NTDLL.dll3 : Export Function

最新推荐文章于 2024-03-04 11:09:09 发布

zhou191954

最新推荐文章于 2024-03-04 11:09:09 发布

阅读量2k

点赞数

分类专栏： NT-Kernel

NT-Kernel 专栏收录该内容

30 篇文章

订阅专栏

2004 Loader APIs

API	NTDLL APIs
LoadResource	LdrAccessResource LdrAlternateResourcesEnabled
DisableThreadLibraryCalls	LdrDisableThreadCalloutsForDll LdrEnumResources LdrFindAppCompatVariableInfo LdrFindEntryForAddress
EnumResourceTypesW	LdrFindResourceDirectory_U
FindResourceExA	LdrFindResource_U LdrFlushAlternateResourceModules LdrGetAlternateResourceModuleHandle
GetModuleHandleForUnicodeString	LdrGetDllHandle
GetProcAddress	LdrGetProcedureAddress LdrInitializeThunk
LoadLibraryEx (LOAD_LIBRARY_AS_DATAFILE)	LdrLoadAlternateResourceModule
LoadLibrary	LdrLoadDll LdrProcessRelocationBlock LdrQueryApplicationCompatibilityGoo LdrQueryImageFileExecutionOptions LdrQueryProcessModuleInformation LdrRelocateImage
ExitProcess	LdrShutdownProcess
ExitThread	LdrShutdownThread LdrUnloadAlternateResourceModule
FreeLibrary	LdrUnloadDll LdrVerifyImageMatchesChecksum LdrVerifyMappedImageMatchesChecksum

Figure 2 Private Loader APIs

LdrpAccessResourceData
LdrpAllocateDataTableEntry
LdrpAllocateTls
LdrpCallInitRoutine
LdrpCallTlsInitializers
LdrpCheckForKnownDll
LdrpCheckForLoadedDll
LdrpCheckForLoadedDllHandle
LdrpClearLoadInProgress
LdrpCompareResourceNames_U
LdrpCreateDllSection
LdrpDefineDllTag
LdrpDllTagProcedures
LdrpDphDetectSnapRoutines
LdrpDphInitializeTargetDll
LdrpDphSnapImports
LdrpFetchAddressOfEntryPoint
LdrpForkProcess
LdrpFreeTls
LdrpGetProcedureAddress
LdrpInitializationFailure
LdrpInitialize
LdrpInitializeProcess
LdrpInitializeThread
LdrpInitializeTls
LdrpInsertMemoryTableEntry
LdrpLoadDll
LdrpLoadImportModule
LdrpMapDll
LdrpNameToOrdinal
LdrpRelocateStartContext
LdrpResolveDllName
LdrpRunInitializeRoutines
LdrpSearchResourceSection_U
LdrpSetAlternateResourceModuleHandle
LdrpSetProtection
LdrpSnapIAT
LdrpSnapThunk
LdrpTagAllocateHeap0...LdrpTagAllocateHeap63
LdrpTagAllocateHeap
LdrpUpdateLoadCount
LdrpValidateImageForMp
LdrpWalkImportDescriptor

Figure 3 Internal Loader Routines

#1 - LoadLibraryExW 3rd parameter is 0:
LdrLoadDll (0x77f889a9)
    LdrpLoadDll 0x77f887e0
        LdrpCheckForLoadedDll (0x77f87122)
        LdrpMapDll (0x77f8bc77)
            LdrpCheckForKnownDll (0x77f8c62b)
            LdrpResolveDllName (0x77f8c3df)
            LdrpCreateDllSection (0x77f8c355)
            LdrpAllocateDataTableEntry (0x77f8be69)
            LdrpFetchAddressOfEntryPoint (0x77f8bf23)
            LdrpInsertMemoryTableEntry (0x77f8bebb)
        LdrpWalkImportDescriptor (0x77f8be15)
            LdrpLoadImportModule (0x77f8bfd1)
                *LdrpCheckForLoadedDll
            LdrpSnapIAT (0x77f8c047)
                LdrpSnapThunk (0x77f87bd1)
                    LdrpNameToOrdinal (0x77f87cf0)
                    **LdrpLoadDll
                    LdrpGetProcedureAddress (0x77f87a20)
                        LdrpCheckforLoadedDllHandle (0x77f870cc)
                        **LdrpSnapThunk
        LdrpUpdateLoadCount (0x77f88afa)
            *LdrpCheckForLoadedDll
            **LdrpUpdateLoadCount
        LdrpRunInitializeRoutines (0x77f8bcb8)
        LdrpClearLoadInProgress (0x77f88c12)

