我的Build无法在未安装visual studio的计算机上运行

Question

大家好，我已经通过挂接两个函数开发了一个构建，这两个函数是1）NtCreateFile和2） NtSetInformationFile用于监视文件Raname、Delete、Create。它在安装了visualstudio的windows-7 32和64位上运行良好，但如果没有安装visualstudio，它就不能在同一个平台上运行。请帮助我。我的代码如下

#include "stdafx.h"
#include <windows.h>
#include "MinHook.h"
#include <Winternl.h>
#include <stdio.h>
#include <shlwapi.h>
#include <tchar.h>
#include <string.h>

#if defined _M_X64
#pragma comment(lib, "libMinHook.x64.lib")
#elif defined _M_IX86
#pragma comment(lib, "libMinHook.x86.lib")
#endif

#define FILE_SUPERSEDED                         0x00000000
#define FILE_OPENED                             0x00000001
#define FILE_CREATED                            0x00000002
#define FILE_OVERWRITTEN                        0x00000003
#define FILE_EXISTS                             0x00000004
#define FILE_DOES_NOT_EXIST                     0x00000005
#define FILE_RENAMED 10
#define FILE_DELETED 13
#define FILE_MODIFIED 19
enum OBJECT_INFORMATION_CLASS 
{ 
ObjectNameInformation = 1
};
struct MOUNTMGR_TARGET_NAME 
{
USHORT DeviceNameLength; 
WCHAR DeviceName[1]; 
};
struct MOUNTMGR_VOLUME_PATHS 
{ 
ULONG MultiSzLength; 
WCHAR MultiSz[1];
};
struct FILE_NAME_INFORMATION 
{ 
ULONG FileNameLength;
WCHAR FileName[1];
};
union ANY_BUFFER 
{
WCHAR Buffer[USHRT_MAX];
MOUNTMGR_TARGET_NAME TargetName;
MOUNTMGR_VOLUME_PATHS TargetPaths;
FILE_NAME_INFORMATION NameInfo;
UNICODE_STRING UnicodeString;
};
typedef struct _FILE_RENAME_INFORMATION 
{
BOOLEAN ReplaceIfExists;
HANDLE  RootDirectory;
ULONG   FileNameLength;
WCHAR   FileName[1];
} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
extern "C" NTSYSAPI NTSTATUS NTAPI NtQueryObject(HANDLE Handle OPTIONAL, OBJECT_INFORMATION_CLASS ObjectInformationClass, PVOID ObjectInformation OPTIONAL, ULONG ObjectInformationLength, PULONG ReturnLength OPTIONAL);
extern "C" NTSYSAPI NTSTATUS NTAPI NtCreateFile(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes,
                                 PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes,
                                 ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength);
extern "C" NTSYSAPI NTSTATUS NTAPI NtSetInformationFile(HANDLE FileHandle, PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation,
                                         ULONG Length, FILE_INFORMATION_CLASS FileInformationClass);
//AnsiToUnicode Function ;
HRESULT __fastcall AnsiToUnicode(LPCSTR pszA, LPOLESTR* ppszW)
{
ULONG cCharacters;
DWORD dwError;
if (NULL == pszA)
{
    *ppszW = NULL;
    return NOERROR;
}
cCharacters =  strlen(pszA) + 1;
*ppszW = (LPOLESTR) CoTaskMemAlloc(cCharacters*2);
if (NULL == *ppszW)
    return E_OUTOFMEMORY;
// Covert to Unicode.
if (0 == MultiByteToWideChar(CP_ACP, 0, pszA, cCharacters, *ppszW, cCharacters))
{
    dwError = GetLastError();
    CoTaskMemFree(*ppszW);
    *ppszW = NULL;
    return HRESULT_FROM_WIN32(dwError);
}
return NOERROR;
}
//UnicodeToAnsi Function;
HRESULT __fastcall UnicodeToAnsi(LPCOLESTR pszW, LPSTR* ppszA)
{
ULONG cbAnsi, cCharacters;
DWORD dwError;
if (pszW == NULL)
{
    *ppszA = NULL;
    return NOERROR;
}
cCharacters = wcslen(pszW) + 1;  
cbAnsi = cCharacters*2;
*ppszA = (LPSTR) CoTaskMemAlloc (cbAnsi);
if (NULL == *ppszA)
    return E_OUTOFMEMORY;
// Convert to ANSI.
if (0 == WideCharToMultiByte(CP_ACP, 0, pszW, cCharacters, *ppszA, cbAnsi, NULL, NULL))
{
    dwError = GetLastError();
    CoTaskMemFree(*ppszA);
    *ppszA = NULL;
    return HRESULT_FROM_WIN32(dwError);
}
return NOERROR;
}
char *replace(const char *s, const char *old, const char *newstr)
{
char *ret = NULL, *sr = NULL;
size_t i, count = 0;
