如何在windows中加载Native API？

Question

I wanted to find the address of some of API like NtUserMessageCall by using GetProcAddress. But this error appears: "The specified procedure could not be found."

HMODULE hUser32 = LoadLibrary(TEXT("User32.dll"));//handle user32
LPCSTR APIName = "NtUserMessageCall";
FARPROC function_address = GetProcAddress(hNtdll, APIName);//retrun Null
int temp = GetLastError();//Error 127
hUser32 = GetModuleHandle(TEXT("User32.dll"));//retrun Null
temp = GetLastError();//Error 127

Answer 1

user32.dll does not export NtUserMessageCall for public use (it is internal only), so you cannot get its address by name using GetProcAddress . You'll have to find another technique, like downloading and parsing the symbol file ( .PDB ) for the version of the DLL you're working with.

Answer 2

Should be set up like:

typedef unsigned __int64 QWORD;
typedef NTSTATUS(NTAPI* _NtUserMessageCall)(
HWND, UINT, WPARAM, LPARAM, DWORD, DWORD, QWORD);

char sNtUserMessageCall[] = { 'N', 't', 'U', 's', 'e', 'r', 'M', 'e', 's', 's', 'a', 'g', 'e', 'C', 'a', 'l', 'l', 0x0 };

static auto NtUserMessageCall = (_NtUserMessageCall)GetProcAddress(GetModuleHandleW("Ntdll.dll"), sNtUserMessageCall);