#2 - LoadLibraryExW 3rd parameter is 0 and DLL has been bound:
LdrLoadDll (0x77f889a9)
    LdrpLoadDll 0x77f887e0
        LdrpCheckForLoadedDll (0x77f87122)
        LdrpMapDll (0x77f8bc77)
            LdrpCheckForKnownDll (0x77f8c62b)
            LdrpResolveDllName (0x77f8c3df)
            LdrpCreateDllSection (0x77f8c355)
            LdrpAllocateDataTableEntry (0x77f8be69)
            LdrpFetchAddressOfEntryPoint (0x77f8bf23)
            LdrpInsertMemoryTableEntry (0x77f8bebb)
        LdrpWalkImportDescriptor (0x77f8be15)
            LdrpLoadImportModule (0x77f8bfd1)
                *LdrpCheckForLoadedDll
        LdrpUpdateLoadCount (0x77f88afa)
            *LdrpCheckForLoadedDll
            **LdrpUpdateLoadCount
        LdrpRunInitializeRoutines (0x77f8bcb8)
        LdrpClearLoadInProgress (0x77f88c12)

#3 - LoadLibraryExW 3rd Parameter is DONT_RESOLVE_DLL_REFERENCES:
LdrLoadDll (0x77f889a9)
    LdrpLoadDll 0x77f887e0
        LdrpCheckForLoadedDll (0x77f87122)
        LdrpMapDll (0x77f8bc77)
            LdrpCheckForKnownDll (0x77f8c62b)
            LdrpResolveDllName (0x77f8c3df)
            LdrpCreateDllSection (0x77f8c355)
            LdrpAllocateDataTableEntry (0x77f8be69)
            LdrpFetchAddressOfEntryPoint (0x77f8bf23)
            LdrpInsertMemoryTableEntry (0x77f8bebb)

#4 - LoadLibraryExW 3rd Parameter is LOAD_WITH_ALTERED_SEARCH_PATH:
LdrLoadDll (0x77f889a9)
    LdrpLoadDll 0x77f887e0
        LdrpCheckForLoadedDll (0x77f87122)
        LdrpMapDll (0x77f8bc77)
            LdrpCheckForKnownDll (0x77f8c62b)
            LdrpResolveDllName (0x77f8c3df)
            LdrpCreateDllSection (0x77f8c355)
            LdrpAllocateDataTableEntry (0x77f8be69)
            LdrpFetchAddressOfEntryPoint (0x77f8bf23)
            LdrpInsertMemoryTableEntry (0x77f8bebb)
        LdrpWalkImportDescriptor (0x77f8be15)
            LdrpLoadImportModule (0x77f8bfd1)
                *LdrpCheckForLoadedDll
        LdrpUpdateLoadCount (0x77f88afa)
            *LdrpCheckForLoadedDll
            **LdrpUpdateLoadCount
        LdrpRunInitializeRoutines (0x77f8bcb8)
        LdrpClearLoadInProgress (0x77f88c12)

#5 - LoadLibraryExW 3rd Parameter is LOAD_LIBRARY_AS_DATAFILE:
LdrpCheckForLoadedDll (0x77f87122)

All addresses based upon Windows 2000 Professional (Build 2195: Service Pack 1)
* previously documented
** recursive call

Figure 4 APIs Forwarded to NTDLL

API	Destination
DeleteCriticalSection	Forwarded to NTDLL.RtlDeleteCriticalSection
EnterCriticalSection	Forwarded to NTDLL.RtlEnterCriticalSection
HeapAlloc	Forwarded to NTDLL.RtlAllocateHeap
HeapFree	Forwarded to NTDLL.RtlFreeHeap
HeapReAlloc	Forwarded to NTDLL.RtlReAllocateHeap
HeapSize	Forwarded to NTDLL.RtlSizeHeap
LeaveCriticalSection	Forwarded to NTDLL.RtlLeaveCriticalSection
RtlFillMemory	Forwarded to NTDLL.RtlFillMemory
RtlMoveMemory	Forwarded to NTDLL.RtlMoveMemory
RtlUnwind	Forwarded to NTDLL.RtlUnwind
RtlZeroMemory	Forwarded to NTDLL.RtlZeroMemory
SetCriticalSectionSpinCount	Forwarded to NTDLL.RtlSetCriticalSection- SpinCount
TryEnterCriticalSection	Forwarded to NTDLL.RtlTryEnterCriticalSection
VerSetConditionMask	Forwarded to NTDLL.VerSetConditionMask

