logoalt Hacker News

jasomillyesterday at 4:37 PM0 repliesview on HN

Presumably you're talking about /SUBSYSTEM:NATIVE, and while you're correct that it changes the default entry point (to NtProcessStartup in this case), it also sets the Subsystem field in the PE optional header to IMAGE_SUBSYSTEM_NATIVE, which causes CreateProcess to fail to start the executable with ERROR_CHILD_NOT_COMPLETE ("The %1 application cannot be run in Win32 mode.").

To see this, try press Windows+R and try running C:\Windows\System32\autochk.exe.

There are workarounds, but AFAIK there's no officially supported way to launch a native executable.

But that doesn't matter unless you want to avoid creating Win32 process structures, loading default Win32 DLLs, etc., as no windows are created and no messages are dispatched by code other than your own unless peculiar startup code is injected into your process at load time.

In particular, you have access to untranslated messages by default, and if you don't want translated messages to be posted, just don't call TranslateMessage in your message loop.