Geoff Chappell, Software Analyst
Windows 8 brought something new to the NT kernel: two new functions are exported only by ordinal. Microsoft’s typical practice is that such functions are not documented.
Ordinal | Function |
---|---|
1 | PsCaptureUserProcessParameters |
2 | ZwCreateUserProcess |