MPClient.h missing from Windows 8.1 and 10 SDK

Question

MPClient.h missing from Windows 8.1 and 10 SDK

Alexander Benikowski 11

Hi,
We want to use the Windows Defender API as documented here:
https://learn.microsoft.com/en-us/windows/win32/lwef/windows-defender-functions

However the given headerfile MPClient.h is missing. In both, WIndows 8.1 SDK and the current Windows 10 SDK.
The main reason for using the header file, or looking into it, is that the type MPCallback_Info, as mentioned on MpScanStart, is not described anywhere.
https://learn.microsoft.com/en-us/windows/win32/lwef/mpscanstart
And ofcourse to get the values behind the documented enumeration values.

Castorix31 90,521 Reputation points

2020-10-14T11:36:23.403+00:00

This had been asked 3 years ago :
Windows Defender - can't locate MpClient.h

Someone from MS should fix this problem....
Rita Han - MSFT 2,171 Reputation points

2020-10-15T01:28:14.443+00:00

Hello @Alexander Benikowski thanks for reporting this issue. I've submitted it internally.

If the answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Alexander Benikowski 11 Reputation points

2020-10-19T08:25:09.943+00:00

Hello RitaHan,
In case the SDKs and Documentation get updated, which could take some time, is it possible for us to get our hands on the header file seperately?
We'd switch to the copy included in future SDK releases later on but could start working on our project sooner.
Rita Han - MSFT 2,171 Reputation points

2020-10-20T03:23:35.857+00:00

I understand your concern and will try my best to report this issue. However, since Windows Defender is legacy feature and lack of some official documents about related definitions (like MPHANDLE, MPSCAN_TYPE etc.), so it is not suggested to make the header file by yourself or use it before we can confirm that these APIs are official public supported.
Alexander Benikowski 11 Reputation points

2020-10-22T14:02:38.237+00:00

So this means, the documented APIs on MSDN, while somewhat documented, are (maybe) not publicly supported?
EDIT: If this API is not supposed to be used, is there an appropiate replacement? Like for running scans (with specific settings) or getting the quarantined threats?
Rita Han - MSFT 2,171 Reputation points

2020-10-23T01:34:10.88+00:00

Because lack of related documents so we need further confirmation. For replacement, you can check Antimalware Scan Interface (AMSI) to see if it helps.
Alexander Benikowski 11 Reputation points

2020-10-26T13:51:33.687+00:00

Ah.
Thanks for the fast reply.
AMSI does help in case we want to run a scan. But it doesn't seem to support querying quarantine information. That's something we're still looking for atm.
Rita Han - MSFT 2,171 Reputation points

2020-10-27T02:05:01.27+00:00

Which API did you use for querying quarantine information?
Alexander Benikowski 11 Reputation points

2020-10-27T17:15:09.733+00:00

MpThreatOpen with MPTHREAT_SOURCE_QUARANTINE and enumerate using MpThreatEnumerate
However since the headerfile is missing, and therefore the official values for constants like MPTHREAT_SOURCE_QUARANTINE from MPTHREAT_SOURCE are nowhere to be found, officially, we used some user generated headers. However the output of MpThreatEnumerate never looked convincing. The memory seemed half uninitialized and random.
That's why we're unsure if our declarations are correct. Did we use the wrong constant value? What is MP_MIDL_STRING and how does it affect a struct?
Lav verma 0 Reputation points

2023-09-07T08:28:50.16+00:00

I think This issue is still there because I'm facing the same, that MPClient.h missing from Windows 10 SDK If there is any improvement so please give information regarding this

1 answer

Your answer

Castorix31 90,521 Reputation points

2020-10-14T11:36:23.403+00:00

This had been asked 3 years ago :
Windows Defender - can't locate MpClient.h

Someone from MS should fix this problem....
Rita Han - MSFT 2,171 Reputation points

2020-10-15T01:28:14.443+00:00

Hello @Alexander Benikowski thanks for reporting this issue. I've submitted it internally.

If the answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Alexander Benikowski 11 Reputation points

2020-10-19T08:25:09.943+00:00

Hello RitaHan,
In case the SDKs and Documentation get updated, which could take some time, is it possible for us to get our hands on the header file seperately?
We'd switch to the copy included in future SDK releases later on but could start working on our project sooner.
Rita Han - MSFT 2,171 Reputation points

2020-10-20T03:23:35.857+00:00

I understand your concern and will try my best to report this issue. However, since Windows Defender is legacy feature and lack of some official documents about related definitions (like MPHANDLE, MPSCAN_TYPE etc.), so it is not suggested to make the header file by yourself or use it before we can confirm that these APIs are official public supported.
Alexander Benikowski 11 Reputation points

2020-10-22T14:02:38.237+00:00

So this means, the documented APIs on MSDN, while somewhat documented, are (maybe) not publicly supported?
EDIT: If this API is not supposed to be used, is there an appropiate replacement? Like for running scans (with specific settings) or getting the quarantined threats?
Rita Han - MSFT 2,171 Reputation points

2020-10-23T01:34:10.88+00:00

Because lack of related documents so we need further confirmation. For replacement, you can check Antimalware Scan Interface (AMSI) to see if it helps.
Alexander Benikowski 11 Reputation points

2020-10-26T13:51:33.687+00:00

Ah.
Thanks for the fast reply.
AMSI does help in case we want to run a scan. But it doesn't seem to support querying quarantine information. That's something we're still looking for atm.
Rita Han - MSFT 2,171 Reputation points

2020-10-27T02:05:01.27+00:00

Which API did you use for querying quarantine information?
Alexander Benikowski 11 Reputation points

2020-10-27T17:15:09.733+00:00

MpThreatOpen with MPTHREAT_SOURCE_QUARANTINE and enumerate using MpThreatEnumerate
However since the headerfile is missing, and therefore the official values for constants like MPTHREAT_SOURCE_QUARANTINE from MPTHREAT_SOURCE are nowhere to be found, officially, we used some user generated headers. However the output of MpThreatEnumerate never looked convincing. The memory seemed half uninitialized and random.
That's why we're unsure if our declarations are correct. Did we use the wrong constant value? What is MP_MIDL_STRING and how does it affect a struct?
Lav verma 0 Reputation points

2023-09-07T08:28:50.16+00:00

I think This issue is still there because I'm facing the same, that MPClient.h missing from Windows 10 SDK If there is any improvement so please give information regarding this

Answer 1

Reza-Ameri 17,336 Volunteer Moderator

All of these documents are in GitHub, you may try visit their GitHub page and report this as an issue, so they will investigate and update the document, for example take a look at:
https://github.com/MicrosoftDocs/win32/blob/docs/desktop-src/lwef/mpscanstart.md

Share via

MPClient.h missing from Windows 8.1 and 10 SDK

1 answer

Your answer