Nikolay Sivov bunglehead@gmail.com wrote:
It looks like it belongs to kernel32/tests.
Since actual access checks are done by ntdll APIs I believe that ntdll/tests is appropriate place, kernel32 file APIs are just wrappers around the tested functionality.
It doesn't matter what it uses internally. You're testing kernel32 calls.
What are you trying to prove? Half of the calls in that file are using kernel32 APIs, that doesn't mean that they need to be moved to kernel32 or that they are doing something wrong.