CmpString ( ) handle flow in kernel space ?

NTDEV
1

CmpString( ) Function kernel32 library is entered into kernel space and handled by which driver or Memory manager ( Driver ) ?

2

xxxxx@yopmail.com wrote:

CmpString( ) Function kernel32 library is entered into kernel space and handled by which driver or Memory manager ( Driver ) ?

I assume you mean CompareStringA and CompareStringW, since there is no
CmpString.

Both of those eventually map to RtlCompareString in ntoskrnl.exe.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

iirc both CompareStringA and W does not enter kernel mode from user mode

On 10/27/15, Tim Roberts wrote:
> xxxxx@yopmail.com wrote:
>> CmpString( ) Function kernel32 library is entered into kernel space and
>> handled by which driver or Memory manager ( Driver ) ?
>
> I assume you mean CompareStringA and CompareStringW, since there is no
> CmpString.
>
> Both of those eventually map to RtlCompareString in ntoskrnl.exe.
>
> –
> Tim Roberts, xxxxx@probo.com
> Providenza & Boekelheide, Inc.
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

4

> I assume you mean CompareStringA and CompareStringW, since there is no

CmpString.

Both of those eventually map to RtlCompareString in ntoskrnl.exe.

In ntdll.dll

There is no need in a syscall to compare the strings.

–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com