When ntdll.dll is loaded in x64dbg, I see that there can be multiple symbols at the same address. For example;

enter image description here

As far as I know, there is no way to achieve something like this using regular msvc tools like cl.exe/link.exe. Is it safe to assume then, this functions are created with an assembler and then linked with rest of the dll?

1 Answer 1


It's likely just using a .def file, to define the exports e.g.

// example.def
LIBRARY "example"
    MyFunctionAlias1 = MyFunction
    MyFunctionAlias2 = MyFunction

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.