New Kernel Version 10.0 Exports

This page lists the 209 functions and 5 variables that are newly exported from the Windows kernel in its first release for version 10.0, i.e., for the original Windows 10. Two of the new functions are exported only in 32-bit Windows (x86) and twenty only in 64-bit Windows (x64).

Hardly any of the new functions for version 10.0 appear in the “Windows Driver Kit (WDK) 10” documentation that Microsoft “integrated with Visual Studio 2015”. An online search on 27th February 2016 turned up several additions that perhaps had been omitted only by oversight. Especially notable among the undocumented functions are those whose names begin with Hvi and are the run-time understanding in kernel mode of what Microsoft documents as the Hypervisor Top-Level Functional Specification. Even a year after the formal release of Windows 10, these undocumented functions knew of flags, etc., that were not yet in Microsoft’s published specification.

Documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. Functions that have their own non-trivial documentation are shown with no background colour. If the function is documented as reserved or obsolete, with or without a prototype, it is shaded red or shaded grey, respectively. An undocumented function that is at least declared in one or another header file from the Windows Driver Kit (WDK) is shaded orange. If the only declaration that Microsoft is known to have disclosed publicly is from the “minwin” directory of the Enterprise WDK for Windows 10 version 1511, specifically, then the function is highlighted orange. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented in the first contemporaneous Device Driver Kit (DDK), WDK or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status as undocumented.

Some declarations are in conditional-compilation blocks that suggest the function is exported by older versions—from even as long ago as Windows XP—and others that would have it that the function is not exported until some later Windows 10 release. The several functions for working with silos mostly started as undocumented but declared. That they were not initially documented may have been because the interface was in flux. More than a few were soon discontinued or superseded, with significant additions for the 1511 and 1607 releases. For the latter, most of the new functions and of those that remained as exports became documented, but as requiring 1607 and higher even if older. The conditional-compilation block that had declared the old functions for 10.0 and higher was modified to require 1607 for all, which does at least have the merit of matching the documentation.

