3

I am new to Windows driver development and minifilters and I am trying to build the nullFilter sample using command line tools. So I added #pragma comment(lib, "FltMgr.lib") to the .c file and issued the following commands successfully:

cl.exe /nologo /Fo../../bin\filter.obj /c filter.c /D _AMD64_
rc.exe /nologo /Fo../../bin\filter.res filter.rc

However, when I try to create the sys file:

link.exe /nologo /DRIVER:WDM /out:../../bin\filter.sys ../../bin\filter.obj ../../bin\filter.res
LINK : error LNK2001: unresolved external symbol NtProcessStartup
../../bin\filter.sys : fatal error LNK1120: 1 unresolved externals

I am using VS2012 Express and WDM8. My LIB environment variable is:

C:\Program Files (x86)\Windows Kits\8.0\Lib\win8\um\x64;C:\Program Files (x86)\Microsoft Visual Studio 11.0\VC\lib\amd64;C:\Program Files (x86)\Windows Kits\8.0\Lib\win8\km\x64;

What am I doing wrong? Am I missing something?

LPs
  • 16,045
  • 8
  • 30
  • 61
user1973167
  • 45
  • 6

1 Answers1

5

NtProcessStartup function is to driver development what 'main' is for regular C programs. In other words, it is the program entry function that you need to provide yourself. See the article here for an introduction and explanation of this function. You can overrule the name of the startup function by using the -entry linker option. Setting '-entry:DriverEntry' is a common practice for driver development.

Ton Plooij
  • 2,583
  • 12
  • 15
  • Hi. I am facing a similar problem as above. My problem is explained in detail in the below link: http://stackoverflow.com/questions/37584201/winrt-library-not-working-in-release-mode As per your advice, I tried adding the /entry:DriverEntry in my project's Linker menu. But now I am getting an error as error LNK2001: unresolved external symbol _DriverEntry Can you tell me where I am going wrong.? – jain Jun 02 '16 at 10:00
  • See my answer to the question in the link you gave. You're not supposed to get a NtProcessStartup error for non-device driver applications. – Ton Plooij Jun 02 '16 at 11:16