3

What is the difference between kernelBase.dll and Kernel32.dll in system32 folder ?

Why both of them implement WideCharToMultiByte ?

Improve this question
1
  • The explanation is great, but a small semantic pointer, actually kernel32.dll and advapi.dll get functionalities from kernelbase.dll. eg: kenerl32!WriteProcessMemoryStub is traced to KERNELBASE!WriteProcessMemory, as already pointed.
    – vhjbh nk
    Jun 8, 2022 at 18:12

1 Answer 1

Reset to default
4

I think this is the reason why there are some WinAPIs that also existing in kernelbase.dll.

"As an example of functionality that we moved to low-level binaries, kernelbase.dll gets functionality from kernel32.dll and advapi32.dll. This means that the existing binary now forwards calls down to the new binary rather than handling them directly; the forwarding can be static (the export table shows the redirection), or runtime (the dll has a stub routine that calls down to the new binary). This will impact low-level applications such as security and backup applications that are dependent upon internal APIs and offsets."

Reference: https://docs.microsoft.com/en-us/windows/desktop/Win7AppQual/new-low-level-binaries

See the example below.

This is the disassembly of OpenProcess in Kernel32.dll which redirects the OpenProcess to Kernelbase.dll enter image description here

Disassembly of OpenProcess in Kernelbase.dll that call the Native API NTOpenProcess

enter image description here

Improve this answer
5
  • is the edirected via ApiSetShema.dll ? from which Windows's version is that happend?
    – Lolo9876
    Dec 21, 2018 at 13:18
  • I provided a screenshot for the kernel32 and kernelbase. Starting from Windows 7.
    – ismael_akez
    Dec 21, 2018 at 13:25
  • Im sorry for not adding the further explanation in the screenshot, I just want to show you that the OpenProcess in kernel32.dll is actually points to the OpenProcess of kernelbase.dll that calls the NtOpenProcess.
    – ismael_akez
    Dec 21, 2018 at 19:52
  • that very intresting what you preset, do you say that all function in Kernel32.dll redirect to Kernelbase.dl ? how can I please see it in your screenshot? you put screenshot of OpenProcess function in Kernel32.dll and OpenProcess` in Kernelbase.dl , how can I see the redirection?
    – Lolo9876
    Dec 22, 2018 at 18:02
  • @Lolo9876 I created a small program that use the OpenProcess. imgur.com/a/6Gw2zbQ
    – ismael_akez
    Dec 22, 2018 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.