Talk:Windows Native API

message: Are you sure the Zw functions are the actual implementations? As far as I remember it's the other way around... NegativeIQ (talk) 22:33, 1 January 2008 (UTC)
replies: text: Nt functions are the actual implementation. --wj32 t/c 07:54, 28 January 2009 (UTC)

text: See URL http://www.osronline.com/custom.cfm?name=articlePrint.cfm&id=257. It sounds like in User Mode, it doesn't matter. It Kernel Mode, The Zw variants set kernel mode and the Nt ones do not. The article currently claims there is a lookup table. The branch table article makes more sense to use, unless I'm not understanding something correctly. Anphanax (talk) 13:12, 13 June 2009 (UTC)
replies: text:  What the NtXxx things are depends on where you are and what you've linked to, because there are really two sets of callable interfaces called NtXxx. One set, the native API, is exposed in user mode by NTDLL.DLL (you would link to NTDLL.LIB to call these). Most of these put a system service ordinal into EAX, then trap into kernel mode with INT 2E (old) or SYSENTER or SYSCALL (new), thereby passing control to KiSystemService in kernel mode. KiSystemService uses the value in EAX to index into the system service dispatch table. There it finds a) the number of arguments needed by the call, using this to copy that many arguments from the previous stack to the thread's kernel mode stack, and b) a function pointer, which it uses to call the underlying "actual implementation". The tricky part is that the "actual routine" is also called NtXxx, exported by ntoskrnl.exe.  There is no name conflict here because ntoskrnl.exe and ntdll.dll are not linked against each other.  Accordingly, in kernel mode, say in a driver, if you call NtXxx (having linked to ntoskrnl.lib) you're calling the real thing.  If you instead call ZwXxx as the WDK doc says you should, those are simply kernel-mode names for the entry points in ntdll.dll - so you go through the INT 2E or SYSENTER or SYSCALL, and KiSystemService does the arg list copy and function pointer lookup. In this case though it is known that your previous mode was kernel mode so a lot of security access checking that would ordinarily be done very early in the "actual implementation" is skipped. Jeh (talk) 07:56, 14 June 2009 (UTC)
thread_title:  Nt and Zw functions 

message: The main thing I think is wrong with the current wording is "there is no one answer". I'm sure there is an answer, it's just not publicly documented. What was wrong with my wording? – Smyth\talk 15:45, 27 September 2016 (UTC)
replies: text: Many callable routines of many of the groups mentioned such as Io, Mm, Cc, Le, Ob, Ps, Ke, etc., are documented... as part of the WDK. What matters for "part of native API" is whether or not there's an entry point in ntdll.dll (the "nt" there means "native"), which is exposed to user mode, not whether it's documented. If something is only exposed to kernel mode then it is flatly not part of the native API. Jeh (talk) 15:54, 27 September 2016 (UTC)

text: "more wrong" because you added an implication that "publically documented" has anything to do with "part of native API". As for why not fix it myself, the coverage on WP of Windows internals is a great morass of both mistaken and obsolete ideas and I just don't have time to fix it all, particularly not for the disputes that would inevitably arise. But I can keep it from getting worse. Jeh (talk) 16:15, 27 September 2016 (UTC)
thread_title:  "More wrong" 

message: Hello fellow Wikipedians,
I have just modified one external link on Native API. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://www.webcitation.org/6D0rHn1dU?url=http://netcode.cz/img/83/nativeapi.html to http://netcode.cz/img/83/nativeapi.html
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 14:02, 14 February 2018 (UTC)
thread_title:  External links modified (February 2018)