The best statement of whether or not calling functions in ntdll is here: https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/libraries-and-headers

The best statement of whether or not calling functions in ntdll is here: https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/libraries-and-headers https://learn.microsoft.com/en-us/windows-hardware/drivers/k... > documentation for the WDK and Windows SDK recommends that application developers avoid calling undocumented Nt entry points So it's safe to call documented ntdll functions. But calling undocumented functions is more risky.