Prove that Nt and Zw Windows API are the same implementation inside.

NtAndZwWinAPI.c

#include <stdio.h>
#include <windows.h>

typedef NTSTATUS (NTAPI *NtAllocateVirtualMemory_t)(
    HANDLE    ProcessHandle,
    PVOID     *BaseAddress,
    ULONG_PTR ZeroBits,
    PSIZE_T   RegionSize,
    ULONG     AllocationType,
    ULONG     Protect
);

int main() {
    HMODULE ntdll = GetModuleHandleA("ntdll.dll");
    if (!ntdll) {
        printf("Failed to load ntdll.dll\n");
        return 1;
    }

    FARPROC pNt = GetProcAddress(ntdll, "NtAllocateVirtualMemory");
    FARPROC pZw = GetProcAddress(ntdll, "ZwAllocateVirtualMemory");

    if (!pNt || !pZw) {
        printf("Failed to get function addresses.\n");
        return 1;
    }

    printf("NtAllocateVirtualMemory address: %p\n", pNt);
    printf("ZwAllocateVirtualMemory address: %p\n", pZw);

    if (pNt == pZw) {
        printf("[+] They point to the same function!\n");
    } else {
        printf("[-] They are different!\n");
    }

    return 0;
}

// Output:
// NtAllocateVirtualMemory address: 00007ffc24b8d7e0
// ZwAllocateVirtualMemory address: 00007ffc24b8d7e0
// [+] They point to the same function!