3

I was looking at the NtDll export table on my Windows 10 computer, and I found that it exports standard C runtime functions, like memcpy, sprintf, strlen, etc.

Does that mean that I can call them dynamically at runtime through LoadLibrary and GetProcAddress? Is this guaranteed to be the case for every Windows version?

If so, it is possible to drop the C runtime library altogether (by just using the CRT functions from NtDll), therefore making my program smaller?

3
  • No, you can't do this. Are you really having problems with your executable files being too big? What problem are you trying to solve? – David Heffernan Aug 16 '16 at 16:06
  • 1
    This goes back to very early versions of Windows, back in the 16-bit days when they had to cram a GUI operating system into 640 KB of ram. To give programmers a fighting chance to write small enough programs, Microsoft shared the standard C runtime functions they needed in Windows. They did however stop exposing them in the SDK libs so getting your program linked is not simple. Or wise, the CRT got pretty convoluted. – Hans Passant Aug 16 '16 at 17:32
  • 2
    The CRT is more than just the CRT functions. There's lots and lots and lots of code in the CRT, some of it is clearly visible (exported functions like memcpy), other parts hardly make it to the surface (exception handling), while still other parts are widely invisible (like initialization of static storage). Not using the CRT is not at all recommended. If you want small deployment, you can target Windows 10, and use the Universal CRT (which is part of the OS, so you don't have to ship it). – IInspectable Aug 16 '16 at 17:56
8

There is absolutely no reason to call these undocumented functions exported by NtDll. Windows exports all of the essential C runtime functions as documented wrappers from the standard system libraries, namely Kernel32. If you absolutely cannot link to the C Runtime Library*, then you should be calling these functions. For memory, you have the basic HeapAlloc and HeapFree (or perhaps VirtualAlloc and VirtualFree), ZeroMemory, FillMemory, MoveMemory, CopyMemory, etc. For string manipulation, the important CRT functions are all there, prefixed with an l: lstrlen, lstrcat, lstrcpy, lstrcmp, etc. The odd man out is wsprintf (and its brother wvsprintf), which not only has a different prefix but also doesn't support floating-point values (Windows itself had no floating-point code in the early days when these functions were first exported and documented.) There are a variety of other helper functions, too, that replicate functionality in the CRT, like IsCharLower, CharLower, CharLowerBuff, etc.

Here is an old knowledge base article that documents some of the Win32 Equivalents for C Run-Time Functions. There are likely other relevant Win32 functions that you would probably need if you were re-implementing the functionality of the CRT, but these are the direct, drop-in replacements.

Some of these are absolutely required by the infrastructure of the operating system, and would be called internally by any CRT implementation. This category includes things like HeapAlloc and HeapFree, which are the responsibility of the operating system. A runtime library only wraps those, providing a nice standard-C interface and some other niceties on top of the nitty-gritty OS-level details. Others, like the string manipulation functions, are just exported wrappers around an internal Windows version of the CRT (except that it's a really old version of the CRT, fixed back at some time in history, save for possibly major security holes that have gotten patched over the years). Still others are almost completely superfluous, or seem so, like ZeroMemory and MoveMemory, but are actually exported so that they can be used from environments where there is no C Runtime Library, like classic Visual Basic (VB 6).

It is also interesting to point out that many of the "simple" C Runtime Library functions are implemented by Microsoft's (and other vendors') compiler as intrinsic functions, with special handling. This means that they can be highly optimized. Basically, the relevant object code is emitted inline, directly in your application's binary, avoiding the need for a potentially expensive function call. Allowing the compiler to generate inlined code for something like strlen, that gets called all the time, will almost undoubtedly lead to better performance than having to pay the cost of a function call to one of the exported Windows APIs. There is no way for the compiler to "inline" lstrlen; it gets called just like any other function. This gets you back to the classic tradeoff between speed and size. Sometimes a smaller binary is faster, but sometimes it's not. Not having to link the CRT will produce a smaller binary, since it uses function calls rather than inline implementations, but probably won't produce faster code in the general case.

* However, you really should be linking to the C Runtime Library bundled with your compiler, for a variety of reasons, not the least of which is security updates that can be distributed to all versions of the operating system via updated versions of the runtime libraries. You have to have a really good reason not to use the CRT, such as if you are trying to build the world's smallest executable. And not having these functions available will only be the first of your hurdles. The CRT handles a lot of stuff for you that you don't normally even have to think about, like getting the process up and running, setting up a standard C or C++ environment, parsing the command line arguments, running static initializers, implementing constructors and destructors (if you're writing C++), supporting structured exception handling (SEH, which is used for C++ exceptions, too) and so on. I have gotten a simple C app to compile without a dependency on the CRT, but it took quite a bit of fiddling, and I certainly wouldn't recommend it for anything remotely serious. Matthew Wilson wrote an article a long time ago about Avoiding the Visual C++ Runtime Library. It is largely out of date, because it focuses on the Visual C++ 6 development environment, but a lot of the big picture stuff is still relevant. Matt Pietrek wrote an article about this in the Microsoft Journal a long while ago, too. The title was "Under the Hood: Reduce EXE and DLL Size with LIBCTINY.LIB". A copy can still be found on MSDN and, in case that becomes inaccessible during one of Microsoft's reorganizations, on the Wayback Machine. (Hat tip to IInspectable and Gertjan Brouwer for digging up the links!)

