mirror-processhacker/2.x/trunk/lib

Microsoft's ntdll.lib files are supplied with the DDK, 

but are not redistributable.



The alternative used in Process Hacker is to have a 

ntdll.def file and create ntdll.lib from that using 

the LIB tool. The x86 ntdll.lib must be fixed using 

fixlib, which converts the exports from ordinal to 

name entries. The x64 ntdll.lib does not suffer from 

this problem.



The regex for swapping the export entries is below:



Replace <:b:b:b:b{.*}:b=:b{.*}>

with    <    \2 = \1>