And about the strlen=ntdll.strlen stuff. Forwarded functions doesnt show up as imported because they arent really imported, so this is normal.
I think that it is not normal. The better way should be to really forward them, this is just half baked stuff.
They are really forwarded. stuff=SOMEDLL.stuff means its forwarded. This is standard module-definition (.def) syntax and its nothing half baked about it.
Forwarded functions are resolved by the loader thus they are not imported by the dll forwarding them.
They are used internally by some other functions inside msvcrt so they must be somewhere what is going on now is that internally a stically linked library is used but anything referencing those functions from the outside are being redirected to ntdll.
What I mean is: If you are forwarding them, why you don´t import them too instead of the static link? If you are statically linking then why forward them?
First: it was not me who added those forwards to ntdll. But it can't see anything wrong with it either.
It seems none of the forwarded functions are implemented/duplicated in crt and they are not called from within crt either thus none of the forwarded routines are imported from ntdll by msvcrt/crtdll.
Gunnar