ZwQueryDirectoryObject on NT4.0 SP6a

NTFSD
1

Hi Everyone,
In my kernel driver, I use ZwQueryDirectoryObject successfully on
Win2K and WinXP after the call to
ZwOpenDirectoryObject.
But when I create this same driver for Win NT 4.0 SP6a ( and link
against ntdll.lib ), my driver will
not load on NT4.0 SP6a and during the boot a message box is displayed
with the error:
“Indicates the specified procedure address cannot be found in the DLL.”
And when I look at ntdll.dll with Visual Studio Tools “Dependency
Walker” , the entry point for
ZwQueryDirectoryObject is present.
Any ideas ???
Thanks in advance,
Duane

2

Are you linking with NT4 DDK? If not, it’s not the Zw call that is not
implemented, but __except_handler3, which is available on W2K/XP, but not NT.
The call is used for exception handling.

Regards, Dejan.

Duane Souder wrote:

Hi Everyone,
In my kernel driver, I use ZwQueryDirectoryObject successfully on
Win2K and WinXP after the call to
ZwOpenDirectoryObject.
But when I create this same driver for Win NT 4.0 SP6a ( and link
against ntdll.lib ), my driver will
not load on NT4.0 SP6a and during the boot a message box is displayed
with the error:
“Indicates the specified procedure address cannot be found in the DLL.”
And when I look at ntdll.dll with Visual Studio Tools “Dependency
Walker” , the entry point for
ZwQueryDirectoryObject is present.
Any ideas ???
Thanks in advance,
Duane

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to %%email.unsub%%

–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32 developers.

3

yes I am linking with the last NT 4.0 DDK libs that Microsoft released…
Duane

Dejan Maksimovic wrote:

Are you linking with NT4 DDK? If not, it’s not the Zw call that is not
>implemented, but __except_handler3, which is available on W2K/XP, but
not NT.
>The call is used for exception handling.
>
> Regards, Dejan.
>
>Duane Souder wrote:
>
>
>
>>Hi Everyone,
>> In my kernel driver, I use ZwQueryDirectoryObject successfully on
>>Win2K and WinXP after the call to
>>ZwOpenDirectoryObject.
>> But when I create this same driver for Win NT 4.0 SP6a ( and link
>>against ntdll.lib ), my driver will
>>not load on NT4.0 SP6a and during the boot a message box is displayed
>>with the error:
>> “Indicates the specified procedure address cannot be found in
the DLL.”
>>And when I look at ntdll.dll with Visual Studio Tools “Dependency
>>Walker” , the entry point for
>>ZwQueryDirectoryObject is present.
>>Any ideas ???
>>Thanks in advance,
>>Duane
>>
>>—
>>You are currently subscribed to ntfsd as: xxxxx@alfasp.com
>>To unsubscribe send a blank email to %%email.unsub%%
>>
>>
>
>–
>Kind regards, Dejan M. www.alfasp.com
>E-mail: xxxxx@alfasp.com ICQ#: 56570367
>Alfa File Monitor - File monitoring library for Win32 developers.
>Alfa File Protector - File protection and hiding library for Win32
developers.
>
>
>
>
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@okena.com
>To unsubscribe send a blank email to %%email.unsub%%
>
>
>