Kernel Version 6.0 Exports

The large table on this page lists the 375 exports that were added to the Windows kernel for version 6.0., i.e., for the original Windows Vista. These represent by far the biggest change in the kernel’s exported functionality over the whole history of Windows.

The version 6.0 from Windows Vista SP1 and Windows Server 2008 adds yet more functions. These 35 additions for Windows Vista SP1 and Windows Server 2008 are listed separately. Curiously, twenty functions from the original do not survive.

Documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. Functions that have their own non-trivial documentation are shown with no background colour. If the whole of the documentation is just that the function is reserved or obsolete, without even giving a prototype, then the function is highlighted red or highlighted pink, respectively. An undocumented function that is at least declared in one or another header file from the Windows Driver Kit (WDK) is highlighted orange. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented in the first contemporaneous Device Driver Kit (DDK), WDK or Installable File System (IFS), then it is shaded yellow to retain some of its previous status as undocumented.

Barely a sixth of these new exports for version 6.0 were documented for the contemporaneous WDK, though many more have got documented since. Most are said correctly to be available starting with Windows Vista. No indication is given whether this availability was not generally disclosed until a later WDK. One function is documented only as being reserved. Not quite a half of the new functions, and five exports of data, are undocumented but with declarations in one or another of the WDK header files. Declarations, both of these and the documented functions, are mostly for Windows Vista and higher, but some have no version constraint at all and a few functions are declared for much older versions. The other third of the new functions have neither documentation nor declaration.

Function Remarks
AlpcGetHeaderSize  
AlpcGetMessageAttribute  
AlpcInitializeMessageAttribute  
CcGetFileObjectFromSectionPtrsRef  
CcIsThereDirtyDataEx undocumented until 2008-2009
CcSetFileSizesEx  
CcSetParallelFlushFile  
CcTestControl  
CmCallbackGetKeyObjectID  
CmGetBoundTransaction  
CmGetCallbackVersion  
CmRegisterCallbackEx  
CmSetCallbackObjectContext  
DbgSetDebugPrintCallback  
EmClientQueryRuleState  
EmClientRuleDeregisterNotification  
EmClientRuleEvaluate  
EmClientRuleRegisterNotification  
EmProviderDeregister  
EmProviderDeregisterEntry  
EmProviderRegister  
EmProviderRegisterEntry  
EmpProviderRegister  
EtwActivityIdControl  
EtwEnableTrace  
EtwEventEnabled  
EtwProviderEnabled  
EtwRegister  
EtwUnregister  
EtwWrite  
EtwWriteEndScenario  
EtwWriteStartScenario  
EtwWriteString  
EtwWriteTransfer  
ExAcquireCacheAwarePushLockExclusive  
ExAllocateCacheAwarePushLock  
ExDeleteLookasideListEx  
ExFetchLicenseData  
ExFlushLookasideListEx  
ExFreeCacheAwarePushLock  
ExGetLicenseTamperState  
ExInitializeLookasideListEx  
ExInitializePushLock  
ExReleaseCacheAwarePushLockExclusive  
ExSetLicenseTamperState  
ExUpdateLicenseData discontinued in 6.2;
