Windows 7 Kernel Architecture Changes - api-ms-win-core files

(追記) (追記ここまで)

Windows 7 Kernel Architecture Changes - api-ms-win-core files

Windows 7 introduces a new set of dll files containing exported functions of many well-known WIN32 APIs. All these filenames begins with 'api-ms-win-core' prefix, followed by the functions category name.
For example, api-ms-win-core-localregistry-l1-1-0.dll contains the exported names for all Registry functions, api-ms-win-core-file-l1-1-0.dll contains the exported names for all file-related functions, api-ms-win-core-localization-l1-1-0.dll contains the exported names for all localization functions, and so on.

If you look deeply into these files, you'll see that all these files are very small, and the functions in them doen't do anything, and simply returns a 'TRUE' value. Just for example, here's the assembly language content of RegDeleteValueW function in api-ms-win-core-localregistry-l1-1-0.dll:

084010CE 33C0 xor eax, eax
084010D0 40 inc eax
084010D1 C20800 ret 0008

By looking in dependency walker utility, we can see that advapi32.dll, kernel32.dll, and other system dll files, are now statically linked to these empty api-ms-win-core files.

Moreover, if we look in the assembly language output of many API functions, we can see that they simply call their corresponding function in one of these api-ms-win-core Dlls. Just for example, RegDeleteValueW in advapi32.dll, simply contains a jump to the RegDeleteValueW in API-MS-Win-Core-LocalRegistry-L1-1-0.dll:

ADVAPI32!RegDeleteValueW:
77C6F301 8BFF mov edi, edi
77C6F303 55 push ebp
77C6F304 8BEC mov ebp, esp
77C6F306 5D pop ebp
77C6F307 EB05 jmp 77C6F30E
.
.
.
77C6F30E FF25B414C677 Jmp dword ptr [77C614B4] <-- [77C614B4] Points the import entry 
of API-MS-Win-Core-LocalRegistry-L1-1-0.RegDeleteValueW

So if RegDeleteValueW in ADVAPI32 and other functions simply jumps to empty functions, how is it possible that these functions still works properly ?

The answer is pretty simple: When Windows loads the dll files, all the import entries of these api-ms-win-core Dlls are replaced with a call to a real function in Windows kernel.
So here's our RegDeleteValueW example again: when loading a program into WinDbg, we can see that the jmp call now points to kernel32!RegDeleteValueW function. That's because during the loading of advapi32.dll, Windows automatically replace the import entry of API-MS-Win-Core-LocalRegistry-L1-1-0.RegDeleteValueW to the function address of RegDeleteValueW in kernel32.

75e5f301 8bff mov edi,edi
75e5f303 55 push ebp
75e5f304 8bec mov ebp,esp
75e5f306 5d pop ebp
75e5f307 eb05 jmp ADVAPI32!RegDeleteValueW+0xd (75e5f30e)
.
.
.
75e5f30e ff25b414e575 jmp dword ptr [ADVAPI32+0x14b4 (75e514b4)] ds:0023:75e514b4=
{kernel32!RegDeleteValueW (758bd5af)}

Another new dll: kernelbase.dll

In addition to the new API-MS-Win-Core dll files, there is also another new dll: kernelbase.dll
In previous versions of Windows, most of the kernel32 functions called to their corresponding functions in ntdll.dll.
In Windows 7, most of the kernel functions call to their corresponding functions in kernelbase.dll, and the kernelbase dll is the one that makes the calls to ntdll.dll

Effects on existing applications - compatibility issues.

Most of the existing applications should not be affected by this kernel change, because all standard API calls still works the same as in previous versions of Windows.
However, there are some diagnostic/debugging applications that rely on the calls chain inside the Windows kernel. These kind of applications may not work properly in Windows 7.
My own utilities, RegFromApp and ProcessActivityView failed to work under Windows 7 because of these changes, and that what led me to discover the kernel changes of Windows 7. These utilities problems already fixed and now they works properly in Windows 7.

