New Kernel Version 1803 Exports

This page lists the functions and variables that are newly exported from the Windows kernel in the 1803 release for Windows 10. Surprisingly many, relative to previous releases of Windows 10, are documented by Microsoft as far as shows up in a search online today (13th October 2018). Undocumented functions that are declared in one or another header file from one or another edition of the Windows Driver Kit are shaded orange. Otherwise, they are highlighted yellow as this site’s usual indication of undocumented status.

Name Remarks
EtwpDisableStackWalkApc  
EtwpReenableStackWalkApc  
FsRtlIsNameInUnUpcasedExpression  
IoGetDeviceDirectory documented with no version requirement
IoGetDriverDirectory documented with no version requirement
IoGetIommuInterface  
IoOpenDriverRegistryKey  
KeAddTriageDumpDataBlock  
KeFlushCurrentTbImmediately x64 only
KeInitializeTriageDumpDataArray  
KeInvalidateRangeAllCachesNoIpi  
MmForceSectionClosedEx  
PoReportDirectedDripsCandidateDevice  
PsWow64IsMachineSupported  
RtlGetEnabledExtendedAndSupervisorFeatures declared for Windows 10 RS3 (1709) and higher;
with TODO comment for “when it gets defined”
RtlGetPersistedStateLocation  
RtlLocateSupervisorFeature declared for Windows 10 RS3 (1709) and higher;
with TODO comment for “when it gets defined”
RtlQueryProcessPlaceholderCompatibilityMode  
RtlQueryRegistryValueWithFallback not declared;
documentation requires “Windows 10, version 1809” as minimum
RtlRaiseCustomSystemEventTrigger  
RtlSetProcessPlaceholderCompatibilityMode  
VslGetSecurePciDeviceAlternateFunctionNumberForVtl0Dma  
qsort_s  

The KeConnectInterruptForHal function, which is exported by the x64 builds of all releases of version 10.0, becomes an x86 export too in version 1803.