{"id":18043,"date":"2009-06-03T10:00:00","date_gmt":"2009-06-03T10:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2009\/06\/03\/what-does-the-zw-prefix-mean\/"},"modified":"2009-06-03T10:00:00","modified_gmt":"2009-06-03T10:00:00","slug":"what-does-the-zw-prefix-mean","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20090603-00\/?p=18043","title":{"rendered":"What does the &#8220;Zw&#8221; prefix mean?"},"content":{"rendered":"<p>If you spend time in kernel mode, you&#8217;re accustomed to seeing functions with two-letter (or occasionally, three-letter) prefixes that indicate which component they belong to.<\/p>\n<table>\n<tr>\n<th>Prefix<\/th>\n<th>Component<\/th>\n<th>Example<\/th>\n<\/tr>\n<tr>\n<td><code>Ex<\/code><\/td>\n<td>Executive<\/td>\n<td><code>ExAllocatePool<\/code><\/td>\n<\/tr>\n<tr>\n<td><code>Hal<\/code><\/td>\n<td>Hardware abstraction layer<\/td>\n<td><code>HalGetBusData<\/code><\/td>\n<\/tr>\n<tr>\n<td><code>Io<\/code><\/td>\n<td>I\/O manager<\/td>\n<td><code>IoAllocateIrp<\/code><\/td>\n<\/tr>\n<tr>\n<td><code>Ke<\/code><\/td>\n<td>Kernel<\/td>\n<td><code>KeBugCheck<\/code><\/td>\n<\/tr>\n<tr>\n<td><code>Ks<\/code><\/td>\n<td>Kernel streaming<\/td>\n<td><code>KsAcquireControl<\/code><\/td>\n<\/tr>\n<tr>\n<td><code>Mm<\/code><\/td>\n<td>Memory manager<\/td>\n<td><code>MmGetPhysicalAddress<\/code><\/td>\n<\/tr>\n<tr>\n<td><code>Ob<\/code><\/td>\n<td>Object manager<\/td>\n<td><code>ObReferenceObjectByHandle<\/code><\/td>\n<\/tr>\n<tr>\n<td><code>Po<\/code><\/td>\n<td>Power management<\/td>\n<td><code>PoSetSystemState<\/code><\/td>\n<\/tr>\n<tr>\n<td><code>Se<\/code><\/td>\n<td>Security<\/td>\n<td><code>SeAccessCheck<\/code><\/td>\n<\/tr>\n<tr>\n<td><code>Tdi<\/code><\/td>\n<td>Transport driver interface<\/td>\n<td><code>TdiProviderReady<\/code><\/td>\n<\/tr>\n<tr>\n<td><code>Zw<\/code><\/td>\n<td>????<\/td>\n<td><code>ZwCancelTimer<\/code><\/td>\n<\/tr>\n<\/table>\n<p> What does the &#8220;Zw&#8221; mean? <\/p>\n<p> Answer: Nothing. <\/p>\n<p> The people who chose the letters wanted to pick something that was unlikely to collide with anything. Perhaps they had a prior bad experience with having chosen a prefix, only to find that somebody ahead of them claimed it already? <\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you spend time in kernel mode, you&#8217;re accustomed to seeing functions with two-letter (or occasionally, three-letter) prefixes that indicate which component they belong to. Prefix Component Example Ex Executive ExAllocatePool Hal Hardware abstraction layer HalGetBusData Io I\/O manager IoAllocateIrp Ke Kernel KeBugCheck Ks Kernel streaming KsAcquireControl Mm Memory manager MmGetPhysicalAddress Ob Object manager ObReferenceObjectByHandle [&hellip;]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[2],"class_list":["post-18043","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-history"],"acf":[],"blog_post_summary":"<p>If you spend time in kernel mode, you&#8217;re accustomed to seeing functions with two-letter (or occasionally, three-letter) prefixes that indicate which component they belong to. Prefix Component Example Ex Executive ExAllocatePool Hal Hardware abstraction layer HalGetBusData Io I\/O manager IoAllocateIrp Ke Kernel KeBugCheck Ks Kernel streaming KsAcquireControl Mm Memory manager MmGetPhysicalAddress Ob Object manager ObReferenceObjectByHandle [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/18043","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=18043"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/18043\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=18043"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=18043"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=18043"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}