The Native API comprises many functions. They include
C runtime functions that are needed for a very basic
C runtime execution, such as strlen(), sprintf(), memcpy() and floor(). Other common procedures like malloc(), printf(), scanf() are missing (the first because it does not specify a
heap to allocate memory from and the second and third because they use the console, accessed only via KERNEL32.DLL). The vast majority of other Native API routines, by convention, have a 2 or 3 letter prefix, which is: •
Nt or
Zw are
system calls declared in ntdll.dll and ntoskrnl.exe. When called from ntdll.dll in user mode, these groups are almost exactly the same; they execute an
interrupt into
kernel mode and call the equivalent function in ntoskrnl.exe via the
SSDT. When calling the functions directly in ntoskrnl.exe (only possible in kernel mode), the Zw variants ensure kernel mode, whereas the Nt variants do not. The Zw prefix does not stand for anything. •
Rtl is the second largest group of ntdll calls. These comprise the (extended) C Run-Time Library, which includes many utility functions that can be used by native applications, yet don't directly involve kernel support. •
Csr are client-server functions that are used to communicate with the Win32 subsystem process,
csrss.exe (
csrss stands for client/server runtime sub-system). •
Dbg are
debugging functions such as a software
breakpoint. •
Ki are upcalls from kernel mode for events like
APC dispatching. •
Ldr are loader functions for
PE file handling and starting of new processes. •
Nls for
National Language Support (similar to code pages). •
Pfx for prefix handling. •
Tp for threadpool handling. user32.dll and gdi32.dll include several other calls that execute an interrupt into kernel mode. These were not part of the original Windows NT design, as can be seen in
Windows NT 3.5. However, due to performance issues of hardware of that age, it was decided to move the graphics subsystem into kernel mode. As such, system call in the range of 0x1000-0x1FFF are satisfied by
win32k.sys (instead of ntoskrnl.exe as done for 0-0x0FFF), and are declared in user32.dll and gdi32.dll. These functions have the
NtUser and
NtGdi prefix (e.g.
NtUserLockWorkStation and
NtGdiEnableEudc). ==Uses==