引用 张静茹:
NTDLL.dll是内核吧,R3的程序能调R0的dll?

引用 acmilan:
ntdll.dll并不是内核，而是一个内核调用的stub而已，可工作于R0和R3。NT内核下的Windows程序都会通过kernel32.dll间接链接此库，所以是可以调用的。

<code class="lang-cpp">typedef BOOL (WINAPI *tIsWow64Process) (HANDLE, PBOOL);
              
BOOL bIsWow64 = FALSE;
              
tIsWow64Process pIsWow64Process =
    (tIsWow64Process) GetProcAddress(GetModuleHandleW(L"kernel32"), "IsWow64Process");
              
if (NULL != pIsWow64Process)
{
    if (!pIsWow64Process(GetCurrentProcess(),&bIsWow64))
        printf("IsWow64Process error.\n");
}
              
if (bIsWow64)
{
    printf("IsWow64Process TRUE.\n");
}
else
{
    printf("IsWow64Process FALSE.\n");
}</code>

<code class="lang-cpp">//#include <commctrl.h>
                  
// 使用comctl32.dll版本6，这是个预处理指令
#pragma comment(linker,"/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'\"")
                    
// TaskDialog函数的原型
typedef HRESULT (WINAPI *tTaskDialog)(HWND hwndParent, HINSTANCE hInstance,
    PCWSTR pszWindowTitle, PCWSTR pszMainInstruction, PCWSTR pszContent,
    TASKDIALOG_COMMON_BUTTON_FLAGS dwCommonButtons, PCWSTR pszIcon, int *pnButton);
                    
// 加载comctl32.dll
HMODULE hcomctl32 = LoadLibraryW(L"comctl32.dll");
                    
// 加载成功
if (hcomctl32 != NULL)
{
    // 获取TaskDialog函数地址
    tTaskDialog pTaskDialog = (tTaskDialog)GetProcAddress(hcomctl32, "TaskDialog");
                    
    // 获取成功，调用TaskDIalog显示对话框
    if (pTaskDialog != NULL)
        pTaskDialog(NULL, NULL, L"任务对话框", L"主指示", L"内容",
                TDCBF_OK_BUTTON|TDCBF_YES_BUTTON, TD_INFORMATION_ICON, NULL);
                    
    // 释放comctl32.dll
    FreeLibrary(hcomctl32);
}</commctrl.h></code>

<code class="lang-cpp">BOOL GetVersionEx2(LPOSVERSIONINFOW lpVersionInformation)
{
    HMODULE hNtDll = GetModuleHandleW(L"NTDLL"); // 获取ntdll.dll的句柄
    typedef NTSTATUS (NTAPI*tRtlGetVersion)(PRTL_OSVERSIONINFOW povi); // RtlGetVersion的原型
    tRtlGetVersion pRtlGetVersion = NULL;
    if (hNtDll)
    {
        pRtlGetVersion = (tRtlGetVersion)GetProcAddress(hNtDll, "RtlGetVersion"); // 获取RtlGetVersion地址
    }
    if (pRtlGetVersion)
    {
        return pRtlGetVersion((PRTL_OSVERSIONINFOW)lpVersionInformation) >= 0; // 调用RtlGetVersion
    }
    else
    {
        return GetVersionExW(lpVersionInformation); // Windows XP以下版本
    }
}</code>

<code class="lang-c">using System;
using System.Drawing;
using System.Runtime.InteropServices;
using System.Windows.Forms;
 
namespace WinUtils
{
    [StructLayout(LayoutKind.Sequential, Pack = 1)]
    public struct SYSTEM_INFO
    {
        public PROCESSOR_ARCHITECTURE wProcessorArchitecture;
        short wReserved;
 
        public int dwPageSize;
        public IntPtr lpMinimumApplicationAddress;
        public IntPtr lpMaximumApplicationAddress;
        public IntPtr dwActiveProcessorMask;
        public int dwNumberOfProcessors;
        public int dwProcessorType;
        public int dwAllocationGranularity;
        public short wProcessorLevel;
        public short wProcessorRevision;
    };
 
    public enum PROCESSOR_ARCHITECTURE : short
    {
        PROCESSOR_ARCHITECTURE_INTEL = 0,
        PROCESSOR_ARCHITECTURE_MIPS = 1,
        PROCESSOR_ARCHITECTURE_ALPHA = 2,
        PROCESSOR_ARCHITECTURE_PPC = 3,
        PROCESSOR_ARCHITECTURE_SHX = 4,
        PROCESSOR_ARCHITECTURE_ARM = 5,
        PROCESSOR_ARCHITECTURE_IA64 = 6,
        PROCESSOR_ARCHITECTURE_ALPHA64 = 7,
        PROCESSOR_ARCHITECTURE_MSIL = 8,
        PROCESSOR_ARCHITECTURE_AMD64 = 9,
        PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 = 10,
        PROCESSOR_ARCHITECTURE_NEUTRAL = 11
    }
 
    public static class WinVer
    {
        public static Version SystemVersion = WinVer.GetSystemVersion();
 
        public static bool IsVistaOrGreater()
        {
            return SystemVersion.Major > 5;
        }
 
        public static bool IsWin10OrGreater()
        {
            return SystemVersion.Major > 9;
        }
 
        public static bool IsX64System()
        {
            SYSTEM_INFO systemInfo = new SYSTEM_INFO();
            int a = Marshal.SizeOf(systemInfo);
            WinAPI.GetNativeSystemInfo(ref systemInfo);
            return systemInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE.PROCESSOR_ARCHITECTURE_AMD64;
        }
 
        public static void ShowShellAboutBox(Form form, string appName, string comment, Icon icon = null)
        {
            WinAPI.ShellAbout(form.Handle, appName, comment, icon == null ? form.Icon.Handle : icon.Handle);
        }
 
        private static Delegate GetFunctionAddress(IntPtr dllModule, string functionName, Type t)
        {
 
            IntPtr address = WinAPI.GetProcAddress(dllModule, functionName);
            if (address == IntPtr.Zero)
                return null;
            else
                return Marshal.GetDelegateForFunctionPointer(address, t);
        }
 
        private delegate IntPtr RtlGetNtVersionNumbers(ref int dwMajor, ref int dwMinor, ref int dwBuildNumber);
 
        public static Version GetSystemVersion()
        {
            IntPtr hinst = WinAPI.LoadLibrary("ntdll.dll");
            RtlGetNtVersionNumbers func = (RtlGetNtVersionNumbers)GetFunctionAddress(hinst, "RtlGetNtVersionNumbers", typeof(RtlGetNtVersionNumbers));
            int dwMajor = 0, dwMinor = 0, dwBuildNumber = 0;
            func.Invoke(ref dwMajor, ref dwMinor, ref dwBuildNumber);
            dwBuildNumber &= 0xffff;
            return new Version(dwMajor, dwMinor, dwBuildNumber);
        }
    }
}</code>

<code class="lang-c">[DllImport("Kernel32")]
public static extern IntPtr LoadLibrary(string funcname);
 
[DllImport("Kernel32")]
public static extern IntPtr GetProcAddress(IntPtr handle, string funcname);
 
[DllImport("Kernel32")]
public static extern IntPtr GetNativeSystemInfo(ref SYSTEM_INFO systemInfo);
 
[DllImport("shell32.dll")]
public static extern int ShellAbout(IntPtr hWnd, string szApp, string szOtherStuff, IntPtr hIcon);</code>