API-MS-Win-Core List

Finally, here's the list of all core dll files added to Windows 7 and the functions list that each one of them contain. I used my own DLL Export Viewer utility to generate the list.

AllocConsole GetConsoleCP GetConsoleMode GetConsoleOutputCP GetNumberOfConsoleInputEvents PeekConsoleInputA ReadConsoleA ReadConsoleInputA ReadConsoleInputW ReadConsoleW SetConsoleCtrlHandler SetConsoleMode WriteConsoleA WriteConsoleW GetDateFormatA GetDateFormatW GetTimeFormatA GetTimeFormatW DebugBreak IsDebuggerPresent OutputDebugStringA OutputDebugStringW DelayLoadFailureHook GetErrorMode GetLastError RaiseException SetErrorMode SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter FlsAlloc FlsFree FlsGetValue FlsSetValue CompareFileTime CreateDirectoryA CreateDirectoryW CreateFileA CreateFileW DefineDosDeviceW DeleteFileA DeleteFileW DeleteVolumeMountPointW FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindCloseChangeNotification FindFirstChangeNotificationA FindFirstChangeNotificationW FindFirstFileA FindFirstFileExA FindFirstFileExW FindFirstFileW FindFirstVolumeW FindNextChangeNotification FindNextFileA FindNextFileW FindNextVolumeW FindVolumeClose FlushFileBuffers GetDiskFreeSpaceA GetDiskFreeSpaceExA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeA GetDriveTypeW GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileTime GetFileType GetFinalPathNameByHandleA GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetLogicalDrives GetLogicalDriveStringsW GetLongPathNameA GetLongPathNameW GetShortPathNameW GetTempFileNameW GetVolumeInformationByHandleW GetVolumeInformationW GetVolumePathNameW LocalFileTimeToFileTime LockFile LockFileEx QueryDosDeviceW ReadFile ReadFileEx ReadFileScatter RemoveDirectoryA RemoveDirectoryW SetEndOfFile SetFileAttributesA SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetFileValidData UnlockFile UnlockFileEx WriteFile WriteFileEx WriteFileGather CloseHandle DuplicateHandle GetHandleInformation SetHandleInformation GetProcessHeap GetProcessHeaps HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapLock HeapQueryInformation HeapReAlloc HeapSetInformation HeapSize HeapSummary HeapUnlock HeapValidate HeapWalk InitializeSListHead InterlockedCompareExchange InterlockedCompareExchange64 InterlockedDecrement InterlockedExchange InterlockedExchangeAdd InterlockedFlushSList InterlockedIncrement InterlockedPopEntrySList InterlockedPushEntrySList InterlockedPushListSList QueryDepthSList CancelIoEx CreateIoCompletionPort DeviceIoControl GetOverlappedResult GetQueuedCompletionStatus GetQueuedCompletionStatusEx PostQueuedCompletionStatus DisableThreadLibraryCalls FindResourceExW FindStringOrdinal FreeLibrary FreeLibraryAndExitThread FreeResource GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetProcAddress LoadLibraryExA LoadLibraryExW LoadResource LoadStringA LoadStringW LockResource SizeofResource ConvertDefaultLocale FindNLSString FindNLSStringEx GetACP GetCalendarInfoEx GetCalendarInfoW GetCPFileNameFromRegistry GetCPInfo GetCPInfoExW GetFileMUIInfo GetFileMUIPath GetLocaleInfoEx GetLocaleInfoW GetNLSVersion GetNLSVersionEx GetOEMCP GetProcessPreferredUILanguages GetSystemDefaultLangID GetSystemDefaultLCID GetSystemPreferredUILanguages GetThreadLocale GetThreadPreferredUILanguages GetThreadUILanguage