From ReactOS Wiki
Revision as of 05:06, 3 April 2012 by BrentNewland (talk | contribs)
Jump to: navigation, search

Ntdll.dll is NOT synced with WINE, it is made by ReactOS (source)

The Native API Architecture is implemented in NTDLL.dll. Aside from containing Native API user mode entry points, NTDLL.dll also contains process startup and module loading code.

NTdll contains part of the Native API, including the C Run Time Library (RTL) api.





  • Implemented handle table and atom table (NTDLL)



  • Fixed binary search algroithm in LdrGetExportByOrdinal - numbers can reach negative values (Filip Navara)
  • Testing shows that Microsoft Windows does allow a thread to leave a critical section entered by another thread (Gé van Geldorp)
  • Implement _bsearch(), _lfind(), _ui64toa() and _ui64tow() (Eric Kohl)
  • Implement RtlFindLeastSignificantBit() and RtlFindMostSignificantBit() (Gé van Geldorp)
  • Implement RtlAccessAllowedAceEx() and RtlAccessDeniedAceEx() (Eric Kohl)
  • Use ACL constants and fix ACL-revision checks (Eric Kohl)
  • Fixed a bug in AppendUnicodeStringToString which could cause a null to be placed one position after the end of a completely full string (Art Yerkes)
  • Always return 8-byte aligned blocks (Gé van Geldorp)


  • Fixed a bug in AppendUnicodeStringToString which could cause a null to be placed one position after the end of a completely full string (Art Yerkes)
  • Corrected processing import directories to handle case when executable imports (Filip Navara)
  • Split LdrpProcessImportDirectory into LdrpProcessImportDirectory and to process all entries with the same name (Hartmut Birr)
  • RtlGetFullPathName_U() is supposed to check the parameter buff, it could be NULL (Thomas Weidenmueller)
  • Enable environment inheritance (Eric Kohl)
  • Implemented RtlCreateCriticalSectionSpinCount (Gunnar Dalsnes)


  • Interpret the sign for qualifier 'l' (Hartmut Birr)
  • Implement RtlFindRange() (Eric Kohl)
  • Implement RtlInvertRangeList() and RtlMergeRangeList() (Eric Kohl)
  • Correct search path for DLL loading (including directory from which .exe was loaded) (Pablo Borobia)
  • Initialized the variable status to get on success a proper return value (Hartmut Birr)
  • Fix Nt/ZwGetTickCount (Eric Kohl)
  • Report failure when function imported by ordinal isn't found (Filip Navara)
  • Added missing unlocking of handle table in RtlLookupAtomInAtomTable (Filip Navara)
  • Implement basic range list functions (Eric Kohl)
  • Implement range list copy and delete functions (Eric Kohl)
  • Implement RtlIsRangeAvailable() (Eric Kohl)
  • Handle ordinals which are not exported (Ge van Geldorp)
  • Move rtl/version|image|encode into rtl (Gunnar Dalsnes)



  • Fixed RtlLargeIntegerArithmeticShift() not to return uninitialized data from the stack (Thomas Weidenmueller)
  • Adapted RtlIntegerToUnicode() from RtlIntegerToChar() and RtlInt64ToUnicodeString() from RtlIntegerToUnicodeString() (Thomas Weidenmueller)
  • Implemented RtlIpv4AddressToStringA/W() and RtlValidRelativeSecurityDescriptor() (Thomas Weidenmueller)
  • Fixed RtlValidSecurityDescriptor() that attempted to validate nonexisting owner/group SID (Thomas Weidenmueller)


  • (Thomas Weidenmueller)
  • Implemented RtlHashUnicodeString
  • Moved ntdll's atom table implementation to Rtl, and rewrote it to use proper structures and to share the generic *implementation between ntoskrnl and ntdll
  • Updated the Rtl handle table implementation to use proper structures; however, reserved handles are not yet supported correctly

