win2k release, there
are some that are mixed in from the current release. Unfortunately,
this mixture leads to this type of problem.
d
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@Home
Sent: Wednesday, October 19, 2005 8:58 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] w2k and Cm[Un]RegisterCallback
> Take a look at the recent discussion on NTFSD entitled “Older O/S
version
> questions WRT filtering” this was covered.
I’ll check that.
Thanks for the hint, Don.
> A lib typically is not the one who forces the import
It’s good to know how it works:-) At last:-)
> What exactly is the issue here…
The issue is very simple [now that we know how it works]:
if a driver links against a set of *.lib’s, it should at least load.
I built a driver in a w2k environment and hit ERROR_PROC_NOT_FOUND on
load.
“depends mydriver.sys” immediately showed the reason.
Not much of a trouble anyway, I was just curious.
Regards,
Alex Shvedov
—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: xxxxx@microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
xxxxx@Home wrote:
> are some that are mixed in from the current release. Unfortunately,
> this mixture leads to this type of problem.
Exactly.
IMHO, it’s just laziness…
There still is something that I do not understand: why on earth
mydrv.sys LINKED successfully under w2k?
- w2k’s ntoskrnl.lib does not export WhateverCall();
- w2k::wdmsec.lib imports it - fine;
but how can it be that the linker is happy [and I am not:-),
and depends is not]?
Wdmsec.lib does not reference ntoskrnl.lib. Instead, it has a direct
import from ntoskrnl.exe. That is, wdmsec.lib has an import record that
says “CmRegisterCallback can be found in ntoskrnl.exe”. As far as the
linker is concerned, that completely satisfies any references to
CmRegisterCallback. It’s happy. The linker doesn’t ever refer to the
DLLs being referenced in an import record. That’s what the .lib is
for. If it didn’t, you couldn’t build XP drivers under 2K.
So, if your driver happens to call CmRegisterCallback, your exe will be
built with an import for ntoskrnl.exe:CmRegisterCallback. That’s
perfectly valid. Now, if you try to LOAD that exe under Win2K, the
operating system loader will notice that CmRegisterCallback is not
really found in ntoskrnl.exe, and it will throw a temper tantrum.
–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.