参见下面的引文：
The NtXxxx version of the native system service is the name of the function
itself. Thus, when a Kernel Mode component calls the NtXxxx version of the
system service, whatever is presently set into previous mode is unchanged.
Thus, it is quite possible that the Kernel component could be running on an
arbitrary User stack, with the requestor mode set to User. The system service
will not know any better, attempt to validate the request parameters, possibly
using the credentials of the arbitrary User Mode thread, and thus possibly fail
the request. Another problem here is that one step in the validation process
for a User Mode request is that all passed in bu®ers have either ProbeForRead
or ProbeForWrite executed on them, depending on the bu®er's usage. These
routines raise exceptions if executed on Kernel Mode addresses. Therefore,
if you pass in Kernel Mode bu®ers with your request mode set to User, your
calls into the native API return STATUS ACCESS VIOLATION.
The moral of this bedtime story is that if you are in User Mode, use
whatever variant you think makes your code look pretty. In Kernel Mode,
use the ZwXxx routines and get your previous mode set properly, to Kernel
Mode.
ZW NT RTL 都是微软未公开的函数，之所以未公开主要是因为这些函数大部分功能太强大了，把他们公开会让一些别有用心的人利用。
ZW 跟NT的区别上面解释了
Zw： Mirror entry point for system services (beginning with Nt) that sets previous access mode to kernel, which eliminates parameter validation, since Nt system services validate parameters only if previous access mode is user
RTL:Run-time library
Rtl函数是windows ddk提供的编写驱动的函数。