ChangeLog-0.2.8 RTL

  • Implement !DeletePinned case in RtlEmptyAtomTable. (Filip Navara)
  • Fixed the definition of RtlUnicodeStringToCountedOemSize. This will fix bug 756. (Hartmut Birr)
  • We have only to signal the event if someone waits on it in RtlLeaveCriticalSection. (Hartmut Birr)
  • Rewrote RtlCreateUserProcess, RtlCreateUserThread. Updated and fixed RtlExitUserThread, RtlFreeUserThreadStack. (Alex Ionescu)
  • Implement RtlCaptureContext (Alex Ionescu)
  • RtlRaiseException to handle cases when a user-mode debugger is present (Alex Ionescu)
  • RtlRaiseStatus as above, plus set the exception address and capture context (Alex Ionescu)
  • Fix RtlDispatchException, add cases for exceptions in the DPC stack and validate the validity of the exception frames. Add support for exception logging by the global flag. Use TRAP_FRAME/EXCPETION_FRAME instead of Context. (Alex Ionescu)
  • Fix RtlUnwind logic, support cases where it's called with custom arguments instead of NULL. (Alex Ionescu)
  • Reimplement RtlpCaptureContext to work properly, convert exception handler calling functions to INTEL syntax and fix some bugs (like checking for the right unwind flag, clearing volatile register values, etc. Also use some optimizations to increase speed. (Alex Ionescu)
  • Implement KiRaiseException, add SEH to all user-mode parameters and when copying data to the user-mode stack. (Alex Ionescu)
  • Implemented all the Dbg* APIs. (Alex Ionescu)


  • Implement NTDLL's CSR routines in a compatible way. Fix prototypes, argument count, deprecated functions and new functions. Also added NtSecureConnectPort. (Alex Ionescu)
  • Make NTDLL Ki* callbacks have SEH to protect them and return to kernel-mode with notification of any exceptions (Alex Ionescu)
  • Fix seriously broken User-Mode Ldr thunk and APC Callback prototypes (Alex Ionescu)
  • Fix KiUserExceptionDispatcher (Alex Ionescu)
  • Fixed multiple bugs in RTL string routines (Alex Ionescu)
  • Implement DbgPrintEx, vDbgPrintEx, and vDbgPrintExWithPrefix (Royce Mitchell)

ChangeLog-0.2.9 Run Time Library (RTL)

  • Fix searching for error messages in resources (Gé van Geldorp)
  • Implement RtlSelfRelativeToAbsoluteSD2 and RtlCreateSystemVolumeInformationFolder (Thomas Weidenmueller)
  • Implement RtlInitializeUnicodePrefix, RtlNextUnicodePrefix, RtlRemoveUnicodePrefix, RtlInsertUnicodePrefix, RtlFindUnicodePrefix. (Alex Ionescu)
  • Implement RtlInitializeGenericTable (Alex Ionescu)
  • Implement RtlSplayTree, RtlSplay, RtlRealPrecessdor, RtlRealSuccessor, RtlDelete (Alex Ionescu)
  • Fix RtlSubtreePredecessor/Successor, someone had implemented them backwards. (Alex Ionescu)
  • Implement RtlPrefectMemoryNonTemporal. Patch by Patrick Baggett <baggett.patrick@gmail.com> and myself. (Alex Ionescu)

Native Library (NTDLL)

  • <placeholder>


  • RtlIntegerToUnicodeString increased the interal buffer size to 33bytes as wine does (Magnus Olsen)
  • RtlInt64ToUnicodeString increased the interal buffer size to 65bytes as wine does (Magnus Olsen)
  • RtlIntegerToUnicodeString/RtlIntegerToUnicodeString will take care of some intToChar Bugs. I have been locking of it for sometimes now thanks to crashfourit network patch and we talk I did found it. (Magnus Olsen)
  • Use RtlComputeCrc32 instead of yet another inline implementation for calculating a CRC32 checksum. The attached patch fixes this. patch from (Thomas Weidenmueller)
  • Add SEH to NtRaiseHardError. (Alex Ionescu)
  • Fix a bug in NtSetSystemTime. (Alex Ionescu)



