Native API

The Native API (with capitalized N) is the application programming interface (API) used by Windows NT and user mode applications. It is usually used during system boot, when other components of Windows are unavailable, and by routines such as those in kernel32.dll that implement the Windows API. The entry point of ntdll.dll is LdrInitializeThunk. Most of the Native API calls are implemented in ntoskrnl.exe and are exposed to user mode by ntdll.dll. Some Native API calls are implemented in user mode directly within ntdll.dll.

Native API calls are handled by the kernel via the SSDT.

While most of Microsoft Windows is implemented using the documented and well-defined Windows API, a few components, such as the Client/Server Runtime Subsystem, are implemented using the Native API, as they can be started earlier in the Windows NT Startup Process when the Windows API is not yet available.

Function groups

The Native API comprises many functions. They include C runtime functions that are needed for a very basic C runtime execution, such as strlen(), sprintf() and floor(). Other common procedures like malloc(), printf(), scanf() are missing. The vast majority of other Native API routines, by convention, have a 2 or 3 letter prefix, which is:

user32.dll and gdi32.dll includes several other calls that trap into kernel mode. These were not part of the original Windows NT design, as can be seen in Windows NT 3.5. However, due to performance issues of hardware of that age, it was decided to move the graphics subsystem into kernel mode. As such, system call in the range of 0x1000-0x1FFF are satisfied by win32k.sys (instead of ntoskrnl.exe as done for 0-0x0FFF), and are declared in user32.dll and gdi32.dll. These functions have the NtUser and NtGdi prefix (e.g. NtUserLockWorkStation and NtGdiEnableEudc).

There are also many more groups exported from ntoskrnl.exe and therefore are usable only in kernel mode. These may or may not be counted for Native API, depending on whom you ask (since the Native API is not fully officially documented, there is no one answer). Such groups include Cc (cache controller), Ex (Windows Executive), FsRtl (file system runtime), Io (I/O manager), Ke (core kernel routines), Ks (kernel streaming), Lpc (Local Procedure Call), Lsa (Local Security Authority), Mm (memory management), Ob (Object Manager), Ps (Process management), Se (security), Po (power management) and others.[2][3][4][5][6][7]

Uses

Uses of Native API functions includes but not limited to:

See also

References

  1. ↑ The NT Insider (August 27, 2003). "Nt vs. Zw - Clearing Confusion On The Native API". OSR Online (OSR Open Systems Resources) 10 (4). Retrieved 2013-09-16.
  2. 1 2 Raymond Chen (2009). "The Old New Thing : What does the "Zw" prefix mean?". Microsoft Corporation. Retrieved 2009-06-13.
  3. ↑ Microsoft Corporation (2009). "I/O Manager Routines". Microsoft Corporation. Retrieved 2009-06-13.
  4. ↑ Microsoft Corporation (2009). "Cache Manager Routines". Microsoft Corporation. Retrieved 2009-06-13.
  5. ↑ Microsoft Corporation (2009). "Power Manager Routines". Microsoft Corporation. Retrieved 2009-06-13.
  6. ↑ Microsoft Corporation (2009). "Core Kernel Library Support Routines". Microsoft Corporation. Retrieved 2009-06-13.
  7. ↑ Microsoft Corporation (2009). "File System Runtime Library Routines". Microsoft Corporation. Retrieved 2009-06-13.

External links

This article is issued from Wikipedia - version of the Sunday, March 13, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.