GetUILanguageInfo GetUserDefaultLangID GetUserDefaultLCID GetUserPreferredUILanguages IsNLSDefinedString IsValidCodePage IsValidLanguageGroup IsValidLocale IsValidLocaleName LCMapStringEx LCMapStringW LocaleNameToLCID NlsCheckPolicy NlsEventDataDescCreate NlsGetCacheUpdateCount NlsUpdateLocale NlsUpdateSystemLocale NlsWriteEtwEvent ResolveLocaleName SetCalendarInfoW SetLocaleInfoW SetThreadLocale VerLanguageNameA VerLanguageNameW RegCloseKey RegCreateKeyExA RegCreateKeyExW RegDeleteKeyExA RegDeleteKeyExW RegDeleteTreeA RegDeleteTreeW RegDeleteValueA RegDeleteValueW RegDisablePredefinedCacheEx RegEnumKeyExA RegEnumKeyExW RegEnumValueA RegEnumValueW RegFlushKey RegGetKeySecurity RegGetValueA RegGetValueW RegLoadKeyA RegLoadKeyW RegLoadMUIStringA RegLoadMUIStringW RegNotifyChangeKeyValue RegOpenCurrentUser RegOpenKeyExA RegOpenKeyExW RegOpenUserClassesRoot RegQueryInfoKeyA RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegRestoreKeyA RegRestoreKeyW RegSaveKeyExA RegSaveKeyExW RegSetKeySecurity RegSetValueExA RegSetValueExW RegUnLoadKeyA RegUnLoadKeyW CreateFileMappingW FlushViewOfFile MapViewOfFile MapViewOfFileEx OpenFileMappingW ReadProcessMemory UnmapViewOfFile VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WriteProcessMemory EnumSystemLocalesA FatalAppExitA FatalAppExitW FormatMessageA FormatMessageW GlobalAlloc GlobalFree IsProcessInJob IsWow64Process LCMapStringA LocalAlloc LocalFree LocalLock LocalReAlloc LocalUnlock lstrcmp lstrcmpA lstrcmpi lstrcmpiA lstrcmpiW lstrcmpW lstrcpyn lstrcpynA lstrcpynW lstrlen lstrlenA lstrlenW NeedCurrentDirectoryForExePathA NeedCurrentDirectoryForExePathW PulseEvent SetHandleCount Sleep Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection ConnectNamedPipe CreateNamedPipeW CreatePipe DisconnectNamedPipe GetNamedPipeAttribute GetNamedPipeClientComputerNameW ImpersonateNamedPipeClient PeekNamedPipe SetNamedPipeHandleState TransactNamedPipe WaitNamedPipeW ExpandEnvironmentStringsA ExpandEnvironmentStringsW FreeEnvironmentStringsA FreeEnvironmentStringsW GetCommandLineA GetCommandLineW GetCurrentDirectoryA GetCurrentDirectoryW GetEnvironmentStrings GetEnvironmentStringsA GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetStdHandle SearchPathW SetCurrentDirectoryA SetCurrentDirectoryW SetEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetStdHandle SetStdHandleEx CreateProcessA CreateProcessAsUserW CreateProcessW CreateRemoteThread CreateRemoteThreadEx CreateThread DeleteProcThreadAttributeList ExitProcess ExitThread FlushProcessWriteBuffers GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetExitCodeThread GetPriorityClass GetProcessId GetProcessIdOfThread GetProcessTimes GetProcessVersion GetStartupInfoW GetThreadId GetThreadPriority GetThreadPriorityBoost InitializeProcThreadAttributeList OpenProcessToken OpenThread OpenThreadToken ProcessIdToSessionId QueryProcessAffinityUpdateMode QueueUserAPC ResumeThread SetPriorityClass SetProcessAffinityUpdateMode SetProcessShutdownParameters SetThreadPriority SetThreadPriorityBoost SetThreadStackGuarantee SetThreadToken SuspendThread SwitchToThread TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue UpdateProcThreadAttribute QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlCaptureStackBackTrace RtlFillMemory RtlUnwind