API-MS-Win-Core-Heap-L1-1-0

All functions in the API-MS-Win-Core-Heap-L1-1-0 set are exports from KERNEL32:

• GetProcessHeap
• GetProcessHeaps
• HeapAlloc
• HeapCompact
• HeapCreate
• HeapDestroy
• HeapFree
• HeapLock
• HeapQueryInformation
• HeapReAlloc
• HeapSetInformation
• HeapSize
• HeapSummary
• HeapUnlock
• HeapValidate
• HeapWalk

For most of these functions, the implementations in KERNEL32 version 6.1 and higher are just stubs which transfer the handling to wherever the schema redirects the API Set. The exceptions are:

• HeapAlloc, HeapReAlloc and HeapSize, which KERNEL32 forwards to a corresponding NTDLL function;
• HeapFree, for which KERNEL32 post-processes a call to a corresponding NTDLL function.

New Locations

For each function that KERNEL32 version 6.1 transfers to the API Set, a non-trivial implementation is exported from KERNELBASE version 6.1 and higher.

The other functions are also exported from KERNELBASE version 6.1 and higher, but as forwards to the corresponding NTDLL function. Although this forwarding reproduces the KERNEL32 handling for three of the functions, it is defective in the case of HeapFree: the NTDLL function, RtlFreeHeap, returns a one-byte BOOLEAN which is not certainly meaningful as a four-byte BOOL suitable for returning from HeapFree. This is more a curiosity than a problem, since very little code ever checks HeapFree for failure. Still, it is remarkable for reproducing in KERNELBASE a bug that took more than a decade to get noticed and corrected in KERNEL32.

Schema Redirection

The Windows 7 schema redirects this API Set to KERNELBASE. Thus:

• high-level executables, which do not use the API Set, continue to import these functions from KERNEL32;
• low-level executables have their imports from the API Set redirected to KERNELBASE;
• as a particular case of the preceding, the stub implementations in KERNEL32 import from underlying implementations in KERNELBASE.