What is the difference between kernelBase.dll and Kernel32.dll in system32 folder ?
Why both of them implement
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
I think this is the reason why there are some WinAPIs that also existing in kernelbase.dll.
"As an example of functionality that we moved to low-level binaries, kernelbase.dll gets functionality from kernel32.dll and advapi32.dll. This means that the existing binary now forwards calls down to the new binary rather than handling them directly; the forwarding can be static (the export table shows the redirection), or runtime (the dll has a stub routine that calls down to the new binary). This will impact low-level applications such as security and backup applications that are dependent upon internal APIs and offsets."
See the example below.
Disassembly of OpenProcess in Kernelbase.dll that call the Native API NTOpenProcess