Kernel Version 6.2 Exports By Name

The large table on this page lists the functions and variables that are newly exported by name from the Windows kernel in its first release for version 6.2, i.e., for the original Windows 8. Several do not survive to the next version. Few were documented immediately (or even by the time of an online search for them all on 29th February 2016).

Documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. Functions that have their own non-trivial documentation are shown with no background colour. If the function is documented as reserved or obsolete, with or without a prototype, it is shaded red or shaded grey, respectively. An undocumented function that is at least declared in one or another header file from the Windows Driver Kit (WDK) is shaded orange. If the only declaration that Microsoft is known to have disclosed publicly is from the “minwin” directory of the Enterprise WDK for Windows 10 version 1511, specifically, then the function is highlighted orange. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented in the first contemporaneous Device Driver Kit (DDK), WDK or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status as undocumented.

Function Remarks
BgkDisplayCharacter  
BgkGetConsoleState  
BgkGetCursorState  
BgkSetCursor  
CcAddDirtyPagesToExternalCache  
CcCopyReadEx  
CcCopyWriteEx  
CcDeductDirtyPagesFromExternalCache  
CcFlushCacheToLsn  
CcIsThereDirtyLoggedPages not declared
CcRegisterExternalCache  
CcScheduleReadAheadEx  
CcSetAdditionalCacheAttributesEx  
CcSetLogHandleForFileEx not declared
CcSetLoggedDataThreshold not declared
CcSetReadAheadGranularityEx not declared
CcUnmapFileOffsetFromSystemCache not declared
CcUnregisterExternalCache  
CcZeroDataOnDisk  
CmCallbackGetKeyObjectIDEx  
CmCallbackReleaseKeyObjectIDEx  
ExBlockOnAddressPushLock  
ExBlockPushLock  
ExCompositionSurfaceObjectType (data) discontinued in 6.3
ExGetFirmwareEnvironmentVariable  
ExNotifyBootDeviceRemoval  
ExQueryFastCacheAppOrigin discontinued in 1511
ExQueryFastCacheDevLicense  
ExQueryTimerResolution undocumented until 2015-2016 (see note below)
ExQueryWnfStateData  
ExRealTimeIsUniversal  
ExRegisterBootDevice  
ExSetFirmwareEnvironmentVariable  
ExSubscribeWnfStateChange  
ExTimedWaitForUnblockPushLock  
ExTryQueueWorkItem  
ExUnsubscribeWnfStateChange  
ExWaitForUnblockPushLock  
FsRtlAcquireEofLock  
FsRtlAcquireHeaderMutex  
FsRtlAreThereWaitingFileLocks documented without version requirement
FsRtlCheckLockForOplockRequest  
FsRtlDismountComplete  
FsRtlGetFilenameInformation  
FsRtlGetIoAtEof  
FsRtlGetSectorSizeInformation  
FsRtlGetSupportedFeatures  
FsRtlInitializeEofLock  
FsRtlIsSystemPagingFile  
FsRtlIssueDeviceIoControl  
FsRtlKernelFsControlFile  
FsRtlMdlReadEx  
FsRtlPrepareMdlWriteEx documented without version requirement
FsRtlPrepareToReuseEcp  
FsRtlQueryCachedVdl  
FsRtlQueryKernelEaFile  
FsRtlReleaseEofLock  
FsRtlReleaseFileNameInformation  
FsRtlReleaseHeaderMutex  
FsRtlSetKernelEaFile  
FsRtlTryToAcquireHeaderMutex  
FsRtlUpdateDiskCounters  
HvlGetLpIndexFromApicId  
HvlPerformEndOfInterrupt x64 only
HvlQueryActiveHypervisorProcessorCount  
HvlQueryActiveProcessors  
HvlQueryHypervisorProcessorNodeNumber  
HvlQueryProcessorTopology  
HvlQueryProcessorTopologyCount  
HvlQueryProcessorTopologyHighestId  
HvlRegisterInterruptCallback  
HvlRegisterWheaErrorNotification  
HvlUnregisterInterruptCallback  
HvlUnregisterWheaErrorNotification  
InbvNotifyDisplayOwnershipChange  
IoBoostThreadIo  
IoClearActivityIdThread  
IoClearReservedDependency discontinued in 6.3
IoCompletionObjectType (data)  
IoCopyDeviceObjectHint  
IoCreateStreamFileObjectEx2  
IoCreateSystemThread  
IoDecrementKeepAliveCount not declared until WDK for Windows 8.1
IoDeleteAllDependencyRelations  
IoGetActivityIdIrp  
IoGetActivityIdThread  
IoGetDeviceInterfacePropertyData  
IoGetInitiatorProcess documented without version requirement
IoGetOplockKeyContextEx  
IoIncrementKeepAliveCount not declared until WDK for Windows 8.1
IoInitializeMiniCompletionPacket  
IoIsActivityTracingEnabled  
IoIsInitiator32bitProcess  
IoIsValidIrpStatus  
IoPropagateActivityIdToThread  
IoQueueWorkItemToNode  
IoRegisterBootDriverCallback  
IoRegisterIoTracking  
IoReportInterruptActive  
IoReportInterruptInactive  
IoReserveDependency  
IoResolveDependency  
IoSetActivityIdIrp  
IoSetActivityIdThread  
IoSetDeviceInterfacePropertyData  
IoSetMasterIrpStatus  
IoSynchronousCallDriver  
IoTransferActivityId  
IoTryQueueWorkItem undocumented until 2014-2015
IoUnregisterBootDriverCallback  
IoUnregisterIoTracking  
IoVolumeDeviceToGuid  
IoVolumeDeviceToGuidPath  
KdLogDbgPrint  
KeAcquireSpinLock x86 only;
exported from HAL (x86) in 3.10 and higher
