3 ms·

I think NT syscalls can change. https://j00ru.vexillium.org/syscalls/nt/64/ https://j00ru.vexillium.org/syscalls/nt/64/ You're meant to go through ntdll.dll, b

I think NT syscalls can change. https://j00ru.vexillium.org/syscalls/nt/64/ https://j00ru.vexillium.org/syscalls/nt/64/ You're meant to go through ntdll.dll, but even that interface is documented as private/unstable.

caspper69 2y ago
You're absolutely right, they can. And they have. But the reality is more like this: https://xkcd.com/1172/ https://xkcd.com/1172/
immibis 2y ago
You're meant to go through published interfaces, such as the ones in kernel32.dll. ntdll is an implementation detail and so are syscalls.