I'd like to use some undocumented symbols that listed in ProcessHacker project. taken from Here:

https://github.com/processhacker/processhacker/blob/master/phnt/include/ntpebteb.h#L241 https://github.com/processhacker/processhacker/blob/master/phnt/include/ntrtl.h#L7156

However, I don't know to which dll do they belong...

In project readme page, it's said that I only need the latest windows SDK, but after compilation I get :

Severity    Code    Description Project File    Line    Suppression State

Error   LNK2019 unresolved external symbol "__declspec(dllimport) struct 
_TEB_ACTIVE_FRAME * __cdecl RtlGetFrame(void)" (__imp_?
RtlGetFrame@@YAPEAU_TEB_ACTIVE_FRAME@@XZ) referenced in function "public: static
 struct _TEB_ACTIVE_FRAME * __cdecl _RTL_FRAME::get(struct 
TestReentrancy  C:\projects\2.3\unit_tests\InjectionTest\Project1\main.obj  1   

Perhaps anybody can tell me how to adjust my project configuration to make it work ? thanks !


1 Answer 1


Those functions are exported from ntdll.dll file. To link with those functions, add #pragma comment (lib, "ntdll.lib") in the source file. Or in Visual Studio, first check the active Configuration and Platform. Then add the library in Project > Properties > Linker > Input > Additional Dependencies. For example, like this %(AdditionalDependencies); ntdll.lib. For mingw, cygwin, msys2 etc. toolchains (where GCC is used), use -lntdll option in command.

Or the functions can be written directly in the source code also without importing those from ntdll. Those functions use members from Thread Information Block (TEB) as follows:

    return NtCurrentTeb()->ActiveFrame;

void RtlPushFrame(PTEB_ACTIVE_FRAME Frame)
    struct _TEB *Teb;

    Teb = NtCurrentTeb();
    Frame->Previous = Teb->ActiveFrame;
    Teb->ActiveFrame = Frame;

void RtlPopFrame(PTEB_ACTIVE_FRAME Frame)
NtCurrentTeb()->ActiveFrame = Frame->Previous;
  • Btw, this works for a (quite a) handful of functions, but last I checked the ntdll.lib was fairly incomplete.
    – 0xC0000022L
    Jan 22, 2022 at 23:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.