Windows Native API

<h2 id="function-groups">Function groups</h2>
<p>The Native API comprises many functions. They include <a href="/facts/C_standard_library/qdG1nW2c">C runtime functions</a> that are needed for a very basic <a href="/facts/C_(programming_language)/Ky2No763">C</a> runtime execution, such as strlen(), sprintf(), memcpy() and floor(). Other common procedures like malloc(), printf(), scanf() are missing (the first because it does not specify a <a href="/facts/Dynamic_memory_allocation/vthLkUpz">heap</a> to allocate memory from and the second and third because they use the console, accessed only via KERNEL32.DLL). The vast majority of other Native API routines, by convention, have a 2 or 3 letter prefix, which is:
</p>
<ul><li>Nt or Zw are <a href="/facts/System_call/NW44AFJr">system calls</a> declared in ntdll.dll and ntoskrnl.exe. When called from ntdll.dll in user mode, these groups are almost exactly the same; they execute an <a href="/facts/Interrupt/Mm6C4rpc">interrupt</a> into <a href="/facts/Ring_(computer_security)/27y4kjHs">kernel mode</a> and call the equivalent function in ntoskrnl.exe via the <a href="/facts/System_Service_Dispatch_Table/Pp0twgf0">SSDT</a>. When calling the functions directly in ntoskrnl.exe (only possible in kernel mode), the Zw variants ensure kernel mode, whereas the Nt variants do not.<a class="footnote-ref" id="fnref:1" href="#fn:1"><sup>1</sup></a> The Zw prefix does not stand for anything.<a class="footnote-ref" id="fnref:2" href="#fn:2"><sup>2</sup></a></li>
<li>Rtl is the second largest group of ntdll calls. These comprise the (extended) C Run-Time Library, which includes many utility functions that can be used by native applications, yet don't directly involve kernel support.</li>
<li>Csr are client-server functions that are used to communicate with the Win32 subsystem process, <a href="/facts/Csrss.exe/nxUgkwbE">csrss.exe</a> (<i>csrss</i> stands for client/server runtime sub-system).</li>
<li>Dbg are <a href="/facts/Debugging/QtdpPJT0">debugging</a> functions such as a software <a href="/facts/Breakpoint/LgtYUIlq">breakpoint</a>.</li>
<li>Ki are upcalls from kernel mode for events like <a href="/facts/Asynchronous_procedure_call/Eyg3p9D3">APC</a> dispatching.</li>
<li>Ldr are loader functions for <a href="/facts/Portable_Executable/pJy7AkuY">PE</a> file handling and starting of new processes.</li>
<li>Nls for <a href="/facts/Internationalization_and_localization/IGkl9VBM">National Language Support</a> (similar to code pages).</li>
<li>Pfx for prefix handling.</li>
<li>Tp for threadpool handling.</li></ul>
<p>user32.dll and gdi32.dll include several other calls that execute an interrupt into kernel mode. These were not part of the original Windows NT design, as can be seen in <a href="/facts/Windows_NT_3.5/QJq52ukC">Windows NT 3.5</a>. However, due to performance issues of hardware of that age, it was decided to move the graphics subsystem into kernel mode. As such, system call in the range of 0x1000-0x1FFF are satisfied by win32k.sys (instead of ntoskrnl.exe as done for 0-0x0FFF), and are declared in user32.dll and gdi32.dll. These functions have the NtUser and NtGdi prefix (e.g. NtUserLockWorkStation and NtGdiEnableEudc).
</p>
<h2 id="uses">Uses</h2>
<p>Uses of Native API functions includes but not limited to:
</p>
<ul><li>Enabling and disabling privileges (RtlAdjustPrivilege)</li>
<li>Creating remote threads within processes that are running in different session (RtlCreateUserThread)</li>
<li>Running native applications (RtlCreateUserProcess)</li>
<li>Performing a forced shutdown (NtShutdownSystem)</li>
<li>Causing a BSOD in User mode (NtRaiseHardError)</li>
<li>Displaying a string in Native Mode (NtDisplayString)</li></ul>
<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/List_of_Microsoft_Windows_components/DevuU3KN">List of Microsoft Windows components</a></li></ul>

<h2 id="external-links">External links</h2>
<ul><li><a href="https://undocumented.ntinternals.net/">A website that documents most of the Native API functions</a> <a href="https://web.archive.org/web/20171025041949/http://undocumented.ntinternals.net/">Archived</a> 2017-10-25 at the <a href="/facts/Wayback_Machine/nmQ3a6JC">Wayback Machine</a></li>
<li><a href="https://technet.microsoft.com/sysinternals/bb897447.aspx">Inside Native Applications</a></li>
<li><a href="https://web.archive.org/web/20121224002314/http://netcode.cz/img/83/nativeapi.html">Inside the Native API</a></li>
<li><a href="http://zenwinx.sourceforge.net/">Open source native applications development framework</a></li>
<li><a href="http://wiki.lazarus.freepascal.org/Target_NativeNT">Compiling Free Pascal programs for the native API</a></li>
<li><a href="https://sourceforge.net/projects/nativetools/">Windows NT Native Tools - A free native applications development util</a></li>
<li><a href="http://hex.pp.ua/nt-native-applications-shell-eng.php">Native shell - Windows command prompt which can start before Winlogon and Win32 subsystem</a> <a href="https://web.archive.org/web/20150811102814/http://hex.pp.ua/nt-native-applications-shell-eng.php">Archived</a> 2015-08-11 at the <a href="/facts/Wayback_Machine/nmQ3a6JC">Wayback Machine</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>The NT Insider (August 27, 2003). "Nt vs. Zw - Clearing Confusion On The Native API". OSR Online. 10 (4). OSR Open Systems Resources. Retrieved 2013-09-16. <a href="http://www.osronline.com/article.cfm?article=257" target="_blank">http://www.osronline.com/article.cfm?article=257</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
<li id="fn:2"><p>Raymond Chen (2009). "The Old New Thing : What does the "Zw" prefix mean?". Microsoft Corporation. Retrieved 2009-06-13. <a href="https://devblogs.microsoft.com/oldnewthing/?p=18043" target="_blank">https://devblogs.microsoft.com/oldnewthing/?p=18043</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li>
</ol>

Windows Native API open-in-new

Windows Native API