Kernel Version 6.2 Exports By Name

The large table on this page lists the functions and variables that are newly exported by name from the Windows kernel in its first release for version 6.2, i.e., for the original Windows 8. Several do not survive to the next version.

Few of the new functions for version 6.2 seem to be documented by Microsoft as far as shows up in a search online today (29th February 2016). The apparently undocumented functions are highlighted yellow below. Many are declared in one or another header file from the Windows Driver Kit—but collating those is left for another day.

Function Remarks
BgkDisplayCharacter  
BgkGetConsoleState  
BgkGetCursorState  
BgkSetCursor  
CcAddDirtyPagesToExternalCache  
CcCopyReadEx  
CcCopyWriteEx  
CcDeductDirtyPagesFromExternalCache  
CcFlushCacheToLsn  
CcIsThereDirtyLoggedPages  
CcRegisterExternalCache  
CcScheduleReadAheadEx  
CcSetAdditionalCacheAttributesEx  
CcSetLogHandleForFileEx  
CcSetLoggedDataThreshold  
CcSetReadAheadGranularityEx  
CcUnmapFileOffsetFromSystemCache  
CcUnregisterExternalCache  
CcZeroDataOnDisk  
CmCallbackGetKeyObjectIDEx  
CmCallbackReleaseKeyObjectIDEx  
ExAcquireFastMutex  
ExBlockOnAddressPushLock  
ExBlockPushLock  
ExCompositionSurfaceObjectType (data) discontinued in 6.3
ExGetFirmwareEnvironmentVariable  
ExNotifyBootDeviceRemoval  
ExQueryFastCacheAppOrigin  
ExQueryFastCacheDevLicense  
ExQueryTimerResolution  
ExQueryWnfStateData  
ExRealTimeIsUniversal  
ExRegisterBootDevice  
ExReleaseFastMutex  
ExSetFirmwareEnvironmentVariable  
ExSubscribeWnfStateChange  
ExTimedWaitForUnblockPushLock  
ExTryQueueWorkItem  
ExTryToAcquireFastMutex  
ExUnsubscribeWnfStateChange  
ExWaitForUnblockPushLock  
FsRtlAcquireEofLock  
FsRtlAcquireHeaderMutex  
FsRtlAreThereWaitingFileLocks  
FsRtlCheckLockForOplockRequest  
FsRtlDismountComplete  
FsRtlGetFilenameInformation  
FsRtlGetIoAtEof  
FsRtlGetSectorSizeInformation  
FsRtlGetSupportedFeatures  
FsRtlInitializeEofLock  
FsRtlIsSystemPagingFile  
FsRtlIssueDeviceIoControl  
FsRtlKernelFsControlFile  
FsRtlMdlReadEx  
FsRtlPrepareMdlWriteEx  
FsRtlPrepareToReuseEcp  
FsRtlQueryCachedVdl  
FsRtlQueryKernelEaFile  
FsRtlReleaseEofLock  
FsRtlReleaseFileNameInformation  
FsRtlReleaseHeaderMutex  
FsRtlSetKernelEaFile  
FsRtlTryToAcquireHeaderMutex  
FsRtlUpdateDiskCounters  
HvlGetLpIndexFromApicId  
HvlPerformEndOfInterrupt x64 only
HvlQueryActiveHypervisorProcessorCount  
HvlQueryActiveProcessors  
HvlQueryHypervisorProcessorNodeNumber  
HvlQueryProcessorTopology  
HvlQueryProcessorTopologyCount  
HvlQueryProcessorTopologyHighestId  
HvlRegisterInterruptCallback  
HvlRegisterWheaErrorNotification  
HvlunregisterInterruptCallback  
HvlUnregisterWheaErrorNotification  
InbvNotifyDisplayOwnershipChange  
IoBoostThreadIo  