  • Patch from Thomas Weidenmueller for Bug #1620: Fix a locking bug in the vectored exception handling
  • Patch from (Thomas Weidenmueller) for Bug #1671: Fix checking the SACL data area in the Win64 version of RtlSelfRelativeToAbsoluteSD2
  • Hackplement RtlSetUserValueHeap and RtlGetUserInfoHeap, they are needed for being able to build higher-level heap management around the Heap APIs (either for developers or the OS). Case in point, needed for my Global* rewrite in kernel32. The current APIs are utter hacks, but they work (eventually we should get rid of the Wine Windows 95 heap implementation and replace it). (Alex Ionescu)
  • Fix implementation of RtlSetUserValueHeap and RtlGetUserInfoHeap to write their flags to the subheap and not the actual main heap structure (since those flags are valid for each allocation). (Alex Ionescu)
  • Make heap allocations 8-byte aligned again. (Alex Ionescu)
  • There are more then only the 3 or 4 heap flags WINE's Windows 95 code supports(there are about 18), so it's a bit stupid to mask them all out, especially since that breaks settable/tag flags. (Alex Ionescu)
  • Stubbed RtlUsageHeap, RtlQueryTagHeap, RtlExtendHeap, RtlCreateTagHeap. (Alex Ionescu)
  • Fix all the failures in the RTLSTR Wine test by merging our old rtl string routines with Wine's. We now pass all 2300 something tests. (Alex Ionescu)
  • Sync RtlBitmap* implementation with WINE: Fixes 278 regression failures (for a total of 0 now). (Alex Ionescu)
  • Also adds implementations for RtlFindMostSignificantBit , RtlFindLeastSignificantBit, RtlFindNextForwardRunClear, RtlFindClearRuns. (Alex Ionescu)
  • Runtime Library Registry Wrappers: Use an array of registry paths instead of duplicating them (Alex Ionescu)
  • Runtime Library Registry Wrappers: Fix implenmentation of RTL_REGISTRY_HANDLE. (Alex Ionescu)
  • Runtime Library Registry Wrappers: Verify all Appends for failure before continuing. (Alex Ionescu)
  • Runtime Library Registry Wrappers: Use the strict minimum key permissions isntead of KEY_ALL_ACCESS. (Alex Ionescu)
  • Runtime Library Registry Wrappers: Don't use OBJ_OPENIF (Alex Ionescu)
  • Runtime Library Registry Wrappers: Use CAPS for \\REGISTRY\\USER (required to match a Windows quirk exposed by a WINE test)* Runtime Library Registry Wrappers: (Alex Ionescu)
  • Runtime Library Registry Wrappers: Use the correct length in RtlpNtQueryValueKey (Alex Ionescu)
  • Implement RtlCaptureStackBackTrace and RtlWalkFrameChain and add definitions to ntifs.h (Alex Ionescu)
  • Get rid of KeRosGetStackFrames and replace usage by RtlWalkFrameChain or RtlCaptureStackBackTrace, depending. (Alex Ionescu)
  • Re-implement the routines in intel syntax and also cleanup the formatting. (Alex Ionescu)
  • Also re-implement the way the routines work, by following Matt Pietrek's c code that he wrote in one of his articles after looking at the disassembly. (Alex Ionescu)
  • Also used a patch for mingw found on Google which contained some implementations in C. (Alex Ionescu)
  • New changes mostly add protection during unwinding, faster speed, and add implementations for __except_handler2 and _abnormal_termination which were not previously present. (Alex Ionescu)
  • Added some generic table routines to rtlfuncs.h so that they can be used in user-mode. (Alex Ionescu)
  • Implemented RtlInsertElementGenericTable and RtlInsertElementGenericTableFull (Splay-Tree versions). Also implemented a helper function RtlpFindGenericTableNodeOrParent when we're not given one and need to locate it manually. (Alex Ionescu)
  • Defined structure for generic table entries so that we can properly return user data and do the right allocations. (Alex Ionescu)
  • Implement RtlIsGenericTableEmpty, RtlNumberGenericTableElements. (Alex Ionescu)
  • Implement RtlLookupElementGenericTable. (Alex Ionescu)
  • Implement RtlDeleteElementGenericTable (Alex Ionescu)
  • Implement RtlLookupElementGenericTableFull. (Alex Ionescu)
  • Implement RtlEnumerateGenericTable. (Alex Ionescu)
  • Implement RtlENumerateGEnericTableWithoutSplaying. (Alex Ionescu)
  • Implement RtlGetElementGenericTable using ordered node/element. (Alex Ionescu)
  • Fix a bug in RtlRaiseException. (Alex Ionescu)


  • Implement, export and NDKize: DbgUiGetThreadDebugObject, DbgUiDebugActiveProcess, DbgUiStopDebugging, NtSetInformationDebugObject. (Alex Ionescu)
  • Stub DbgUiConvertStateChangeStructure (this isn't done in kernel32 anymore) and export it. (Alex Ionescu)
  • Implement and export DbgUiSetThreadDebugObject. (Alex Ionescu)
  • Fix DbgUi* APIs to use DbgSsReserved[1], and not [0]. Still trying to figure out what [0] is for. (Alex Ionescu)
  • Implement DbgUiConvertStateChangeStructure. Win32/Native Debugging should be fully implemented now (and waiting on the kernel to support it.) (Alex Ionescu)
  • Fix ntdll and usetup not to use OBJ_OPENLINK on symbolic links. This attribute is for registry keys, not symlinks. (Alex Ionescu)

See Also

  • Native API: Rtl is the second largest group of ntdll calls. These comprise the (extended) C Run-Time Library, which includes many utility functions that can be used by native applications, yet don't directly involve kernel support.