restored in 10.0 and higher
ExfTryAcquirePushLockShared  
FirstEntrySList  
FsRtlAcknowledgeEcp undocumented until 2007
FsRtlAddBaseMcbEntryEx  
FsRtlAllocateExtraCreateParameter undocumented until 2007
FsRtlAllocateExtraCreateParameterFromLookasideList  
FsRtlAllocateExtraCreateParameterList undocumented until 2007
FsRtlAreVolumeStartupApplicationsComplete undocumented until 2007
FsRtlCancellableWaitForMultipleObjects  
FsRtlCancellableWaitForSingleObject  
FsRtlChangeBackingFileObject  
FsRtlCurrentOplock undocumented until 2008-2009
FsRtlDeleteExtraCreateParameterLookasideList  
FsRtlFindExtraCreateParameter undocumented until 2007
FsRtlFreeExtraCreateParameter undocumented until 2007
FsRtlFreeExtraCreateParameterList undocumented until 2007
FsRtlGetEcpListFromIrp undocumented until 2007
FsRtlGetNextExtraCreateParameter undocumented until 2007
FsRtlIncrementCcFastMdlReadWait  
FsRtlInitExtraCreateParameterLookasideList  
FsRtlInitializeBaseMcbEx  
FsRtlInsertExtraCreateParameter undocumented until 2007
FsRtlInsertPerFileContext  
FsRtlIsEcpAcknowledged undocumented until 2007
FsRtlIsEcpFromUserMode  
FsRtlLogCcFlushError  
FsRtlLookupPerFileContext  
FsRtlMupGetProviderIdFromName undocumented until 2008-2009
FsRtlMupGetProviderInfoFromFileObject undocumented until 2008-2009
FsRtlNotifyCleanupAll  
FsRtlNotifyVolumeEventEx  
FsRtlOplockBreakToNone undocumented until 2008-2009
FsRtlRegisterFltMgrCalls  
FsRtlRegisterMupCalls  
FsRtlRegisterUncProviderEx  
FsRtlRemoveDotsFromPath  
FsRtlRemoveExtraCreateParameter undocumented until 2007
FsRtlRemovePerFileContext  
FsRtlSetEcpListIntoIrp  
FsRtlTeardownPerFileContexts  
FsRtlValidateReparsePointBuffer  
HvlQueryConnection  
IoAllocateMiniCompletionPacket  
IoAllocateSfioStreamIdentifier  
IoApplyPriorityInfoThread  
IoCallDriverStackSafe discontinued in 6.1;
declaration withdrawn in 2006-2007
IoCheckShareAccessEx  
IoClearIrpExtraCreateParameter  
IoConnectInterruptEx documents earlier availability through statically-linked library IOINTEX.LIB for Windows 2000 and higher
IoCreateArcName  
IoCreateFileEx  
IoDisconnectInterruptEx documents earlier availability through statically-linked library IOINTEX.LIB for Windows 2000 and higher
IoFreeMiniCompletionPacket  
IoFreeSfioStreamIdentifier  
IoGetBootDiskInformationLite  
IoGetDevicePropertyData undocumented until 2007
IoGetIoPriorityHint  
IoGetIrpExtraCreateParameter  
IoGetSfioStreamIdentifier  
IoGetTransactionParameterBlock  
IoInitializeWorkItem  
IoIsFileObjectIgnoringSharing  
IoQueueWorkItemEx  
IoRequestDeviceEjectEx  
IoRetrievePriorityInfo  
IoSetDevicePropertyData undocumented until 2007
IoSetIoCompletionEx  
IoSetIoPriorityHint  
IoSetIoPriorityHintIntoFileObject  
IoSetIoPriorityHintIntoThread  
IoSetIrpExtraCreateParameter  
IoSetShareAccessEx  
IoSizeofWorkItem  
IoUninitializeWorkItem  
IoWithinStackLimits undocumented until 2007
KeAlertThread  
KeAllocateCalloutStack  
KeExpandKernelStackAndCalloutEx  
KeFreeCalloutStack  
KeInvalidateRangeAllCaches  
KeQueryActiveProcessorCount not declared unless SINGLE_GROUP_LEGACY_API defined
KeQueryDpcWatchdogInformation undocumented until 2008-2009
KeQueryMaximumProcessorCount undocumented until 2007;