Name Remarks
CcAsyncCopyRead  
EtwSetInformation  
ExAcquireAutoExpandPushLockExclusive  
ExAcquireAutoExpandPushLockShared  
ExAllocateAutoExpandPushLock  
ExCleanupAutoExpandPushLock  
ExCleanupRundownProtectionCacheAware declared for Windows Blue (6.3) and higher
ExConvertPushLockExclusiveToShared  
ExFreeAutoExpandPushLock  
ExInitializeAutoExpandPushLock  
ExInitializeRundownProtectionCacheAwareEx declared for Windows Blue (6.3) and higher
ExIsManufacturingModeEnabled  
ExRawInputManagerObjectType (data)  
ExReleaseAutoExpandPushLockExclusive  
ExReleaseAutoExpandPushLockShared  
ExShareAddressSpaceWithDevice  
ExSizeOfAutoExpandPushLock  
ExTimerObjectType (data)  
ExTryAcquireAutoExpandPushLockExclusive  
ExTryAcquireAutoExpandPushLockShared  
ExTryAcquireCacheAwarePushLockExclusiveEx  
ExTryAcquireCacheAwarePushLockSharedEx  
FsRtlIsMobileOS  
FsRtlNotifyFilterChangeDirectoryLite  
FsRtlNotifyFilterReportChangeLite  
FsRtlQueryInformationFile  
FsRtlRegisterUncProviderEx2 declared for Windows Blue (6.3) and higher
FsRtlSetDriverBacking declared for Windows Blue (6.3) and higher
HviGetDebugDeviceOptions  
HviGetEnlightenmentInformation  
HviGetHardwareFeatures  
HviGetHypervisorFeatures  
HviGetHypervisorInterface  
HviGetHypervisorVendorAndMaxFunction  
HviGetHypervisorVersion  
HviGetImplementationLimits  
HviIsAnyHypervisorPresent  
HviIsHypervisorMicrosoftCompatible  
HviIsHypervisorVendorMicrosoft  
HviIsIommuInUse  
HvlReadPerformanceStateCounters  
IoAllocateIrpEx  
IoGetFsTrackOffsetState  
IoGetFsZeroingOffset declared for Windows Blue (6.3) and higher
IoInitializeIrpEx  
IoIrpHasFsTrackOffsetExtensionType  
IoMakeAssociatedIrpEx  
IoPropagateIrpExtensionEx mentioned in comments
IoQueryInterface  
IoRequestDeviceRemovalForReset  
IoSetFsTrackOffsetState  
IoSetFsZeroingOffset declared for Windows Blue (6.3) and higher
IoSetFsZeroingOffsetRequired declared for Windows Blue (6.3) and higher
IoSizeOfIrpEx  
IoSteerInterrupt  
KdEventLoggingEnabled (data)  
KdGetDebugDevice  
KdSetEventLoggingPresent  
KeCancelTimer2  
KeConnectInterruptForHal initially x64 only;
x86 also in 1803 and higher
KeConvertAuxiliaryCounterToPerformanceCounter  
KeConvertPerformanceCounterToAuxiliaryCounter  
KeDeregisterBoundCallback undocumented until 2015-2016
KeFlushIoBuffers documented as “Available in Windows 2000 and later”;
previously a macro
KeInitializeEnumerationContextFromAffinity  
KeInitializeTimer2  
KeNotifyProcessorFreezeSupported  
KeQueryAuxiliaryCounterFrequency  
KeQueryHeteroCpuPolicyThread  
KeRegisterBoundCallback undocumented until 2015-2016
KeReportCacheIncoherentDevice  
KeSetHeteroCpuPolicyThread  
KeSetSelectedCpuSetsThread  
KeSetTimer2  
KeShouldYieldProcessor  
KeSynchronizeTimeToQpc  
KeSystemFullyCacheCoherent  
KeUpdateThreadTag  
KiAccumulateCycleStats x86 only
KiBeginThreadAccountingPeriod x86 only
MmAddVerifierSpecialThunks declared for Windows XP and higher
MmChangeImageProtection  
MmLoadSystemImage  
MmMapIoSpaceEx undocumented until 2015-2016
MmUnloadSystemImage  
PoCpuIdledSinceLastCallImprecise  
PoCreateThermalRequest  
PoDeleteThermalRequest  
PoEnergyEstimationEnabled  
PoFxEnableDStateReporting  
PoFxIssueComponentPerfStateChange undocumented until 2015-2016
PoFxIssueComponentPerfStateChangeMultiple  
PoFxQueryCurrentComponentPerfState  
PoFxRegisterComponentPerfStates  
PoGetThermalRequestSupport  
PoNotifyMediaBuffering  
PoSetThermalActiveCooling  
PoSetThermalPassiveCooling  
PsAllocateMonitorContextServerSilo discontinued in 1607
PsAttachSiloToCurrentThread declared but undocumented until 2016;
documentation requires “Windows 10, version 1607” as minimum;
now declared for Windows 10 RS1 (1607) and higher
PsDeleteMonitorContextServerSilo discontinued in 1607
PsDereferenceMonitorContextServerSilo discontinued in 1607
PsDetachSiloFromCurrentThread declared but undocumented until 2016;
documentation requires “Windows 10, version 1607” as minimum;
now declared for Windows 10 RS1 (1607) and higher
PsEqualCurrentSilo discontinued in 1607
PsGetCurrentSilo declared but undocumented until 2016;
documentation requires “Windows 10, version 1607” as minimum;
now declared for Windows 10 RS1 (1607) and higher
