Richard Campbell wrote:
A little FYI: The windows NT kernel is apparently 100% unicode. This means that ALL strings within the kernel are unicode. His changes are correct.
this is not entirely correct. Unfortunately there are a few strings that are not unicode, e.g. the ImageFileName field in the EPROCESS structure....But most parts are ;) i guess with kernel he meant the kernel32 library.
Thomas