update on ntdll/kernel32 separation