size_t newlen = strlen(newstr);
size_t oldlen = strlen(old);
if (newlen != oldlen)
{
    for (i = 0; s[i] != ''; ) 
    {
        if (memcmp(&s[i], old, oldlen) == 0)
            count++, i += oldlen;
        else
            i++;
    }
}
else
    i = strlen(s);
ret = (char*) malloc(i + 1 + count * (newlen - oldlen));
if (ret == NULL)
    return NULL;
sr = ret;
while (*s)
{
    if (memcmp(s, old, oldlen) == 0)
    {
        memcpy(sr, newstr, newlen);
        sr += newlen;
        s += oldlen;
    }
    else
        *sr++ = *s++;
}
*sr = '';
return ret;
}
void GetFileNameFromVolumeName(wchar_t * VolumeName, wchar_t * FilePath)
{
wchar_t *Ptr = NULL ;
if ((Ptr = StrStrIW(VolumeName, L"\device\mup"))!= NULL)
{ 
    wcscpy(FilePath, Ptr + 11);
    return;
}
if ((Ptr = StrStrIW(VolumeName, L"\??\UNC"))!= NULL)
{
    wcscpy(FilePath, Ptr + 7);
    return;
}   
if ((Ptr = StrStrIW(VolumeName, L"\??\"))!= NULL)
{
    wcscpy(FilePath, Ptr + 4);
    return;
}
}
void GetFileNameFromDeviceName (wchar_t * DevicePath,wchar_t * FilePath)
{
int i, j = 0;
DWORD  test, mydrives = 100;
wchar_t *lpBuffer = new wchar_t[100];
wchar_t *lpTargetPath = new wchar_t[1000];
wchar_t *drives = new wchar_t[26];
wchar_t *str1 = new wchar_t[512] ;
wchar_t *pch;
test = GetLogicalDriveStringsW(mydrives, lpBuffer);
if (test != 0)
{
    for (i = 0; i < 100; i += 4)
    {
        wsprintf(drives + j,L"%c:", lpBuffer[i]);
        if (wcslen(drives + j) == 0) break;
        QueryDosDeviceW((LPCWSTR)drives + j, lpTargetPath, 1000);
        if ((pch = StrStrIW(DevicePath, lpTargetPath)) != NULL)
        {
            wcscpy(str1, drives + j);
            wcsncat(str1, DevicePath + wcslen(lpTargetPath), wcslen(DevicePath) - wcslen(lpTargetPath));
            wcscpy(FilePath, str1);
            delete drives;
            delete str1 ;
            break;
        }
        j+= 2;
    }
    delete lpBuffer;
    delete lpTargetPath;
}
}
void GetFilePath(HANDLE hFile, wchar_t *filename)
{
static ANY_BUFFER nameFull, nameRel, nameMnt;
ULONG returnedLength; 
NTSTATUS status;
status = NtQueryObject(hFile, ObjectNameInformation, nameFull.Buffer, sizeof(nameFull.Buffer), &returnedLength);
wchar_t *ptr = wcschr(nameFull.UnicodeString.Buffer, L'\');
if (StrStrIW(ptr, L"device\mup") == NULL)
    GetFileNameFromDeviceName(ptr, filename);
else
    GetFileNameFromVolumeName(ptr, filename);
}
typedef NTSTATUS(WINAPI *NtCreateFileNext)(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes,
                                       PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes,
                                       ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength);
NtCreateFileNext Real_NtCreateFileData = NULL;
NTSTATUS WINAPI NtCreateFileCallback(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes,
                                 PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes,
                                 ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength)
{
LPSTR  buff = NULL ;
HRESULT res = 0;
LPOLESTR AnsiToUniBuf = {0};
NTSTATUS status;
POBJECT_ATTRIBUTES OAttributes ; 
status = Real_NtCreateFileData(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
char * buffer = new char [MAX_PATH];
char * buff2  = new char [MAX_PATH];
wchar_t  *FileCreated = new wchar_t[512];
if (IoStatusBlock->Information == FILE_CREATED)
{
    GetFileNameFromVolumeName(ObjectAttributes->ObjectName->Buffer, FileCreated); 
    MessageBoxW(NULL, FileCreated, L"Created", MB_OK);
    /*UnicodeToAnsi( ObjectAttributes->ObjectName->Buffer, &buff);
    for (int i = 0 ; i < strlen(buff) ; i++)
