Home/ Questions/Q 904117
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-15T15:59:52+00:00

My exe depends on ntdll, user32 and kernel32. I save these dlls as a

  • 0

My exe depends on ntdll, user32 and kernel32. I save these dlls as a local copy and change the first letter as “V”.
I then edit the exe’s Import dll name as Vernel32.dll from kernel32. The application works fine by loading vernel32.dll in local space.
Next i edit the exe’s import dll spec as vtdll as ntdll, the process loads vtdll from local, runs its code and throws an _stackhash exception on vtdll instructions.

I need this for developing my appliction to bundle all windows dependencies. Does any body have any idea, Why ntdll cant be run in local space.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    No! You cannot try to replace ntdll. It is mapped by the kernel into every single process, probably before any of your code is even loaded. It has an intricate connection with the kernel. It knows all the correct system call numbers. Try using ntdll from NT 5.1 and it will crash on NT 6.1. ntdll hosts the system call entry and exit code. The kernel-user callback dispatcher code. The thread start function which the kernel knows the address of. The user exception dispatcher. The user APC handler. I could go on, but I won’t.

    I don’t see why you’re trying to “bundle” these DLLs with your program. There is no way a Windows install won’t have these DLLs. And that’s ZERO chance for ntdll.dll since I don’t see how without the session manager and CSR you are going to run your program in the first place.

    • 0