New Kernel Version 1709 Exports

This page lists the functions that are newly exported from the Windows kernel in its 1709 release. Relative to the highly selective disclosure that Microsoft has established for previous releases of Windows 10, surprisingly many of the additions for the 1709 release are documented by Microsoft (as far as shows up in a search online today, 13th October 2018).

Documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. Functions that have their own non-trivial documentation are shown with no background colour. If the function is documented as reserved or obsolete, with or without a prototype, it is shaded red or shaded grey, respectively. An undocumented function that is at least declared in one or another header file from the Windows Driver Kit (WDK) is shaded orange. If the only declaration that Microsoft is known to have disclosed publicly is from the “minwin” directory of the Enterprise WDK for Windows 10 version 1511, specifically, then the function is highlighted orange. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented in the first contemporaneous Device Driver Kit (DDK), WDK or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status as undocumented.

Name Remarks
AlpcCreateSecurityContext  
CcGetNumberOfMappedPages  
EtwTelemetryCoverageReport  
ExGetFirmwareType  
ExIsSoftBoot  
FsRtlNotifyFilterReportChangeLiteEx  
HvlInvokeFastExtendedHypercall x64 only
IoCheckLinkShareAccess  
IoRemoveLinkShareAccess  
IoSetLinkShareAccess  
IoUpdateLinkShareAccess  
KeSetLastBranchRecordInUse x64 only
MmGetSectionInformation  
MmMapMdl  
NtNotifyChangeDirectoryFileEx  
NtQueryDirectoryFileEx  
PoFxSetTargetDripsDevicePowerState declared for Windows Threshold (10.0) and higher
PsGetParentSilo  
PsGetProcessSilo  
PsIsWin32KFilterAuditEnabledForProcess  
PsIsWin32KFilterEnabledForProcess  
PsPartitionType (data)  
PsSetLoadImageNotifyRoutineEx  
PsSetProcessFaultInformation  
RtlCapabilityCheckForSingleSessionSku  
RtlCheckSystemBootStatusIntegrity  
RtlExtendCorrelationVector declared for Windows 10 RS2 (1703) and higher
RtlExtractBitMapEx x64 only
RtlGetSystemBootStatus  
RtlGetSystemBootStatusEx  
RtlIncrementCorrelationVector declared for Windows 10 RS2 (1703) and higher
RtlInitializeCorrelationVector declared for Windows 10 RS2 (1703) and higher
RtlIsCloudFilesPlaceholder declared for Windows 10 RS2 (1703) and higher
RtlIsPartialPlaceholder declared for Windows 10 RS2 (1703) and higher
RtlIsPartialPlaceholderFileHandle declared for Windows 10 RS2 (1703) and higher
RtlIsPartialPlaceholderFileInfo declared for Windows 10 RS2 (1703) and higher
RtlIsStateSeparationEnabled declared for Windows 10 RS2 (1703) and higher, before WDK for 1803;
now declared for Windows 10 RS4 (1803) and higher
RtlOpenImageFileOptionsKey  
RtlPcToFileName  
RtlPcToFilePath  
RtlQueryImageFileKeyOption  
RtlQueryThreadPlaceholderCompatibilityMode  
RtlRestoreSystemBootStatusDefaults  
RtlSetSystemBootStatus  
RtlSetSystemBootStatusEx  
RtlSetThreadPlaceholderCompatibilityMode  
RtlShiftLeftBitMap  
RtlShiftLeftBitMapEx x64 only
RtlValidateCorrelationVector declared for Windows 10 RS2 (1703) and higher
VslGetSecurePciEnabled  
ZwAlpcOpenSenderProcess  
ZwGetNextThread  
ZwNotifyChangeDirectoryFileEx  
ZwQueryDirectoryFileEx documented with no version requirement