Customer Reviews

Windows NT/2000 Native API Reference

5 star:		(8)
4 star:		(2)
3 star:		(1)
2 star:		(1)
1 star:		(1)

 

 

This is the missing chapter of the Windows 2000 device driver kit! Why doesn't Microsoft publish such a book? It documents ALL native API functions and relevant structures very accurately. The author must have spent several months of disassembly and reverse engineering. The book is a must-have reference for anyone writing NT/Win2K system-level software, like debuggers, spying/monitoring utilities, system info tools, drivers, and the like.

However, keep in mind that it's a REFERENCE in its purest sense. Although there is some interspersed sample code, it's NOT a tutorial. You need to know already what you're doing before you will benefit from this book.

Disclaimer: I wrote one of the inside cover blurbs. Don't expect me to slam the book.

The Native API Reference not only shows you the neat and very useful things that NT can do but does not expose through its Win32 personality; it also tells you which areas are covered by documented Win32 APIs, lessening, one hopes, the gratuitous use of officially undocumented functionality. Right from the start, you will find the NtQuery...() functions fascinating, and if you write kernel-mode code, you will *love* having a complete reference to the Zw...() functions -- no more cursing the horrible DDK documentation.

Intended audience: If you don't know what a handle is, or how Win32 deals with I/O, synchronization, and the like, then this book is not for you; read Richter's _Advanced Windows_ first.

My only wish is for MTP to have chosen a font slightly larger than Flyspeck 3, and maybe less of the black splotches that make the book's pages look like an unbroken string of obituaries.

Things to note:

0. Read the reviews after mine. People are right about what they say.

1. Native API is (or now was) officially unpublished. Microsoft does not want you to know about this API. In fact, the publisher almost did not publish the book for fear of legal issues.

2. Usually, you need to talk to Microsoft to learn of Native API calls. This book is easier than dealing with Microsoft.

3. Native API evolves. Only Microsoft (and those who've obtained the proper source licenses) know of the new API functions that were added after this book went to print.

4. Native API will help you do a lot of black-magic kernel-mode things, without having to hack/patch the OS. (think memory pools, devices, etc.)

5. This book will not teach you how to do program kernel mode modules. Yet, cnsider this book to be an ESSENTIAL supplement for kernel mode things.

This book is the first and only reference of its type. It delves deep into the harsh and uncompromizing world of NT internals. No other book documents these APIs as clearly or acurately (Not even Microsoft's own documentation such as it is). This is suprizingly refreshing especially given that much of this information ISN'T DOCUMENTED AT ALL _ANYWHERE ELSE_!!! Thus even a mediocre reference would have been a welcome reprieve. However, there is nothing mediocre about this rendition.

It is important to note what this book is not. It is not a beginners reference to win32. It will not teach you the how and why of windows programming, and it is not a good starting point for learning about NT internals (However, it is essential once you have understood the basic material and want to do more).

For developers wanting to learn about basic windows programming I recommend "Win32 System Programming" by Johnson M. Hart (ISBN 0-201-70310-6). For those interested in the how and why of 2000 internals I suggest chapter eleven of "Modern Operating Systems" by Andrew S. Tanenbaum, 2nd ed. (ISBN 0-13-031358-0). Chapter 11, pp. 763-851, is a case study explaining how the concepts of OS theory as described in the rest of the chapters apply to Windows 2000.

This is not a regular text book about the Undocumented Windows NT. It does not tell anything about the system components or even how does the system works. I do not think this was by any means the target of the writer. It is clear to me that the writer spent lots of his time reverse engineering the NT native system APIs and in his book he is providing us with the outcomes of his work.
If you are looking for a book about NT internals then you need to look for some other books. However, if you are a system engineer who spends most of his time doing kernel debugging using SoftIce or Microsoft Kernel Debugger then this book is definitely for you. If you know how to break at each NT native API using SoftIce (or Microsoft KD) and dump the parameters passed to the function then this book is an invaluable help to you. Otherwise, this book is not for you.
Finally, this is the only available text book to the public that has published the prototype of most of NT native APIs. If you need to know those APIs then this book is for you. However, you need to consider the fact that maybe there are some mistakes so you need to verify each API prototype yourself.

This is the first, and only, book to document the previously undocumented native NT API. You wanna know how Microsoft implements the functionality in certain utilities? It's in here. The book is technically accurate and solid. While the book does contain a few examples, this book is NOT a tutorial. Its title precisely reflects its approach: This is a REFERENCE book. Thus, it will be most appropriate and easily used by advanced software developers, as well as those already knowledgeable about NT system internals. EVERY SINGLE native NT system service is covered. This book is awesome, groundbreaking... a true must have for any serious NT system programmer.

A more complete review of this book appears in the Jan/Feb 2000 edition of The NT Insider.

This book is a must have for every person taking NT development seriously. This book should have been published by M$ years ago. It gives great insights how the WIN32 api is mapped onto the NT kernel functions. It leaves out some informations, that is described better at other places (EventPairs) but its definitely worth its money. What i am missing most is an URL where the code shown in the book could be downloaded from - this caused me to give only 4 stars instead of the deserved 5 ones for the rest of the book.

Execellent coverage of a very little know subject. It covers what it advertises and nothing more. Only thing I would like to see is a table equating some of the Win32 calls with the Native API calls, and perhaps a CD of the source code.

A must for any reference shelf.

This is an extremely useful and well written reference book. It's not for the faint of heart or the newbie, though. For the experienced programmer wanting to learn more about what's under the hood, and experienced driver programmer, it's an invaluable companion. I strongly recommend it if you fit the above criteria.

I'm so sorry that the previous review didn't appear here before I bought this book. Maybe it's just me, but this book is NOT good. It doesn't even have any explanations at all, page upon page of dry description, nay, *enumeration* of functions and parameters. "HANDLE hFile: file handle", how helpful is that? OK, there are mayby a dosen pages in the whole book with a bit of code, but this is absolutely insufficient!

I've run into one of the very positive reviewers here on-line somewhere and told him it was rather low to post such a glowing review when the book clearly isn't really good, so he said in response, well, it's a reference. I know it's a reference! but even references have got to have a code snippet after a function description. This API that the book presents is by definition UNDOCUMENTED! How are you going to be able to use it if the use isn't shown anywhere? Is there a programmer's guide that I missed? I don't think so.

I feel ripped off, and I highly recommend to those contemplating purchasing this manual to take a careful look and evaluate on their own, and not go by the positive reviews here. I am appaled by the tactics that the publishers are resorting to these day in order to enrich themselves, and I'm enraged by how some people with a little bit of name recognition are willing to partake in the racket.

I'd give this thing minus 5 if I could as it is a very dishonest book in my opinion. A book like that would have been acceptable if offered as vol II with some kind of Programmer's Guide being vol I, but in the absense of such, it's a ripoff.