title: DllImport with non-exported functions. Why is it working?
body: <p>I just encountered with strange behaviour of DllImport in C#, which I can't explain. I want to know how It is possible and where I can read about It. Case is that via DllImport one can call function that doesn't really exported form dll. In my case It is kernel32.dll and function ZeroMemory (but with Copy/Move/Fill memory such behavior). So, my code:</p>
  <pre><code>[DllImport(&quot;kernel32&quot;, EntryPoint = &quot;LoadLibraryW&quot;, CharSet = CharSet.Unicode, SetLastError = true)]
  public static extern IntPtr LoadLibrary(string libName);
  
  [DllImport(&quot;kernel32.dll&quot;, CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
  public static extern IntPtr GetProcAddress(IntPtr module, string procName);
  
  //WTF???
  [DllImport(&quot;kernel32.dll&quot;, SetLastError = true)]
  public static extern bool ZeroMemory(IntPtr address, int size);
  
  static void TestMemory()
  {
      IntPtr mem = Marshal.AllocHGlobal(100); //Allocate memory block of 100 bytes size
      Marshal.WriteByte(mem, 55);            //Write some value in the first byte
      ZeroMemory(mem, 100);                   //Clearing block of memory
      byte firstByte = Marshal.ReadByte(mem); //Read the first byte of memory block
      Console.WriteLine(firstByte);           //Output 0 (not 55) - ZeroMemory is working
  
      //Getting address of ZeroMemory from kernel32.dll
      IntPtr kernelHandle = LoadLibrary(&quot;kernel32.dll&quot;);
      IntPtr address = GetProcAddress(kernelHandle, &quot;ZeroMemory&quot;);
      Console.WriteLine(address.ToString(&quot;X&quot;));   //Output 0 - Library kernel32.dll DOESN'T export function ZeroMemory!!!
  
      //Testing GetProcAddress via getting address of some exported function
      Console.WriteLine(GetProcAddress(kernelHandle, &quot;AllocConsole&quot;).ToString(&quot;X&quot;));  //Output some address value - all is OK.
  }
  </code></pre>
  <p>No EntryPointNotFoundException is thrown - code works fine. If change name of ZeroMemory to ZeroMemory1 or something like that - exception will be thrown. But in export table of kernel32.dll we see:</p>
  <p><a href="https://i.stack.imgur.com/hy1Iu.png" rel="noreferrer"><img src="https://i.stack.imgur.com/hy1Iu.png" alt="There is NO ZeroMemory!!!" /></a></p>
  <p>There is NO ZeroMemory function at all!
  If we look in <a href="https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa366920(v=vs.85)" rel="noreferrer">msdn</a>, we read that ZeroMemory is just a macro in WinBase.h header file for C++. Inside that we see:</p>
  <pre><code>#define RtlMoveMemory memmove
  #define RtlCopyMemory memcpy
  #define RtlFillMemory(d,l,f) memset((d), (f), (l))
  #define RtlZeroMemory(d,l) RtlFillMemory((d),(l),0)
  #define MoveMemory RtlMoveMemory
  #define CopyMemory RtlCopyMemory
  #define FillMemory RtlFillMemory
  #define ZeroMemory RtlZeroMemory
  </code></pre>
  <p>Obviously, that in C++ ZeroMemory actually works through RtlFillMemory from ntdll.dll. But it is in C++!!! Why is it work in C#?? On official documentation for DllImport attribute <a href="https://docs.microsoft.com/ru-ru/dotnet/api/system.runtime.interopservices.dllimportattribute?view=netframework-4.8" rel="noreferrer">here</a> we can read the next:</p>
  <blockquote>
  <p>As a minimum requirement, you must supply the name of the DLL
  <strong>containing the entry point.</strong></p>
  </blockquote>
  <p>But in that case kernel32.dll CANNOT contating entry point for ZeroMemory. What is going on?? Help, please.</p>