If your concern is just the need to distribute the C Runtime Library DLL(s) alongside your application, you can consider statically linking to the CRT. This embeds the code into your executable, and eliminates the requirement for the separate DLLs. Again, this bloats your executable, but does make it simpler to deploy without the need for an installer or even a ZIP file. The big caveat of this, naturally, is that you cannot benefit to incremental security updates to the CRT DLLs; you have to recompile and redistribute the application to get those fixes. For toy apps with no other dependencies, I often choose to statically link; otherwise, dynamically linking is still the recommended scenario.

1
  • A few notes: "The CRT handles [...] parsing the command line arguments" - That's really the shell, that does the heavy lifting (CommandLineToArgvW). "[When statically linking] you have to recompile and redistribute the application to get those fixes." - I'd argue that you have to do the same, when dynamically linking. If you don't, you wind up distributing untested code. The Universal CRT seems to allow for that scenario, though. "[A]ll the links seem to be dead" - any archive.org snapshots maybe? – IInspectable Aug 16 '16 at 18:16
1

There are some C runtime functions in NtDll. According to Windows Internals these are limited to string manipulation functions. There are other equivalents such as using HeapAlloc instead of malloc, so you may get away with it depending on your requirements.

Although these functions are acknowledged by Microsoft publications and have been used for many years by the kernel programmers, they are not part of the official Windows API and you should not use of them for anything other than toy or demo programs as their presence and function may change.

You may want to read a discussion of the option for doing this for the Rust language here.

5
  • So technically it would be allright to use them? I already looked about the HeapAlloc instead of malloc but i look for the way to get rid of crt from my dll, since i use only the string functions i think i should be ok – Vlad Aug 16 '16 at 16:17
  • As far as I know, yes. – Pete Kirkham Aug 16 '16 at 16:23
  • 1
    No it would not be alright to use these undocumented functions that may not exist in all versions of ntdll, might change meaning in future versions, and won't give you any benefits anyway. What is your actual problem? You'll still be using the C runtime of your compiler anyway. All you are doing here is creating work for yourself, risk of future failure, for no benefit whatsoever. – David Heffernan Aug 16 '16 at 16:24
  • @DavidHeffernan In the context of something like a 4K demo, using something documented by WI rather than MSDN doesn't matter. In other contexts, I'd agree. – Pete Kirkham Aug 16 '16 at 16:30
  • The thing is, the asker probably thinks that this is a really good idea, for practical use. It is worth pointing out that it is an utterly bone headed idea for anything other than a silly toy program. You should at the very least point out that no amount of scraping system DLLs for helper functions gets away from the runtime support needed to get the process up and running and a main function executed. The C runtime of the whatever compiler is used will be needed for that. – David Heffernan Aug 16 '16 at 16:38
0

Does that mean that I can call them dynamically at runtime through LoadLibrary and GetProcAddress?

yes. even more - why not use ntdll.lib (or ntdllp.lib) for static binding to ntdll ? and after this you can direct call this functions without any GetProcAddress

Is this guaranteed to be the case for every Windows version?

from nt4 to win10 exist many C runtime functions in ntdll, but it set is different. usual it grow from version to version. but some of then less functional compare msvcrt.dll . say for example printf from ntdll not support floating point format, but in general functional is same

it is possible to drop the C runtime library altogether (by just using the CRT functions from NtDll), therefore making my program smaller?

yes, this is 100% possible.

30
  • 1
    "yes, this is 100% possible" - Well, no, not really. Writing an application that doesn't link against the CRT is nigh impossible. Cody Gray's answer points out some of the lesser known things the CRT implements, that you wouldn't want to live without (SEH being a major component). Similarly, buffer security checks (/GS compiler switch) require the CRT. Plus, an application that doesn't link against the CRT is more readily flagged as malware by anti-malware. As always, no mention that none of this is supported or documented, hence -1. – IInspectable Aug 19 '16 at 17:00
  • @IInspectable - i write many application which work without CRT – RbMm Aug 19 '16 at 17:05
  • SEH being a major component - can use only __try/__except - implemented in ntdll buffer security checks - can off in compiler options – RbMm Aug 19 '16 at 17:07
  • 1
    Sure, you can use the compiler's __try/__except keywords, but that's only half of the SEH implementation. The remainder is buried deep in the CRT (see A Crash Course on the Depths of Win32™ Structured Exception Handling for details). The rule is simple: No CRT, no SEH. And there's more: You won't get much floating point support (beyond basic arithmetic), and there's hardly any support for __in64 (on x86 anyway). And of course, you won't run static initializers either, when not using the CRT. – IInspectable Aug 19 '16 at 17:19
  • @IInspectable - no this is full SEH implementation from windows view. this cannot handle c++ exception - but for low windows level this is enough. about floating point - yes, ntdll have restricted support for this(I say about printf limitation for example) - static initializers - I wrote by self initterm() implementation - very simply only several lines of code. so I many years write code without standard CRT – RbMm Aug 19 '16 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.