Kernel Version 5.1 Exports

The large table on this page lists the 247 exports that were added to the Windows kernel in its first release for version 5.1., i.e., for the original Windows XP. All but five are still exported as of version 6.0.

The few additions for Windows XP SP1 are listed separately, as are the more additions for Windows XP SP2. A handful of other exports perhaps were designed for version 5.1, and are mostly dated to Windows XP by Microsoft, but appear first, in order of version number, as additions for Windows 2000 SP3.

Documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. Functions that have their own non-trivial documentation are shown with no background colour. If the whole of the documentation is just that the function is reserved or obsolete, without even giving a prototype, then the function is highlighted red or highlighted pink, respectively. An undocumented function that is at least declared in one or another header file from the Windows Driver Kit (WDK) is highlighted orange. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented in the first contemporaneous Device Driver Kit (DDK), WDK or Installable File System (IFS), then it is shaded yellow to retain some of its previous status as undocumented.

Just more than 40% of these new exports for version 5.1 are nowadays documented. For most, the documentation states that the function is “available on Microsoft Windows XP and later”. Six functions are documented only as being reserved, without even saying which versions have them. Another four are documented as obsolete, again without saying which versions have them. A small proportion of the new functions are undocumented but with declarations in one or another of the WDK header files. Declarations, both of these and the documented functions, are mostly for Windows XP and higher. Nearly a half of the new functions have neither documentation nor declaration.

