> they may have an efficient mechanism for trapping NT "syscalls" I believe this is not really necessary. The syscall ABI is not stable from Windows version to

> they may have an efficient mechanism for trapping NT "syscalls" I believe this is not really necessary. The syscall ABI is not stable from Windows version to Windows version - ABI stability is instead provided via the userspace DLLs (kernel32, user32 etc.), which are the official API applications are expected to use. Some processes might invoke the syscalls directly, but this is a narrow use case (e.g. security software or copy protection wrappers might use syscalls to bypass userspace API hooks).