32-bit kernel32.dll does not export RtlCopyMemory

[mpolicki]

When calling PInvoke.Kernel32.CopyMemory in a 32-bit process, a System.EntryPointNotFoundException: 'Unable to find an entry point named 'RtlCopyMemory' in DLL 'Kernel32'. occurs.

.NET Framework 4.7.2, PInvoke 0.7.104

More information in this StackOverflow answer.

[BinToss]

https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-rtlcopymemory MS Docs state this function is exported by NtDll.dll (user mode) or NtosKrnl.exe (kernel mode) since Windows 2000.

https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa366535(v=vs.85) Only the Legacy documentation states that this function is exported by Kernel32.dll, starting with WinXP.

A pull request to refactor this extern function to NtDll and add an extern "shim" in Kernel32 should fix it while maintaining API compatibility.

[AArnott]

Can folks blocked by this switch to CsWin32? That's the direction we're headed anyway.

[BinToss]

CsWin32 0.2.10-beta with Win32Metadata 25.0.28-preview does not generate "RtlCopyMemory". This is because it's not part of the Win32 API. This function is categorized as being part of the Windows (Hardware) Development Kit.

EDIT: The addition of NtDll exports had been suggested as an enhancement to Win32Metadata in 2021 https://github.com/microsoft/wdkmetadata/issues/1