-
Nov 28th, 2017, 08:33 AM
#1
Thread Starter
Frenzied Member
Which Windows DLL actually has RtlCopyMemory?
According to MSDN, RtlCopyMemory is faster than RtlMoveMemory (though RtlMoveMemory is often aliased as CopyMemory in VB6 declarations). So I scrolled down the MSDN page and found where it says what DLL to find it in. And there I see it say "NtDll.dll (user mode)", so I know what DLL it should be in, and I use this declare statement:
Code:
Private Declare Sub RtlCopyMemory Lib "ntdll.dll" (ByRef Destination As Long, ByRef Source As Long, ByVal Length As Long)
Unfortunately this doesn't work when I actually call the DLL function in my test program:
Code:
Private Sub Form_Load()
Dim a As Long
Dim b As Long
a = 5
RtlCopyMemory b, a, 1
Print b
End Sub
I end up getting an error that says "Can't find DLL entry point RtlCopyMemory in ntdll.dll". So which DLL is it in? There's tons of DLL files in the Windows system folder. And it's not like it's an undocumented function either. It's documented on MSDN, so if MS moves its location, then there's going to be a lot of programs out there that use it that will now break.
Here's the MSDN page for it https://msdn.microsoft.com/en-us/lib...(v=vs.85).aspx
-
Nov 28th, 2017, 08:48 AM
#2
Re: Which Windows DLL actually has RtlCopyMemory?
-
Nov 28th, 2017, 09:36 AM
#3
Re: Which Windows DLL actually has RtlCopyMemory?
Try Kernel32.Dll. I used RtlMoveMemory a lot when I was still using VB6 and I don't ever recall it being in any DLL but Kernel32.
-
Nov 28th, 2017, 01:02 PM
#4
Thread Starter
Frenzied Member
Re: Which Windows DLL actually has RtlCopyMemory?
Originally Posted by Niya
Try Kernel32.Dll. I used RtlMoveMemory a lot when I was still using VB6 and I don't ever recall it being in any DLL but Kernel32.
You are right, RtlMoveMemory is in kernel32, but RtlMoveMemory is not what I'm trying to find. I'm trying to find RtlCopyMemory. Notice the difference in the function name. One has the word Copy in it while the other contains the word Move instead. RtlCopyMemory is supposed to be in ntdll.dll, according to MSDN, but it's not there. This is the MSDN page that includes the information that RtlCopyMemory is supposed to be in ntdll.dll https://msdn.microsoft.com/en-us/lib...(v=vs.85).aspx
RtlCopyMemory is supposed to be faster than RtlMoveMemory, with the only restriction being that the destination memory block can't share any of the same bytes as the source memory block. This speed improvement could be useful for processing large amounts of data rapidly. The problem is that RtlCopyMemory is not in ntdll.dll where MSDN says it should be.
-
Nov 28th, 2017, 01:52 PM
#5
Re: Which Windows DLL actually has RtlCopyMemory?
Last edited by Arnoutdv; Nov 28th, 2017 at 01:55 PM.
-
Nov 28th, 2017, 03:33 PM
#6
Re: Which Windows DLL actually has RtlCopyMemory?
i thought it never existed... it's always been MACRO aliased to the C runtime memcpy.
not only that - but i bet it's an intrinsic that gets inlined too. (no function call)
-
Nov 28th, 2017, 07:37 PM
#7
Thread Starter
Frenzied Member
Re: Which Windows DLL actually has RtlCopyMemory?
Originally Posted by DEXWERX
i thought it never existed... it's always been MACRO aliased to the C runtime memcpy.
not only that - but i bet it's an intrinsic that gets inlined too. (no function call)
MSDN though claims that there's supposed to be a function called RtrCopyMemory in ntdll.dll.
-
Nov 29th, 2017, 03:47 AM
#8
Re: Which Windows DLL actually has RtlCopyMemory?
Then MSDN is either wrong or outdated.
