NtXxx Routines
This section describes the NtXxx versions of the Windows Native System Services routines. Most native system services routines have two versions, one of which has a name begins with the prefix Nt; the other version has a name that begins with the prefix Zw. For example, calls to NtCreateFile and ZwCreateFile perform similar operations and are, in fact, serviced by the same kernel-mode system routine.
For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the NtXxx and ZwXxx versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.
The following table summarizes the NtXxx and ZwXxx versions of the routines:
| NtXxx | ZwXxx |
|---|---|
NtAllocateLocallyUniqueId |
|
NtAllocateVirtualMemory |
|
NtClose |
|
NtCommitComplete |
|
NtCommitEnlistment |
|
NtCommitTransaction |
|
NtCreateDirectoryObject |
|
NtCreateEnlistment |
|
NtCreateEvent |
|
NtCreateFile |
|
NtCreateKey |
|
NtCreateResourceManager |
|
NtCreateSection |
|
NtCreateTransaction |
|
NtCreateTransactionManager |
|
NtCurrentProcess |
|
NtCurrentThread |
|
NtDeleteFile |
|
NtDeleteKey |
|
NtDeleteValueKey |
|
NtDeviceIoControlFile |
|
NtDuplicateObject |
|
NtDuplicateToken |
|
NtEnumerateKey |
|
NtEnumerateTransactionObject |
|
NtEnumerateValueKey |
|
NtFlushBuffersFile |
|
NtFlushBuffersFileEx |
|
NtFlushKey |
|
NtFlushVirtualMemory |
|
NtFreeVirtualMemory |
|
NtFsControlFile |
|
NtGetNotificationResourceManager |
|
NtLoadDriver |
|
NtLockFile |
|
NtMakeTemporaryObject |
|
NtMapViewOfSection |
|
NtNotifyChangeKey |
|
NtOpenDirectoryObject |
|
NtOpenEnlistment |
|
NtOpenEvent |
|
NtOpenFile |
|
NtOpenKey |
|
NtOpenProcess |
|
NtOpenProcessTokenEx |
|
NtOpenResourceManager |
|
NtOpenSection |
|
NtOpenSymbolicLinkObject |
|
NtOpenThreadTokenEx |
|
NtOpenTransaction |
|
NtOpenTransactionManager |
|
NtPowerInformation |
|
NtPrepareComplete |
|
NtPrepareEnlistment |
|
NtPrePrepareComplete |
|
NtPrePrepareEnlistment |
|
NtQueryDirectoryFile |
|
NtQueryFullAttributesFile |
|
NtQueryInformationEnlistment |
|
NtQueryInformationFile |
|
NtQueryInformationResourceManager |
|
NtQueryInformationToken |
|
NtQueryInformationTransaction |
|
NtQueryInformationTransactionManager |
|
NtQueryKey |
|
NtQueryObject |
|
NtQueryQuotaInformationFile |
|
NtQuerySecurityObject |
|
NtQuerySecurityObject |
|
NtQueryValueKey |
|
NtQueryVirtualMemory |
|
NtQueryVolumeInformationFile |
|
NtReadFile |
|
NtReadOnlyEnlistment |
|
NtReadOnlyEnlistment |
|
NtRecoverResourceManager |
|
NtRecoverTransactionManager |
|
NtRollbackComplete |
|
NtRollbackEnlistment |
|
NtRollbackTransaction |
|
NtRollforwardTransactionManager |
|
NtSetEvent |
|
NtSetInformationEnlistment |
|
NtSetInformationFile |
|
NtSetInformationResourceManager |
|
NtSetInformationThread |
|
NtSetInformationToken |
|
NtSetInformationTransaction |
|
NtSetQuotaInformationFile |
|
NtSetSecurityObject |
|
NtSetValueKey |
|
NtSetVolumeInformationFile |
|
NtSinglePhaseReject |
|
NtTerminateProcess |
|
NtUnloadDriver |
|
NtUnlockFile |
|
NtUnmapViewOfSection |
|
NtWaitForSingleObject |
|
NtWriteFile |