Geoff Chappell, Software Analyst
The large table on this page lists the 157 functions and variables that are newly exported from the Windows kernel in its first release for version 4.0., i.e., for the original Windows NT 4.0. Almost all are still exported as of version 10.0. Also listed are five exports that were added in service packs: three variables in SP3 and two functions in SP4.
For the table below, documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. (If you read this website with scripts enabled, then hovering the mouse over any coloured text will produce a tooltip that shows why the text is coloured.) Functions that have their own non-trivial documentation are shown with no background colour. If the function is documented as reserved or obsolete, it is shaded red or shaded grey, respectively. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status. Many undocumented functions do at least have C-language declarations in one or another header file from the WDK. These are shaded orange, except for one special case. Some declarations are known only from “minwin” headers that Microsoft published in early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public knowledge even of the declaration is exceptional.
Function | Export History | Documentation History | Declaration History |
---|---|---|---|
CcFastCopyRead | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
CcFastCopyWrite | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
CcFastMdlReadWait (data) | before 5.1 (IFS) to 6.0, undocumented | ||
CcFastReadNotPossible (data) | discontinued in 6.0 | ||
CcFastReadWait (data) | discontinued in 6.0 | ||
CcSetBcbOwnerPointer | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 |
To say that the CcFastMdlReadWait, CcFastReadNotPossible and CcFastReadWait counters are indirectly documented would be a little generous even given the background that exported variables typically aren’t documented directly. Still, they are alluded to in documentation of FsRtlIncrementCcFastMdlReadWait, FsRtlIncrementCcFastReadNotPossible and FsRtlIncrementCcFastReadWait, except that what these functions increment are not variables that are exported from the kernel but the same-named members of the current processor’s KPRCB. Whether any or all were declared in NTIFS.H from an IFS Kit for versions 5.1 or 5.2 before two were discontinued for version 6.0 is not known.
Function | Export History | Documentation History | Declaration History |
---|---|---|---|
DbgBreakPointWithStatus | before 5.0, declared since 5.1, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
ExAllocateFromPagedLookasideList | since 6.0, x86 only | since 6.1 revision, documented start is 5.0 | |
ExAllocatePoolWithTagPriority | starts in SP4 | since 6.1, documented start is 5.0 | since 6.0, declared start is 5.0 |
ExDeleteNPagedLookasideList | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
ExDeletePagedLookasideList | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
ExDesktopObjectType (data) | before 10.0, undocumented indirectly documented |
declared start is 10.0 | |
ExEnumHandleTable | |||
ExFreeToPagedLookasideList | since 6.0, x86 only | since 6.1 revision, documented start is 5.0 | |
ExGetPreviousMode | before 5.0, declared since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
ExInitializeNPagedLookasideList | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
ExInitializePagedLookasideList | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
ExInterlockedCompareExchange64 | x86 only | before 5.0, declared since 6.1 revision, documented start is 5.0 |
|
ExInterlockedPopEntrySList | x86 only | since 6.1 revision, documented start is 5.0 | |
ExInterlockedPushEntrySList | x86 only | since 6.1 revision, documented start is 5.0 | |
ExIsProcessorFeaturePresent | before 5.0, declared since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
ExSetResourceOwnerPointer | before 5.0, declared since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
ExWindowStationObjectType (data) |
Although the ExDesktopObjectType variable is not itself documented, it does get a mention in the WDK for Windows 10, specifically in documentation of the OB_OPERATION_REGISTRATION structure. It is there said, presumably just for the page’s limited purpose, to be “supported in Windows 10 and not in the earlier versions of the operating system.”
Function | Export History | Documentation History | Declaration History |
---|---|---|---|
FsRtlAddToTunnelCache | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
FsRtlDeleteKeyFromTunnelCache | before 5.0 (IFS), undocumented in 6.1, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
FsRtlDeleteTunnelCache | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
FsRtlFindInTunnelCache | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
FsRtlGetFileSize | before 5.0 (IFS), undocumented before 5.1 (IFS) to 6.0, declared |
since 6.0, declared start is 5.0 | |
FsRtlInitializeTunnelCache | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
FsRtlMdlReadComplete | |||
FsRtlMdlReadCompleteDev | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.0 | |
FsRtlMdlReadDev | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.0 | |
FsRtlMdlWriteComplete | |||
FsRtlMdlWriteCompleteDev | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.0 | |
FsRtlPrepareMdlWriteDev | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.0 | |
InterlockedCompareExchange | x86 only | since 6.1 revision, documented start is 5.0 | |
InterlockedExchangeAdd | x86 only | since 6.1 revision, documented start is 5.0 | |
IoAttachDeviceToDeviceStack | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
