Kernel Version 4.0 Exports

The large table on this page lists the 157 exports that were added to the Windows kernel in its first release for version 4.0., i.e., for the original Windows NT 4.0. Almost all are still exported as of version 10.0.

Three variables were added for Windows NT 4.0 SP3 and two functions for Windows NT 4.0 SP4. They are listed separately.

Documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. Functions that have their own non-trivial documentation are shown with no background colour. If the whole of the documentation is just that the function is reserved or obsolete, without even giving a prototype, then the function is highlighted red or highlighted pink, respectively. An undocumented function that is at least declared in one or another header file from the Windows Driver Kit (WDK) is highlighted orange. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented in the first contemporaneous Device Driver Kit (DDK), WDK or Installable File System (IFS), then it is shaded yellow to retain some of its previous status as undocumented.

Just over half of these new exports for version 4.0 are nowadays documented. However, a dozen are documented only as being reserved, and one more as obsolete. At the time these functions were documented, it does not seem to have been Microsoft’s standard practice to document which Windows versions have which kernel functions. For all documented functions in the table, including if marked as obsolete or reserved, assume that the WDK documentation has no version information except if stated otherwise in the Remarks column.

The documented functions and four undocumented functions are declared in one or another of the WDK header files. The WDK applies version constraints (in terms of the NTDDI_VERSION macro) to most declarations, but this is a recent practice. When Microsoft decided to start adding this information, it seems no trouble was taken to determine any function’s origin from before Windows 2000. Yet instead of leaving the old declarations without version constraints, trouble was taken to add version information in the full knowledge that the addition would be factually wrong for the overwhelming majority of these old functions. In this way, very nearly all these functions that first appeared in Windows NT 4.0 are said to require at least Windows 2000. Exported variables are always declared without version constraints. When a function is redefined by a macro or is implemented inline, no version constraints apply.

