Kernel Exports Added for Windows Server 2003 SP1

The table below lists the 50 functions that are first exported by the Windows kernel in the version 5.2 from Windows Server 2003 SP1. Two more are listed as additions for Windows XP SP3 because the latter has the lower version number. All these added functions are still exported as of version 6.2, but one is discontinued in 6.3. These additions represent by far the largest expansion of the kernel’s exported functionality for any service-pack release in the history of Windows. Indeed, more functions were added for Windows Server 2003 SP1 than for the original Windows Server 2003. An explanation is that this is the first Windows version (known to this study) that has an x64 build. Many of the new functions are exported only from x64 builds.

Barely a quarter of the new functions are documented. For only a few does the documentation state the applicable versions as beginning with Windows Server 2003 SP1 specifically. Unusually, one function that is documented is not declared in any WDK header file. Another half of the functions are not documented but do at least get declared in one or another WDK header file. Declarations, both of these and the documented functions, are mostly for Windows Server 2003 SP1 and higher, but some have no version constraint at all, and one dates the function to Windows XP.

Function Remarks
ExAcquireFastMutex x64 only;
supported for x86 as export from HAL version 3.51 and higher
ExAcquireRundownProtectionCacheAware  
ExAcquireRundownProtectionCacheAwareEx  
ExAllocateCacheAwareRundownProtection  
ExEnterCriticalRegionAndAcquireFastMutexUnsafe  
ExEnterCriticalRegionAndAcquireResourceExclusive  
ExEnterCriticalRegionAndAcquireResourceShared  
ExEnterCriticalRegionAndAcquireSharedWaitForExclusive  
ExFreeCacheAwareRundownProtection  
ExInitializeRundownProtectionCacheAware  
ExQueryDepthSList x64 only;
conditionally defined inline;
supported (and long documented) for x86 by macro definition
ExReInitializeRundownProtectionCacheAware  
ExReleaseFastMutex x64 only;
supported for x86 as export from HAL version 3.51 and higher
ExReleaseFastMutexUnsafeAndLeaveCriticalRegion  
ExReleaseResourceAndLeaveCriticalRegion  
ExReleaseRundownProtectionCacheAware  
ExReleaseRundownProtectionCacheAwareEx  
ExRundownCompletedCacheAware  
ExSizeOfRundownProtectionCacheAware  
ExTryToAcquireFastMutex x64 only;
supported for x86 as export from HAL version 3.51 and higher
ExWaitForRundownProtectionReleaseCacheAware  
ExfReleasePushLockExclusive  
ExfReleasePushLockShared  
ExfTryToWakePushLock  
ExiAcquireFastMutex x86 only
ExiReleaseFastMutex x86 only
ExiTryToAcquireFastMutex x86 only
ExpInterlockedFlushSList x64 only
ExpInterlockedPopEntrySList x64 only
ExpInterlockedPushEntrySList x64 only
InitializeSListHead x64 only;
defined inline for x86;
also exported from KERNEL32 version 5.1 and higher;
documentation is in SDK for KERNEL32, and requires Windows XP and higher
IoIs32bitProcess x64 only;
documented before available, at least as early as 2002
IoTranslateBusAddress  
IoWMIDeviceObjectToProviderId x64 only;
documented before available, at least as early as 2000;
supported for x86 by macro
KdChangeOption  
KdSystemDebugControl  
KeAcquireGuardedMutex documentation requires Windows Server 2003 and higher
KeAcquireGuardedMutexUnsafe documentation requires Windows Server 2003 and higher
KeAcquireInStackQueuedSpinLock x64 only;
also x86 in 6.2 and higher;
supported for x86 as export from HAL version 5.1 and higher
KeAcquireInStackQueuedSpinLockRaiseToSynch x64 only;
also x86 in 6.2 and higher;
supported for x86 as export from HAL version 5.1 and higher
KeAcquireQueuedSpinLock x64 only;
also x86 in 6.2 and higher;
supported for x86 as export from HAL version 5.0 and higher
KeAcquireQueuedSpinLockRaiseToSynch x64 only;
