If my program primarily uses the win32 API, are my API calls being emulated in Windows XP/Vista/7?
No. The Win32 API is a bit misnamed. It probably should have been named the Windows API. It is not emulated unless your code is actually running in one of the emulation modes.
What Jared said about the naming. Not sure if this is what you were getting at, but if you are running a 32 bit process on a 64 bit operating systems, there is an emulation (or "thunking") layer which allows them to run. This is true for all 64 bit editions of Windows.
There's the Windows NT kernel underneath it all, and native NT applications use the (largely undocumented) NT API to interact with it.
csrss.exe
, the "Client/Server Runtime Subsystem", is a native NT application which provides the user-mode Win32 subsystem, and win32k.sys
provides the kernel-mode Win32 subsystem. Win32 applications cannot run without these two loaded.
smss.exe
, the "Session Manager Subsystem", is the first application to be executed during startup. As one of its tasks, it starts the Win32 subsystem.
What do you consider "native"? The kernel does not understand Win32 at all -- all Win32 API calls are handled by the runtime and csrss
, which eventually boil down to NT API calls. But you will never have Windows running without the Win32 subsystem.
There also exist OS/2 and POSIX subsystems for Windows as well. I do not believe that they are in common use.
If you're familiar with UNIX, here's a rough analogy: is syslog(3)
a native API?
POSIX mandates its existence. It is likely implemented by the libc
runtime library as "connect to a socket/pipe and send a message". This cannot work unless the syslogd
daemon is running. A syslogd
daemon is started by the init scripts.
It's not a perfect analogy; many applications do not depend on syslog(3)
, and it is usually possible to stop and restart the syslogd
daemon without detrimental effects on the system's operation (much unlike csrss.exe
).