Function Remarks
CcFastCopyRead undocumented until 2000 (IFS);
declaration requires Windows 2000 and higher
CcFastCopyWrite undocumented until 2000 (IFS);
declaration requires Windows 2000 and higher
CcFastMdlReadWait (data)  
CcFastReadNotPossible (data) discontinued in 6.0
CcFastReadWait (data) discontinued in 6.0
CcSetBcbOwnerPointer undocumented until 2000 (IFS);
declaration requires Windows 2000 and higher
DbgBreakPointWithStatus undocumented until 1996-2000;
documentation requires Windows 2000 and higher;
declaration requires Windows 2000 and higher
ExAllocateFromPagedLookasideList x86-only before 5.2 from Windows Server 2003 SP1, and in 6.0 and higher;
declared inline unless _WIN2K_COMPAT_SLIST_USAGE defined (x86 only)
ExDeleteNPagedLookasideList declaration requires Windows 2000 and higher
ExDeletePagedLookasideList declaration requires Windows 2000 and higher
ExDesktopObjectType (data)  
ExEnumHandleTable  
ExFreeToPagedLookasideList x86-only before 5.2 from Windows Server 2003 SP1, and in 6.0 and higher;
declared inline unless _WIN2K_COMPAT_SLIST_USAGE defined (x86 only)
ExGetPreviousMode undocumented until 1996-2000;
declaration requires Windows 2000 and higher
ExInitializeNPagedLookasideList declaration requires Windows 2000 and higher
ExInitializePagedLookasideList declaration requires Windows 2000 and higher
ExInterlockedCompareExchange64 x86 only;
undocumented until 1996-2000;
redefined by macro using ExfInterlockedCompareExchange64;
supported for x64 by macro using compiler intrinsic _InterlockedCompareExchange64
ExInterlockedPopEntrySList x86 only;
redefined by macro using InterlockedPopEntrySList unless _WIN2K_COMPAT_SLIST_USAGE defined (x86 only);
supported for x64 by macro using ExpInterlockedPopEntrySList
ExInterlockedPushEntrySList x86 only;
redefined by macro using InterlockedPushEntrySList unless _WIN2K_COMPAT_SLIST_USAGE defined (x86 only);
supported for x64 by macro using ExpInterlockedPushEntrySList
ExIsProcessorFeaturePresent undocumented until 1996-2000;
declaration requires Windows 2000 and higher
ExSetResourceOwnerPointer undocumented until 1996-2000;
declaration requires Windows 2000 and higher
ExWindowStationObjectType (data)  
FsRtlAddToTunnelCache undocumented until 2000 (IFS);
declaration requires Windows 2000 and higher
FsRtlDeleteKeyFromTunnelCache undocumented until 2000 (IFS);
documentation since 2008-2009 requires Windows 2000 and higher;
declaration requires Windows 2000 and higher
FsRtlDeleteTunnelCache undocumented until 2000 (IFS);
declaration requires Windows 2000 and higher
FsRtlFindInTunnelCache undocumented until 2000 (IFS);
declaration requires Windows 2000 and higher
FsRtlGetFileSize undocumented until 2000-2006 (IFS);
declaration requires Windows 2000 and higher
FsRtlInitializeTunnelCache undocumented until 2000 (IFS);
declaration requires Windows 2000 and higher
FsRtlMdlReadComplete  
FsRtlMdlReadCompleteDev undocumented until 2000-2006 (IFS);
declaration requires Windows 2000 and higher
FsRtlMdlReadDev undocumented until 2000-2006 (IFS);
declaration requires Windows 2000 and higher
FsRtlMdlWriteComplete  
FsRtlMdlWriteCompleteDev undocumented until 2000-2006 (IFS);
declaration requires Windows 2000 and higher
FsRtlPrepareMdlWriteDev undocumented until 2000-2006 (IFS);
declaration requires Windows 2000 and higher
InterlockedCompareExchange x86 only;
conditionally redefined by macro as compiler intrinsic _InterlockedCompareExchange or by inline assembly language using lock cmpxchg instruction;
supported for x64 by macro as compiler intrinsic _InterlockedCompareExchange
InterlockedExchangeAdd x86 only;
conditionally redefined by macro as compiler intrinsic _InterlockedExchangeAdd or by inline assembly language using lock xadd instruction;
supported for x64 by macro as compiler intrinsic _InterlockedExchangeAdd
IoAttachDeviceToDeviceStack declaration requires Windows 2000 and higher
IoCreateNotificationEvent declaration requires Windows 2000 and higher
IoDeviceHandlerObjectSize  
IoDeviceHandlerObjectType  
IoFastQueryNetworkAttributes undocumented until 2000-2006 (IFS);
declaration requires Windows 2000 and higher
IoGetBaseFileSystemDeviceObject undocumented until 2000-2006 (IFS);
declaration requires Windows 2000 and higher
IoGetStackLimits undocumented until 1996-2000
IoOpenDeviceInstanceKey discontinued in 5.0
IoQueryDeviceEnumInfo discontinued in 5.0
IoQueueThreadIrp undocumented until 2000-2006 (IFS);
declaration requires Windows 2000 and higher
IoSetThreadHardErrorMode undocumented until 1996-2000;
documentation since 2008-2009 requires Windows 2000 and higher;
declaration requires Windows 2000 and higher
KeBoostCurrentThread discontinued in 5.0
KeI386Call16BitCStyleFunction x86 only;
discontinued in 6.2
KeInitializeTimerEx declaration requires Windows 2000 and higher
KeRaiseUserException  