PsGetEffectiveContainerId  
PsGetJobProperty  
PsGetMonitorContextServerSilo discontinued in 1607
PsGetServerSiloDefaultCompartmentId discontinued in 1511
PsGetServerSiloServiceSessionId declared but undocumented until 2016;
documentation requires “Windows 10, version 1607” as minimum;
documentation has “pre-released product” warning;
now declared for Windows 10 RS1 (1607) and higher
PsGetSiloObject discontinued in 1511
PsGetSiloObjectFromJob discontinued in 1607
PsGetThreadCreateTime  
PsGetThreadProperty  
PsInsertSiloObject discontinued in 1511
PsInsertSiloObjectFromJob discontinued in 1607
PsIsDpcActive discontinued in 1511
PsIsHostSilo not declared until WDK for 1607;
documentation requires “Windows 10, version 1607” as minimum;
now declared for Windows 10 RS1 (1607) and higher
PsIsProcessInAppSilo  
PsLoadedModuleList (data)  
PsLoadedModuleResource (data)  
PsReferenceMonitorContextServerSilo discontinued in 1607
PsRegisterMonitorServerSilo discontinued in 1607
PsRegisterPicoProvider  
PsRemoveSiloObject discontinued in 1511
PsRemoveSiloObjectFromJob discontinued in 1607
PsSetCreateThreadNotifyRoutineEx undocumented until 2015-2016
PsSetJobProperty  
PsSetMonitorContextServerSilo discontinued in 1607
PsSetThreadProperty  
PsStartMonitorServerSilo discontinued in 1607
PsUnregisterMonitorServerSilo discontinued in 1607
PsUpdateComponentPower  
PspDereferenceSiloObject discontinued in 1511
PspReferenceSiloObject discontinued in 1511
RtlAddAccessAllowedObjectAce  
RtlAddAccessDeniedAceEx  
RtlAddAccessDeniedObjectAce  
RtlAddAuditAccessAceEx  
RtlAddAuditAccessObjectAce  
RtlAddProcessTrustLabelAce  
RtlAreBitsClearEx x64 only
RtlAreBitsSetEx x64 only
RtlCapabilityCheck  
RtlClearAllBitsEx x64 only
RtlClearBitEx x64 only
RtlClearBitsEx x64 only
RtlDecompressBufferEx2 undocumented until 2015-2016;
declared for Windows Blue (6.3) and higher
RtlDecompressFragmentEx undocumented until 2015-2016;
declared for Windows Blue (6.3) and higher
RtlEndStrongEnumerationHashTable  
RtlFindClearBitsAndSetEx x64 only
RtlFindClearBitsEx x64 only
RtlFindExportedRoutineByName  
RtlFindNextForwardRunClearEx x64 only
RtlFindSetBitsAndClearEx x64 only
RtlFindSetBitsEx x64 only
RtlFirstFreeAce  
RtlGetControlSecurityDescriptor  
RtlInitStringEx undocumented until 2015-2016
RtlInitStrongEnumerationHashTable  
RtlInitializeBitMapEx x64 only
RtlInitializeSidEx undocumented until 2015-2016
RtlIsMultiSessionSku declared for Windows 10 RS1 (1607) and higher
RtlIsSandboxedToken  
RtlLargeIntegerToChar  
RtlNumberOfClearBitsEx x64 only
RtlNumberOfSetBitsEx x64 only
RtlOsDeploymentState  
RtlQueryPackageClaims  
RtlRbReplaceNode  
RtlSetAllBitsEx x64 only
RtlSetBitEx x64 only
RtlSetBitsEx x64 only
RtlStronglyEnumerateEntryHashTable  
RtlSuffixUnicodeString  
RtlTestBitEx x64 only
RtlUnicodeStringToInt64  
RtlValidAcl  
SeCompareSigningLevels  
SeMarkLogonSessionForTerminationNotificationEx declared for Windows 10 RS1 (1607) and higher
SeQueryServerSiloToken declared for Windows 10 RS1 (1607) and higher
SeQuerySessionIdTokenEx declared for Windows 2000 and higher
SeRegisterLogonSessionTerminatedRoutineEx declared for Windows 10 RS1 (1607) and higher
SeSetSecurityAttributesTokenEx  
SeUnregisterLogonSessionTerminatedRoutineEx declared for Windows 10 RS1 (1607) and higher
SkAcquirePushLockExclusive  
SkAllocatePool  
SkFreePool  
SkInitializePushLock  
SkIsSecureKernel  
SkQuerySecureKernelInformation  
SkReleasePushLockExclusive  
VfCheckNxPagePriority  
VfCheckNxPageProtection  
VfCheckNxPoolType  
VmAccessFault discontinued in 1709
VmCreateMemoryRange discontinued in 1709
VmDeleteMemoryRange discontinued in 1709
VslExchangeEntropy  
VslRetrieveMailbox  
ZwAlpcOpenSenderThread  
ZwAlpcQueryInformationMessage  
ZwCompareTokens  
ZwGetCachedSigningLevel  
ZwGetNextProcess  
ZwNotifyChangeDirectoryFile  
ZwTraceControl  
_finite  
_wcslwr_s  
iswalnum  
iswdigit  
iswspace  
sqrt x64 only
sqrtf x64 only

Additionally, ExUpdateLicenseData, which is exported from versions 6.0 and 6.1 but then not from 6.2 or 6.3, is restored as an export for version 10.0. Another function, RtlPcToFileHeader, which earlier versions export only from x64 builds, becomes exported for x86 builds too.