Pavel Yosifovich, co-author of Windows Internals 7th Edition Part 1 and author of the book Windows Native API Programming, teaches you to call the Nt and Rtl functions in NTDLL.dll directly from C and C++.
Watch 3 lessons free before you buy: Course Overview, The Native API, and Client ID.
15+ hours
on-demand video
Labs
with solution walkthroughs
90
lessons
3
downloadable resources
15 CPE
CEU credits, self-reported
Certification
Certificate of completion
Every Win32 call eventually lands in NTDLL.dll. When you call CreateFile in kernel32, it calls NtCreateFile in NTDLL, which makes the system call into the kernel executive. This lower layer is the Windows native API: the Nt, Zw and Rtl functions the operating system itself is built on. Most of it is undocumented, and it can do things Win32 does not expose: enumerate every process and its threads in a single call, suspend a whole process, enumerate every handle on the system, open any object by its object manager path, edit the registry inside a transaction, and run native applications at boot, before any subsystem is loaded.
Not the right fit if you are new to C, C++ or the Windows API (start with Windows System Programming 1), or if you want kernel driver development (take Windows Kernel Programming 1).
Pavel is the author of the book “Windows Native API Programming”, the co-author of “Windows Internals, 7th Edition, Part 1” (Microsoft Press), the author of “Windows Kernel Programming” and “Windows 10 System Programming”, and a Microsoft MVP, with more than 25 years as a developer, consultant, trainer, author and speaker.
In this course he takes you below Win32 the way he does in the book: each native function next to its Win32 counterpart, with working code and the tools to verify what it does.
Windows exposes two faces to developers in user mode: the familiar Win32 (Windows API) layer and a far leaner, more powerful interface the operating system itself relies on: the Native API. In this course, Pavel Yosifovich guides you past the Win32 façade and straight to that inner doorway. You begin with the NT architecture and the system-call path, then master the data types, processes, threads, objects, and memory structures that everything in Windows is built on. Each subsequent module peels back another layer: spawning true Native executables, leveraging the object manager’s namespace, tracing handles, using virtual memory, streaming data through the I/O manager, and editing the Registry atomically. Short labs turn every concept into working code in Visual Studio using open-source headers, so by the final lesson you can create, probe, and control kernel-backed resource from user mode.
Begin your native-level adventure with a clear map of the territory. First we dissect the Windows NT architecture: user mode, kernel mode, and the all-important NTDLL gateway that ties them together. Next comes a quick tour of the historical subsystems (POSIX, OS/2, Win32) to see how each layers its own personality over the same kernel. With that context we crack open the undocumented Native API: how NTDLL funnels higher-level APIs into the kernel, and what you can (and can’t) do that Win32 hides. We wrap up in Visual Studio: adding the open-source PHNT headers for instant prototypes and experimenting.
You will also see how an Nt function stub in NTDLL loads a system call number and executes the syscall instruction to reach the system service dispatcher and the SSDT, and why those numbers differ between Windows versions.
The Native API speaks its own dialect, and this module hands you the phrasebook. Pavel demystifies the core data structures-NTSTATUS, Unicode strings, OBJECT_ATTRIBUTES, linked-list nodes, CLIENT_ID, and time types-and then drills you through a lab where you put each one to work. By the end of the module, you’ll know the helper macros and functions that tame them, and be ready to pass well-formed parameters into any Nt* function that appears in later modules.
Now that you know the API’s landscape, it’s time to compile real executables that live there. This module shows how Windows treats “Native” and “Boot” applications, then guides you through creating, linking, and finally spawning a Native EXE entirely from your own code.
Windows hides a vast amount of live data just below Win32. In this module you learn to pull back the curtain. Starting with NtQuerySystemInformation, you’ll enumerate processes, threads, and even every open handle on the system. Along the way Pavel demystifies the Object Manager-its types, names, and namespace hierarchy. The module wraps with a look at KUSER_SHARED_DATA, the always-mapped page that gives you fast, syscall-free access to clocks, CPU info and more.
Processes are the backbone of Windows. This module starts with crafting a process from raw pieces-image, initial thread, parameters-before moving on to deep inspection via NtQueryInformationProcess and direct reads of the Process Environment Block. You’ll learn to suspend, resume, terminate, and tweak scheduling priority without ever touching Win32.
Processes may own resources, but threads get work done. In this module, you craft threads from scratch with NtCreateThreadEx, peek into their stacks and TEBs, and gather live stats via NtQueryInformationThread. Pavel then unpacks the Native APIs for keeping threads in line: waits, APCs, and low-level synchronization, culminating in thread-pool discussion that showcases practical concurrency patterns.
Windows unifies named kernel objects through the Object Manager, and this module is your guided tour. You’ll map the kernel namespace, enumerate every object it contains, and learn to create, link, duplicate, and query them using pure Native calls. With a solid grasp of directory and symbolic-link objects, you pivot to the synchronization primitives-mutexes, semaphores, events-and finish by managing whole process groups with job objects.
Memory is everywhere. In this module, Pavel walks you from the hardware-backed basics up through high-level heaps and memory-mapped files. You’ll allocate, protect, query, and even patch memory using pure Native calls, then peek into the kernel’s view of working sets and protection bits. The journey continues with custom heaps for performance-critical tasks and finishes with section objects-the backbone of DLLs and shared memory.
