Module 1: Windows System Architecture & Native API Fundamentals

Begin your native-level adventure with a clear map of the territory. First we dissect the Windows NT architecture-user mode, kernel mode, and the all-important NTDLL gateway that ties them together. Next comes a quick tour of the historical subsystems (POSIX, OS/2, Win32) to see how each layers its own personality over the same kernel. With that context we crack open the undocumented Native API: why those mysterious Nt*/Zw* pairs exist, how NTDLL funnels them into ring-0 through the system-service dispatcher, and what you can (and can’t) do that Win32 hides. We wrap up in Visual Studio: adding the open-source PHNT headers for instant prototypes and experimenting with both static and dynamic binding so you can call native functions safely from day one. By the end of the module you’ll know exactly where the Native layer sits, how to talk to it, and why it unlocks powers later module builds on.