About Windows Native APIs 1

[alixiang]

Hi:
I'v read the document <<Windows Kernel Interals-Process Architecture>>,written by David B. Probert, Ph.D.
In that he list some Windows native APIs like:
NtGetNextProcess(),NtGetNextThread()...
I tried but I could not find these APIs reference.
Any advice is helpful,thanks.

alixiang

 

[teriviret]

I'm pretty sure those are internal Windows kernel functions, meaning they are not exposed outside the kernel. They're part of the Windows source code only.

 

[alixiang]

I know those were kernel functions,I searched kernel API entries in some reference documents,and found most of functions listed in <<Windows Kernel Interals-Process Architecture>>,only
NtGetNextProcess(),NtGetNextThread()
could not be found.Even I could NOT found entrys of them
in ntdll.dll! Then where are they?

 

[teriviret]

They are only in the source code for the operating system. When Microsoft compiles it, the symbols are stripped. A DLL only retains the symbols that are exported. In the case of these internal functions, they are not exported. The code exists in the kernel, but only in a compiled form without symbolic names.

 

[alixiang]

Thanks teriviret,I did understand your means.

alixiang