KeRestoreFloatingPointState undocumented until 1996-2000;
defined inline to succeed trivially (x64)
KeRundownQueue undocumented until 2000 (IFS);
declaration requires Windows 2000 and higher
KeSaveFloatingPointState undocumented until 1996-2000;
defined inline to succeed trivially (x64)
KeSetAffinityThread  
KeSetIdealProcessorThread undocumented until 2000-2006 (IFS);
declaration requires Windows 2000 and higher
KeSetKernelStackSwapEnable undocumented until 2000-2006 (IFS);
declaration requires Windows 2000 and higher
KeSetProfileIrql  
KeSetSwapContextNotifyRoutine discontinued in 5.1
KeSetThreadSelectNotifyRoutine discontinued in 5.1
KeSetTimeUpdateNotifyRoutine discontinued in 5.2;
undocumented until 2000-2002;
not declared
KeSetTimerEx declaration requires Windows 2000 and higher
KiBugCheckData (data)  
LdrFindResourceDirectory_U  
MmGrowKernelStack  
MmMapVideoDisplay undocumented until 2000-2002;
declaration requires Windows 2000 and higher
MmUnmapVideoDisplay undocumented until 2000-2002;
declaration requires Windows 2000 and higher
NlsAnsiCodePage (data)  
NtAddAtom  
NtDeleteAtom  
NtFindAtom  
NtQueryInformationAtom  
NtQueryOleDirectoryFile discontinued in 5.0
ObAssignSecurity  
ObCheckCreateObjectAccess  
ObCheckObjectAccess  
ObFindHandleForObject  
ObGetObjectSecurity undocumented until 1996-2000;
declaration requires Windows 2000 and higher
ObOpenObjectByName  
ObQueryObjectAuditingByHandle undocumented until 2000-2006 (IFS);
declaration requires Windows 2000 and higher
ObReferenceObjectByName  
ObReleaseObjectSecurity undocumented until 1996-2000;
declaration requires Windows 2000 and higher
ObSetSecurityDescriptorInfo  
ObfReferenceObject declaration requires Windows 2000 and higher
PoSetDeviceIdleDetection discontinued in 5.0
PsAssignImpersonationToken declaration requires Windows 2000 and higher
PsCreateWin32Process discontinued in 5.0
PsGetCurrentProcessId undocumented until 1996-2000;
declaration requires Windows 2000 and higher
PsGetCurrentThreadId undocumented until 1996-2000;
declaration requires Windows 2000 and higher
PsGetVersion undocumented until 1996-2000;
documented since 2000-2002 as obsolete for Windows XP and higher;
declaration requires Windows 2000 and higher
PsImpersonateClient undocumented until 2000-2006 (IFS);
documentation requires Windows XP and higher;
declaration requires Windows 2000 and higher
PsRevertToSelf undocumented until 2007;
documentation requires Windows XP and higher;
declaration requires Windows 2000 and higher
PsSetCreateThreadNotifyRoutine undocumented until 1996-2000;
declaration requires Windows 2000 and higher
PsSetLegoNotifyRoutine  
RtlAddAtomToAtomTable  
RtlAnsiCharToUnicodeChar undocumented until 2008-2009;
documentation requires Windows 2000 and higher;
not declared
RtlAreAnyAccessesGranted  
RtlCompressChunks undocumented until 2000-2006 (IFS);
declaration requires Windows XP and higher
RtlCreateAtomTable  
RtlDecompressChunks undocumented until 2000-2006 (IFS);
declaration requires Windows XP and higher
RtlDeleteAtomFromAtomTable  
RtlDeleteNoSplay undocumented until 2000 (IFS);
declaration requires Windows 2000 and higher
RtlDescribeChunk undocumented until 2000-2006 (IFS);
declaration requires Windows XP and higher
RtlDestroyAtomTable  
RtlEmptyAtomTable  
RtlGetDefaultCodePage  
RtlLookupAtomInAtomTable  
RtlMultiByteToUnicodeSize undocumented until 2000 (IFS);
declaration requires Windows 2000 and higher
RtlPinAtomInAtomTable  
RtlQueryAtomInAtomTable  
RtlRaiseException  
RtlReserveChunk undocumented until 2000-2006 (IFS);
declaration requires Windows XP and higher
SeAuditingFileOrGlobalEvents undocumented until 2000 (IFS);
declaration requires Windows 2000 and higher
SeDeleteObjectAuditAlarm undocumented until 2000 (IFS);
declaration requires Windows 2000 and higher
SeOpenObjectForDeleteAuditAlarm undocumented until 2000 (IFS);
declaration requires Windows 2000 and higher
SeSetAccessStateGenericMapping undocumented until 2000 (IFS);
declaration requires Windows 2000 and higher
SeTokenImpersonationLevel  
ZwLoadKey  
ZwQueryDefaultLocale  
ZwQueryObject undocumented until 2007;
documentation requires Windows 2000 and higher;
declaration requires Windows 2000 and higher
ZwQuerySystemInformation  
ZwReplaceKey  
ZwSaveKey  
ZwSetInformationObject  
ZwSetSystemTime  
ZwTerminateProcess undocumented until 2005-2006
ZwUnloadDriver undocumented until 2000-2006 (IFS);
documentation requires Windows XP and higher;
declaration requires Windows 2000 and higher
ZwUnloadKey  
ZwYieldExecution  
_alldiv x86 only
_allmul x86 only
_allrem x86 only
_allshl x86 only
_allshr x86 only
_aulldiv x86 only
_aullrem x86 only
_aullshr x86 only
_strnset  
_strrev  
_strset  
_wcslwr  
_wcsnset  
_wcsrev  
_wcsupr  
mbtowc  
strcat  
strcmp  
strcpy  
strlen  
strncat  
strspn  
towlower  
towupper  
wcsncat  
wcsspn  
wcstombs  
wctomb