Windows 8.1 detection

[Anders]

RtlVerifyVersionInfo probably helps because its internal call to RtlGetVersion is not hooked, this might change in the future of course because MS will discover that people are doing this. Our only hope is that it is a layering violation for NTDLL to call back up to the shim dll's so they might let this one slide, fingers crossed...

[th_mi]

Originally Posted by Anders

RtlVerifyVersionInfo probably helps because its internal call to RtlGetVersion is not hooked, this might change in the future of course because MS will discover that people are doing this.

No RtlGetVersion is not an "internal" function. It is a well documented part of the Windows Driver Support routines:
https://msdn.microsoft.com/en-us/lib...(v=vs.85).aspx
https://msdn.microsoft.com/en-us/lib...(v=vs.85).aspx

From what I remember this functions did not changed since eons. Currently I also do not expect this functions will be changed, Microsoft will surely not making the driver development more difficuilt. And since most drivers are capable to be used on more than one OS this functions are very essential for driver development.

[Anders]

Originally Posted by th_mi

No RtlGetVersion is not an "internal" function. It is a well documented part of the Windows Driver Support routines:

Where did I say that RtlGetVersion is an internal function? The RtlVerifyVersionInfo implementation calls RtlGetVersion to get the version info it uses when comparing the fields. Because this call happens inside ntdll it is not affected by the compatibility hooking that is forced on you when calling RtlGetVersion in your own code.

Originally Posted by th_mi

Microsoft will surely not making the driver development more difficuilt. And since most drivers are capable to be used on more than one OS this functions are very essential for driver development.

While some functions exist both in kernel and user mode they don't have to share the same implementation. It would be possible for ntdll!RtlGetVersion to lie without affecting drivers! RtlGetVersion is only documented for driver use, the user mode version is technically undocumented and could even go away in the future.