Hacker News Reader

You're meant to go through ntdll.dll, but even that interface is documented as private/unstable.

You're meant to go through published interfaces, such as the ones in kernel32.dll. ntdll is an implementation detail and so are syscalls.

You're absolutely right, they can.

And they have.

But the reality is more like this: https://xkcd.com/1172/