What is Ntoskrnl.exe, Kernel32.dll, Ntdll.dll, ws2_32.dll?

Ntoskrnl.exe and Native System Services:

Ntoskrnl.exe exports system services through well-defined functions with names starting with Nt or Zw. These functions provide core functionalities like memory management, process management, and device driver interaction.

Nt vs Zw: The choice between Nt and Zw prefixes depends on whether the call originates from kernel mode (Zw) or user mode (Nt). Kernel-mode drivers directly use the Zw entry points for efficiency.

In conclusion, kernel-mode drivers interact with the core functionalities of the operating system by calling the Nt and Zw entry points exposed by Ntoskrnl.exe.

Kernel32.dll: This is a user-mode DLL that provides various functionalities used by Windows programs in user space. It doesn't contain the native system service routines directly accessible by kernel-mode drivers.

Ntdll.dll: This is another user-mode DLL that offers functionalities related to processes, memory management, and file systems. It acts as an intermediary between user-mode applications and the kernel but doesn't directly expose the Nt and Zw entry points for kernel-mode drivers.

ws2_32.dll: This DLL is associated with the Windows Sockets API (Winsock) and provides network communication functions. It's not used for general kernel-mode system services.