KeDispatchSecondaryInterrupt  
KeForceEnableNx  
KeGetNextTimerExpirationDueTime discontinued in 6.3
KeHwPolicyLocateResource  
KeInitializeSecondaryInterruptServices  
KeLoadMTRR  
KeQueryEffectivePriorityThread  
KeQueryInterruptTimePrecise undocumented until 2014-2015;
documented as “Available starting with Windows 8.1”
KeQuerySystemTimePrecise  
KeQueryTotalCycleTimeThread declared for Windows 7 and higher
KeStallWhileFrozen  
KeSweepLocalCaches  
KeUpdateTime discontinued in 6.3
KeUpdateTimeAssist discontinued in 6.3
KeWriteProtectPAT  
KfAcquireSpinLock x86 only;
exported from HAL (x86) in 3.50 and higher
KfReleaseSpinLock x86 only;
exported from HAL (x86) in 3.50 and higher
KiEndThreadAccountingPeriod x86 only
KiEntropyQueueDpc x86 only
KseQueryDeviceData  
KseQueryDeviceDataList  
KseQueryDeviceFlags  
KseRegisterShim  
KseRegisterShimEx  
KseSetDeviceFlags  
KseUnregisterShim  
MmAllocateContiguousNodeMemory  
MmAllocateMdlForIoSpace  
MmAllocateNodePagesForMdlEx undocumented until 2012-2014
MmAreMdlPagesCached  
MmGetMaximumFileSectionSize documentd without version requirement
MmIsDriverSuspectForVerifier  
MmMapViewInSystemSpaceEx  
MmMapViewInSessionSpaceEx  
MmMdlPageContentsState  
MmPrefetchVirtualAddresses  
NtSetCachedSigningLevel  
NtSetInformationVirtualMemory  
ObDuplicateObject  
ObReferenceObjectSafe  
ObReferenceObjectSafeWithTag  
ObWaitForMultipleObjects  
ObWaitForSingleObject  
PoAllProcessorsDeepIdle discontinued in 6.3
PoFxCompleteDevicePowerNotRequired  
PoFxCompleteIdleCondition  
PoFxCompleteIdleState  
PoFxIdleComponent  
PoFxNotifySurprisePowerOn  
PoFxPowerControl  
PoFxProcessorNotification  
PoFxRegisterCoreDevice undocumented until 2014-2015;
documented as “Available starting with Windows 10”
PoFxRegisterDevice  
PoFxRegisterPlugin undocumented until 2014-2015;
documented as “Available starting with Windows 10”
PoFxRegisterPluginEx undocumented until 2014-2015;
documented as “Available starting with Windows 10”
PoFxRegisterPrimaryDevice  
PoFxReportDevicePoweredOn  
PoFxSetComponentLatency  
PoFxSetComponentResidency  
PoFxSetComponentWake  
PoFxSetDeviceIdleTimeout  
PoFxStartDevicePowerManagement  
PoFxUnregisterDevice  
PoGetProcessorIdleAccounting  
PoInitiateProcessorWake  
PoLatencySensitivityHint  
PoNotifyDisableDynamicTick discontinued in 6.3
PoNotifyVSyncChange  
PoRegisterCoalescingCallback  
PoSetUserPresent  
PoUnregisterCoalescingCallback  
PoUserShutdownCancelled  
PsChargeProcessWakeCounter  
PsCreateSystemThreadEx  
PsDereferenceKernelStack  
PsGetProcessCommonJob  
PsGetProcessSignatureLevel  
PsGetThreadExitStatus  
PsIsDiskCountersEnabled  
PsQueryProcessAttributesByToken  
PsQueryTotalCycleTimeProcess  
PsReferenceKernelStack  
PsReleaseProcessWakeCounter  
PsUpdateDiskCounters  
RtlAddAtomToAtomTableEx  
RtlAddResourceAttributeAce  
RtlCheckPortableOperatingSystem  
RtlCheckTokenCapability  
RtlCheckTokenMembership  
RtlCheckTokenMembershipEx  
RtlCopyBitMap  
RtlCrc32  
RtlCrc64  
RtlCreateAtomTableEx  
RtlCreateHashTableEx  
RtlCreateUserThread  
RtlCultureNameToLCID  
RtlDecompressBufferEx  
RtlDeleteElementGenericTableAvlEx  
RtlEqualWnfChangeStamps  
RtlExtractBitMap  
RtlGenerateClass5Guid  
RtlGetAppContainerNamedObjectPath  
RtlIsUntrustedObject  
RtlLCIDToCultureName  
RtlNumberOfClearBitsInRange  
RtlNumberOfSetBitsInRange  
RtlOpenCurrentUser  
RtlQueryInformationAcl  
RtlQueryPackageIdentity  
RtlQueryRegistryValuesEx  
RtlQueryValidationRunLevel  
RtlRbInsertNodeEx  
RtlRbRemoveNode  
RtlSetControlSecurityDescriptor  
RtlSetPortableOperatingSystem  
SeAccessCheckFromStateEx  
SeAuditingAnyFileEventsWithContextEx  
SeAuditingFileEventsWithContextEx  
SeCreateClientSecurityEx  
SeCreateClientSecurityFromSubjectContextEx  
SeGetLogonSessionToken  
SeQuerySecureBootPolicyValue  
SeSecurityAttributePresent  
SeSystemDefaultSd (data)  
SeTokenFromAccessInformation  
TmInitializeTransactionManager documented as “Available in Windows Vista and later”
TmIsKTMCommitCoordinator  
TmRenameTransactionManager documented as “Available starting with Windows Vista”
TmSinglePhaseReject documented as “Available in Windows Vista and later”
WheaRegisterInUsePageOfflineNotification x64 only
WheaUnregisterInUsePageOfflineNotification x64 only
ZwAlpcConnectPortEx  
ZwCreateWnfStateName  
ZwDeleteWnfStateData  
ZwDeleteWnfStateName  
ZwFlushBuffersFileEx  
ZwQuerySystemEnvironmentValueEx  
ZwQueryWnfStateData  
ZwQueryWnfStateNameInformation  
ZwSetCachedSigningLevel  
ZwSetInformationKey declared for Windows 7 and higher
ZwSetInformationVirtualMemory documented as “Available starting with Windows 10, version 1511”
ZwSetSystemEnvironmentValueEx  
ZwUnlockVirtualMemory  
ZwUpdateWnfStateData  
bsearch_s  

