3 ms·

> That said, these rely on USER.32.DLL and KERNEL32.DLL to do the majority of the heavy lifting. Since the low-level Windows kernel API is undocumented and non

• Pannoniae 1mo ago
  no, you can also call ntdll (or even syscalls although those aren't stable), there's plenty of documentation on the internet but also why would you, not much point except for very niche functionality
  • skrellm 1mo ago
    > no, you can also call ntdll (or even syscalls although those aren't stable), there's plenty of documentation on the internet I mean officially. Yes, you can find some on the internet, but nothing on the official MSDN. > but also why would you, not much point except for very niche functionality Exactly. Using system DLL API is backward and forward compatible, and just as standardized and well-documented as the POSIX API. I see no problem relying on it. (Sidenote: as a bonus, MSDN is surprisingly good, understandable, well organized, lots of examples. I rarely say this, but well done MS, that's how a dev doc should be.)
    • Someone 1mo ago
      >> no, you can also call ntdll (or even syscalls although those aren't stable), there's plenty of documentation on the internet > I mean officially. Yes, you can find some on the internet, but nothing on the official MSDN. It seems that changed. https://learn.microsoft.com/en-us/windows/win32/devnotes/ntqueryattributesfile https://learn.microsoft.com/en-us/windows/win32/devnotes/ntq... says [This function may be changed or removed from Windows without further notice.] but it on the official MSDN site, and it does document a call in Ntdll.dll. It’s easy to find many more examples such as https://learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-rtlchartointeger https://learn.microsoft.com/en-us/windows/win32/api/winternl..., so I don’t think that’s an accident.
      • not_a9 1mo ago
        In addition a bunch are documented in the driver docs, such as https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwmapviewofsection https://learn.microsoft.com/en-us/windows-hardware/drivers/d.... > If the call to this function occurs in user mode, you should use the name "NtMapViewOfSection" instead of "ZwMapViewOfSection".
      • skrellm 1mo ago
        > but it on the official MSDN site, and it does document a call in Ntdll.dll. Does it? What's FILE_BASIC_INFORMATION? Link gives me 404. How do you replace kernel32 API with this? > It’s easy to find many more examples such as https://learn.microsoft.com/en-us/windows/win32/api/winternl https://learn.microsoft.com/en-us/windows/win32/api/winternl..., so I don’t think that’s an accident. Again, how do you replace kernel32 API with this? > In addition a bunch are documented in the driver docs, such as https://learn.microsoft.com/en-us/windows-hardware/drivers/d https://learn.microsoft.com/en-us/windows-hardware/drivers/d.... This has nothing to do with ntdll at all. I still don't get it, what's wrong with using the user32 and kernel32 APIs? It's stable, well-documented, and is the official API on Windows. So why not use it?
        • not_a9 1mo ago
          > This has nothing to do with ntdll at all. I can only wonder where `NtMapViewOfSection` could be exported from...
          • skrellm 24d ago
            Yeah, but the link talks about `ZwMapViewOfSection`. From that page: > For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. How "differently" exactly? That's undocumented. And lots of other small (but very important) details are undocumented as well.
            • not_a9 23d ago