> it’s very rare to call ntdll or to make system calls directly Until you need to do something that's not possible through kernel32.dll. Sometimes I've called

> it’s very rare to call ntdll or to make system calls directly Until you need to do something that's not possible through kernel32.dll. Sometimes I've called ntdll.dll directly to support older Windows versions.