unsafe string GetNtdllName() { var sb = new StringBuilder(64); uint srcSize, dstSize; Control.GetTextReplacementWide("$ntdllsym", 0, null, 0, &srcSize, sb, 128, &dstSize); string ntdll = sb.ToString(); if (ntdll.StartsWith("nt")) { return(ntdll); } return("ntdll"); }