also x86 in 6.2 and higher;
supported for x86 as export from HAL version 5.0 and higher
KeAcquireSpinLockRaiseToDpc x64 only;
declaration requires Windows 2000 and higher
KeAcquireSpinLockRaiseToSynch x64 only;
also x86 in 6.2 and higher;
supported for x86 as export from HAL version 4.0 and higher
KeAreAllApcsDisabled documentation requires Windows Server 2003 and higher
KeEnterGuardedRegion documentation requires Windows Server 2003 and higher
KeExpandKernelStackAndCallout x64-only in 5.2;
undocumented until 2005-2006
KeGetCurrentIrql x64 only;
defined inline to read cr8;
supported for x86 as export from HAL version 3.51 and higher
KeInitializeCrashDumpHeader not declared
KeInitializeGuardedMutex documentation requires Windows Server 2003 and higher
KeIsWaitListEmpty  
KeLastBranchMSR (data) x64 only
KeLeaveGuardedRegion documentation requires Windows Server 2003 and higher
KeLowerIrql x64 only;
defined inline to write cr8;
supported for x86 as export from HAL version 3.51 and higher
KeQueryMultiThreadProcessorSet x64 only
KeQueryPrcbAddress x64 only
KeRaiseIrqlToDpcLevel x64 only;
supported for x86 as export from HAL version 4.0 and higher
KeReleaseGuardedMutex documentation requires Windows Server 2003 and higher
KeReleaseGuardedMutexUnsafe documentation requires Windows Server 2003 and higher
KeReleaseInStackQueuedSpinLock x64 only;
supported for x86 as export from HAL version 5.1 and higher
KeReleaseQueuedSpinLock x64 only;
also x86 in 6.2 and higher;
supported for x86 as export from HAL version 5.0 and higher
KeReleaseSpinLock x64 only;
also x86 in 6.2 and higher;
supported for x86 as export from HAL version 3.51 and higher
KeTryToAcquireGuardedMutex documentation requires Windows Server 2003 and higher
KeTryToAcquireQueuedSpinLock x64 only;
also x86 in 6.2 and higher;
supported for x86 as export from HAL version 5.0 and higher
KeTryToAcquireQueuedSpinLockRaiseToSynch x64 only;
also x86 in 6.2 and higher;
supported for x86 as export from HAL version 5.0 and higher
KeTryToAcquireSpinLockAtDpcLevel documented before available, as early as 2002
KfRaiseIrql x64 only;
redefined as inline function to read and write cr8;
supported for x86 as export from HAL version 3.51 and higher
KiCpuId x64 only;
also x86 in 6.2;
discontinued in 6.3
MmAllocatePagesForMdlEx undocumented until 2005-2006
PsGetCurrentProcessWin32Process  
PsGetCurrentProcessWow64Process x64 only
PsGetCurrentThreadProcess  
PsGetCurrentThreadProcessId  
PsGetCurrentThreadTeb  
PsGetCurrentThreadWin32Thread  
PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion  
PsGetProcessWow64Process x64 only
PsIsSystemProcess  
PsWrapApcWow64Thread  
RtlCopyMemory x64 only;
redefined by macro using memcpy (x86 also)
RtlCopyMemoryNonTemporal x64 only;
redefined by macro as RtlCopyMemory (x86 only)
RtlLookupFunctionEntry x64 only;
also exported as export from contemporaneous KERNEL32 versions;
documentation and declaration are in SDK for KERNEL32
RtlPcToFileHeader x64 only;
x86 also in 10.0 and higher;
also exported as export from contemporaneous KERNEL32 versions;
documentation and declaration are in SDK for KERNEL32
RtlRestoreContext x64 only;
also exported as export from contemporaneous KERNEL32 versions;
documentation and declaration are in SDK for KERNEL32
RtlUnwindEx x64 only;
also exported as export from contemporaneous KERNEL32 versions;
documentation and declaration are in SDK for KERNEL32
RtlVirtualUnwind x64 only;
also exported as export from contemporaneous KERNEL32 versions;
documentation and declaration are in SDK for KERNEL32
SeReportSecurityEvent  
SeSetAuditParameter  
ZwSecureConnectPort  
__C_specific_handler x64 only
__chkstk x64 only
__misaligned_access x64 only
_local_unwind x64 only
_setjmp x64 only
_setjmpex x64 only
longjmp x64 only
memcmp x64 only;
also x86 in 6.2 and higher