Edit: The article is for drivers:
Kernel-Mode Driver Reference -> Driver Support Routines -> Run-Time Library (RTL) Routines
https://msdn.microsoft.com/en-us/lib...(v=vs.85).aspx
Last edited by Arnoutdv; Nov 29th, 2017 at 03:51 AM.
-
Nov 29th, 2017, 06:07 AM
#9
Re: Which Windows DLL actually has RtlCopyMemory?
Here's an excerpt from the classic Hardcore Visual Basic book:
Originally Posted by Bruce McKinney
CopyMemory: A Strange and Terrible Saga
Here’s the long, strange story of how the Win32 function for copying raw memory came to be called CopyMemory, even though there’s no such function in Visual Basic or in the Windows API.
It started when I first began searching for the Win32 equivalent of the Win16 hmemcpy function for use in Visual Basic version 4. No such thing—not even a note that the function might be obsolete. But…
The closest I could come up with was the CopyMemory function, which has exactly the same arguments and is documented the same as the old hmemcpy. Unfortunately, despite what you might read in Win32 documentation, there is no such thing as CopyMemory. You can search all the 32-bit DLLs with the DumpBin utility, but you won’t find any DLL containing CopyMemory. But…
If you search carefully through the Win32 C include files, you’ll turn up the following in WINBASE.H:
#define CopyMemory RtlCopyMemory
#define MoveMemory RtlMoveMemory
#define ZeroMemory RtlZeroMemory
This C equivalent of an alias indicates that CopyMemory is another name for a function called RtlCopyMemory. Don’t ask why; just check for RtlCopyMemory in KERNEL32.DLL. Again, nothing. More sleuthing in the Win32 include files reveals the reason. WINNT.H contains something like this:
#define RtlCopyMemory(dst, src, len) memcpy(dst, src, len)
In other words, RtlCopyMemory is an alias for the C memcpy function, but you can’t use memcpy or any other C library function from Basic. The documenta-tion is simply lying when it claims that CopyMemory is a Windows function rather than a C function. If it’s not exported from a DLL, you can’t call it. But… KERNEL32.DLL does contain an entry for RtlMoveMemory. If you check the Win32 documentation, you’ll see that MoveMemory does the same thing as CopyMemory except that it handles overlapped memory in a different fashion. I can’t imagine a situation in which a Basic programmer would be copying overlapped memory. No reason not to use MoveMemory instead. The name CopyMemory seemed more intelligible than hmemcpy or MoveMemory, so I used this alias for both 16-bit and 32-bit versions:
#If Win32 Then
Declare Sub CopyMemory Lib "KERNEL32" Alias "RtlMoveMemory" ( _
lpvDest As Any, lpvSource As Any, ByVal cbCopy As Long) #Else
Declare Sub CopyMemory Lib "KERNEL" Alias "hmemcpy" ( _
lpvDest As Any, lpvSource As Any, ByVal cbCopy As Long) #End If
The Windows API type library has an equivalent (or almost equivalent) CopyMemory function.
That explains why I used CopyMemory, but why does everybody else use it? Because I sent a copy of my sidebar to an internal alias at Microsoft, and someone who read it decided it would make a good Knowledge Base article. I agreed to let them use it if they mentioned it was an excerpt from my book. Good advertising, I thought. Ever since then I’ve read articles and heard speakers at the VBITS conference talking about CopyMemory as if it really existed. And none of them mention my book as the source. So don’t be fooled by false advertising. If they talk about RtlMoveMemory, they figured it out on their own. If they talk about CopyMemory, they got it (perhaps without knowing) from me.
If you want an equivalent to the RtlCopyMemory routine that you can call from VB6, you'll probably be pleased to know that VB6's runtime DLL (msvbvm60.dll) actually already exports such a function: __vbaCopyBytes. This undocumented function works pretty much the same way as RtlCopyMemory and, as would be expected, it also runs (slightly) faster than RtlMoveMemory. Their only difference is in the order of their parameters.
-
Nov 29th, 2017, 09:24 AM
#10
Re: Which Windows DLL actually has RtlCopyMemory?
