Part 9 · DLLs and Windows APIs

Chapter 23 · Windows APIs

2 min read

Status: ✅ COMPLETE

Scope: How a program asks Windows to do things: the layers from the application through Win32 and the Native API, the system call into the kernel, the full journey of one call, and how errors travel back
Time to complete: 75–100 minutes of reading + lab
Prerequisites: Chapter 2 (CPU Internals), Chapter 7 (kernel mode and user mode), Chapter 9 (handles), Chapter 22 (DLLs)
What you'll know after: What the Win32 API and the Native API are, how a call crosses from user mode into the kernel, and how to follow a call such as CreateFileW from your program down to the disk and back

INTRODUCTION

A program cannot touch the disk, the screen or the memory chips. It has to ask Windows. The menu of things it may ask for is called an API. This chapter shows what is on that menu, which layers an order passes through, and how the order gets across the safety wall between user mode and the kernel.

Chapter 22 explained the DLL files that hold this code. This chapter explains which functions live in them and how they hand a request from one to the next.

This chapter explains:

  • The layers: application, Win32, Native API, system call, kernel, driver, hardware
  • The Win32 API as the documented, stable contract, and the jobs of kernel32, user32 and gdi32
  • ANSI and Unicode versions of functions, and API sets
  • The Native API in ntdll.dll (Nt and Zw functions) and why Win32 wraps it
  • The system call: the syscall instruction, the ring change and the dispatch table
  • A complete walk-through of CreateFileW, plus VirtualAlloc and MessageBoxW
  • Errors: GetLastError, NTSTATUS and net helpmsg

CHAPTER OUTLINE

Related chapters: Chapter 2, Chapter 7, Chapter 8, Chapter 9, Chapter 22

Chapter Status: Complete
Estimated reading time: 85 minutes
Practical time: 30 minutes
Knowledge check time: 30 minutes