The ExQueryTimerResolution function is described above as being initially undocumented. The WDK documentation for Windows 8, Windows 8.1 and again for Windows 10 that Microsoft presents as “integrated” with successive editions of Visual Studio has a page titled High-Resolution Timers that lists the function, and states explicitly that a driver may call the function, but the link to what might have been the documentation of the function itself is broken. Whether, or for how long, the supposedly same documentation online had this deficiency is not known, just that the page was seen to be available online in 2016.

Old Friends

Several more functions that are exported from all earlier versions of x64 builds are now exported from x86 builds too. One, however, is discontinued as an export from both builds in the very next version.

Function Remarks
ExAcquireFastMutex exported from HAL (x86) in 3.50 and higher
ExReleaseFastMutex exported from HAL (x86) in 3.50 and higher
ExTryToAcquireFastMutex exported from HAL (x86) in 3.50 and higher
KeAcquireInStackQueuedSpinLock exported from HAL (x86) in 5.1 and higher
KeAcquireInStackQueuedSpinLockRaiseToSynch  
KeAcquireQueuedSpinLock  
KeAcquireQueuedSpinLockRaiseToSynch  
KeAcquireSpinLockRaiseToSynch  
KeReleaseInStackQueuedSpinLock exported from HAL (x86) in 5.1 and higher
KeReleaseQueuedSpinLock  
KeReleaseSpinLock  
KeTryToAcquireQueuedSpinLock  
KeTryToAcquireQueuedSpinLockRaiseToSynch  
KiCpuId discontinued in 6.3
memcmp