Crate nt_apiset

source ·
Expand description

A parser for API Set Map files of Windows 10 and later.

API Sets are dependencies of PE executables whose names start with “api-” or “ext-”, e.g. api-ms-win-core-sysinfo-l1-1-0. They don’t exist as real DLL files. Instead, when that PE executable is loaded, an API Set Map file of the operating system is checked to figure out the real library file belonging to the dependency (in this case: kernelbase.dll).

The most prominent API Set Map file is apisetschema.dll.


To get the real library file behind the aforementioned api-ms-win-core-sysinfo-l1-1-0, you can use this crate like:

let dll = std::fs::read("apisetschema.dll").unwrap();
let pe_file = PeFile::from_bytes(&dll).unwrap();
let map = ApiSetMap::try_from_pe64(pe_file).unwrap();

let namespace_entry = map
let value_entry = namespace_entry.value_entries().unwrap().next().unwrap();

let name =;
let default_value = value_entry.value().unwrap();
println!("{name} -> {default_value}");



Type Definitions

  • Central result type of nt-apiset.