Skip to content
Free public beta until December 4, 2026: every course is open, no card needed. After that, the first chapter of each course stays free and full access is a one-time $39 ($19 for up to 100 founding members chosen for helpful feedback). Your progress is kept. How the beta works

ntdll

The Windows library at the bottom of every program; its small functions are the ones that actually make system calls.

ntdll.dll exports the Native API (Nt*/Zw* functions) whose stubs load a build-specific system call number and execute syscall; Win32 functions such as WriteFile in kernel32/kernelbase call down into it.

See also

system call number system call DLL dynamic linker
Read the full section →