Ntdll.dll contains the userspace side of the NT API. Specifically, Zw* and Nt* contain most of the APIs that map directly into the kernel. Then there's the Rt

Ntdll.dll contains the userspace side of the NT API. Specifically, Zw* and Nt* contain most of the APIs that map directly into the kernel. Then there's the Rtl* stuff which provides a lot of fun functions for manipulating processes, and the Ldr* stuff for loading binaries; Ldr is a lot of fun to hook into, if you want to manipulate binaries with a high degree of transparency. Edit: One thing to note, though, is that it's easy to subvert the Win32 subsystem by using these APIs directly. I.e. if you want to fork a Win32 process, you're going to need to not only fork it the standard NT way, but then tell CSRSS what you're actually doing. It's easy to run into a situation where the Win32 subsystem won't play nicely with you, because it just doesn't have enough information.