Figure 5 Binding via LdrpSnapIAT and LdrpSnapThunk for Forwarded.DLL

              IAT         IAT    
  Address     File       Memory  API Name (* - Forwarded APIs)
  1200B000  0000C314 => 77E851E1 HeapCreate
* 1200B004  0000C322 => 77FCA535 HeapFree (RtlFreeHeap)
  1200B008  0000C0AA => 77E8F07F GetCommandLineA
  1200B00C  0000C0BC => 77E85C77 GetVersion
  1200B010  0000C0CA => 77EA83DE DbgBreakPoint
  1200B014  0000C0D8 => 77E8F043 GetStdHandle
  1200B018  0000C0E8 => 77E8334F WriteFile
  1200B01C  0000C0F4 => 77E82EF1 InterlockedDecrement
  1200B020  0000C10C => 77E9E0C8 OutputDebugStringA
  1200B024  0000C122 => 77E87031 GetProcAddress
  1200B028  0000C134 => 77E87273 LoadLibraryA
  1200B02C  0000C144 => 77E82EE0 InterlockedIncrement
  1200B030  0000C15C => 77E88885 GetModuleFileNameA
  1200B034  0000C172 => 77E8F32D ExitProcess
  1200B038  0000C180 => 77EB45FF TerminateProcess
  1200B03C  0000C194 => 77E8304F GetCurrentProcess
  1200B040  0000C1A8 => 77E83510 GetCurrentThreadId
  1200B044  0000C1BE => 77E836DD TlsSetValue
  1200B048  0000C1CC => 77E8C512 TlsAlloc
  1200B04C  0000C1D8 => 77E8F254 TlsFree
  1200B050  0000C1E2 => 77E83008 SetLastError
  1200B054  0000C1F2 => 77E83025 TlsGetValue
  1200B058  0000C200 => 77E8301B GetLastError
  1200B05C  0000C210 => 77E831E7 SetHandleCount
  1200B060  0000C222 => 77E84C93 GetFileType
  1200B064  0000C230 => 77E8F10A GetStartupInfoA
* 1200B068  0000C242 => 77F837C4 DeleteCriticalSection (RtlDeleteCriticalSection)
  1200B06C  0000C25A => 77E83A61 IsBadWritePtr
  1200B070  0000C26A => 77E84F4F IsBadReadPtr
  1200B074  0000C27A => 77E8BC6C HeapValidate
  1200B078  0000C28A => 77E82116 FreeEnvironmentStringsA
  1200B07C  0000C2A4 => 77E8F085 FreeEnvironmentStringsW
  1200B080  0000C2BE => 77E8593F WideCharToMultiByte
  1200B084  0000C2D4 => 77E9C60D GetEnvironmentStrings
  1200B088  0000C2EC => 77E8324E GetEnvironmentStringsW
  1200B08C  0000C306 => 77E8523C HeapDestroy
  1200B090  0000C41E => 77E841B6 LCMapStringW
  1200B094  0000C40E => 77E95278 LCMapStringA
  1200B098  0000C32E => 77E85194 VirtualFree
  1200B09C  0000C33C => 77E83833 InitializeCriticalSection
* 1200B0A0  0000C358 => 77F81B42 EnterCriticalSection (RtlEnterCriticalSection)
* 1200B0A4  0000C370 => 77F81B73 LeaveCriticalSection (RtlLeaveCriticalSection)
* 1200B0A8  0000C388 => 77FCA055 HeapAlloc (RtlAllocateHeap)
* 1200B0AC  0000C394 => 77F85B48 HeapReAlloc (RtlReAllocateHeap)
  1200B0B0  0000C3A2 => 77E850EC VirtualAlloc
  1200B0B4  0000C3B2 => 77E8EFB8 GetCPInfo
  1200B0B8  0000C3BE => 77E83852 GetACP
  1200B0BC  0000C3C8 => 77E8724D GetOEMCP
  1200B0C0  0000C3D4 => 77E84035 MultiByteToWideChar
  1200B0C4  0000C3EA => 77E9740C GetStringTypeA
  1200B0C8  0000C3FC => 77E867D4 GetStringTypeW
  1200B0CC  0000C42E => 77E853E8 SetFilePointer
* 1200B0D0  0000C440 => 77F8E13A RtlUnwind (RtlUnwind)
  1200B0D4  0000C44C => 77E8F3BC SetStdHandle
  1200B0D8  0000C45C => 77E863C1 FlushFileBuffers
  1200B0DC  0000C470 => 77E83053 CloseHandle
  1200B0E0  00000000    00000000
  1200B0E4  0000C090 => 77E1F098 MessageBoxW
  1200B0E8  00000000    00000000

