Unresolved external symbol for NtResumeProcess

Asked Feb 06 '20 at 11:48

Active Feb 06 '20 at 15:46

Viewed 29 times

I am developing software which must log in to an Active Directory with the following credentials:

Username
Domain Name
NTLM password

This is my code:

if (OpenProcessToken(process_infos.hProcess, TOKEN_READ | (is_impersonate ? TOKEN_DUPLICATE : 0), &handle_token))
{
    if (GetTokenInformation(handle_token, TokenStatistics, &token_status, sizeof(token_status), &needed_size))
    {
        NtResumeProcess(process_infos.hProcess);
    }
}

After successful authentication, it should run a process with the authenticated token. However, in the program, I wanted to use NtResumeProcess, but when I use it, the compiler gives me the following error:

Error LNK2019 unresolved external symbol "long __cdecl NtResumeProcess(void *)" (?NtResumeProcess@@YAJPEAX@Z) referenced in function "void __cdecl Dispatcher(void)" (?Dispatcher@@YAXXZ)

How should I resolve this problem?

edited Feb 06 '20 at 15:46

Remy Lebeau

555,201
31
458
770

asked Feb 06 '20 at 11:48

NtResumeProcess is an undocumented API so you'll need to find out which library it lives in – Alan Birtles Feb 06 '20 at 11:51
Looks like you need to load it yourself using GetProcAddress: https://github.com/xilun/cbwin/blob/master/outbash/ntsuspend.cpp – Alan Birtles Feb 06 '20 at 11:53
2

at first you wrong declare `NtResumeProcess`- must me *extern "C"* and *__stdcall* aka `NTAPI` or `WINAPI`. at second - link with *ntdll.lib* or *ntdllp.lib* – RbMm Feb 06 '20 at 11:53
1

@AlanBirtles -nothing need to *load* – RbMm Feb 06 '20 at 11:54
Try linking to ntdll.lib – Steve Feb 06 '20 at 11:55
anyway i not understand - for what you need `NtResumeProcess` – RbMm Feb 06 '20 at 11:55
@RbMm Thank you, brother. I use extern "C" and my problem is fixed now. The program compiled successfully. – Feb 06 '20 at 12:06
@RbMm In mimikatz project which I used it for my study, It uses this api. – Feb 06 '20 at 12:06
1

*It uses this api* - this not mean that you must do this. you must understand what you doing and for what – RbMm Feb 06 '20 at 12:12

Unresolved external symbol for NtResumeProcess

0 Answers0