The execution path from user mode to kernel mode

Let's take a look at the life cycle of one API that requires kernel mode (in this example, it will be FindFirstFileA). We will dissect each step so that we can understand the role that each part of the system plays in handling process requests:

Figure 4: The API call life cycle

Let's break down the preceding diagram, as follows:

1. First, the process calls the FindFirstFileA API, which is implemented in the kernel32.dll library.
2. Then, Kernel32.dll (like all subsystem DLLs) calls the ntdll.dll library. In this example, it calls an API called ZwQueryDirectoryFile (or ZwQueryDirectoryFileEx).
3. All of the Zw* APIs execute syscall, as you saw in Figure 3. ZwQueryDirectoryFile executes syscall by providing the command ID in eax (here, the command ID is changing from one Windows version to another).
4. Now, the application moves to the kernel mode and execution is redirected to a kernel-mode function called KiSystemService, which is also...