WinAPI

DLLs

The documented WinAPI functions are implemented in kernel32.dll, advapi32.dll, gdi32.dll, user32.dll (and others?).

These DLLs forward calls to WinAPI functions to the appropriate and undocumented (for user mode) Native API functions that are exported in ntdll.dll (and still run in user mode).

ntdll.dll then forwards such calls to ntoskrnl.exe and win32k.sys.

Base services for accessing the file system, managing processes and handling devices are implemented in kernel32.dll.

Apparently, with Windows 7, these system libraries were refactored into Kernelbase32.dll.

WOW64

WOW64 allows to run 32 bit processes on 64-bit Windows.

\Windows\SysWOW64

Native System Services / Kernel support functions

WinAPI functions must be distinguished from native system services and kernel support functions: Only WinAPI functions are documented.

Native system services are functions that are callable from user mode. For example, an application might call the WinAPI CreateProcess() function which in turn calls the native system service function NtCreateService().

A Kernel support function can only be called from within kernel mode, very possibly by device drivers

An example is ExAllocatePoolWithTag to allocate memory.

Strings

The Win32 API expects strings to be NULL-terminated while the Native API expects the length of a string.

For example, NtCreateKey gets a pointer to a UNICODE_STRING struct which has the member Length, while RegCreateKeyExW gets an «ordinary» LPCWSTR.

This has the interesting consquence that RegCreateKeyExW cannot be used to create a registry key with a zero character although such keys are possible if created with NtCreateKey.

This behavior also gives rise to the Sysinternals tool RegHide.

No hooking functionality

Windows does not natively provide a system call hooking facility like ptrace on Linux.

Some skilled developers have therefore developped kernel drivers (rootkits) that hooked the System Service Descriptor Table (SSDT) which then allowed to trace system calls on Windows.

With 64-bit versions of Windows, patching the SSDT has become more difficult because of Kernel Patch Protection.

Querying functions

reverseame/winapi-categories is a github repository that classifies WinAPI functions and syscalls.

For a given function, query the DLL where it is located, the header file where it is defined, the return type and its arguments:

$winApiFunc = (invoke-RestMethod -useBasicParsing https://raw.githubusercontent.com/reverseame/winapi-categories/refs/heads/main/winapi_categories.json).DrawText
$winApiFunc.dll
$winApiFunc.header
$winApiFunc.return_type
$winApiFunc.n_arguments
foreach ($arg in $winApiFunc.arguments) { $arg }

Find a function's category. Make sure to run this jq script in PowerShell 7.2 (because earlier versions of PowerShell seem to mangle double quotes within single quotes).

(invoke-webRequest -useBasicParsing https://raw.githubusercontent.com/reverseame/winapi-categories/refs/heads/main/winapi_functions_by_category.json).content | jq -r 'to_entries[] | select(.value[] == "d") | .key'

Display all functions of a given category:

(invoke-RestMethod -useBasicParsing https://raw.githubusercontent.com/reverseame/winapi-categories/refs/heads/main/winapi_functions_by_category.json)."Font and Text"

Find categories:

invoke-restMethod https://raw.githubusercontent.com/reverseame/winapi-categories/refs/heads/main/categories.txt | findstr.exe /i management | sort.exe

Find functions that match a given regular expression and print their associated category in tabular form:

(invoke-webrequest -useBasicParsing https://raw.githubusercontent.com/reverseame/winapi-categories/refs/heads/main/winapi_categories.json).content |
   jq -r '["Key", "Category"], (to_entries | map(select(.key | test("font"; "i"))) | map([.key, .value.category] ) | .[] ) | @tsv'

TODO

WinRT

Windows Runtime (=WinRT) is an alternative API, implemented in C++, within the Win32 subsystem.

WinAPI is the underlying technology of WinRT

WinRT must not be confused with Windows RT (a deprecated mobile operating system).

Links

Windows API Index