pb 4.30 [x64] RtlFillMemoryUlong doesn't work

bingo · Post by **bingo** » Mon Oct 20, 2008 1:32 pm

tested in vista64 ...

OpenLibrary(0, "ntdll.dll")

Debug GetFunction(0, "RtlCompareMemory") ; ok      
Debug GetFunction(0, "RtlFillMemoryUlong") ; = 0 !
Debug GetFunction(0, "RtlComputeCrc32") ; ok

CloseLibrary(0)

:roll:

RtlFillMemoryUlong is legal api function ...

Post by **Fred** » Mon Oct 20, 2008 2:35 pm

are you sure it's exported by the ntdll.dll ? sometimes, API are defined as macro in the C headers.

bingo · Post by **bingo** » Mon Oct 20, 2008 2:45 pm

yes ... i have tested with polib.exe (64)
polib.exe /out:ntdll.lib c:\windows\SysWOW64\ntdll.dll /nound /MACHINE:x64

... RtlEraseUnicodeString RtlExitUserProcess RtlExitUserThread RtlExpandEnvironmentStrings RtlExpandEnvironmentStrings_U RtlExtendMemoryBlockLookaside RtlExtendMemoryZone RtlExtendedIntegerMultiply RtlExtendedLargeIntegerDivide RtlExtendedMagicDivide RtlFillMemory RtlFillMemoryUlong RtlFinalReleaseOutOfProcessMemoryStream RtlFindAceByType RtlFindActivationContextSectionGuid RtlFindActivationContextSectionString RtlFindCharInUnicodeString RtlFindClearBits RtlFindClearBitsAndSet RtlFindClearRuns RtlFindClosestEncodableLength RtlFindLastBackwardRunClear RtlFindLeastSignificantBit RtlFindLongestRunClear RtlFindMessage...

Post by **Fred** » Mon Oct 20, 2008 2:58 pm

And it's shown by "dependency walker" as well ?

bingo · Post by **bingo** » Mon Oct 20, 2008 3:33 pm

OpenLibrary(0, "ntdll.dll")

Debug GetFunction(0, "RtlCompareMemory") ; ok
Debug GetFunction(0, "RtlFillMemoryUlong") ; = 0 !
Debug GetFunction(0, "RtlComputeCrc32") ; ok

CloseLibrary(0)

RtlFillMemoryUlong (or RtlFillMemoryUlong_(...) directly) - it works in xp32/vista32 .

bingo · Post by **bingo** » Mon Oct 20, 2008 4:23 pm

ok and sorry ...
http://www.tipandtrick.net/2008/how-to- ... sysnative/

c:\windows\sysnative is the right 64bit dll folder . RtlFillMemoryUlong is missing in 64bit ntdll.dll

how can create the right libs from 64bit dll with polib ?
polib.exe and 64bit dll:
Polib: fatal error: Internal error (create_archive_file).

--- edit 22.10. ---
my libs from 64bit dll

1. dumpbin /exports /out:ntdll.def c:\windows\sysnative\ntdll.dll
2. convert def-fomat to polib-def-format (pb tool )

3. polib.exe /out:ntdll.lib /machine:x64 /def:ntdll.def

it works !

dumpbin.exe (part of vs c++ 2008)
+ mspdb80.dll
+ install dotnet 3.5 (dotNetFx35setup.exe)