IoClearActivityIdThread  
IoClearReservedDependency discontinued in 6.3
IoCompletionObjectType (data)  
IoCopyDeviceObjectHint  
IoCreateStreamFileObjectEx2  
IoCreateSystemThread  
IoDecrementKeepAliveCount  
IoDeleteAllDependencyRelations  
IoGetActivityIdIrp  
IoGetActivityIdThread  
IoGetDeviceInterfacePropertyData  
IoGetInitiatorProcess  
IoGetOplockKeyContextEx  
IoIncrementKeepAliveCount  
IoInitializeMiniCompletionPacket  
IoIsActivityTracingEnabled  
IoIsInitiator32bitProcess  
IoIsValidIrpStatus  
IoPropagateActivityIdToThread  
IoQueueWorkItemToNode  
IoRegisterBootDriverCallback  
IoRegisterIoTracking  
IoReportInterruptActive  
IoReportInterruptInactive  
IoReserveDependency  
IoResolveDependency  
IoSetActivityIdIrp  
IoSetActivityIdThread  
IoSetDeviceInterfacePropertyData  
IoSetMasterIrpStatus  
IoSynchronousCallDriver  
IoTransferActivityId  
IoTryQueueWorkItem  
IoUnregisterBootDriverCallback  
IoUnregisterIoTracking  
IoVolumeDeviceToGuid  
IoVolumeDeviceToGuidPath  
KdLogDbgPrint  
KeAcquireSpinLock x86 only
KeDispatchSecondaryInterrupt  
KeForceEnableNx  
KeGetNextTimerExpirationDueTime discontinued in 6.3
KeHwPolicyLocateResource  
KeInitializeSecondaryInterruptServices  
KeLoadMTRR  
KeQueryEffectivePriorityThread  
KeQueryInterruptTimePrecise  
KeQuerySystemTimePrecise  
KeQueryTotalCycleTimeThread  
KeReleaseInStackQueuedSpinLock  
KeStallWhileFrozen  
KeSweepLocalCaches  
KeUpdateTime discontinued in 6.3
KeUpdateTimeAssist discontinued in 6.3
KeWriteProtectPAT  
KfAcquireSpinLock x86 only
KfReleaseSpinLock x86 only
KiEndThreadAccountingPeriod x86 only
KiEntropyQueueDpc x86 only
KseQueryDeviceData  
KseQueryDeviceDataList  
KseQueryDeviceFlags  
KseRegisterShim  
KseRegisterShimEx  
KseSetDeviceFlags  
KseUnregisterShim  
MmAllocateContiguousNodeMemory  
MmAllocateMdlForIoSpace  
MmAllocateNodePagesForMdlEx  
MmAreMdlPagesCached  
MmGetMaximumFileSectionSize  
MmIsDriverSuspectForVerifier  
MmMapViewInSystemSpaceEx  
MmMapViewInSessionSpaceEx  
MmMdlPageContentsState  
MmPrefetchVirtualAddresses  
NtSetCachedSigningLevel  
NtSetInformationVirtualMemory  
ObDuplicateObject  
ObReferenceObjectSafe  
ObReferenceObjectSafeWithTag  
ObWaitForMultipleObjects  
ObWaitForSingleObject  
PoAllProcessorsDeepIdle discontinued in 6.3
PoFxCompleteDevicePowerNotRequired  
PoFxCompleteIdleCondition  
PoFxCompleteIdleState  
PoFxIdleComponent  
PoFxNotifySurprisePowerOn  
PoFxPowerControl  
PoFxProcessorNotification  
PoFxRegisterCoreDevice  
PoFxRegisterDevice  
PoFxRegisterPlugin  
PoFxRegisterPluginEx  
PoFxRegisterPrimaryDevice  
PoFxReportDevicePoweredOn  
PoFxSetComponentLatency  
PoFxSetComponentResidency  
PoFxSetComponentWake  
PoFxSetDeviceIdleTimeout  
PoFxStartDevicePowerManagement  
PoFxUnregisterDevice  
PoGetProcessorIdleAccounting  
