Low-level user-mode programming for Windows usually involves working with the documented Windows API, exported from subsystem DLLs, such as Kernel32.dll, user32.dll, advapi32.dll, kernelbase.dll, and more. Lurking beneath most of these APIs are system calls, invoked under the covers to access the kernel. Anything worthwhile in Windows (or any other OS for that matter) must talk to the kernel to get system-level things done, such as allocating memory, creating processes and threads, performing IO operations, and more. The native API, implemented in a couple of DLLs is used to make the transition to the kernel. The most important one is NtDll.dll - a system wide user-mode DLL that serves this critical role. This book is about this DLL’s API, as it pertains to invoking system calls that transition the processor to kernel-mode to perform the requested operation. Other APIs discussed are not system calls per-se, but are still part of NtDll, and are interesting to get to know. Most of these functions start with Rtl (Runtime Library). As a simple example, the CreateFile documented Windows API (provided by kernel32.dll) invokes NtCreateFile in NtDll.Dll to ask the kernel to perform the operation. Most of the native APIs are undocumented - hence this book. The sample code for this book can be found on Github. The book is for anyone interested in learning about the Windows native API provided by NtDll.dll. The reader should have a solid understanding of the foundations of Windows, such as processes, threads, virtual memory, and DLLs. Also recommended is a good familiarity of the Windows documented API.