not declared unless SINGLE_GROUP_LEGACY_API defined
KeRevertToUserAffinityThreadEx undocumented until 2007;
not declared unless SINGLE_GROUP_LEGACY_API defined
KeSetActualBasePriorityThread  
KeSetSystemAffinityThreadEx undocumented until 2007;
not declared unless SINGLE_GROUP_LEGACY_API defined
KeStartDynamicProcessor  
LdrFindResourceEx_U  
LdrResFindResource  
LdrResFindResourceDirectory  
LdrResSearchResource  
LpcReplyWaitReplyPort  
LpcRequestWaitReplyPortEx  
LpcSendWaitReceivePort  
MmAllocateContiguousMemorySpecifyCacheNode undocumented until 2007;
declaration requires Windows 2000 and higher
MmBadPointer (data) undocumented until 2007
MmCopyVirtualMemory  
MmIsDriverVerifyingByAddress undocumented until 2007
MmRotatePhysicalView  
MmSetUserExceptionCallout discontinued in 6.1
NtBuildGUID (data)  
NtBuildLab (data)  
NtClearAllSavepointsTransaction discontinued in SP1
NtClearSavepointTransaction discontinued in SP1
NtCommitComplete undocumented until 2008-2009
NtCommitEnlistment undocumented until 2008-2009
NtCommitTransaction undocumented until 2008-2009
NtCreateEnlistment undocumented until 2008-2009
NtCreateResourceManager undocumented until 2008-2009
NtCreateTransaction undocumented until 2008-2009
NtEnumerateTransactionObject undocumented until 2008-2009
NtFreezeTransactions  
NtGetNotificationResourceManager undocumented until 2008-2009
NtMarshallTransaction discontinued in SP1
NtOpenEnlistment undocumented until 2008-2009
NtOpenResourceManager undocumented until 2008-2009
NtOpenTransaction undocumented until 2008-2009
NtPrePrepareEnlistment undocumented until 2008-2009
NtPrepareComplete undocumented until 2008-2009
NtPrepareEnlistment undocumented until 2008-2009
NtPullTransaction discontinued in SP1
NtQueryInformationEnlistment undocumented until 2008-2009
NtQueryInformationResourceManager undocumented until 2008-2009
NtQueryInformationTransaction undocumented until 2008-2009
NtQueryInformationTransactionManager undocumented until 2008-2009
NtRollbackEnlistment undocumented until 2008-2009
NtRollbackTransaction undocumented until 2008-2009
NtSavepointComplete discontinued in SP1
NtSavepointTransaction discontinued in SP1
NtSetInformationEnlistment undocumented until 2008-2009
NtSetInformationResourceManager undocumented until 2008-2009
NtSetInformationTransaction undocumented until 2008-2009
NtStartTm discontinued in SP1
NtThawTransactions  
NtTraceControl  
ObDereferenceObjectDeferDelete undocumented until 2007;
documentation until 2008-2009 requires Windows XP and higher
ObIsDosDeviceLocallyMapped  
ObIsKernelHandle undocumented until 2007
POGOBuffer (data)  
PfFileInfoNotify  
PoDisableSleepStates  
PoGetSystemWake  
PoReenableSleepStates  
PoRegisterPowerSettingCallback  
PoSetFixedWakeSource  
PoSetSystemWake  
PoUnregisterPowerSettingCallback  
PoUserShutdownInitiated  
PsAcquireProcessExitSynchronization  
PsChargeProcessCpuCycles discontinued for x64 in 6.1;
discontinued for x86 in 6.2
PsEnterPriorityRegion  
PsIsCurrentThreadPrefetching  
PsIsProtectedProcess  
PsLeavePriorityRegion  
PsReferenceProcessFilePointer  
PsReleaseProcessExitSynchronization  
PsResumeProcess  
PsSetCurrentThreadPrefetching  
PsSuspendProcess  
