|
|
|
|
|
|
by Dwedit
880 days ago
|
|
|
KERNEL32 is mainly implemented through calls to NTDLL. NTDLL is the one that triggers the actual system calls or thunks, the actual implementation is in NTOSKRNL.exe Meanwhile USER32 used to do system calls to Win32k, but then they changed it to call Win32U, and have Win32U be all system calls to Win32k. |
|
|