Guide | How To [Theory] Native Windows API (NTAPI)

[ttyssh]

Hi,
I have a few questions.
So if i understand correctly:
Example:
OpenProcess is a function Win32 API (wrapper?) that calls ntdll.dll (NATIVE API) which in turn calls the corresponding function in the kernel right? what function does it call in the kernel?
the prefix Nt (Example: NtOpenProcess) and Zw (Example: ZwOpenProcess) are aliases?
NtOpenProcess / ZwOpenProcess is just usermode?
what function need to use in the kernel?

PS: sry for bad english >.>

 

[maka]

Hi

OpenProcess is a function Win32 API (wrapper?) that calls ntdll.dll (NATIVE API) which in turn calls the corresponding function in the kernel right?

As far as I know, you're right. If you open kernel32.dll on W10 with IDA (which has a free version, IDA Free) you'll see this:

OpenProcess from kernel32.dll will call OpenProcess from KernelBase.dll (on W10):

OpenProcess (kernel32.dll) => OpenProcess (KernelBase.dll) => NtOpenProcess (ntdll.dll)

the prefix Nt (Example: NtOpenProcess) and Zw (Example: ZwOpenProcess) are aliases?

Yes, NtOpenProcess and ZwOpenProcess in usermode are the same:

what function does it call in the kernel?

if I'm not mistaken, when you call NtOpenProcess/ZwOpenprocess from usermode it will call the real NtOpenProcess from ntoskrnl.exe and if you call ZwOpenProcess from kernel mode it will call ZwOpenProcess (ntoskrnl.exe).

what function need to use in the kernel?

In kernel mode use ZwOpenProcess

sry for bad english

Welcome to the club

It's a pity that users like Wave and Opcode are no longer in the forum because they have a great knowledge about reversing and Windows Internals. I hope that one day they will return.
PS: I may be wrong in some of my affirmations. If someone find false information in my post, please let me know.

 

[Andy Ful]

Hi

As far as I know, you're right. If you open kernel32.dll on W10 with IDA (which has a free version, IDA Free) you'll see this:
View attachment 194398

OpenProcess from kernel32.dll will call OpenProcess from KernelBase.dll (on W10):
View attachment 194400
OpenProcess (kernel32.dll) => OpenProcess (KernelBase.dll) => NtOpenProcess (ntdll.dll)



Yes, NtOpenProcess and ZwOpenProcess in usermode are the same:View attachment 194401



if I'm not mistaken, when you call NtOpenProcess/ZwOpenprocess from usermode it will call the real NtOpenProcess from ntoskrnl.exe and if you call ZwOpenProcess from kernel mode it will call ZwOpenProcess (ntoskrnl.exe).


In kernel mode use ZwOpenProcess


Welcome to the club

It's a pity that users like Wave and Opcode are no longer in the forum because they have a great knowledge about reversing and Windows Internals. I hope that one day they will return.
PS: I may be wrong in some of my affirmations. If someone find false information in my post, please let me know.

kram7750, Wave, and Opcode (Deleted member 65228), there are the names of the same smart & knowledgeable guy. There are some very interesting tutorials posted by him over some years. I also hope to see him again here on MalwareTips. You both seem to have the similar interest in programming, so it would be interesting to see your discussions.

 

[maka]

kram7750, Wave, and Opcode (Deleted member 65228), there are the names of the same smart & knowledgeable guy. There are some very interesting tutorials posted by him over some years.

Honestly, I suspected that they were the same user due to some similarities in their posts. Now I have no doubt.
I respect this user a lot and I consider that his tutorials are a very valuable resource.

You both seem to have the similar interest in programming, so it would be interesting to see your discussions.

Thanks for your words
Yes sure we have similar interest in programming/reversing/Windows internals but, being humble, this guy is on another level.

Regards!

 

[ttyssh]

ohh thanks for the help.

Im trying to learn how to program drivers in kernel mode,
Can i use all the functions of ntdll.dll in the driver (kernel mode)? or only functions of ntoskrnl?

EDIT:
Why NtOpenProcess don't have arguments? There are many function without arguments..

 

[thepown3der]

Nice topic ...
Win32 api for software programing is better than Ntapi
but Ntapi for security however evading security or defeting it's more than better

 

[M0x0N]

nice introduction

 

[lain]

ohh thanks for the help.

Im trying to learn how to program drivers in kernel mode,
Can i use all the functions of ntdll.dll in the driver (kernel mode)? or only functions of ntoskrnl?

EDIT:
Why NtOpenProcess don't have arguments? There are many function without arguments..
View attachment 194455

Those Nt* functions *do* have arguments, what you're seeing is the syscall number being moved into the eax register before the syscall and the first argument (rcx) being moved to r10.
You use Nt* functions from Ntdll in usermode, and their equivalents in ntoskrnl in the Kernel.

Edit: Wow lol I didn't see the thread was from 2018