Comment by skrellm | Hacker News Reader

Comment by skrellm | Hacker News Reader

Parent Full thread

> but it on the official MSDN site, and it does document a call in Ntdll.dll.

Does it? What's FILE_BASIC_INFORMATION? Link gives me 404. How do you replace kernel32 API with this?

> It’s easy to find many more examples such as https://learn.microsoft.com/en-us/windows/win32/api/winternl..., so I don’t think that’s an accident.

Again, how do you replace kernel32 API with this?

> In addition a bunch are documented in the driver docs, such as https://learn.microsoft.com/en-us/windows-hardware/drivers/d....

This has nothing to do with ntdll at all.

I still don't get it, what's wrong with using the user32 and kernel32 APIs? It's stable, well-documented, and is the official API on Windows. So why not use it?

> This has nothing to do with ntdll at all.

I can only wonder where `NtMapViewOfSection` could be exported from...

Yeah, but the link talks about `ZwMapViewOfSection`. From that page:

> For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters.

How "differently" exactly? That's undocumented. And lots of other small (but very important) details are undocumented as well.

> PS C:\Program Files\Microsoft Visual Studio\18\Community> dumpbin.exe /EXPORTS C:\Windows\System32\ntdll.dll | rg ZwMapViewOfSection

       2072  80F 001612B0 ZwMapViewOfSection

       2073  810 00163160 ZwMapViewOfSectionEx

> PS C:\Program Files\Microsoft Visual Studio\18\Community> dumpbin.exe /EXPORTS C:\Windows\System32\ntdll.dll | rg NtMapViewOfSection

        425  1A0 001612B0 NtMapViewOfSection

        426  1A1 00163160 NtMapViewOfSectionEx

> How "differently" exactly? That's undocumented.

https://learn.microsoft.com/en-us/windows-hardware/drivers/k...

Reply on news.ycombinator.com