windows内核函数命名规则(system routine naming convention)
windows内核函数命名的一般格式为：
<Prefix><Operation><Object>
Prefix指示导出该例程的组件，Operation指出对对象或资源做什么样的动作，Object标示操作的对象或资源。比如ExAllocatePoolWithTag是一个执行体(Executive)例程,用来从分页池(paged pool)或非分页池(nonpaged pool)中分配内存。KeInitializeThread是一个分配并且设置内核线程对象(kernel thread object)的内核例程。
下面的表列出了常用的前缀和组件的对应关系。
| Prefix | Component |
|---|---|
| Alpc | Advanced Local Inter-Process Communication |
| Cc | Common Cache |
| Cm | Configuration Manager |
| Dbgk | Debugging Framework for User-Mode |
| Em | Errata Manager |
| Etw | Event Tracing for Windows |
| Ex | Executive support routines |
| FsRtl | File System Driver Run-Time Library |
| Hal | Hardware abstraction layer |
| Hvl | Hypervisor Library |
| Io | I/O manager |
| Ke | Kernel |
| Kd | Kernel Debugger |
| Ks | Kernel Streaming |
| Lsa | Local Security Authority |
| Mm | Memory manager |
| Nt | NT system services(most of which are exported as Win32 functions) ,NT Native API |
| Ob | Object manager |
| Pf | Prefetcher |
| Po | Power manager |
| Pp | PnP manager |
| Ps | Process support |
| Rtl | Run-time library |
| Se | Security |
| Tm | Transaction manager |
| Vf | Verifier |
| Whea | Windows Hardware Error Architecture |
| Wmi | windows management instrumentation |
| Wdi | windows diagnostic infrastructure |
| Zw | The origin of the prefix "Zw" is unknown;it is rumored that this prefix was chosen due to its having no significance at all.Mirror entry point for system services (beginning with Nt) that sets previous access mode to kernel,which eliminates parameter validation, since Nt system services validate parameters only if previous access mode is user mode |
| Lpc | Local Procedure Call |
| Ldr | Loader |
| Nls | National language support |
| Dbg | Debug |
| Tdi | Transport driver interface |
| Csr | Client Server Runtime,represents the interface to the win32 subsystem located in csrss.exe |
| Inbv | Initialize boot video |
每一个系统组件还有一个变体前缀来指示内部使用(unexported)的函数，或者是组件前缀的第一个字母后面跟上i(指internal)，或者是全部的前缀跟上字母p(指private)。比如Ki指示一个Kernel内部函数，Psp指示一个Process support内部函数。
有些内核函数还在前缀或简化的前缀后面加上小写字母f，来指示这个函数使用fastcall调用约定,比如ObfDereferenceObject。KfRaiseIrql、KfLowerIrql、KfAcquireSpinLock、KfReleaseSpinLock等亦属此类。
经常会有人问Zw到底是什么单词的缩写(abbreviation),而且有种种的猜测在流传。实际上到现在也没有一个权威的说法，姑且认为选择这样一个古怪的前缀很难与其他组件发生冲突吧。
如果你知道这里没有列出的前缀或者有错误的地方，欢迎留言指出。
Categories: Windows