Function Remarks
CcMdlWriteAbort  
CmRegisterCallback undocumented until 2002-2005;
documented as obsolete for Windows Vista and higher
CmUnRegisterCallback undocumented until 2002-2005
DbgPrintEx  
DbgQueryDebugFilterState  
DbgSetDebugFilterState  
ExAcquireRundownProtection  
ExGetCurrentProcessorCounts  
ExGetCurrentProcessorCpuUsage  
ExInitializeRundownProtection  
ExReInitializeRundownProtection  
ExReleaseRundownProtection  
ExRundownCompleted  
ExVerifySuite undocumented until 2002-2005
ExWaitForRundownProtectionRelease  
ExfInterlockedCompareExchange64 x86 only
FsRtlIncrementCcFastReadNoWait  
FsRtlIncrementCcFastReadNotPossible  
FsRtlIncrementCcFastReadResourceMiss  
FsRtlIncrementCcFastReadWait  
FsRtlInsertPerFileObjectContext undocumented until 2008-2009;
documentation requires Windows Vista and higher
FsRtlInsertPerStreamContext documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher
FsRtlIsPagingFile documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher
FsRtlLookupPerFileObjectContext undocumented until 2008-2009;
documentation requires Windows Vista and higher
FsRtlLookupPerStreamContextInternal  
FsRtlNotifyFilterChangeDirectory documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher
FsRtlNotifyFilterReportChange documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher;
declaration requires Windows 2000 and higher
FsRtlRegisterFileSystemFilterCallbacks documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher
FsRtlRemovePerFileObjectContext undocumented until 2008-2009;
documentation requires Windows Vista and higher
FsRtlRemovePerStreamContext documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher
FsRtlTeardownPerStreamContexts documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher;
declaration requires Windows 2000 and higher
HalExamineMBR previously supported (and documented) as macro using HalDispatchTable
HeadlessDispatch  
InterlockedPopEntrySList x86 only;
supported for x64 by macro using ExpInterlockedPopEntrySList;
also exported from KERNEL32 version 5.1 and higher;
documentation is in SDK for KERNEL32
InterlockedPushEntrySList x86 only;
supported for x64 by macro using ExpInterlockedPushEntrySList;
also exported from KERNEL32 version 5.1 and higher;
documentation is in SDK for KERNEL32
IoAssignDriveLetters discontinued in 6.1
IoAttachDeviceToDeviceStackSafe documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher
IoCreateDisk  
IoCreateFileSpecifyDeviceObjectHint  
IoCreateStreamFileObjectEx  
IoCsqInitialize documents earlier availability through statically-linked library CSQ.LIB for Windows 2000
IoCsqInsertIrp documents earlier availability through statically-linked library CSQ.LIB for Windows 2000
IoCsqRemoveIrp documents earlier availability through statically-linked library CSQ.LIB for Windows 2000
IoCsqRemoveNextIrp documents earlier availability through statically-linked library CSQ.LIB for Windows 2000
IoEnumerateDeviceObjectList documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher
IoForwardAndCatchIrp redefined by macro as IoForwardIrpSynchronously
IoForwardIrpSynchronously  
IoFreeErrorLogEntry  
IoGetDeviceAttachmentBaseRef documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher
IoGetDiskDeviceObject documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher
IoGetLowerDeviceObject documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher
IoQueryFileDosDeviceName  
IoReadDiskSignature  
IoReadPartitionTable also exported from HAL version 3.51 and higher;
deprecated
IoReadPartitionTableEx  
IoSetCompletionRoutineEx  
IoSetPartitionInformation also exported from HAL version 3.51 and higher;
deprecated
IoSetPartitionInformationEx  
IoSetStartIoAttributes  
IoSetSystemPartition  
IoVerifyPartitionTable  
IoVolumeDeviceToDosName  
IoWMIDeviceObjectToInstanceName  
IoWMIExecuteMethod  
IoWMIHandleToInstanceName  
IoWMIOpenBlock  
IoWMIQueryAllData  
IoWMIQueryAllDataMultiple  
IoWMIQuerySingleInstance  
IoWMIQuerySingleInstanceMultiple declaration requires Windows 2000 and higher
IoWMISetNotificationCallback  
IoWMISetSingleInstance  
IoWMISetSingleItem  
IoWritePartitionTable also exported from HAL version 3.51 and higher;
deprecated
IoWritePartitionTableEx  
KdPowerTransition  
KeAcquireInStackQueuedSpinLockAtDpcLevel  
KeAcquireInterruptSpinLock  
KeAreApcsDisabled  
KeGetRecommendedSharedDataAlignment  
KeIsAttachedProcess  
KeQueryRuntimeThread  
KeReleaseInStackQueuedSpinLockFromDpcLevel  
KeReleaseInterruptSpinLock  
KeRemoveByKeyDeviceQueueIfBusy  
KeRemoveSystemServiceTable  
MmAddVerifierThunks undocumented until 2005-2006
MmAdvanceMdl  
MmAllocateMappingAddress  
MmFreeMappingAddress  
MmIsVerifierEnabled undocumented until 2005-2006
MmMapLockedPagesWithReservedMapping  
MmMarkPhysicalMemoryAsBad not declared
MmMarkPhysicalMemoryAsGood not declared
MmPrefetchPages  
MmProtectMdlSystemAddress  
MmUnmapReservedMapping  
NtMakePermanentObject  
NtOpenProcessTokenEx undocumented until 2008-2009
NtOpenThread  
NtOpenThreadToken declaration requires Windows 2000 and higher
NtOpenThreadTokenEx undocumented until 2008-2009
NtQueryInformationThread  
NtShutdownSystem  
NtTraceEvent  
ObCloseHandle  
ObCreateObjectType  
ObDereferenceSecurityDescriptor  
ObLogSecurityDescriptor  
ObReferenceSecurityDescriptor  
ObSetHandleAttributes  
ObSetSecurityObjectByPointer  
PoQueueShutdownWorkItem  
PoRequestShutdownEvent  
PsChargeProcessNonPagedPoolQuota  
PsChargeProcessPagedPoolQuota  
PsChargeProcessPoolQuota  
PsDereferenceImpersonationToken documented before exported, as early as 2000
PsDereferencePrimaryToken documented before exported, as early as 2000
PsGetCurrentProcess documented before exported, as early as 1996;
redefined by macro as IoGetCurrentProcess;
not declared