    {
        buff2[i] = tolower(buff[i]);
    }
    buffer = replace(buff2, "\??\c:", "\??\d:");
    AnsiToUnicode(buffer,&AnsiToUniBuf); 
    wcscpy(ObjectAttributes->ObjectName->Buffer, AnsiToUniBuf);*/
}
delete buffer;
delete buff2;
delete FileCreated;
return status;
}
typedef NTSTATUS(WINAPI *NtSetInformationFileNext)(HANDLE FileHandle, PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation,
                                               ULONG Length, FILE_INFORMATION_CLASS FileInformationClass);
NtSetInformationFileNext Real_NtSetInformationFileData = NULL;
NTSTATUS WINAPI NtSetInformationFileCallback(HANDLE FileHandle, PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation,
                                         ULONG Length, FILE_INFORMATION_CLASS FileInformationClass)
{
wchar_t  * renfrom = new wchar_t[512];
if (FileInformationClass == FILE_DELETED)
{
    memset(renfrom, 0, sizeof(wchar_t)*512);
    GetFilePath(FileHandle,renfrom);
    MessageBoxW(NULL, renfrom, L"Deleted File", MB_OK);
}
if (FileInformationClass == FILE_RENAMED)
{   
    memset(renfrom, 0, sizeof(wchar_t)*512);
    FILE_RENAME_INFORMATION *pInfo = NULL;
    pInfo=(PFILE_RENAME_INFORMATION)FileInformation;
    GetFilePath(FileHandle,renfrom);
    MessageBoxW(NULL, renfrom, L"Renamed From", MB_OK);
    memset(renfrom, 0, sizeof(wchar_t)*512);
    GetFileNameFromVolumeName(pInfo->FileName, renfrom);
    MessageBoxW(NULL, renfrom, L"Renamed To", MB_OK);   
}
if (FileInformationClass == FILE_MODIFIED)
{
    memset(renfrom, 0, sizeof(wchar_t)*512);
    GetFilePath(FileHandle,renfrom);
    MessageBoxW(NULL, renfrom, L"Modified File", MB_OK);
}
delete renfrom;
return Real_NtSetInformationFileData(FileHandle, IoStatusBlock, FileInformation, Length, FileInformationClass);
}
//DllMain Function 
BOOL APIENTRY DllMain(HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved)
{
//HINSTANCE hwnd = LoadLibraryA("ntdll.dll");
//if (hwnd != NULL)
//{
//  Actual_NtCreateFileData = (NtCreateFileNext)GetProcAddress(hwnd, "NtCreateFile");
//  //Actual_NtSetInformationFileData = (NtSetInformationFileNext)(hwnd, "NtSetInformationFile");
//}
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
    if (MH_Initialize() != MH_OK)
    {
        MessageBoxW(NULL, L"Failed Initialize", L"Info!", MB_ICONWARNING|MB_OK);    
    }
    if (MH_CreateHook(&NtCreateFile, &NtCreateFileCallback, reinterpret_cast<void**>(&Real_NtCreateFileData)) != MH_OK)
    {
        MessageBoxW(NULL, L"Failed CreateHook NtCreateFile", L"Info!", MB_ICONWARNING|MB_OK);
    }
    if (MH_EnableHook(&NtCreateFile) != MH_OK)
    {
        MessageBoxW(NULL, L"Failed EnableHook NtCreateFile", L"Info!", MB_ICONWARNING|MB_OK);
    }
    if (MH_CreateHook(&NtSetInformationFile, &NtSetInformationFileCallback, reinterpret_cast<void**>(&Real_NtSetInformationFileData)) != MH_OK)
    {
        MessageBoxW(NULL, L"Failed CreateHook NtSetInformationFile", L"Info!", MB_ICONWARNING|MB_OK);
    }
    if (MH_EnableHook(&NtSetInformationFile) != MH_OK)
    {
        MessageBoxW(NULL, L"Failed EnableHook NtSetInformationFile", L"Info!", MB_ICONWARNING|MB_OK);
    }
    break;
case DLL_PROCESS_DETACH:
    if (MH_Uninitialize() != MH_OK)
    {               
    }
    if (MH_DisableHook(&NtCreateFile) != MH_OK)
    {
    }
    if (MH_DisableHook(&NtSetInformationFile) != MH_OK)
    {
    }
    break;
}
return TRUE;
}

上面的代码构建良好，在构建之后，如果尝试在安装了visual studio的windows-7 32/64位上的资源管理器进程中注入此dll，则它正在注入并运行良好，但它没有在未安装visual studio的windows-7 32/64位元机的任何进程中注入。请帮助我

Answer 1

在不工作的机器上运行依赖性Walker。这将显示缺少哪些DLL：

http://www.dependencywalker.com