Results 1 to 16 of 16

Thread: Which Windows DLL actually has RtlCopyMemory?

  1. #1

    Thread Starter
    Frenzied Member
    Join Date
    Oct 2008
    Posts
    1,181

    Which Windows DLL actually has RtlCopyMemory?

    According to MSDN, RtlCopyMemory is faster than RtlMoveMemory (though RtlMoveMemory is often aliased as CopyMemory in VB6 declarations). So I scrolled down the MSDN page and found where it says what DLL to find it in. And there I see it say "NtDll.dll (user mode)", so I know what DLL it should be in, and I use this declare statement:
    Code:
    Private Declare Sub RtlCopyMemory Lib "ntdll.dll" (ByRef Destination As Long, ByRef Source As Long, ByVal Length As Long)
    Unfortunately this doesn't work when I actually call the DLL function in my test program:
    Code:
    Private Sub Form_Load()
        Dim a As Long
        Dim b As Long
        a = 5
        RtlCopyMemory b, a, 1
        Print b
    End Sub
    I end up getting an error that says "Can't find DLL entry point RtlCopyMemory in ntdll.dll". So which DLL is it in? There's tons of DLL files in the Windows system folder. And it's not like it's an undocumented function either. It's documented on MSDN, so if MS moves its location, then there's going to be a lot of programs out there that use it that will now break.

    Here's the MSDN page for it https://msdn.microsoft.com/en-us/lib...(v=vs.85).aspx

  2. #2
    Super Moderator jmcilhinney's Avatar
    Join Date
    May 2005
    Location
    Sydney, Australia
    Posts
    110,296

    Re: Which Windows DLL actually has RtlCopyMemory?


  3. #3
    Angel of Code Niya's Avatar
    Join Date
    Nov 2011
    Posts
    8,598

    Re: Which Windows DLL actually has RtlCopyMemory?

    Try Kernel32.Dll. I used RtlMoveMemory a lot when I was still using VB6 and I don't ever recall it being in any DLL but Kernel32.
    Treeview with NodeAdded/NodesRemoved events | BlinkLabel control | Calculate Permutations | Object Enums | ComboBox with centered items | .Net Internals article(not mine) | Wizard Control | Understanding Multi-Threading | Simple file compression | Demon Arena

    Copy/move files using Windows Shell | I'm not wanted

    C++ programmers will dismiss you as a cretinous simpleton for your inability to keep track of pointers chained 6 levels deep and Java programmers will pillory you for buying into the evils of Microsoft. Meanwhile C# programmers will get paid just a little bit more than you for writing exactly the same code and VB6 programmers will continue to whitter on about "footprints". - FunkyDexter

    There's just no reason to use garbage like InputBox. - jmcilhinney

    The threads I start are Niya and Olaf free zones. No arguing about the benefits of VB6 over .NET here please. Happiness must reign. - yereverluvinuncleber

  4. #4

    Thread Starter
    Frenzied Member
    Join Date
    Oct 2008
    Posts
    1,181

    Re: Which Windows DLL actually has RtlCopyMemory?

    Quote Originally Posted by Niya View Post
    Try Kernel32.Dll. I used RtlMoveMemory a lot when I was still using VB6 and I don't ever recall it being in any DLL but Kernel32.
    You are right, RtlMoveMemory is in kernel32, but RtlMoveMemory is not what I'm trying to find. I'm trying to find RtlCopyMemory. Notice the difference in the function name. One has the word Copy in it while the other contains the word Move instead. RtlCopyMemory is supposed to be in ntdll.dll, according to MSDN, but it's not there. This is the MSDN page that includes the information that RtlCopyMemory is supposed to be in ntdll.dll https://msdn.microsoft.com/en-us/lib...(v=vs.85).aspx
    RtlCopyMemory is supposed to be faster than RtlMoveMemory, with the only restriction being that the destination memory block can't share any of the same bytes as the source memory block. This speed improvement could be useful for processing large amounts of data rapidly. The problem is that RtlCopyMemory is not in ntdll.dll where MSDN says it should be.

  5. #5
    PowerPoster Arnoutdv's Avatar
    Join Date
    Oct 2013
    Posts
    5,871

    Re: Which Windows DLL actually has RtlCopyMemory?

    I read somewhere that the function is not exposed anymore.
    Trying to find the source of this statement.

    https://autohotkey.com/board/topic/1...rtlcopymemory/

    https://stackoverflow.com/questions/...-work-in-vista
    Last edited by Arnoutdv; Nov 28th, 2017 at 01:55 PM.

  6. #6
    PowerPoster
    Join Date
    Jun 2015
    Posts
    2,224

    Re: Which Windows DLL actually has RtlCopyMemory?

    i thought it never existed... it's always been MACRO aliased to the C runtime memcpy.

    not only that - but i bet it's an intrinsic that gets inlined too. (no function call)

  7. #7

    Thread Starter
    Frenzied Member
    Join Date
    Oct 2008
    Posts
    1,181

    Re: Which Windows DLL actually has RtlCopyMemory?