PoInitiateProcessorWake  
PoLatencySensitivityHint  
PoNotifyDisableDynamicTick discontinued in 6.3
PoNotifyVSyncChange  
PoRegisterCoalescingCallback  
PoSetUserPresent  
PoUnregisterCoalescingCallback  
PoUserShutdownCancelled  
PsChargeProcessWakeCounter  
PsCreateSystemThreadEx  
PsDereferenceKernelStack  
PsGetProcessCommonJob  
PsGetProcessSignatureLevel  
PsGetThreadExitStatus  
PsIsDiskCountersEnabled  
PsQueryProcessAttributesByToken  
PsQueryTotalCycleTimeProcess  
PsReferenceKernelStack  
PsReleaseProcessWakeCounter  
PsUpdateDiskCounters  
RtlAddAtomToAtomTableEx  
RtlAddResourceAttributeAce  
RtlCheckPortableOperatingSystem  
RtlCheckTokenCapability  
RtlCheckTokenMembership  
RtlCheckTokenMembershipEx  
RtlCopyBitMap  
RtlCrc32  
RtlCrc64  
RtlCreateAtomTableEx  
RtlCreateHashTableEx  
RtlCreateUserThread  
RtlCultureNameToLCID  
RtlDecompressBufferEx  
RtlDeleteElementGenericTableAvlEx  
RtlEqualWnfChangeStamps  
RtlExtractBitMap  
RtlGenerateClass5Guid  
RtlGetAppContainerNamedObjectPath  
RtlIsUntrustedObject  
RtlLCIDToCultureName  
RtlNumberOfClearBitsInRange  
RtlNumberOfSetBitsInRange  
RtlOpenCurrentUser  
RtlQueryInformationAcl  
RtlQueryPackageIdentity  
RtlQueryRegistryValuesEx  
RtlQueryValidationRunLevel  
RtlRbInsertNodeEx  
RtlRbRemoveNode  
RtlSetControlSecurityDescriptor  
RtlSetPortableOperatingSystem  
SeAccessCheckFromStateEx  
SeAuditingAnyFileEventsWithContextEx  
SeAuditingFileEventsWithContextEx  
SeCreateClientSecurityEx  
SeCreateClientSecurityFromSubjectContextEx  
SeGetLogonSessionToken  
SeQuerySecureBootPolicyValue  
SeSecurityAttributePresent  
SeSystemDefaultSd  
SeTokenFromAccessInformation  
TmInitializeTransactionManager  
TmIsKTMCommitCoordinator  
TmRenameTransactionManager  
TmSinglePhaseReject  
WheaRegisterInUsePageOfflineNotification x64 only
WheaUnregisterInUsePageOfflineNotification x64 only
ZwAlpcConnectPortEx  
ZwCreateWnfStateName  
ZwDeleteWnfStateData  
ZwDeleteWnfStateName  
ZwFlushBuffersFileEx  
ZwQuerySystemEnvironmentValueEx  
ZwQueryWnfStateData  
ZwQueryWnfStateNameInformation  
ZwSetCachedSigningLevel  
ZwSetInformationKey  
ZwSetInformationVirtualMemory  
ZwSetSystemEnvironmentValueEx  
ZwUnlockVirtualMemory  
ZwUpdateWnfStateData  
bsearch_s  

Old Friends

Several more functions that are exported from all earlier versions of x64 builds are now exported from x86 builds too. One, however, is discontinued as an export from both builds in the very next version.

Function Remarks
KeAcquireInStackQueuedSpinLock  
KeAcquireInStackQueuedSpinLockRaiseToSynch  
KeAcquireQueuedSpinLock  
KeAcquireQueuedSpinLockRaiseToSynch  
KeAcquireSpinLockRaiseToSynch  
KeReleaseQueuedSpinLock  
KeReleaseSpinLock  
KeTryToAcquireQueuedSpinLock  
KeTryToAcquireQueuedSpinLockRaiseToSynch  
KiCpuId discontinued in 6.3
memcmp