Google "davec apcobj.c"; that'll point you in the direction of some of Dave's brilliant work that dates back to 1989.
(Three versions of NT have been leaked; NT 4.0, Windows 2000, an the Windows Research Kit (which is Win2k3) -- they are all trivial to find online (first page of Google results).)
I'd love to read the source code myself to see how it works instead