    Quote Originally Posted by DEXWERX View Post
    i thought it never existed... it's always been MACRO aliased to the C runtime memcpy.

    not only that - but i bet it's an intrinsic that gets inlined too. (no function call)

    MSDN though claims that there's supposed to be a function called RtrCopyMemory in ntdll.dll.

  8. #8
    PowerPoster Arnoutdv's Avatar
    Join Date
    Oct 2013
    Posts
    5,871

    Re: Which Windows DLL actually has RtlCopyMemory?

    Then MSDN is either wrong or outdated.

    Edit: The article is for drivers:
    Kernel-Mode Driver Reference -> Driver Support Routines -> Run-Time Library (RTL) Routines
    https://msdn.microsoft.com/en-us/lib...(v=vs.85).aspx
    Last edited by Arnoutdv; Nov 29th, 2017 at 03:51 AM.

  9. #9
    Hyperactive Member
    Join Date
    Aug 2017
    Posts
    380

    Re: Which Windows DLL actually has RtlCopyMemory?

    Here's an excerpt from the classic Hardcore Visual Basic book:

    Quote Originally Posted by Bruce McKinney
    CopyMemory: A Strange and Terrible Saga

    Here’s the long, strange story of how the Win32 function for copying raw memory came to be called CopyMemory, even though there’s no such function in Visual Basic or in the Windows API.

    It started when I first began searching for the Win32 equivalent of the Win16 hmemcpy function for use in Visual Basic version 4. No such thing—not even a note that the function might be obsolete. But…

    The closest I could come up with was the CopyMemory function, which has exactly the same arguments and is documented the same as the old hmemcpy. Unfortunately, despite what you might read in Win32 documentation, there is no such thing as CopyMemory. You can search all the 32-bit DLLs with the DumpBin utility, but you won’t find any DLL containing CopyMemory. But…

    If you search carefully through the Win32 C include files, you’ll turn up the following in WINBASE.H:

    #define CopyMemory RtlCopyMemory
    #define MoveMemory RtlMoveMemory
    #define ZeroMemory RtlZeroMemory


    This C equivalent of an alias indicates that CopyMemory is another name for a function called RtlCopyMemory. Don’t ask why; just check for RtlCopyMemory in KERNEL32.DLL. Again, nothing. More sleuthing in the Win32 include files reveals the reason. WINNT.H contains something like this:

    #define RtlCopyMemory(dst, src, len) memcpy(dst, src, len)

    In other words, RtlCopyMemory is an alias for the C memcpy function, but you can’t use memcpy or any other C library function from Basic. The documenta-tion is simply lying when it claims that CopyMemory is a Windows function rather than a C function. If it’s not exported from a DLL, you can’t call it. But… KERNEL32.DLL does contain an entry for RtlMoveMemory. If you check the Win32 documentation, you’ll see that MoveMemory does the same thing as CopyMemory except that it handles overlapped memory in a different fashion. I can’t imagine a situation in which a Basic programmer would be copying overlapped memory. No reason not to use MoveMemory instead. The name CopyMemory seemed more intelligible than hmemcpy or MoveMemory, so I used this alias for both 16-bit and 32-bit versions:

    #If Win32 Then
    Declare Sub CopyMemory Lib "KERNEL32" Alias "RtlMoveMemory" ( _
    lpvDest As Any, lpvSource As Any, ByVal cbCopy As Long)
    #Else
    Declare Sub CopyMemory Lib "KERNEL" Alias "hmemcpy" ( _
    lpvDest As Any, lpvSource As Any, ByVal cbCopy As Long)
    #End If


    The Windows API type library has an equivalent (or almost equivalent) CopyMemory function.

    That explains why I used CopyMemory, but why does everybody else use it? Because I sent a copy of my sidebar to an internal alias at Microsoft, and someone who read it decided it would make a good Knowledge Base article. I agreed to let them use it if they mentioned it was an excerpt from my book. Good advertising, I thought. Ever since then I’ve read articles and heard speakers at the VBITS conference talking about CopyMemory as if it really existed. And none of them mention my book as the source. So don’t be fooled by false advertising. If they talk about RtlMoveMemory, they figured it out on their own. If they talk about CopyMemory, they got it (perhaps without knowing) from me.

    If you want an equivalent to the RtlCopyMemory routine that you can call from VB6, you'll probably be pleased to know that VB6's runtime DLL (msvbvm60.dll) actually already exports such a function: __vbaCopyBytes. This undocumented function works pretty much the same way as RtlCopyMemory and, as would be expected, it also runs (slightly) faster than RtlMoveMemory. Their only difference is in the order of their parameters.

