Revision in progress. Use caution.

Kernel Exports Added for Windows 10 Version 1803

This page lists the functions and variables that are newly exported from the Windows kernel in the 1803 release for Windows 10. Surprisingly many, relative to previous releases of Windows 10, are documented by Microsoft as far as shows up in a search online today (13th October 2018). Undocumented functions that are declared in one or another header file from one or another edition of the Windows Driver Kit are shaded orange. Otherwise, they are highlighted yellow as this site’s usual indication of undocumented status.

Name Documentation History
EtwpDisableStackWalkApc  
EtwpReenableStackWalkApc  
FsRtlIsNameInUnUpcasedExpression  

It’s certainly not impossible that I overlooked FsRtlIsNameInUnUpcasedExpression in my survey of Microsoft’s online documentation on 13th October 2018. The documentation that’s there today, 17th September 2020, is dated 19th October 2018, but so are others that were new for 1803 and which I did record as having seen six days earlier. Though I think it’s likely this function wasn’t documented immediately, I can’t say so definitely.

Name Export History Documentation History
IoGetDeviceDirectory    
IoGetDriverDirectory    
IoGetIommuInterface    
IoOpenDriverRegistryKey    
KeAddTriageDumpDataBlock    
KeFlushCurrentTbImmediately x64 only  
KeInitializeTriageDumpDataArray    
KeInvalidateRangeAllCachesNoIpi    
MmForceSectionClosedEx    
PoReportDirectedDripsCandidateDevice discontinued in 1903  
PsWow64IsMachineSupported    
RtlGetEnabledExtendedAndSupervisorFeatures    
RtlGetPersistedStateLocation    
RtlLocateSupervisorFeature    
RtlQueryProcessPlaceholderCompatibilityMode    
RtlQueryRegistryValueWithFallback   before 1809, undocumented
documented start is 1809
RtlRaiseCustomSystemEventTrigger    
RtlSetProcessPlaceholderCompatibilityMode    
VslGetSecurePciDeviceAlternateFunctionNumberForVtl0Dma    
qsort_s    

The KeConnectInterruptForHal function, which is exported by the x64 builds of all releases of version 10.0, becomes an x86 export too in version 1803.