1

I try to create a Windows driver:

.h file:

NTSTATUS RfRegistryCallback(__in PVOID CallbackContext, __in PVOID Argument1, __in PVOID Argument2);
void RfUnload(__in PDRIVER_OBJECT pDriverObject);

.cpp file:

#include "Ntdef.h"
#include "Ntddk.h"
#include "DriverEntry.h"

LARGE_INTEGER g_CmCookie = { 0 };

//--- Register ---//
extern "C"
NTSTATUS DriverEntry(__in PDRIVER_OBJECT pDriverObject, __in PUNICODE_STRING    pRegistryPath)
{
   UNREFERENCED_PARAMETER(pRegistryPath);

    //  Set up our unload routine
    pDriverObject->DriverUnload = RfUnload;

    //  Register our callback with the system
    UNICODE_STRING AltitudeString = RTL_CONSTANT_STRING(L"360000");
    NTSTATUS status = CmRegisterCallbackEx(RfRegistryCallback, &AltitudeString, pDriverObject, NULL, &g_CmCookie, NULL);
    if (!NT_SUCCESS(status))
    {
        //  Failed to register - probably shouldn't succeed the driver intialization since this is critical
    }

    return status;
}

//--- Unregister ---//
void RfUnload(__in PDRIVER_OBJECT pDriverObject)
{
    UNREFERENCED_PARAMETER(pDriverObject);
    PAGED_CODE();

    NTSTATUS status = CmUnRegisterCallback(g_CmCookie);
    if (!NT_SUCCESS(status))
    {
        //  Failed to unregister - try to handle gracefully
    }
 }

 //--- Callback handle
 NTSTATUS RfRegistryCallback(__in PVOID CallbackContext, __in PVOID Argument1, __in PVOID Argument2)
{
    UNREFERENCED_PARAMETER(CallbackContext);
    UNREFERENCED_PARAMETER(Argument2);

    REG_NOTIFY_CLASS Operation = (REG_NOTIFY_CLASS)(ULONG_PTR)Argument1;
    switch (Operation)
    {
        .....
    }

    return STATUS_SUCCESS;
}

I get in the LINK process the following errors:

More errors:

  1. LNK2019 unresolved external symbol _vcrt_LoadLibraryExW referenced in function "struct HINSTANCE * cdecl GetPdbDll(void)" (?GetPdbDll@@YAPAUHINSTANCE@@XZ) \MSVCRTD.lib(pdblkup.obj)

  2. LNK2019 unresolved external symbol _vcrt_GetModuleHandleW referenced in function "struct HINSTANCE * cdecl GetPdbDll(void)" (?GetPdbDll@@YAPAUHINSTANCE@@XZ) \MSVCRTD.lib(pdblkup.obj)

  3. LNK2019 unresolved external symbol _vcrt_GetModuleFileNameW referenced in function "struct HINSTANCE * cdecl GetPdbDll(void)" (?GetPdbDll@@YAPAUHINSTANCE@@XZ) \MSVCRTD.lib(pdblkup.obj)

  4. LNK2019 unresolved external symbol ___stdio_common_vsprintf_s referenced in function __vsprintf_s_l \MSVCRTD.lib(error.obj)

  5. LNK2019 unresolved external symbol __wsplitpath_s referenced in function "int __cdecl GetPdbDllPathFromFilePath(wchar_t const *,wchar_t *,unsigned int)" (?GetPdbDllPathFromFilePath@@YAHPB_WPA_WI@Z) \MSVCRTD.lib(pdblkup.obj)

  6. LNK2019 unresolved external symbol __wmakepath_s referenced in function "int __cdecl GetPdbDllPathFromFilePath(wchar_t const *,wchar_t *,unsigned int)" (?GetPdbDllPathFromFilePath@@YAHPB_WPA_WI@Z) \MSVCRTD.lib(pdblkup.obj)

  7. LNK2019 unresolved external symbol __imp_@CmUnRegisterCallback@8 referenced in function "void __fastcall RfUnload(struct _DRIVER_OBJECT *)" (?RfUnload@@YIXPAU_DRIVER_OBJECT@@@Z) \DriverEntry.obj

  8. LNK2019 unresolved external symbol __imp_@CmRegisterCallbackEx@24 referenced in function @DriverEntry@8 \DriverEntry.obj

  9. LNK2019 unresolved external symbol __except_handler4_common referenced in function __except_handler4 \MSVCRTD.lib(chandler4gs.obj)

  10. LNK2019 unresolved external symbol __CrtDbgReportW referenced in function __CRT_RTC_INITW \MSVCRTD.lib(init.obj)

  11. LNK2019 unresolved external symbol __CrtDbgReport referenced in function __CRT_RTC_INIT \MSVCRTD.lib(init.obj)

  12. LNK2019 unresolved external symbol _wcscpy_s referenced in function "int __cdecl GetPdbDllPathFromFilePath(wchar_t const *,wchar_t *,unsigned int)" (?GetPdbDllPathFromFilePath@@YAHPB_WPA_WI@Z) \MSVCRTD.lib(pdblkup.obj)

Any clue will be helpful.

Dan
  • 11
  • 3
  • 1
    Possible duplicate of [What is an undefined reference/unresolved external symbol error and how do I fix it?](http://stackoverflow.com/questions/12573816/what-is-an-undefined-reference-unresolved-external-symbol-error-and-how-do-i-fix) – IInspectable Jul 18 '16 at 14:29
  • 1
    you need use hal.lib for __imp__KeGetCurrentIrql@0 and /NODEFAULTLIB option for not link with msvcrt[d].lib – RbMm Jul 18 '16 at 15:38
  • There are more errors: – Dan Jul 19 '16 at 08:10
  • You do not need to include ntdef.h, ntddk.h (or ntifs.h) does the job. It also seems that you somewhat include things available only for usermode applications. How did you create the driver project? More recent versions of MS Visual Studio (2012+) have templates for that, or you can use VisualDDK (MSVS 2010), altough it is not the most clean way. – Martin Drab Jul 19 '16 at 09:37
  • I created "Filter Driver: Filesystem Mini-filter" project using VS2015. Should I use another template? – Dan Jul 19 '16 at 13:22
  • Hm, that's the right template (I am using it when creating new non-PnP driver projects). Try #include or #include instead of the quotation marks (the header files are "libraries", not direct parts of your project). As I said before, ntdef.h should not be needed. I don't have MSVS 2015, so I am not sure how the minifilter template changed. – Martin Drab Jul 19 '16 at 14:14
  • includes here absolute not related - this is not compile errors. this is linker errors. again - not include msvcrtd.lib !! to libs (/NODEFAULTLIB) . include ntoskrnl.lib and hal.lib. you need look project properties and think by head – RbMm Jul 20 '16 at 06:57

0 Answers0