PsGetCurrentProcessSessionId  
PsGetCurrentThread documented before exported, as early as 1996;
defined inline using KeGetCurrentThread
PsGetCurrentThreadPreviousMode  
PsGetCurrentThreadStackBase  
PsGetCurrentThreadStackLimit  
PsGetJobLock  
PsGetJobSessionId  
PsGetJobUIRestrictionsClass  
PsGetProcessCreateTimeQuadPart undocumented until 2007
PsGetProcessDebugPort  
PsGetProcessExitProcessCalled  
PsGetProcessExitStatus  
PsGetProcessId undocumented until 2005-2006
PsGetProcessImageFileName  
PsGetProcessInheritedFromUniqueProcessId  
PsGetProcessJob  
PsGetProcessPeb  
PsGetProcessPriorityClass  
PsGetProcessSectionBaseAddress  
PsGetProcessSecurityPort  
PsGetProcessSessionId  
PsGetProcessWin32Process  
PsGetProcessWin32WindowStation  
PsGetThreadFreezeCount  
PsGetThreadHardErrorsAreDisabled  
PsGetThreadId  
PsGetThreadProcess  
PsGetThreadProcessId declaration requires Windows Server 2003 and higher
PsGetThreadSessionId  
PsGetThreadTeb  
PsGetThreadWin32Thread  
PsIsProcessBeingDebugged  
PsIsSystemThread undocumented until 2007
PsIsThreadImpersonating  
PsRemoveCreateThreadNotifyRoutine undocumented until 2002-2005
PsRemoveLoadImageNotifyRoutine undocumented until 2002-2005
PsReturnProcessNonPagedPoolQuota  
PsReturnProcessPagedPoolQuota  
PsRevertThreadToSelf  
PsSetJobUIRestrictionsClass discontinued in 6.2
PsSetProcessPriorityClass  
PsSetProcessSecurityPort  
PsSetProcessWin32Process  
PsSetProcessWindowStation  
PsSetThreadHardErrorsAreDisabled  
PsSetThreadWin32Thread  
RtlClearBit undocumented until 2005-2006
RtlCreateSystemVolumeInformationFolder  
RtlDeleteElementGenericTableAvl  
RtlEnumerateGenericTableAvl  
RtlEnumerateGenericTableLikeADirectory  
RtlEnumerateGenericTableWithoutSplayingAvl  
RtlGetElementGenericTableAvl undocumented until 2008-2009
RtlGetSetBootStatusData  
RtlGetVersion documented before exported, as early as 2000;
documentation since 2000-2002 requires Windows XP and higher;
declaration requires Windows 2000 and higher
RtlHashUnicodeString undocumented until 2005-2006
RtlInitializeGenericTableAvl  
RtlInsertElementGenericTableAvl  
RtlInsertElementGenericTableFullAvl  
RtlInt64ToUnicodeString documented before exported, as early as 2000;
declaration requires Windows 2000 and higher
RtlIntegerToUnicode  
RtlIpv4AddressToStringA also exported from NTDLL version 5.1 and higher;
documentation and declaration are in SDK for NTDLL;
documentation requires Windows Vista and higher;
declaration requires Windows Vista and higher
RtlIpv4AddressToStringW also exported from NTDLL version 5.1 and higher;
documentation and declaration are in SDK for NTDLL;
documentation requires Windows Vista and higher;
declaration requires Windows Vista and higher
RtlIpv4StringToAddressA also exported from NTDLL version 5.1 and higher;
documentation and declaration are in SDK for NTDLL;
documentation requires Windows Vista and higher;
declaration requires Windows Vista and higher
RtlIpv4StringToAddressW also exported from NTDLL version 5.1 and higher;
documentation and declaration are in SDK for NTDLL;
documentation requires Windows Vista and higher;
declaration requires Windows Vista and higher
RtlIpv6AddressToStringA also exported from NTDLL version 5.1 and higher;
documentation and declaration are in SDK for NTDLL;
documentation requires Windows Vista and higher;
declaration requires Windows Vista and higher
RtlIpv6AddressToStringW also exported from NTDLL version 5.1 and higher;
documentation and declaration are in SDK for NTDLL;
documentation requires Windows Vista and higher;
declaration requires Windows Vista and higher
RtlIpv6StringToAddressA also exported from NTDLL version 5.1 and higher;
documentation and declaration are in SDK for NTDLL;
documentation requires Windows Vista and higher;
declaration requires Windows Vista and higher
RtlIpv6StringToAddressW also exported from NTDLL version 5.1 and higher;
documentation and declaration are in SDK for NTDLL;
documentation requires Windows Vista and higher;
declaration requires Windows Vista and higher
RtlIsGenericTableEmptyAvl  
RtlLockBootStatusData  
RtlLookupElementGenericTableAvl  
RtlLookupElementGenericTableFullAvl  
RtlMapSecurityErrorToNtStatus  
RtlNumberGenericTableElementsAvl  
RtlRandomEx  
RtlSetBit undocumented until 2005-2006
RtlTestBit undocumented until 2005-2006
RtlTimeToElapsedTimeFields  
RtlUnlockBootStatusData  
RtlVerifyVersionInfo documented before exported, as early as 2000;
declaration requires Windows 2000 and higher 
SeFilterToken  
SeTokenObjectType (data) mentioned since 2008-2009 in documentation of ObReferenceObjectByHandle, etc
VerSetConditionMask declaration requires Windows 2000 and higher
VfFailDeviceNode  
VfFailDriver  
VfFailSystemBIOS  
VfIsVerificationEnabled  
WmiFlushTrace discontinued in 6.0
WmiGetClock  
WmiQueryTrace discontinued in 6.0
WmiQueryTraceInformation  
WmiStartTrace discontinued in 6.0
WmiStopTrace discontinued in 6.0
WmiTraceMessage  
WmiTraceMessageVa  
WmiUpdateTrace discontinued in 6.0
XIPDispatch  
ZwAddBootEntry  
ZwAssignProcessToJobObject  
ZwCreateJobObject  
ZwDeleteBootEntry  
ZwEnumerateBootEntries  
ZwIsProcessInJob  
ZwOpenJobObject  
ZwOpenProcessTokenEx  
ZwOpenThreadTokenEx  
ZwQueryBootEntryOrder  
ZwQueryBootOptions  
ZwQueryFullAttributesFile undocumented until 2008-2009;
documentation requires Windows 2000 and higher;
declaration requires Windows 2000 and higher
ZwQueryInformationJobObject  
ZwQueryInformationThread  
ZwSaveKeyEx  
ZwSetBootEntryOrder  
ZwSetBootOptions  
ZwSetInformationJobObject  
ZwTerminateJobObject  
ZwTranslateFilePath  
_CIcos x86 only
_CIsin x86 only
_CIsqrt x86 only
_alldvrm x86 only
_alloca_probe x86 only
_aulldvrm x86 only
_vsnwprintf  
vDbgPrintEx undocumented until 2005-2006
vDbgPrintExWithPrefix undocumented until 2007