> Every system call must go through ntdll.dll or it'll stop working on the next major upgrade, which will scramble the system call numbers.
Wow, really? So you can't make system calls from assembly language on Windows?
> It places fewer constraints on the kernel and lets you implement 32-bit-to-64-bit system call thunks entirely in userspace, completely avoiding a major class of security vulnerability.
Well, there is VDSO. What kind of thunks and security vulnerabilities are you talking about though?
Re:A ToC of the 20-part linker essay (2008)
by quotemstr on Monday July 14, 2014 @05:51AM
(#8030223)
> Wow, really? So you can't make system calls from assembly language on Windows?
Of course you can. Just go through the system DLL like any other program.
> What kind of thunks and security vulnerabilities are you talking about though?
Something like http://xorl.wordpress.com/2009/08/07/cve-2007-4573-linux-ker..., though that's not the only one.
You're right, though, about history being a factor. Windows was born with dynamic linking; shared libraries were a Unix bolt-on. (Then again, symlink was a bolt-on feature too, but it's well-integrated these days.)
It's also interesting to note that on Windows, there's no such thing as a static executable in the sense you might have one in Unix. Every system call must go through ntdll.dll or it'll stop working on the next major upgrade, which will scramble the system call numbers. On Windows, the ABI compatibility boundary is ntdll/kernel32/user32/etc., while on Unix, the ABI boundary is the kernel-userspace boundary.
The Windows way of doing it is much better. It places fewer constraints on the kernel and lets you implement 32-bit-to-64-bit system call thunks entirely in userspace, completely avoiding a major class of security vulnerability.