On Mon Feb 19 17:09:27 2024 +0000, Alexandre Julliard wrote:
Conceptually, functions exported only from ntoskrnl go to the DDK, and functions exported from ntdll go to both SDK and DDK. In practice it's a bit muddled because there are many functions that Microsoft doesn't document at all, or only documents as ntoskrnl exports even though they are also in ntdll. Also a number of DDK headers are now included in the SDK. If we wanted to strictly follow Microsoft, there are a million things that we could move around, and keep moving around as they change things on their side. Basically the advice is to try to follow Microsoft when adding new things, and don't change the existing stuff unless really necessary.
That makes sense. Thanks for the explanation.