Originally Posted by Ben321
MSDN though claims that there's supposed to be a function called RtrCopyMemory in ntdll.dll.
The documentation (not for the first time!) is not correct. RtlCopyMemory() isn't a .dll exported function. It is not even exported from NtosKrnl.exe for kernel mode programs.
All advice is offered in good faith only. You are ultimately responsible for the effects of your programs and the integrity of the machines they run on. Anything I post, code snippets, advice, etc is licensed as Public Domain https://creativecommons.org/publicdomain/zero/1.0/
C++23 Compiler: Microsoft VS2022 (17.6.5)
-
Nov 29th, 2017, 08:46 PM
#11
Thread Starter
Frenzied Member
Re: Which Windows DLL actually has RtlCopyMemory?
Originally Posted by 2kaud
The documentation (not for the first time!) is not correct. RtlCopyMemory() isn't a .dll exported function. It is not even exported from NtosKrnl.exe for kernel mode programs.
Then where is the function located? Is it a non exported function? Is there some trick to accessing it?
-
Nov 30th, 2017, 08:24 AM
#12
Re: Which Windows DLL actually has RtlCopyMemory?
Originally Posted by Ben321
Then where is the function located? Is it a non exported function? Is there some trick to accessing it?
It NEVER EXISTED. it's a MACRO aliased to memcpy(), which is technically located in the C runtime (MSVCRTxx.DLL)
But really - if you compile a program in C/C++ it doesn't even call a routine because memcpy is an intrinsic. the code for the function gets inlined.
https://msdn.microsoft.com/en-us/library/26td21ds.aspx
Last edited by DEXWERX; Nov 30th, 2017 at 08:27 AM.
-
Nov 30th, 2017, 08:37 AM
#13
Re: Which Windows DLL actually has RtlCopyMemory?
Originally Posted by Ben321
Then where is the function located? Is it a non exported function? Is there some trick to accessing it?
See post #9!
All advice is offered in good faith only. You are ultimately responsible for the effects of your programs and the integrity of the machines they run on. Anything I post, code snippets, advice, etc is licensed as Public Domain https://creativecommons.org/publicdomain/zero/1.0/
C++23 Compiler: Microsoft VS2022 (17.6.5)
-
Dec 6th, 2017, 03:26 PM
#14
Thread Starter
Frenzied Member
Re: Which Windows DLL actually has RtlCopyMemory?
Originally Posted by DEXWERX
If it is compiled inline, then why do C++ programs always require a copy of msvcrt.dll? It seems that calls to this DLL are required.
-
Dec 6th, 2017, 04:39 PM
#15
Re: Which Windows DLL actually has RtlCopyMemory?
From winnt.h
Code:
#define RtlCopyMemory(dst, src, len) memcpy(dst, src, len)
So RtlCopyMemory() is just another name for memcpy(). memcpy() is exported from msvcrt.dll
Code:
1259 4EA 00009910 memcpy
All advice is offered in good faith only. You are ultimately responsible for the effects of your programs and the integrity of the machines they run on. Anything I post, code snippets, advice, etc is licensed as Public Domain https://creativecommons.org/publicdomain/zero/1.0/
C++23 Compiler: Microsoft VS2022 (17.6.5)
-
Dec 7th, 2017, 08:24 AM
#16
Re: Which Windows DLL actually has RtlCopyMemory?
Originally Posted by Ben321
If it is compiled inline, then why do C++ programs always require a copy of msvcrt.dll? It seems that calls to this DLL are required.
if you check that link, there is a list of all the intrinsic functions that can be compiled inline.
you'll notice it's not everything, there is a lot of things that are not intrinsic...
things like memory management (new/delete) and exception handling.
edit:here's the page that lists the of VC++ intrinsics https://msdn.microsoft.com/en-us/library/tzkfha43.aspx
memory copying is typically something you want to be performant - so removing the function call helps that much more.
Also C++ programs do not always require a copy of msvcrt.dll.
Last edited by DEXWERX; Dec 7th, 2017 at 08:40 AM.
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
Click Here to Expand Forum to Full Width
|