zw 开头的函数是什么函数？

[Xcoder]

近日看到不少Zw开头的函数，好像是只有在NT中才能用的。以前只在一本NT API函数手册中看到，但没仔细看。WIN32 程序员手册中也都没有介绍。
哪位高手能介绍一下，这些函数的功能，级别，及和其他API 函数集关系。一定重分相谢。

[masterz]

Table 2-6 lists most of the commonly used function name prefixes for the executive components. Each of these major executive components also uses a variation of the prefix to denote internal functions—either the first letter of the prefix followed by an i (for internal) or the full prefix followed by a p (for private). For example, Ki represents internal kernel functions, and Psp refers to internal process support functions.

Table 2-6 Commonly Used Prefixes

Prefix Component
Cc Cache manager
Cm Configuration manager
Ex Executive support routines
FsRtl File system driver run-time library
Hal Hardware abstraction layer
Io I/O manager
Ke Kernel
Lpc Local Procedure Call
Lsa Local security authentication
Mm Memory manager
Nt Windows 2000 system services (most of which are exported as Win32 functions)
Ob Object manager
Po Power manager
Pp PnP manager
Ps Process support
Rtl Run-time library
Se Security
Wmi Windows Management Instrumentation
Zw Mirror entry point for system services (beginning with Nt) that sets previous access mode to kernel, which eliminates parameter validation, since Nt system services validate parameters only if previous access mode is user

see Inside Microsoft Windows 2000

[duiduiblues]

nt本机api，大多数win32的api函数都是包装了这些zwxxx api和ntxxx api实现的。
在用户模式下，这两种形式的本机api是相同的，只是ntdll.dll中相同入口点的两个不同符号。
在内核模式下，代码依靠ntoskrnl.exe来连接，不再是ntdll.dll。这是，zwxxx的函数入口点含有来自于ntdll.dll的一份拷贝。ntxxx的函数入口点则含有系统服务的实际实现。

[Xcoder]

多谢二位。
masterz,到处都能看到你，能介绍几本你用的参考资料吗？