尝试链接 C++ 和程序集 (GCC x86) 时未定义的引用

Question

So I'm trying to make NTDLL Syscalls using Assembly and linking in my C++ project but every time I compile I get a:(.text+0xf2b): undefined reference to `NtClose@4'

(Using NtClose as an example, every function I try to call from assembly on C++ I get this)

Syscalls.S:

.text
    .global NtClose

NtClose:
    movl    $0x3000F,       %eax
    movl    $0x4B307170,    %edx
    call    *%edx
    ret     $4

Typedef (Syscalls.h):

EXTERN_C NTSTATUS NTAPI NtClose(IN HANDLE ObjectHandle);

Calling like this (Injection.cpp):

NtClose(Thread);

Compiling with:

CC=gcc
CXX=g++

$(ASM_OBJ_FILES): $(OBJ_DIR)/%.o: %.S
    $(CC) -c $< -o $@

$(CPP_OBJ_FILES): $(OBJ_DIR)/%.o: %.cpp
    $(CXX) $(CXXFLAGS) -c $< -o $@

And linking like this:

$(OUT): $(OBJ_FILES)
    $(CXX) $^ -o $@ $(LNKFLAGS)

Yes I am including Syscalls.h

Answer 1

NTAPI (in fact all stdcall ) functions are decorated with @N where N stands for number of arguments. So you'll need to modify name of function accordingly.