https://github.com/rnk commented: I think this is a good way to go, but in the long run I think we'll need to have flags or special macros on the interceptors to communicate which functions need ntdll interception. https://github.com/llvm/llvm-project/pull/120397