NtXxx Routines

This section describes the Nt*Xxx* versions of the Windows Native System Services routines. Most native system services routines have two versions, one of which has a name begins with the prefix Nt; the other version has a name that begins with the prefix Zw. For example, calls to NtCreateFile and ZwCreateFile perform similar operations and are, in fact, serviced by the same kernel-mode system routine.

For calls from kernel-mode drivers, the Nt*Xxx* and Zw*Xxx* versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the Nt*Xxx* and Zw*Xxx* versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

The following table summarizes the Nt*Xxx* and Zw*Xxx* versions of the routines:

NtXxx ZwXxx

NtAllocateLocallyUniqueId

ZwAllocateLocallyUniqueId

NtAllocateVirtualMemory

ZwAllocateVirtualMemory

NtClose

ZwClose

NtCommitComplete

ZwCommitComplete

NtCommitEnlistment

ZwCommitEnlistment

NtCommitTransaction

ZwCommitTransaction

NtCreateDirectoryObject

ZwCreateDirectoryObject

NtCreateEnlistment

ZwCreateEnlistment

NtCreateEvent

ZwCreateEvent

NtCreateFile

ZwCreateFile

NtCreateKey

ZwCreateKey

NtCreateResourceManager

ZwCreateResourceManager

NtCreateSection

ZwCreateSection

NtCreateTransaction

ZwCreateTransaction

NtCreateTransactionManager

ZwCreateTransactionManager

NtCurrentProcess

ZwCurrentProcess

NtCurrentThread

ZwCurrentThread

NtDeleteFile

ZwDeleteFile

NtDeleteKey

ZwDeleteKey

NtDeleteValueKey

ZwDeleteValueKey

NtDeviceIoControlFile

ZwDeviceIoControlFile

NtDuplicateObject

ZwDuplicateObject

NtDuplicateToken

ZwDuplicateToken

NtEnumerateKey

ZwEnumerateKey

NtEnumerateTransactionObject

ZwEnumerateTransactionObject

NtEnumerateValueKey

ZwEnumerateValueKey

NtFlushBuffersFile

ZwFlushBuffersFile

NtFlushBuffersFileEx

ZwFlushBuffersFileEx

NtFlushKey

ZwFlushKey

NtFlushVirtualMemory

ZwFlushVirtualMemory

NtFreeVirtualMemory

ZwFreeVirtualMemory

NtFsControlFile

ZwFsControlFile

NtGetNotificationResourceManager

ZwGetNotificationResourceManager

NtLoadDriver

ZwLoadDriver

NtLockFile

ZwLockFile

NtMakeTemporaryObject

ZwMakeTemporaryObject

NtMapViewOfSection

ZwMapViewOfSection

NtNotifyChangeKey

ZwNotifyChangeKey

NtOpenDirectoryObject

ZwOpenDirectoryObject

NtOpenEnlistment

ZwOpenEnlistment

NtOpenEvent

ZwOpenEvent

NtOpenFile

ZwOpenFile

NtOpenKey

ZwOpenKey

NtOpenProcess

ZwOpenProcess

NtOpenProcessTokenEx

ZwOpenProcessTokenEx

NtOpenResourceManager

ZwOpenResourceManager

NtOpenSection

ZwOpenSection

NtOpenSymbolicLinkObject

ZwOpenSymbolicLinkObject

NtOpenThreadTokenEx

ZwOpenThreadTokenEx

NtOpenTransaction

ZwOpenTransaction

NtOpenTransactionManager

ZwOpenTransactionManager

NtPowerInformation

ZwPowerInformation

NtPrepareComplete

ZwPrepareComplete

NtPrepareEnlistment

ZwPrepareEnlistment

NtPrePrepareComplete

ZwPrePrepareComplete

NtPrePrepareEnlistment

ZwPrePrepareEnlistment

NtQueryDirectoryFile

ZwQueryDirectoryFile

NtQueryFullAttributesFile

ZwQueryFullAttributesFile

NtQueryInformationEnlistment

ZwQueryInformationEnlistment

NtQueryInformationFile

ZwQueryInformationFile

NtQueryInformationResourceManager

ZwQueryInformationResourceManager

NtQueryInformationToken

ZwQueryInformationToken

NtQueryInformationTransaction

ZwQueryInformationTransaction

NtQueryInformationTransactionManager

ZwQueryInformationTransactionManager

NtQueryKey

ZwQueryKey

NtQueryObject

ZwQueryObject

NtQueryQuotaInformationFile

ZwQueryQuotaInformationFile

NtQuerySecurityObject

ZwQuerySecurityObject

NtQuerySecurityObject

ZwQuerySymbolicLinkObject

NtQueryValueKey

ZwQueryValueKey

NtQueryVirtualMemory

ZwQueryVirtualMemory

NtQueryVolumeInformationFile

ZwQueryVolumeInformationFile

NtReadFile

ZwReadFile

NtReadOnlyEnlistment

ZwReadOnlyEnlistment

NtReadOnlyEnlistment

ZwRecoverEnlistment

NtRecoverResourceManager

ZwRecoverResourceManager

NtRecoverTransactionManager

ZwRecoverTransactionManager

NtRollbackComplete

ZwRollbackComplete

NtRollbackEnlistment

ZwRollbackEnlistment

NtRollbackTransaction

ZwRollbackTransaction

NtRollforwardTransactionManager

ZwRollforwardTransactionManager

NtSetEvent

ZwSetEvent

NtSetInformationEnlistment

ZwSetInformationEnlistment

NtSetInformationFile

ZwSetInformationFile

NtSetInformationResourceManager

ZwSetInformationResourceManager

NtSetInformationThread

ZwSetInformationThread

NtSetInformationToken

ZwSetInformationToken

NtSetInformationTransaction

ZwSetInformationTransaction

NtSetQuotaInformationFile

ZwSetQuotaInformationFile

NtSetSecurityObject

ZwSetSecurityObject

NtSetValueKey

ZwSetValueKey

NtSetVolumeInformationFile

ZwSetVolumeInformationFile

NtSinglePhaseReject

ZwSinglePhaseReject

NtTerminateProcess

ZwTerminateProcess

NtUnloadDriver

ZwUnloadDriver

NtUnlockFile

ZwUnlockFile

NtUnmapViewOfSection

ZwUnmapViewOfSection

NtWaitForSingleObject

ZwWaitForSingleObject

NtWriteFile

ZwWriteFile


Send comments about this topic to Microsoft