Source
r/C_Programming•
blabbities

typedef question

Question

Im looking at (Win32 C) code and I see this typedef declaration:

typedef NTSTATUS(WINAPI* NtQueryInformationProcess_t)(
    IN HANDLE,
    IN PROCESSINFOCLASS,
    OUT PVOID,
    IN ULONG,
    OUT PULONG
    );

So the old datatype is NTSTATUS. This person is changing it to what though?

There doesnt seem to be a new identifier/alias and I dont understand why this is done.

Posted Apr 9, 2022, 7:53 PM UTC

14
[deleted]•

It is changed into NtQueryInformationProcess_t, the original type was a function pointer that takes in the 5 arguments and returns something of type NTSTATUS.

1
blabbitiesOP•

Thanks for you input. One more thing

the original type was a function pointer that takes in the 5 arguments and returns something of type NTSTATUS.

So the alias is NtQueryInformationProcess_t.... but what is the original type? There is nothing inbetween the "NTSTATUS(WINAPI* NtQueryInformationProcess_t)" and typedef for the original type

1
chernicals•

The original type is NTSTATUS (WINAPI*)(
IN HANDLE,
IN PROCESSINFOCLASS,
OUT PVOID,
IN ULONG,
OUT PULONG
); or a pointer to a WINAPI function that takes five arguments and returns an NTSTATUS

typedef for function pointers works by putting the name of the alias where the name of the function pointer would normally go.

1
aioeu•

You may be getting confused because of the WINAPI macro there. It looks like the name of another type — "OK, we've got a WINAPI pointer and, err, what?"

WINAPI isn't a type. It actually provides a function attribute. If you were to write this whole thing out without WINAPI it might be clearer what's going on. (The WINAPI is needed though: it overrides the calling convention should something call functions of this type.)

1