PsUILanguageComitted (data)  
RtlCmDecodeMemIoResource  
RtlCmEncodeMemIoResource  
RtlCompareAltitudes  
RtlComputeCrc32  
RtlCopyLuidAndAttributesArray  
RtlCopySidAndAttributesArray  
RtlDuplicateUnicodeString declaration requires Windows XP and higher
RtlFindClosestEncodableLength  
RtlFormatMessage  
RtlGetIntegerAtom  
RtlGetProductInfo  
RtlGetThreadLangIdByIndex  
RtlIdnToAscii  
RtlIdnToNameprepUnicode  
RtlIdnToUnicode  
RtlInvertRangeListEx  
RtlIoDecodeMemIoResource  
RtlIoEncodeMemIoResource  
RtlIsNormalizedString  
RtlIsNtDdiVersionAvailable conditionally redefined by macro as WdmlibRtlIsNtDdiVersionAvailable, typically resolved from statically-linked library RTLVER.LIB;
not declared
RtlIsServicePackVersionInstalled conditionally redefined by macro as WdmlibRtlIsNtDdiVersionAvailable, typically resolved from statically-linked library RTLVER.LIB;
not declared
RtlLocalTimeToSystemTime  
RtlLookupFirstMatchingElementGenericTableAvl perhaps documented as RtlLookupFirstMatchingElementGenericTable instead;
declaration requires Windows XP and higher
RtlNormalizeString  
RtlNumberOfSetBitsUlongPtr  
RtlQueryDynamicTimeZoneInformation  
RtlQueryElevationFlags  
RtlQueryModuleInformation  
RtlRunOnceBeginInitialize  
RtlRunOnceComplete  
RtlRunOnceExecuteOnce  
RtlRunOnceInitialize  
RtlSetDynamicTimeZoneInformation  
RtlSidHashInitialize  
RtlSidHashLookup  
RtlSystemTimeToLocalTime  
RtlValidateUnicodeString declaration requires Windows XP and higher
SeAccessCheckFromState  
SeAuditHardLinkCreationWithTransaction  
SeAuditTransactionStateChange  
SeCaptureSubjectContextEx  
SeCloseObjectAuditAlarmForNonObObject  
SeComputeAutoInheritByObjectType  
SeCreateAccessStateEx  
SeDeleteObjectAuditAlarmWithTransaction  
SeExamineSacl  
SeGetLinkedToken  
SeLocateProcessImageName  
SeOpenObjectAuditAlarmForNonObObject  
SeOpenObjectAuditAlarmWithTransaction  
SeOpenObjectForDeleteAuditAlarmWithTransaction  
SeReportSecurityEventWithSubCategory  
SeSetAuthorizationCallbacks  
TmCancelPropagationRequest  
TmCommitComplete undocumented until 2007
TmCommitEnlistment undocumented until 2007
TmCommitTransaction undocumented until 2007
TmCreateEnlistment undocumented until 2007
TmCurrentTransaction  
TmDefaultTmOpenFileCount discontinued in SP1
TmDereferenceEnlistmentKey undocumented until 2007
TmEnableCallbacks undocumented until 2007
TmEndPropagationRequest  
TmEnlistmentObjectType (data) mentioned since 2007 in documentation of ObReferenceObjectByHandle, etc
TmFreezeTransactions  
TmGetTransactionId undocumented until 2007
TmInitDefaultTemporaryTm discontinued in SP1
TmInitSystem  
TmInitSystemPhase2  
TmInitializeResourceManager discontinued in 6.2
TmInitializeTransaction discontinued in 6.2
TmIsTransactionActive undocumented until 2007
TmMarshallTransaction discontinued in SP1
TmPrePrepareComplete undocumented until 2007
TmPrePrepareEnlistment undocumented until 2007
TmPrepareComplete undocumented until 2007
TmPrepareEnlistment undocumented until 2007
TmPropagationComplete  
TmPropagationFailed  
TmPullTransaction discontinued in SP1
TmReadOnlyEnlistment undocumented until 2007
TmRecoverEnlistment undocumented until 2007
TmRecoverResourceManager undocumented until 2007