Whether you’re reading from disk, pinging a driver, or ringing the PC speaker, it all rides the same I/O manager. This module teaches you to open any path, translate it into the kernel’s namespace, and push bytes through NtReadFile, NtWriteFile, or custom IOCTLs. You’ll enumerate directories, grab metadata, harness I/O completion ports for efficiency, and even load a driver-all with pure Native calls.
The Registry is Windows’ configuration database, and the Native API lets you operate on it with surgical precision. In this module, Pavel demystifies its hive-backed architecture, then leads you through opening, creating, editing, and enumerating keys and values without a single Win32 call. You’ll set up change notifications for instant event-driven reactions and wrap multiple edits inside kernel-level transactions for all-or-nothing safety.
Every access to a kernel object involves a user/group (SID) opening a handle to a relevant object that may be protected by a Security Descriptor. The user’s “power” is represented by its Access Token, containing its privileges and other properties. This module connects those dots. You’ll decode SIDs, inspect and duplicate tokens, enumerate logon sessions, and even create tokens from scratch. Finally, you’ll craft security descriptors and ACLs, giving you full control over who can do what with your objects, essential knowledge for access management.
Most of the native API is undocumented, and structures, information classes and system call numbers change between Windows versions. The course does not hide this. It shows where reliable declarations come from: the Zw twins documented in the Windows Driver Kit, the few definitions in winternl.h, and the community PHNT headers, installed directly or through vcpkg. You also learn two ways to call a function: linking against an NTDLL import library, or binding at runtime with GetModuleHandle and GetProcAddress when an export is missing from the library.
Same subjects, different layer. Windows System Programming 1 teaches processes, threads, synchronization, memory, I/O and security through the documented Win32 API. This course redoes those subjects at the NTDLL layer, and adds the things Win32 will not let you do, such as opening any object by its object manager path, enumerating every handle on the system, or editing the registry inside a transaction. If the Windows API is new to you, take Windows System Programming 1 first. After this course, continue to Windows Kernel Programming 1 for kernel mode, or Malware Analysis and Development for security research.
87 video lessons with English captions, about 15 hours of video, plus a slides PDF of the whole course and a labs PDF and ZIP with starter and solution code. In on-screen lab walkthroughs, Pavel builds a thread suspend and resume tool, a boot-time native application, a kernel module lister and a job handle inspector. You get lifetime access, a certificate of completion with a Credly badge, and a 14-day money-back guarantee. The course earns 15 CPE/CEU credits, self-reported to your certification body with your TrainSec certificate.
It is the set of Nt, Zw and Rtl functions exported by NTDLL.dll, the layer every Win32 call ends up in before the system call into the kernel. Most of it is undocumented, and it exposes capabilities Win32 does not, such as enumerating every handle on the system or opening any object by its object manager path.
You are ready if you write C or C++ on Windows, use Visual Studio 2022, and already know the basics of the Windows API and of processes, threads and virtual memory. The course constantly compares each native function to its Win32 counterpart, so if the documented API is still new to you, Windows System Programming 1 is the better starting point.
No. Everything is user-mode code calling NTDLL. The course does show loading and unloading a driver and uses a kernel debugger to inspect one, but it does not teach driver development. Windows Kernel Programming 1 is the course for that.
Windows with Visual Studio 2022, and the PHNT headers installed either directly or through vcpkg. The course also shows how to get an import library or bind to NTDLL functions dynamically, and it uses WinDbg plus free inspection tools such as Process Explorer, WinObj and VMMap.
Yes, and it says so explicitly. System call numbers, structures and information classes differ by Windows version, which is why declarations come from the community PHNT headers rather than the Windows SDK. The course shows you how to find and verify the current definitions.
The closing lesson lists the native API areas left out: LPC, ETW, debugger support, communication with CSRSS and parts of the loader. NTDLL exports many more functions than one course can cover.
There are 87 video lessons, about 15 hours of video, plus lab time. Most students spread it over several weeks, and the labs take longer than their video length suggests.
Pre-recorded and self-paced. You watch at your own pace, whenever you want.
A slides PDF of the whole course, a labs PDF and a labs ZIP with starter and solution code, plus lab walkthrough lessons where the solutions are built on screen.
Purchased courses come with lifetime access in your account on the TrainSec learning platform.
Yes. When you complete every lesson you receive a certificate of completion and a Credly digital badge. The course also earns 15 CPE/CEU credits, which you self-report to your certification body using your certificate.
Yes, English captions on all 87 video lessons.
The course is $380, or 4 installments of $100 ($400 in total on the plan).
Yes. Pre-recorded courses can be refunded up to 14 days after purchase, back to the original payment method. Email [email protected] to request one.
For kernel mode, Windows Kernel Programming 1. For security research, Malware Analysis and Development or EDR Internals. For deeper background on the mechanisms themselves, the Windows Internals series.
Pavel is the author of the book “Windows Native API Programming”, the co-author of “Windows Internals, 7th Edition, Part 1” (Microsoft Press), the author of “Windows Kernel Programming” and “Windows 10 System Programming”, and a Microsoft MVP, with more than 25 years as a developer, consultant, trainer, author and speaker.
In this course he takes you below Win32 the way he does in the book: each native function next to its Win32 counterpart, with working code and the tools to verify what it does.