CompareStringEx CompareStringOrdinal CompareStringW FoldStringW GetStringTypeExW GetStringTypeW MultiByteToWideChar WideCharToMultiByte AcquireSRWLockExclusive AcquireSRWLockShared CancelWaitableTimer CreateEventA CreateEventExA CreateEventExW CreateEventW CreateMutexA CreateMutexExA CreateMutexExW CreateMutexW CreateSemaphoreExW CreateWaitableTimerExW DeleteCriticalSection EnterCriticalSection InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSRWLock LeaveCriticalSection OpenEventA OpenEventW OpenMutexW OpenProcess OpenSemaphoreW OpenWaitableTimerW ReleaseMutex ReleaseSemaphore ReleaseSRWLockExclusive ReleaseSRWLockShared ResetEvent SetCriticalSectionSpinCount SetEvent SetWaitableTimer SetWaitableTimerEx SleepEx TryAcquireSRWLockExclusive TryAcquireSRWLockShared TryEnterCriticalSection WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx GetComputerNameExA GetComputerNameExW GetDynamicTimeZoneInformation GetLocalTime GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAdjustment GetSystemTimeAsFileTime GetSystemWindowsDirectoryA GetSystemWindowsDirectoryW GetTickCount GetTickCount64 GetTimeZoneInformation GetTimeZoneInformationForYear GetVersion GetVersionExA GetVersionExW GetWindowsDirectoryA GetWindowsDirectoryW GlobalMemoryStatusEx SetLocalTime SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime CallbackMayRunLong CancelThreadpoolIo ChangeTimerQueueTimer CloseThreadpool CloseThreadpoolCleanupGroup CloseThreadpoolCleanupGroupMembers CloseThreadpoolIo CloseThreadpoolTimer CloseThreadpoolWait CloseThreadpoolWork CreateThreadpool CreateThreadpoolCleanupGroup CreateThreadpoolIo CreateThreadpoolTimer CreateThreadpoolWait CreateThreadpoolWork CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueueEx DeleteTimerQueueTimer DisassociateCurrentThreadFromCallback FreeLibraryWhenCallbackReturns IsThreadpoolTimerSet LeaveCriticalSectionWhenCallbackReturns QueryThreadpoolStackInformation RegisterWaitForSingleObjectEx ReleaseMutexWhenCallbackReturns ReleaseSemaphoreWhenCallbackReturns SetEventWhenCallbackReturns SetThreadpoolStackInformation SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum SetThreadpoolTimer SetThreadpoolWait StartThreadpoolIo SubmitThreadpoolWork TrySubmitThreadpoolCallback UnregisterWaitEx WaitForThreadpoolIoCallbacks WaitForThreadpoolTimerCallbacks WaitForThreadpoolWaitCallbacks WaitForThreadpoolWorkCallbacks Beep DecodePointer DecodeSystemPointer EncodePointer EncodeSystemPointer RtlCopyExtendedContext RtlGetEnabledExtendedFeatures RtlGetExtendedContextLength RtlGetExtendedFeaturesMask RtlInitializeExtendedContext RtlLocateExtendedFeature RtlLocateLegacyContext RtlSetExtendedFeaturesMask AccessCheck AccessCheckAndAuditAlarmW AccessCheckByType AccessCheckByTypeAndAuditAlarmW AccessCheckByTypeResultList AccessCheckByTypeResultListAndAuditAlarmByHandleW AccessCheckByTypeResultListAndAuditAlarmW AddAccessAllowedAce AddAccessAllowedAceEx AddAccessAllowedObjectAce AddAccessDeniedAce AddAccessDeniedAceEx AddAccessDeniedObjectAce AddAce AddAuditAccessAce AddAuditAccessAceEx AddAuditAccessObjectAce AddMandatoryAce AdjustTokenGroups AdjustTokenPrivileges AllocateAndInitializeSid AllocateLocallyUniqueId AreAllAccessesGranted AreAnyAccessesGranted CheckTokenMembership ConvertToAutoInheritPrivateObjectSecurity CopySid CreatePrivateObjectSecurity