LKBEN10930: Can you statically link your program with ntdll.lib?

This article has not been checked!

LKB | Created: 02/04/2020 | Version: 0 | Language: EN | Rating: 0 | Outdated: False | Marked for deletion: False

Author: Wim Peeters - Keskon GmbH & Co. KG


You would like to use Static linking with Ntdll.lib


Static linking with Ntdll.lib is in fact dynamic linking! This is by design.


You have used static linking for your User-Mode application. This means that your application will use native system service routines from Ntdll.dll by calling entry points in the dynamic link library. These calls convert your routines into system calls in kernel mode.

What now, is it static or dynamic? Well, even if you linked statically with ntdll.lib, there routines are just stubs for entry points in the dynamically linked ntdll.dll at run time. User-mode applications are always linked with ntdll.dll. This is by design. A User-mode application cannot call entry points in Ntoskrnl.exe and needs the ntdll functions to do this transition into kernel mode.

Please also note that kernel-mode drivers cannot call entry points in Ntdll.dll either! They have to stay in kernel mode!

About the Author

Wim Peeters is electronics engineer with an additional master in IT and over 30 years of experience including time spent in support, development, consulting, training and database administration. Wim has worked with SQL Server since version 6.5. He has developed in C/C++, Java and C# on Windows and Linux in different European countries and different European languages. He writes knowledge base articles to solve IT problems and publishes them on the Lubby Knowledge Platform where he is one of the most important contributors and the main developer.


The information provided in this document is intended for your information only. Lubby makes no claims to the validity of this information. Use of this information is at own risk!