Kernel Version 6.3 Exports By Name

This page lists the functions and variables that are newly exported by name from the Windows kernel in its first release for version 6.3, i.e., for the original Windows 8.1.

Few of the new functions for version 6.3 seem to be documented by Microsoft as far as shows up in a search online today (29th February 2016). Several of those do not appear in the documentation that Microsoft offered when saying “The Windows Driver Kit (WDK) is integrated with Microsoft Visual Studio” whether in 2014 for Windows 8.1 or even in 2015 for Windows 10.

Documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. Functions that have their own non-trivial documentation are shown with no background colour. If the function is documented as reserved or obsolete, with or without a prototype, it is shaded red or shaded grey, respectively. An undocumented function that is at least declared in one or another header file from the Windows Driver Kit (WDK) is shaded orange. If the only declaration that Microsoft is known to have disclosed publicly is from the “minwin” directory of the Enterprise WDK for Windows 10 version 1511, specifically, then the function is highlighted orange. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented in the first contemporaneous Device Driver Kit (DDK), WDK or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status as undocumented.

Name Remarks
DbgkWerCaptureLiveKernelDump  
ExAcquireCacheAwarePushLockExclusiveEx  
ExAcquireCacheAwarePushLockSharedEx  
ExAcquirePushLockExclusiveEx  
ExAcquirePushLockSharedEx  
ExAllocateTimer undocumented until 2015-2016 (see note below)
ExCancelTimer undocumented until 2015-2016 (see note below)
ExCompositionObjectType (data)  
ExDeleteTimer undocumented until 2015-2016 (see note below)
ExReleaseCacheAwarePushLockExclusiveEx  
ExReleaseCacheAwarePushLockSharedEx  
ExReleasePushLockEx  
ExReleasePushLockExclusiveEx  
ExReleasePushLockSharedEx  
ExSetTimer undocumented until 2015-2016 (see note below)
ExTryAcquirePushLockExclusiveEx  
ExTryAcquirePushLockSharedEx  
ExTryConvertPushLockSharedToExclusiveEx  
ExTryToAcquireResourceExclusiveLite  
ExUnblockOnAddressPushLockEx  
ExUnblockPushLockEx  
FsRtlCheckUpperOplock  
FsRtlHeatInit  
FsRtlHeatLogIo  
FsRtlHeatLogTierMove  
FsRtlHeatUninit  
FsRtlInsertReservedPerFileContext  
FsRtlInsertReservedPerStreamContext  
FsRtlLookupReservedPerFileContext  
FsRtlLookupReservedPerStreamContext  
FsRtlRemoveReservedPerFileContext  
FsRtlRemoveReservedPerStreamContext  
FsRtlSendModernAppTermination  
FsRtlUpperOplockFsctrl  
HvlQueryNumaDistance  
InterlockedPushListSList undocumented until 2014-2015;
documentation (but as KERNEL32 export) requires Windows Vista as minimum;
declaration requires Windows XP and higher
IoConvertFileHandleToKernelHandle  
IoGetGenericIrpExtension  
IoLoadCrashDumpDriver x64 only
IoPropagateIrpExtension  
IoQueryFullDriverPath undocumented until 2015-2016
IoSetGenericIrpExtension  
IoSizeofGenericIrpExtension  
IoTestDependency  
KdAcquireDebuggerLock  
KdDeregisterPowerHandler  
KdRegisterPowerHandler  
KdReleaseDebuggerLock  
KeClockInterruptNotify  
KeClockTimerPowerChange  
KeFindFirstSetRightAffinityEx  
KeGetClockOwner  
KeGetClockTimerResolution  
KeGetNextClockTickDuration  
KeRemoveQueueDpcEx  
KitLogFeatureUsage  
MmCopyMemory undocumented until 2015-2016
MmGetCacheAttribute  
MmMdlPagesAreZero  
PoFxPowerOnCrashdumpDevice undocumented until 2014-2015
PoFxRegisterCrashdumpDevice undocumented until 2014-2015
PsGetProcessProtection  
PsIsProtectedProcessLight  
RtlAvlInsertNodeEx  
RtlAvlRemoveNode  
RtlGetAppContainerParent  
RtlGetAppContainerSidType  
RtlImageNtHeaderEx  
RtlInterlockedClearBitRun  
RtlInterlockedSetBitRun  
RtlInterlockedSetClearRun  
SeAdjustAccessStateForTrustLabel  
SeGetCachedSigningLevel  
SeIsParentOfChildAppContainer  
SeRegisterImageVerificationCallback  
SeShouldCheckForAccessRightsFromParent  
SeUnregisterImageVerificationCallback  
VfInsertContext  
VfQueryDeviceContext  
VfQueryDispatchTable  
VfQueryDriverContext  
VfQueryIrpContext  
VfQueryThreadContext  
VfRemoveContext  
ZwAssociateWaitCompletionPacket  
ZwCancelIoFileEx  
ZwCreateWaitCompletionPacket  
ZwLockVirtualMemory  
ZwProtectVirtualMemory  
ZwQuerySystemInformationEx  

Four functions that work with timer objects are described above as having been initially undocumented. The WDK documentation for Windows 8.1 and again for Windows 10 that Microsoft presents as “integrated” with successive editions of Visual Studio has a page titled ExXxxTimer Routines and EX_TIMER Objects that lists the functions, and even describes them, but the links to what might have been the documentation of the functions themselves are broken. Whether, or for how long, the supposedly same documentation online had this deficiency is not known, just that the page was seen to be available online in 2016.

Version 6.3 discontinues notably many exports, none of which are known ever to have been documented or declared: