2

What is the difference between kernelBase.dll and Kernel32.dll in system32 folder ?

Why both of them implement WideCharToMultiByte ?

2

I think this is the reason why there are some WinAPIs that also existing in kernelbase.dll.

"As an example of functionality that we moved to low-level binaries, kernelbase.dll gets functionality from kernel32.dll and advapi32.dll. This means that the existing binary now forwards calls down to the new binary rather than handling them directly; the forwarding can be static (the export table shows the redirection), or runtime (the dll has a stub routine that calls down to the new binary). This will impact low-level applications such as security and backup applications that are dependent upon internal APIs and offsets."

Reference: https://docs.microsoft.com/en-us/windows/desktop/Win7AppQual/new-low-level-binaries

See the example below.

This is the disassembly of OpenProcess in Kernel32.dll which redirects the OpenProcess to Kernelbase.dll enter image description here

Disassembly of OpenProcess in Kernelbase.dll that call the Native API NTOpenProcess

enter image description here

| improve this answer | |
  • is the edirected via ApiSetShema.dll ? from which Windows's version is that happend? – Lolo9876 Dec 21 '18 at 13:18
  • I provided a screenshot for the kernel32 and kernelbase. Starting from Windows 7. – ismael_akez Dec 21 '18 at 13:25
  • Im sorry for not adding the further explanation in the screenshot, I just want to show you that the OpenProcess in kernel32.dll is actually points to the OpenProcess of kernelbase.dll that calls the NtOpenProcess. – ismael_akez Dec 21 '18 at 19:52
  • that very intresting what you preset, do you say that all function in Kernel32.dll redirect to Kernelbase.dl ? how can I please see it in your screenshot? you put screenshot of OpenProcess function in Kernel32.dll and OpenProcess` in Kernelbase.dl , how can I see the redirection? – Lolo9876 Dec 22 '18 at 18:02
  • @Lolo9876 I created a small program that use the OpenProcess. imgur.com/a/6Gw2zbQ – ismael_akez Dec 22 '18 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.