Search code examples
winapidllreverse-engineering

What is the difference between the 'Avl' suffix and the original function in the Win32 API?


I've dumped the export table of ntdll.dll looking for specific APIs, but found the same function but one 'Avl' appended to it, what does it mean? like: RtlDeleteElementGenericTable RtlDeleteElementGenericTableAvl


Solution

  • That is just the simple meaning, For example: RtlDeleteElementGenericTable and RtlDeleteElementGenericTableAvl, The parameter type of RtlDeleteElementGenericTable is RTL_GENERIC_TABLE, But RtlDeleteElementGenericTableAvl is RTL_AVL_TABLE.

    The RTL_AVL_TABLE structure contains file system-specific data for an Adelson-Velsky/Landis (AVL) tree. An AVL tree ensures a more balanced, shallower tree implementation than a splay tree implementation of a generic table (RTL_GENERIC_TABLE).

    So that's is also the differences between * and *Avl functions.