4 ms·
The syscall api is in ntdll.dll (and user32.dll for win32k.sys calls). kernel32 does not know the syscall numbers, it just calls functions in ntdll.
by poizan42 6y ago
The syscall api is in ntdll.dll (and user32.dll for win32k.sys calls). kernel32 does not know the syscall numbers, it just calls functions in ntdll.
- my123 6y agoBefore, it used to be user32.dll/gdi32.dll calling directly while also having tons of logic inside. Nowadays, it's split up as it should always have been, with the path being user32.dll -> win32u.dll -> win32k.sys.
- poizan42 6y agoAh yes forgot about that. The kernel side has also been split up into win32kbase.sys and win32kfull.sys/win32kmin.sys (I think win32kmin may have only been used for the now discontinued Windows 10 Mobile), and win32k.sys just calls into those.