 |  |  |  |  |  |  |  |
Doubt in Native API
Please support our C++ advertiser: Intel Parallel Studio Home
Thread Solved |
Hello,
I've read in a book that APIs in the native APIs start with one of the two prefixes: Either Nt or Zw, so that the functions have names like NtCreateFile or ZwCreateFile. What does Zw stand for?
It further says:
Both versions actually point to the same code in the user mode implementation in NTDLL.DLL. In kernel mode, they are different. The Nt versions are the actual implementations of the APIs, while Zw versions are stubs that go through the system call mechanism.
I'm not able to understand this thing in the italics. Any help would be appreciated...
-Jishnu.
I've read in a book that APIs in the native APIs start with one of the two prefixes: Either Nt or Zw, so that the functions have names like NtCreateFile or ZwCreateFile. What does Zw stand for?
It further says:
Both versions actually point to the same code in the user mode implementation in NTDLL.DLL. In kernel mode, they are different. The Nt versions are the actual implementations of the APIs, while Zw versions are stubs that go through the system call mechanism.
I'm not able to understand this thing in the italics. Any help would be appreciated...
-Jishnu.
"You know you're a computer geek when you try to shoo a fly away from the monitor screen with your cursor. That just happened to me. It was scary." - Juuso Heimonen.
"The only truly secure computer is one buried in concrete, with the power turned off and the network cable cut." - Anonymous.
"The only truly secure computer is one buried in concrete, with the power turned off and the network cable cut." - Anonymous.
>What does Zw stand for?
It's a mystery. The common assumption is that Zw was chosen because it meant absolutely nothing and there was little chance of something popping up that would make it significant.
>I'm not able to understand this thing in the italics.
Put simply, the Zw* versions will do some magic kernel stuff when called in kernel mode, and the Nt* versions won't. In user mode, both evaluate to the same thing.
It's a mystery. The common assumption is that Zw was chosen because it meant absolutely nothing and there was little chance of something popping up that would make it significant.
>I'm not able to understand this thing in the italics.
Put simply, the Zw* versions will do some magic kernel stuff when called in kernel mode, and the Nt* versions won't. In user mode, both evaluate to the same thing.
I'm here to prove you wrong.
•
•
•
•
>What does Zw stand for?
It's a mystery. The common assumption is that Zw was chosen because it meant absolutely nothing and there was little chance of something popping up that would make it significant.
If possible, I'm needing some more elaborate explanation for this:
•
•
•
•
Zw versions are stubs that go through the system call mechanism.
meaning what are stubs and the need for going through the system call mechanism..
Last edited by Jishnu; Dec 17th, 2007 at 1:47 pm.
"You know you're a computer geek when you try to shoo a fly away from the monitor screen with your cursor. That just happened to me. It was scary." - Juuso Heimonen.
"The only truly secure computer is one buried in concrete, with the power turned off and the network cable cut." - Anonymous.
"The only truly secure computer is one buried in concrete, with the power turned off and the network cable cut." - Anonymous.
•
•
Join Date: Mar 2006
Posts: 176
Reputation: 
Solved Threads: 22
Junior Poster
Narue has pointed to a great article. To udestand this article you may need Debugging tools for windows. http://www.microsoft.com/whdc/devtoo...g/default.mspx
However, these are non-documented APIs you should avoid calling from user mode application.
However, these are non-documented APIs you should avoid calling from user mode application.
I know I am. Therefore I am.
Yes, the article is pretty in depth. I appreciate it for the details. I'm familiar with some of the terms used. The unfamiliar ones will help me to go into enough depth in my reversing course. Thank you Narue 
Thanks dubeyprateek for that link.
Why is that so?
Thanks dubeyprateek for that link.
•
•
•
•
these are non-documented APIs you should avoid calling from user mode application.
Last edited by Jishnu; Dec 18th, 2007 at 12:01 pm.
"You know you're a computer geek when you try to shoo a fly away from the monitor screen with your cursor. That just happened to me. It was scary." - Juuso Heimonen.
"The only truly secure computer is one buried in concrete, with the power turned off and the network cable cut." - Anonymous.
"The only truly secure computer is one buried in concrete, with the power turned off and the network cable cut." - Anonymous.
•
•
Join Date: Mar 2006
Posts: 176
Reputation:
Solved Threads: 22
Junior Poster
•
•
•
•
Why is that so?
1) Microsoft may change behaviour of these APIs without any notifications. Therefore your application may break.
2) Microsoft does not 'supports' usage of thses APIs.
I know I am. Therefore I am.
Got it. Thanks
"You know you're a computer geek when you try to shoo a fly away from the monitor screen with your cursor. That just happened to me. It was scary." - Juuso Heimonen.
"The only truly secure computer is one buried in concrete, with the power turned off and the network cable cut." - Anonymous.
"The only truly secure computer is one buried in concrete, with the power turned off and the network cable cut." - Anonymous.
 |
Other Threads in the C++ Forum
- Previous Thread: Why i am not reseaving a menu?
- Next Thread: Count characters of a string.
| Thread Tools | Search this Thread |
Latest C++ Posts
- Today's Posts
- Unanswered Threads
Related Forum Features
Tag cloud for C++
add api array arrays based beginner binary bmp c++ c/c++ calculator char class classes code compile compiler console conversion count data delete deploy desktop directshow dll download dynamic encryption error file forms fstream function functions game givemetehcodez google graph gui homeworkhelp iamthwee ifstream input int integer java lib library linkedlist linker linux list loop looping loops map math matrix memory microsoft newbie news number output pointer problem program programming project python random read recursion recursive return simple string strings studio system temperature template templates test text text-file tree unix url variable vector video visual visualstudio win32 windows winsock wordfrequency wxwidgets
