New Kernel Version 1511 Exports

This page lists the functions that are newly exported from the Windows kernel in its 1511 release. Hardly any seem to be documented by Microsoft as far as shows up in a search online today (7th October 2018).

Documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. Functions that have their own non-trivial documentation are shown with no background colour. If the function is documented as reserved or obsolete, with or without a prototype, it is shaded red or shaded grey, respectively. An undocumented function that is at least declared in one or another header file from the Windows Driver Kit (WDK) is shaded orange. If the only declaration that Microsoft is known to have disclosed publicly is from the “minwin” directory of the Enterprise WDK for Windows 10 version 1511, specifically, then the function is highlighted orange. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented in the first contemporaneous Device Driver Kit (DDK), WDK or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status as undocumented.

All declarations of the new exports in version 1511 have conditional-compilation blocks that date the function to some other release of Windows 10. Those that would have it that the function is not available until a later release do at least have the merit of matching the documentation.

Name Remarks
InbvSetVirtualFrameBuffer  
IoClearFsTrackOffsetState declared for Windows Threshold (10.0) and higher
IoGetSiloParameters declared for Windows Threshold (10.0) but undocumented until 2016;
documentation requires “Windows 10, version 1607” as minimum;
now declared for Windows 10 RS1 (1607) and higher
IoVolumeDeviceNameToGuid declared for Windows 10 and higher
IoVolumeDeviceNameToGuidPath declared for Windows 10 and higher
KeGetEffectiveIrql  
ObOpenObjectByNameEx  
PoSetSystemWakeDevice  
PsEqualCurrentServerSilo discontinued in 1607
PsGetCurrentServerSilo declared for Windows Threshold (10.0) but undocumented until 2016;
documentation requires “Windows 10, version 1607” as minimum;
now declared for Windows 10 RS1 (1607) and higher
PsGetCurrentServerSiloName declared for Windows Threshold (10.0) but undocumented until 2016;
documentation requires “Windows 10, version 1607” as minimum;
documentation has “pre-released product” warning;
now declared for Windows 10 RS1 (1607) and higher
PsGetCurrentSiloObject discontinued in 1607;
declared for Windows Threshold (10.0)
PsGetJobServerSilo not declared until WDK for 1607;
documentation requires “Windows 10, version 1607” as minimum;
declared for Windows 10 RS1 (1607) and higher
PsGetProcessServerSilo  
PsGetSiloIdentifier  
PsIsCurrentThreadInServerSilo declared for Windows Threshold (10.0) but undocumented until 2016;
documentation requires “Windows 10, version 1607” as minimum;
documentation has “pre-released product” warning;
now declared for Windows 10 RS1 (1607) and higher
PsSetCreateProcessNotifyRoutineEx2 not declared until WDK for 1703;
documentation requires “Windows 10, version 1703” as minimum;
now declared for Windows 10 RS2 (1703) and higher
RtlGetCurrentServiceSessionId  
SeAuditFipsCryptoSelftests declared for Windows Threshold (10.0) and higher
ZwUnloadKey2  

Version 1511 also discontinued the export of some functions, including seven that had only just been introduced for the original version 10.0. These functions for working with silos were apparently so much in flux that version 1607 discontinued more, including some that had been new for version 1511.