mirror-processhacker/2.x/trunk/lib

Microsoft's ntdll.lib files are supplied with the DDK,

but are not redistributable.



The alternative used in Process Hacker is to have a

ntdll.def file and create ntdll.lib from that using

the LIB tool. The x86 ntdll.lib must be fixed using

fixlib, which converts the exports from ordinal to

name entries. The x64 ntdll.lib does not suffer from

this problem.



The regex for swapping the export entries is below:



Replace <:b:b:b:b{.*}:b=:b{.*}>

with    <    \2 = \1>