TmRecoverTransactionManager undocumented until 2007
TmReferenceEnlistmentKey undocumented until 2007
TmRequestOutcomeEnlistment undocumented until 2007
TmResourceManagerObjectType (data) mentioned since 2007 in documentation of ObReferenceObjectByHandle, etc
TmRmIsNotificationQueueEmpty_Temporary discontinued in SP1
TmRollbackComplete undocumented until 2007
TmRollbackEnlistment undocumented until 2007
TmRollbackTransaction undocumented until 2007
TmSavepointComplete discontinued in SP1
TmSavepointTransaction discontinued in SP1
TmSetCurrentTransaction  
TmSetPreviousModeToKernel discontinued in SP1
TmThawTransactions  
TmTransactionManagerObjectType (data) mentioned since 2007 in documentation of ObReferenceObjectByHandle, etc
TmTransactionObjectType (data) mentioned since 2007 in documentation of ObReferenceObjectByHandle, etc
WheaRegisterErrSrcInitializer discontinued in 6.1
WheaReportHwError  
ZwAllocateLocallyUniqueId  
ZwAlpcAcceptConnectPort  
ZwAlpcCancelMessage  
ZwAlpcConnectPort  
ZwAlpcCreatePort  
ZwAlpcCreatePortSection  
ZwAlpcCreateResourceReserve  
ZwAlpcCreateSectionView  
ZwAlpcCreateSecurityContext  
ZwAlpcDeletePortSection  
ZwAlpcDeleteResourceReserve  
ZwAlpcDeleteSectionView  
ZwAlpcDeleteSecurityContext  
ZwAlpcDisconnectPort  
ZwAlpcQueryInformation  
ZwAlpcSendWaitReceivePort  
ZwAlpcSetInformation  
ZwCommitEnlistment undocumented until 2007
ZwCommitTransaction  
ZwCreateEnlistment  
ZwCreateIoCompletion  
ZwCreateKeyTransacted undocumented until 2008-2009
ZwCreateResourceManager  
ZwCreateTransaction  
ZwCreateTransactionManager  
ZwEnumerateTransactionObject undocumented until 2007
ZwFlushBuffersFile  
ZwGetNotificationResourceManager undocumented until 2007
ZwImpersonateAnonymousToken  
ZwLoadKeyEx  
ZwLockProductActivationKeys  
ZwMarshallTransaction discontinued in SP1
ZwOpenEnlistment  
ZwOpenKeyTransacted undocumented until 2008-2009
ZwOpenResourceManager  
ZwOpenTransaction  
ZwOpenTransactionManager  
ZwPrePrepareEnlistment undocumented until 2007
ZwPrepareComplete undocumented until 2007
ZwPrepareEnlistment undocumented until 2007
ZwPullTransaction discontinued in SP1
ZwQueryInformationEnlistment  
ZwQueryInformationResourceManager  
ZwQueryInformationTransaction  
ZwQueryInformationTransactionManager  
ZwQueryLicenseValue  
ZwQueryVirtualMemory  
ZwRecoverEnlistment undocumented until 2007
ZwRecoverResourceManager  
ZwRecoverTransactionManager  
ZwRemoveIoCompletion  
ZwRemoveIoCompletionEx  
ZwRequestPort  
ZwRollbackEnlistment undocumented until 2007
ZwRollbackTransaction  
ZwSavepointComplete discontinued in SP1
ZwSavepointTransaction discontinued in SP1
ZwSetInformationEnlistment  
ZwSetInformationTransaction  
ZwUnloadKeyEx  
_alloca_probe_16 x86 only
_alloca_probe_8 x86 only
_chkstk x86 only
_strtoui64  
_swprintf  
_vswprintf  
bsearch  
psMUITest (data)  

Additionally, the KeIsExecutingDpc function, exported from x86 builds in version 3.51 and higher, starts being exported from x64 builds in version 6.0. But the two functions ExAllocateFromPagedLookasideList and ExFreeToPagedLookasideList, first exported in version 4.0 and retained for the first x64 builds, are dropped from x64 builds in version 6.0.