7 Mar
2015
7 Mar
'15
4:30 p.m.
Am 07.03.2015 um 16:44 schrieb Pierre Schweitzer:
Hi,
There's one point I don't see any reference to: you keep talking about
DLLs & such. How would you handle API in these DLLs that require system
calls from kernel? Does that mean our kernel has to evolve to something
higher than 5.2?
At some point we will probably need to do that. But a lot of the
APIs
can be - possibly in faked manner - written in usermode. But I don't
see a major issue in adding system calls as we need them, just not
exposed though the win 2003 ntdll, so a "normal" application wouldn't
see them. I would also not care for their system call numbers atm, since
that does really not matter so much. Just put them at the end and good.
Alternatively we could even "simulate" these with a kernel extension
driver that we invoke using ioctls, but I'm not sure if that provides
any benefit. I guess every feature that we want to add will require
individual estimation what the best approach is. The major point is that
we have a way to hide these things from user mode applications as
transparently as possible.
Another (minor) point: you talk about parent DLLs that would host most
of the code, with other DLLs that would have the rest of the API missing
(as it would be done for kernel32 nowadays). How do you handle APIs that
would have slightly changed behavior between two Windows releases?
Duplicate code? Ignore previous behavior? That can also be seen: how do
you handle API that get extended over the time, supporting more and more
flags? One who can do the most, can do less?
In that case I see 3 possible
approaches: a) implement a wrapper /
reimplement the changed behaviour in that DLL, or b) Have the parent DLL
expose a "versioned" export, that will handle the different behaviour,
or c) Initialize the parent DLL with a version number stored in a global
variable and handle the different things depending on that version
number. I think all of these have their pros and cons and we might even
decide to use a mixture of these.
When it comes to differences in kernel-behaviour, we could probably
check the PEB or the OS version and handle these things based on that.
Timo