The Native API (with capitalized N) is the publicly largely undocumented application programming interface used internally by the Windows NT family of operating systems produced by Microsoft. Most of the Native API calls are in ntdll.dll and ntoskrnl.exe (and its variants).

While most of Microsoft Windows is implemented using the documented and well-defined Windows API, a few components, such as the Client/Server Runtime Subsystem are implemented using the Native API, as they are started early enough in the Windows NT Startup Process that the Windows API is not available yet.

Some rootkits make use of the Native API to hide their presence from malware detection software.

Two specific areas where Microsoft has provided documentation for Native API calls include the Installable File System and Driver Development Kit SDKs.


reference - http://undocumented.ntinternals.net/