Windows: Native System Service

Most Native System Service routines come in two versions, one with the prefix Nt, the other with the prefix Zw (for example NtCreateFile and ZwCreateFile).

When called from user mode NtXYZ() and ZwXYZ() behave exactly the same. In fact, these are aliases.

In kernel mode, however, these functions are different. The real work is performed by ZwXYZ(). The NtXYZ() variant first validates the parameters and then calls ZwXYZ().

According to Microsoft's documentation, the prefix Zw was chosen to explicitly mean nothing.