Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame

Question

I'd like to use some undocumented symbols that listed in ProcessHacker project. taken from Here:

https://github.com/processhacker/processhacker/blob/master/phnt/include/ntpebteb.h#L241 https://github.com/processhacker/processhacker/blob/master/phnt/include/ntrtl.h#L7156

However, I don't know to which dll do they belong...

In project readme page, it's said that I only need the latest windows SDK, but after compilation I get :

Severity    Code    Description Project File    Line    Suppression State

Error   LNK2019 unresolved external symbol "__declspec(dllimport) struct 
_TEB_ACTIVE_FRAME * __cdecl RtlGetFrame(void)" (__imp_?
RtlGetFrame@@YAPEAU_TEB_ACTIVE_FRAME@@XZ) referenced in function "public: static
 struct _TEB_ACTIVE_FRAME * __cdecl _RTL_FRAME::get(struct 
_TEB_ACTIVE_FRAME_CONTEXT const *)" (?
get@_RTL_FRAME@@SAPEAU_TEB_ACTIVE_FRAME@@PEBU_TEB_ACTIVE_FRAME_CONTEXT@@@Z) 
TestReentrancy  C:\projects\2.3\unit_tests\InjectionTest\Project1\main.obj  1   

Perhaps anybody can tell me how to adjust my project configuration to make it work ? thanks !

Answer 1

Those functions are exported from ntdll.dll file. To link with those functions, add #pragma comment (lib, "ntdll.lib") in the source file. Or in Visual Studio, first check the active Configuration and Platform. Then add the library in Project > Properties > Linker > Input > Additional Dependencies. For example, like this %(AdditionalDependencies); ntdll.lib. For mingw, cygwin, msys2 etc. toolchains (where GCC is used), use -lntdll option in command.

Or the functions can be written directly in the source code also without importing those from ntdll. Those functions use members from Thread Information Block (TEB) as follows:

PTEB_ACTIVE_FRAME RtlGetFrame()
{
    return NtCurrentTeb()->ActiveFrame;
}

void RtlPushFrame(PTEB_ACTIVE_FRAME Frame)
{
    struct _TEB *Teb;

    Teb = NtCurrentTeb();
    Frame->Previous = Teb->ActiveFrame;
    Teb->ActiveFrame = Frame;
}

void RtlPopFrame(PTEB_ACTIVE_FRAME Frame)
{
NtCurrentTeb()->ActiveFrame = Frame->Previous;
}