**********************************************************************************
LdrSnap Display (Note the displays of forwarded APIs):

LDR: LdrLoadDll, loading Forwarder.DLL from 
     E:\PROJECTS\TEMP\Test\debug;.;D:\WINNT\System32;D:\WINNT\system;D:\WINNT;...
LDR: Loading (DYNAMIC) E:\PROJECTS\TEMP\Test\debug\Forwarder.DLL
LDR: KERNEL32.dll used by Forwarder.DLL
LDR: Snapping imports for Forwarder.DLL from KERNEL32.dll
LDR: LdrLoadDll, loading NTDLL.dll from 
LDR: LdrGetProcedureAddress by NAME - RtlEnterCriticalSection
LDR: LdrLoadDll, loading NTDLL.dll from 
LDR: LdrGetProcedureAddress by NAME - RtlDeleteCriticalSection
LDR: LdrLoadDll, loading NTDLL.dll from 
LDR: LdrGetProcedureAddress by NAME - RtlFreeHeap
LDR: LdrLoadDll, loading NTDLL.dll from 
LDR: LdrGetProcedureAddress by NAME - RtlLeaveCriticalSection
LDR: LdrLoadDll, loading NTDLL.dll from 
LDR: LdrGetProcedureAddress by NAME - RtlAllocateHeap
LDR: LdrLoadDll, loading NTDLL.dll from 
LDR: LdrGetProcedureAddress by NAME - RtlReAllocateHeap
LDR: LdrLoadDll, loading NTDLL.dll from 
LDR: LdrGetProcedureAddress by NAME - RtlUnwind
LDR: Real INIT LIST
     E:\PROJECTS\TEMP\Test\debug\Forwarder.DLL init routine 110010e9
LDR: Forwarder.DLL loaded. - Calling init routine at 110010e9

Figure 6 Pre-binding using SDK Bind

              IAT
             File &
  Address    Memory  API Name (* - Forwarded APIs)
  10004000  77E851E1 HeapCreate
  10004004  77E85C77 GetVersion
  10004008  77E8F32D ExitProcess
  1000400C  77EB45FF TerminateProcess
  10004010  77E8304F GetCurrentProcess
  10004014  77E83510 GetCurrentThreadId
  10004018  77E836DD TlsSetValue
  1000401C  77E8C512 TlsAlloc
  10004020  77E8F254 TlsFree
  10004024  77E83025 TlsGetValue
  10004028  77E831E7 SetHandleCount
  1000402C  77E8F043 GetStdHandle
  10004030  77E84C93 GetFileType
  10004034  77E8F10A GetStartupInfoA
* 10004038  77F837C4 DeleteCriticalSection (RtlDeleteCriticalSection)
  1000403C  77E88885 GetModuleFileNameA
  10004040  77E82116 FreeEnvironmentStringsA
  10004044  77E8F085 FreeEnvironmentStringsW
  10004048  77E8593F WideCharToMultibyte
  1000404C  77E9C60D GetEnvironmentStrings
  10004050  77E8324E GetEnvironmentStringsW
  10004054  77E8523C HeapDestroy
  10004058  77E8F07F GetCommandLineA
  1000405C  77E85194 VirtualFree
* 10004060  77FCA535 HeapFree (RtlFreeHeap)
  10004064  77E8334F WriteFile
  10004068  77E83833 InitializeCriticalSection
* 1000406C  77F81B42 EnterCriticalSection (RtlEnterCriticalSection)
* 10004070  77F81B73 LeaveCriticalSection (RtlLeaveCriticalSection)
* 10004074  77FCA055 HeapAlloc (RtlAllocateHeap)
  10004078  77E8EFB8 GetCPInfo
  1000407C  77E83852 GetACP
  10004080  77E8724D GetOEMCP
  10004084  77E850EC VirtualAlloc
* 10004088  77F85B48 HeapReAlloc (RtlReAllocateHeap)
  1000408C  77E87031 GetProcAddress
  10004090  77E87273 LoadLibraryA
  10004094  77E84035 MultiByteToWideChar
  10004098  77E95278 LCMapStringA
  1000409C  77E841B6 LCMapStringW
  100040A0  77E9740C GetStringTypeA
  100040A4  77E867D4 GetStringTypeW
* 100040A8  77F8E13A RtlUnwind (RtlUnwind)

**********************************************************************************
LdrSnap Display (Note there are no displays of forwarded APIs):

LDR: LdrLoadDll, loading TestDll.DLL from 
     E:\PROJECTS\TEMP\Test\debug;.;D:\WINNT\System32;D:\WINNT\system;D:\WINNT;...
LDR: Loading (DYNAMIC) E:\PROJECTS\TEMP\Test\debug\TestDll.DLL
LDR: TestDll.DLL bound to KERNEL32.dll
LDR: TestDll.DLL has correct binding to KERNEL32.dll
LDR: TestDll.DLL bound to NTDLL.DLL via forwarder(s) from KERNEL32.dll
LDR: TestDll.DLL has correct binding to NTDLL.DLL
LDR: Real INIT LIST
     E:\PROJECTS\TEMP\Test\debug\TestDll.DLL init routine 10001109
LDR: TestDll.DLL loaded. - Calling init routine at 10001109

打开NTDLL.dll,惊奇的发现原来CRT的许多基本函数居然都是在这里实现的！甚至包括qsort,ceil这样的函数，还有臭名昭著的strcpy（严格来讲，这只能怪使用者不当心）。堆的释放，进城管理，似乎都是在这。于是，我决定，仔细察看以下它，这1410个函数是做什么的

用户模式的代码在调用系统内核函数的时候，首先把一个叫做system call number的数放在EAX中，把参数放在其它的寄存器中了。然后调用INT 2E中断。但是大部分应用程序并不需要直接这么做。通常都是在调用kernel32.dll等时由他们来调用INT 2E.

内核模式的代码，做法稍微有点不同。他们通常调用由NTOSKRNL.EXE导出的NTDLL.dll中Zw开头的那一系列函数，比如ZwWaitForSingleObject，　反之，如果是用户级代码需要调用内核，就会利用INT 2E调用WaitForSingleObject.对于许多函数的批量调用，你会明显发现 Zw族要比Rtl族效率高很多。

可惜ntdll.dll中的大部分函数都是undocumented.
对于一部分得知其定义形式的函数，可以这样调用：
1.先将NTDLL.DLL读入 LoadLibrary(TEXT("NTDLL.dll"))
2.利用GetProcAddress 获取其函数入口地址
3.利用得到的函数指针调用

但是可以大致的分为几类吧
1 PropertyLengthAsVariant 它被排在了第一号，但是我就是不明白它是做什么的
2 Csr（configuration status register？ Command and Status Register？）系列
CsrAllocateCaptureBuffer CsrAllocateMessagePointer CsrCaptureMessageBuffer CsrCaptureMessageMultiUnicodeStringsInPlace CsrCaptureMessageString CsrCaptureTimeout CsrClientCallServer CsrClientConnectToServer CsrFreeCaptureBuffer CsrGetProcessId CsrIdentifyAlertableThread CsrNewThread CsrProbeForRead CsrProbeForWrite CsrSetPriorityClass

3 Dbg系列调试函数
DbgBreakPoint DbgPrint DbgPrintEx DbgPrintReturnControlC DbgPrompt DbgQueryDebugFilterState DbgSetDebugFilterState DbgUiConnectToDbg DbgUiContinue DbgUiConvertStateChangeStructure DbgUiDebugActiveProcess DbgUiGetThreadDebugObject DbgUiIssueRemoteBreakin DbgUiRemoteBreakin DbgUiSetThreadDebugObject DbgUiStopDebugging DbgUiWaitStateChange DbgUserBreakPoint

4 ki系列
KiRaiseUserExceptionDispatcher
KiUserApcDispatcher
KiUserCallbackDispatcher
KiUserExceptionDispatcher

5 Ldr系列 Loader APIs，共34个
API
NTDLL APIs
LoadResource
LdrAccessResource
LdrAlternateResourcesEnabled
DisableThreadLibraryCalls
LdrDisableThreadCalloutsForDll
LdrEnumResources
LdrFindAppCompatVariableInfo
LdrFindEntryForAddress
EnumResourceTypesW
LdrFindResourceDirectory_U
FindResourceExA
LdrFindResource_U
LdrFlushAlternateResourceModules
LdrGetAlternateResourceModuleHandle
GetModuleHandleForUnicodeString
LdrGetDllHandle
GetProcAddress
LdrGetProcedureAddress
LdrInitializeThunk
LoadLibraryEx (LOAD_LIBRARY_AS_DATAFILE)
LdrLoadAlternateResourceModule
LoadLibrary
LdrLoadDll
LdrProcessRelocationBlock
LdrQueryApplicationCompatibilityGoo
LdrQueryImageFileExecutionOptions
LdrQueryProcessModuleInformation
LdrRelocateImage
ExitProcess
LdrShutdownProcess
ExitThread
LdrShutdownThread
LdrUnloadAlternateResourceModule
FreeLibrary
LdrUnloadDll
LdrVerifyImageMatchesChecksum
LdrVerifyMappedImageMatchesChecksum

6 Nls（National Language Support）系列代码页管理
NlsAnsiCodePage
NlsMbCodePageTag
NlsMbOemCodePageTag

7 Nt系列共285个，大部分都是kernel32.dll,user32.dll等的核心实现
NtCreateFile, NtOpenFile, NtClose, NtWaitForSingleObject 是kernel32.dll中许多用户级代码的核心实现。
NTSTATUS NtClose( HANDLE Handle);
竟然是CloseHandle 的原身！唯一的缺点是该函数并没有导出库，如果要调用，就必须使用GetProcAddress 来获得其函数指针然后调用。
NtCreateFile 可以说是DDK的核心
RtlUnwind initiates an unwind of procedure call frames
结构化异常（Structured Exception Handling, SEH ）的核心。
NTSTATUS NtWaitForSingleObject( HANDLE Handle, BOOLEAN Alertable, PLARGE_INTEGER Timeout);
Waits until the specified object attains a state of signaled

8 pfx 不明白
PfxFindPrefix
PfxInitialize
PfxInsertPrefix
PfxRemovePrefix

9 RestoreEm87Context SaveEm87Context

10 rtl系列共506个。我想，rtl应该是runtime library的缩写吧。一个很庞大的函数族，里面包含像 RtlCreateUserProcess 这样的一些很基本的函数，通常供内核模式的driver等调用
下面是一部分示例
APIs Forwarded to NTDLL
API
Destination
DeleteCriticalSection
Forwarded to NTDLL.RtlDeleteCriticalSection
EnterCriticalSection
Forwarded to NTDLL.RtlEnterCriticalSection
HeapAlloc
Forwarded to NTDLL.RtlAllocateHeap
HeapFree
Forwarded to NTDLL.RtlFreeHeap
HeapReAlloc
Forwarded to NTDLL.RtlReAllocateHeap
HeapSize
Forwarded to NTDLL.RtlSizeHeap
LeaveCriticalSection
Forwarded to NTDLL.RtlLeaveCriticalSection
RtlFillMemory
Forwarded to NTDLL.RtlFillMemory
RtlMoveMemory
Forwarded to NTDLL.RtlMoveMemory
RtlUnwind
Forwarded to NTDLL.RtlUnwind
RtlZeroMemory
Forwarded to NTDLL.RtlZeroMemory
SetCriticalSectionSpinCount
Forwarded to NTDLL.RtlSetCriticalSection- SpinCount
TryEnterCriticalSection
Forwarded to NTDLL.RtlTryEnterCriticalSection
VerSetConditionMask
Forwarded to NTDLL.VerSetConditionMask

11 VerSetConditionMask 用于确认系统信息
The VerSetConditionMask function sets the bits of a 64-bit value to indicate the comparison operator to use for a specified operating system version attribute. This function is used to build the dwlConditionMask parameter of the VerifyVersionInfo function.

12 Zw系列共284个。前面已经说过，为可执行性系统服务提供内核模式的入口，为NTOSKRNL.EXE 提供实现。由于是内核模式，所以在执行的时候并不检查用户是否有执行权限

13 内部函数共116个。具体作用不明，很底层的东西。无法查到任何相关资料。无法得知与其相关的任何信息。
_CIcos _CIlog _CIpow _CIsin _CIsqrt __eCommonExceptions __eEmulatorInit __eF2XM1 __eFABS __eFADD32 __eFADD64 __eFADDPreg __eFADDreg __eFADDtop __eFCHS __eFCOM __eFCOM32 __eFCOM64 __eFCOMP __eFCOMP32 __eFCOMP64 __eFCOMPP __eFCOS __eFDECSTP __eFDIV32 __eFDIV64 __eFDIVPreg __eFDIVR32 __eFDIVR64 __eFDIVRPreg __eFDIVRreg __eFDIVRtop __eFDIVreg __eFDIVtop __eFFREE __eFIADD16 __eFIADD32 __eFICOM16 __eFICOM32 __eFICOMP16 __eFICOMP32 __eFIDIV16 __eFIDIV32 __eFIDIVR16 __eFIDIVR32 __eFILD16 __eFILD32 __eFILD64 __eFIMUL16 __eFIMUL32 __eFINCSTP __eFINIT __eFIST16 __eFIST32 __eFISTP16 __eFISTP32 __eFISTP64 __eFISUB16 __eFISUB32 __eFISUBR16 __eFISUBR32 __eFLD1 __eFLD32 __eFLD64 __eFLD80 __eFLDCW __eFLDENV __eFLDL2E __eFLDLN2 __eFLDPI __eFLDZ __eFMUL32 __eFMUL64 __eFMULPreg __eFMULreg __eFMULtop __eFPATAN __eFPREM __eFPREM1 __eFPTAN __eFRNDINT __eFRSTOR __eFSAVE __eFSCALE __eFSIN __eFSQRT __eFST __eFST32 __eFST64 __eFSTCW __eFSTENV __eFSTP __eFSTP32 __eFSTP64 __eFSTP80 __eFSTSW __eFSUB32 __eFSUB64 __eFSUBPreg __eFSUBR32 __eFSUBR64 __eFSUBRPreg __eFSUBRreg __eFSUBRtop __eFSUBreg __eFSUBtop __eFTST __eFUCOM __eFUCOMP __eFUCOMPP __eFXAM __eFXCH __eFXTRACT __eFYL2X __eFYL2XP1 __eGetStatusWord

14 一些CRT的基本函数共131个主要是字符串管理，还有些基本的数学函数
__isascii __iscsym __iscsymf __toascii _alldiv _alldvrm _allmul _alloca_probe _allrem _allshl _allshr _atoi64 _aulldiv _aulldvrm _aullrem _aullshr _chkstk _fltused _ftol _i64toa _i64tow _itoa _itow _lfind _ltoa _ltow _memccpy _memicmp _snprintf _snwprintf _splitpath _strcmpi _stricmp _strlwr _strnicmp _strupr _tolower _toupper _ui64toa _ui64tow _ultoa _ultow _vsnprintf _vsnwprintf _wcsicmp _wcslwr _wcsnicmp _wcsupr _wtoi _wtoi64 _wtol abs atan atoi atol bsearch ceil cos fabs floor isalnum isalpha iscntrl isdigit isgraph islower isprint ispunct isspace isupper iswalpha iswctype iswdigit iswlower iswspace iswxdigit isxdigit labs log mbstowcs memchr memcmp memcpy memmove memset pow qsort sin sprintf sqrt sscanf strcat strchr strcmp strcpy strcspn strlen strncat strncmp strncpy strpbrk strrchr strspn strstr strtol strtoul swprintf tan tolower toupper towlower towupper vDbgPrintEx vDbgPrintExWithPrefix vsprintf wcscat wcschr wcscmp wcscpy wcscspn wcslen wcsncat wcsncmp wcsncpy wcspbrk wcsrchr wcsspn wcsstr wcstol wcstombs wcstoul