Hi, currently our Zw functions for kernel mode are implemented by an parameter wrapper and an int 0x2e instruction. The only reason for using the Zw functions in kernel mode is to bypass the buffer check. Can we implement the Zw functions by saving/changing/restoring the previous mode and calling the equal Nt function? - Hartmut