News for hackers. Stuff that matters.
Re:The Journey Before main() by gpm on Saturday October 25, 2025 @05:05PM (#45706956)
I thought windows had an unstable syscall interface?
Re:The Journey Before main() by Dwedit on Saturday October 25, 2025 @06:07PM (#45707374)
Pretty much yeah.

You have your usual Win32 API functions found in libraries like Kernel32, User32, and GDI32, but since after Windows XP, those don't actually make system calls. The actual system calls are found in NTDLL and Win32U. Lots of functions you can import, and they're basically one instruction long. Just SYSENTER for the native version, or a switch back to 64-bit mode for a WOW64 DLL. The names of the function always begin with Nt, like NtCreateFile. There's a corresponding Kernel mode call that starts with Zw instead, so in Kernel mode you have ZwCreateFile.

But the system call numbers used with SYSENTER are indeed reordered every time there's a major version change to Windows, so you just call into NTDLL or Win32U instead if you want to directly make a system call.

Re:The Journey Before main() by LegionMammal978 on Saturday October 25, 2025 @05:11PM (#45706999)
It looks like that project does link against the usual Windows DLLs, it just doesn't use a static or dynamic C runtime.
Re:The Journey Before main() by pmc00 on Saturday October 25, 2025 @05:23PM (#45707081)
Windows isn’t quite like Linux in that typically apps don’t make syscalls directly. Maybe you could say what’s in ntdll is the system call contract, but in practice you call the subsystem specific API, typically the Win32 API, which is huge compared to the Linux syscall list because it includes all sorts of things like UI, COM (!), etc.

The project has some of the properties discussed above such as not having a typical main() (or winmain), because there’s no CRT to call it.