All geek questions in one place

What is the difference between NtCreateProcess and ZwCreateProcess?

What is the difference between NtCreateProcess and ZwCreateProcess? In ntdll.dll, both NtCreateProcess and ZwCreateProcess indicate exactly the same address.

+3
source share
2 answers

In user mode, the Nt and Zw API groups are identical. In kernel mode, they are different. The Nt API contains the actual implementation. The Zw API uses the system call mechanism and ensures that it is called in kernel mode, and there is no need to check the parameters if they contain user mode addresses. Otherwise, you could use the user mode API with kernel parameters that would not be good. So this is just a security mechanism.

+4
source

, OSR Online: .

Native API, Gary Nebbett, " API Windows NT/2000", , WinDbg ( "" -bag ").

+1

Source: https://habr.com/ru/post/1773426/

More articles:


All Articles