Why are some system functions exported as stubs instead as forwarders?
If you do a little digging around inside some Windows system functions, you’ll see that, for example, the CreateProcessW
function looks like this:
kernel32!CreateProcessW: 6b819ef0 mov edi,edi 6b819ef2 push ebp 6b819ef3 mov ebp,esp 6b819ef5 pop ebp 6b819ef6 jmp dword ptr [kernel32!kernelbase_
Continue reading Why are some system functions exported as stubs instead as forwarders?