NtXxx Routines

This section describes the NtXxx versions of the Windows Native System Services routines. Most native system services routines have two versions, one of which has a name begins with the prefix Nt; the other version has a name that begins with the prefix Zw. For example, calls to NtCreateFile and ZwCreateFile perform similar operations and are, in fact, serviced by the same kernel-mode system routine.

For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the NtXxx and ZwXxx versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

The following table summarizes the NtXxx and ZwXxx versions of the routines:

NtXxx	ZwXxx
NtAllocateLocallyUniqueId	ZwAllocateLocallyUniqueId
NtAllocateVirtualMemory	ZwAllocateVirtualMemory
NtClose	ZwClose
NtCommitComplete	ZwCommitComplete
NtCommitEnlistment	ZwCommitEnlistment
NtCommitTransaction	ZwCommitTransaction
NtCreateDirectoryObject	ZwCreateDirectoryObject
NtCreateEnlistment	ZwCreateEnlistment
NtCreateEvent	ZwCreateEvent
NtCreateFile	ZwCreateFile
NtCreateKey	ZwCreateKey
NtCreateResourceManager	ZwCreateResourceManager
NtCreateSection	ZwCreateSection
NtCreateTransaction	ZwCreateTransaction
NtCreateTransactionManager	ZwCreateTransactionManager
NtCurrentProcess	ZwCurrentProcess
NtCurrentThread	ZwCurrentThread
NtDeleteFile	ZwDeleteFile
NtDeleteKey	ZwDeleteKey
NtDeleteValueKey	ZwDeleteValueKey
NtDeviceIoControlFile	ZwDeviceIoControlFile
NtDuplicateObject	ZwDuplicateObject
NtDuplicateToken	ZwDuplicateToken
NtEnumerateKey	ZwEnumerateKey
NtEnumerateTransactionObject	ZwEnumerateTransactionObject
NtEnumerateValueKey	ZwEnumerateValueKey
NtFlushBuffersFile	ZwFlushBuffersFile
NtFlushBuffersFileEx	ZwFlushBuffersFileEx
NtFlushKey	ZwFlushKey
NtFlushVirtualMemory	ZwFlushVirtualMemory
NtFreeVirtualMemory	ZwFreeVirtualMemory
NtFsControlFile	ZwFsControlFile
NtGetNotificationResourceManager	ZwGetNotificationResourceManager
NtLoadDriver	ZwLoadDriver
NtLockFile	ZwLockFile
NtMakeTemporaryObject	ZwMakeTemporaryObject
NtMapViewOfSection	ZwMapViewOfSection
NtNotifyChangeKey	ZwNotifyChangeKey
NtOpenDirectoryObject	ZwOpenDirectoryObject
NtOpenEnlistment	ZwOpenEnlistment
NtOpenEvent	ZwOpenEvent
NtOpenFile	ZwOpenFile
NtOpenKey	ZwOpenKey
NtOpenProcess	ZwOpenProcess
NtOpenProcessTokenEx	ZwOpenProcessTokenEx
NtOpenResourceManager	ZwOpenResourceManager
NtOpenSection	ZwOpenSection
NtOpenSymbolicLinkObject	ZwOpenSymbolicLinkObject
NtOpenThreadTokenEx	ZwOpenThreadTokenEx
NtOpenTransaction	ZwOpenTransaction
NtOpenTransactionManager	ZwOpenTransactionManager
NtPowerInformation	ZwPowerInformation
NtPrepareComplete	ZwPrepareComplete
NtPrepareEnlistment	ZwPrepareEnlistment
NtPrePrepareComplete	ZwPrePrepareComplete
NtPrePrepareEnlistment	ZwPrePrepareEnlistment
NtQueryDirectoryFile	ZwQueryDirectoryFile
NtQueryFullAttributesFile	ZwQueryFullAttributesFile
NtQueryInformationEnlistment	ZwQueryInformationEnlistment
NtQueryInformationFile	ZwQueryInformationFile
NtQueryInformationResourceManager	ZwQueryInformationResourceManager
NtQueryInformationToken	ZwQueryInformationToken
NtQueryInformationTransaction	ZwQueryInformationTransaction
NtQueryInformationTransactionManager	ZwQueryInformationTransactionManager
NtQueryKey	ZwQueryKey
NtQueryObject	ZwQueryObject
NtQueryQuotaInformationFile	ZwQueryQuotaInformationFile
NtQuerySecurityObject	ZwQuerySecurityObject
NtQuerySecurityObject	ZwQuerySymbolicLinkObject
NtQueryValueKey	ZwQueryValueKey
NtQueryVirtualMemory	ZwQueryVirtualMemory
NtQueryVolumeInformationFile	ZwQueryVolumeInformationFile
NtReadFile	ZwReadFile
NtReadOnlyEnlistment	ZwReadOnlyEnlistment
NtReadOnlyEnlistment	ZwRecoverEnlistment
NtRecoverResourceManager	ZwRecoverResourceManager
NtRecoverTransactionManager	ZwRecoverTransactionManager
NtRollbackComplete	ZwRollbackComplete
NtRollbackEnlistment	ZwRollbackEnlistment
NtRollbackTransaction	ZwRollbackTransaction
NtRollforwardTransactionManager	ZwRollforwardTransactionManager
NtSetEvent	ZwSetEvent
NtSetInformationEnlistment	ZwSetInformationEnlistment
NtSetInformationFile	ZwSetInformationFile
NtSetInformationResourceManager	ZwSetInformationResourceManager
NtSetInformationThread	ZwSetInformationThread
NtSetInformationToken	ZwSetInformationToken
NtSetInformationTransaction	ZwSetInformationTransaction
NtSetQuotaInformationFile	ZwSetQuotaInformationFile
NtSetSecurityObject	ZwSetSecurityObject
NtSetValueKey	ZwSetValueKey
NtSetVolumeInformationFile	ZwSetVolumeInformationFile
NtSinglePhaseReject	ZwSinglePhaseReject
NtTerminateProcess	ZwTerminateProcess
NtUnloadDriver	ZwUnloadDriver
NtUnlockFile	ZwUnlockFile
NtUnmapViewOfSection	ZwUnmapViewOfSection
NtWaitForSingleObject	ZwWaitForSingleObject
NtWriteFile	ZwWriteFile