  10. #10
    Fanatic Member 2kaud's Avatar
    Join Date
    May 2014
    Location
    England
    Posts
    996

    Re: Which Windows DLL actually has RtlCopyMemory?

    Quote Originally Posted by Ben321 View Post
    MSDN though claims that there's supposed to be a function called RtrCopyMemory in ntdll.dll.
    The documentation (not for the first time!) is not correct. RtlCopyMemory() isn't a .dll exported function. It is not even exported from NtosKrnl.exe for kernel mode programs.
    All advice is offered in good faith only. You are ultimately responsible for the effects of your programs and the integrity of the machines they run on. Anything I post, code snippets, advice, etc is licensed as Public Domain https://creativecommons.org/publicdomain/zero/1.0/

    C++23 Compiler: Microsoft VS2022 (17.6.5)

  11. #11

    Thread Starter
    Frenzied Member
    Join Date
    Oct 2008
    Posts
    1,181

    Re: Which Windows DLL actually has RtlCopyMemory?

    Quote Originally Posted by 2kaud View Post
    The documentation (not for the first time!) is not correct. RtlCopyMemory() isn't a .dll exported function. It is not even exported from NtosKrnl.exe for kernel mode programs.
    Then where is the function located? Is it a non exported function? Is there some trick to accessing it?

  12. #12
    PowerPoster
    Join Date
    Jun 2015
    Posts
    2,224

    Re: Which Windows DLL actually has RtlCopyMemory?

    Quote Originally Posted by Ben321 View Post
    Then where is the function located? Is it a non exported function? Is there some trick to accessing it?
    It NEVER EXISTED. it's a MACRO aliased to memcpy(), which is technically located in the C runtime (MSVCRTxx.DLL)

    But really - if you compile a program in C/C++ it doesn't even call a routine because memcpy is an intrinsic. the code for the function gets inlined.
    https://msdn.microsoft.com/en-us/library/26td21ds.aspx
    Last edited by DEXWERX; Nov 30th, 2017 at 08:27 AM.

  13. #13
    Fanatic Member 2kaud's Avatar
    Join Date
    May 2014
    Location
    England
    Posts
    996

    Re: Which Windows DLL actually has RtlCopyMemory?

    Quote Originally Posted by Ben321 View Post
    Then where is the function located? Is it a non exported function? Is there some trick to accessing it?
    See post #9!
    All advice is offered in good faith only. You are ultimately responsible for the effects of your programs and the integrity of the machines they run on. Anything I post, code snippets, advice, etc is licensed as Public Domain https://creativecommons.org/publicdomain/zero/1.0/

    C++23 Compiler: Microsoft VS2022 (17.6.5)

  14. #14

    Thread Starter
    Frenzied Member
    Join Date
    Oct 2008
    Posts
    1,181

    Re: Which Windows DLL actually has RtlCopyMemory?

    Quote Originally Posted by DEXWERX View Post
    But really - if you compile a program in C/C++ it doesn't even call a routine because memcpy is an intrinsic. the code for the function gets inlined.
    https://msdn.microsoft.com/en-us/library/26td21ds.aspx

    If it is compiled inline, then why do C++ programs always require a copy of msvcrt.dll? It seems that calls to this DLL are required.

  15. #15
    Fanatic Member 2kaud's Avatar
    Join Date
    May 2014
    Location
    England
    Posts
    996

    Re: Which Windows DLL actually has RtlCopyMemory?

    From winnt.h

    Code:
    #define RtlCopyMemory(dst, src, len) memcpy(dst, src, len)
    So RtlCopyMemory() is just another name for memcpy(). memcpy() is exported from msvcrt.dll

    Code:
    1259  4EA 00009910 memcpy
    All advice is offered in good faith only. You are ultimately responsible for the effects of your programs and the integrity of the machines they run on. Anything I post, code snippets, advice, etc is licensed as Public Domain https://creativecommons.org/publicdomain/zero/1.0/

    C++23 Compiler: Microsoft VS2022 (17.6.5)

  16. #16
    PowerPoster
    Join Date
    Jun 2015
    Posts
    2,224

    Re: Which Windows DLL actually has RtlCopyMemory?

    Quote Originally Posted by Ben321 View Post
    If it is compiled inline, then why do C++ programs always require a copy of msvcrt.dll? It seems that calls to this DLL are required.
    if you check that link, there is a list of all the intrinsic functions that can be compiled inline.
    you'll notice it's not everything, there is a lot of things that are not intrinsic...
    things like memory management (new/delete) and exception handling.

    edit:here's the page that lists the of VC++ intrinsics https://msdn.microsoft.com/en-us/library/tzkfha43.aspx

    memory copying is typically something you want to be performant - so removing the function call helps that much more.

    Also C++ programs do not always require a copy of msvcrt.dll.
    Last edited by DEXWERX; Dec 7th, 2017 at 08:40 AM.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Click Here to Expand Forum to Full Width