CreatePrivateObjectSecurityEx CreatePrivateObjectSecurityWithMultipleInheritance CreateRestrictedToken CreateWellKnownSid DeleteAce DestroyPrivateObjectSecurity DuplicateToken DuplicateTokenEx EqualDomainSid EqualPrefixSid EqualSid FindFirstFreeAce FreeSid GetAce GetAclInformation GetFileSecurityW GetKernelObjectSecurity GetLengthSid GetPrivateObjectSecurity GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorLength GetSecurityDescriptorOwner GetSecurityDescriptorRMControl GetSecurityDescriptorSacl GetSidIdentifierAuthority GetSidLengthRequired GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetWindowsAccountDomainSid ImpersonateAnonymousToken ImpersonateLoggedOnUser ImpersonateSelf InitializeAcl InitializeSecurityDescriptor InitializeSid IsTokenRestricted IsValidAcl IsValidRelativeSecurityDescriptor IsValidSecurityDescriptor IsValidSid IsWellKnownSid MakeAbsoluteSD MakeAbsoluteSD2 MakeSelfRelativeSD MapGenericMask ObjectCloseAuditAlarmW ObjectDeleteAuditAlarmW ObjectOpenAuditAlarmW ObjectPrivilegeAuditAlarmW PrivilegeCheck PrivilegedServiceAuditAlarmW QuerySecurityAccessMask RevertToSelf SetAclInformation SetFileSecurityW SetKernelObjectSecurity SetPrivateObjectSecurity SetPrivateObjectSecurityEx SetSecurityAccessMask SetSecurityDescriptorControl SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorRMControl SetSecurityDescriptorSacl SetTokenInformation LookupAccountNameLocalA LookupAccountNameLocalW LookupAccountSidLocalA LookupAccountSidLocalW LsaLookupClose LsaLookupFreeMemory LsaLookupGetDomainInfo LsaLookupManageSidNameMapping LsaLookupOpenLocalPolicy LsaLookupTranslateNames LsaLookupTranslateSids ConvertSecurityDescriptorToStringSecurityDescriptorW ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW CloseServiceHandle ControlServiceExW CreateServiceW DeleteService OpenSCManagerW OpenServiceW StartServiceW ChangeServiceConfig2W ChangeServiceConfigW NotifyServiceStatusChangeW QueryServiceConfig2W QueryServiceConfigW QueryServiceObjectSecurity QueryServiceStatusEx SetServiceObjectSecurity ChangeServiceConfig2A ChangeServiceConfigA ControlService ControlServiceExA CreateServiceA I_QueryTagInformation I_ScBroadcastServiceControlMessage I_ScIsSecurityProcess I_ScPnPGetServiceName I_ScQueryServiceConfig I_ScRpcBindA I_ScRpcBindW I_ScSendPnPMessage I_ScSendTSMessage I_ScValidatePnPService NotifyServiceStatusChangeA OpenSCManagerA OpenServiceA QueryServiceConfig2A QueryServiceConfigA QueryServiceStatus RegisterServiceCtrlHandlerA RegisterServiceCtrlHandlerExA RegisterServiceCtrlHandlerW StartServiceA StartServiceCtrlDispatcherA

DLL File	Function Names
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-delayload-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-io-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-1-0.dll
api-ms-win-core-localregistry-l1-1-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-misc-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-threadpool-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-core-xstate-l1-1-0.dll
api-ms-win-security-base-l1-1-0.dll
api-ms-win-security-lsalookup-l1-1-0.dll
api-ms-win-security-sddl-l1-1-0.dll
api-ms-win-service-core-l1-1-0.dll
api-ms-win-service-management-l1-1-0.dll
api-ms-win-service-management-l2-1-0.dll
api-ms-win-service-winsvc-l1-1-0.dll