IoCreateNotificationEvent | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
IoDeviceHandlerObjectSize (data) | |||
IoDeviceHandlerObjectType (data) | |||
IoFastQueryNetworkAttributess | before 5.0 (IFS), undocumented before 5.1 (IFS) to 6.0, declared |
since 6.0, declared start is 5.0 | |
IoGetBaseFileSystemDeviceObject | before 5.0 (IFS), undocumented before 5.1 (IFS) to 6.0, declared |
since 6.0, declared start is 5.0 | |
IoGetStackLimits | before 5.0, declared since 6.1 revision, documented start is 5.0 |
||
IoOpenDeviceInstanceKey | discontinued in 5.0 | ||
IoQueryDeviceEnumInfo | discontinued in 5.0 | ||
IoQueueThreadIrp | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.0 | |
IoSetThreadHardErrorMode | before 5.0, declared since 6.1, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
KeBoostCurrentThread | discontinued in 5.0 | ||
KeI386Call16BitCStyleFunction | x86 only; discontinued in 6.2 |
||
KeInitializeTimerEx | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
KeRaiseUserException | |||
KeRestoreFloatingPointState | before 5.0, undocumented since 6.1 revision, documented start is 5.0 |
||
KeRundownQueue | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
KeSaveFloatingPointState | before 5.0, undocumented since 6.1 revision, documented start is 5.0 |
||
KeSetAffinityThread | |||
KeSetIdealProcessorThread | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.0 | |
KeSetKernelStackSwapEnable | before 5.1 (IFS) to 6.0, undocumented
before 6.1 revision, reserved since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
KeSetProfileIrql | |||
KeSetSwapContextNotifyRoutine | discontinued in 5.1 | ||
KeSetThreadSelectNotifyRoutine | discontinued in 5.1 | ||
KeSetTimeUpdateNotifyRoutine | discontinued in 5.2 | before 5.1, declared | |
KeSetTimerEx | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
KiBugCheckData (data) | |||
LdrFindResourceDirectory_U | |||
MmGrowKernelStack | |||
MmHighestUserAddress (data) | starts in SP3 | ||
MmMapLockedPagesSpecifyCache | starts in SP4 | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 |
MmMapVideoDisplay | before 5.1, declared | since 6.0, declared start is 5.0 | |
MmSystemRangeStart (data) | starts in SP3 | ||
MmUnmapVideoDisplay | before 5.1, declared | since 6.0, declared start is 5.0 | |
MmUserProbeAddress (data) | starts in SP3 |
The MmHighestUserAddress and MmUserProbeAddress variables allow for what was, in Windows NT 4.0 SP3, the new feature of dynamically reconfiguring how much of the virtual address space is accessible from user mode. The ancient MM_HIGHEST_USER_ADDRESS and MM_USER_PROBE_ADDRESS macros had evaluated to constants but could now—well, in the next DDK—be variable.
Function | Export History | Documentation History | Declaration History |
---|---|---|---|
NlsAnsiCodePage (data) | |||
NtAddAtom | |||
NtDeleteAtom | |||
NtFindAtom | |||
NtQueryInformationAtom | |||
NtQueryOleDirectoryFile | discontinued in 5.0 | ||
ObAssignSecurity | |||
ObCheckCreateObjectAccess | |||
ObCheckObjectAccess | |||
ObFindHandleForObject | |||
ObGetObjectSecurity | before 5.0, declared since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
ObOpenObjectByName | |||
ObQueryObjectAuditingByHandle | before 5.0 (IFS), undocumented before 5.1 (IFS) to 6.0, declared |
since 6.0, declared start is 5.0 | |
ObReferenceObjectByName | |||
ObReleaseObjectSecurity | before 5.0, declared since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
ObSetSecurityDescriptorInfo | |||
ObfReferenceObject | before 5.0, declared before 2015-2018, indirectly documented since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 |
Who’s to know why, but although the DDK for Windows XP does not much change the documentation of ObGetObjectSecurity and ObReleaseObjectSecurity, it warns that “This is preliminary documentation and subject to change.”
As just an implementation detail for the ObReferenceObject macro, the ObfReferenceObject function is indirectly documented since version 5.0. But Microsoft nowadays gives the function its own page. When exactly this started is not known. It is not in the Windows 10 WDK documentation as integrated into Visual Studio 2015, but it is at Microsoft’s website today, 17th September 2020. As with almost all of Microsoft’s online WDK documentation since its reorganisation around which functions are declared in which headers, it is dated 30th April 2018.
Function | Export History | Documentation History | Declaration History |
---|---|---|---|
PoSetDeviceIdleDetection | discontinued in 5.0 | ||
PsAssignImpersonationToken | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.0 | |
PsCreateWin32Process | discontinued in 5.0 | ||
PsGetCurrentProcessId | before 5.0, declared since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
PsGetCurrentThreadId | before 5.0, declared since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
PsGetVersion | before 5.0, declared before 5.1, documented |
since 6.0, declared start is 5.0 | |
PsImpersonateClient | before 5.1 (IFS), undocumented documented start is 5.1 |
since 6.0, declared start is 5.0 | |
PsRevertToSelf | before 5.1 (IFS), undocumented before 6.1, declared documented start is 5.1 |
since 6.0, declared start is 5.0 | |
PsSetCreateThreadNotifyRoutine | before 5.0, declared since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
PsSetLegoNotifyRoutine | |||
RtlAddAtomToAtomTable | |||
RtlAnsiCharToUnicodeChar | before 6.1, undocumented documented start is 5.0 documented but not declared |
||
RtlAreAnyAccessesGranted | |||
RtlCompressChunks | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.1 | |
RtlCreateAtomTable | |||
RtlDecompressChunks | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.1 | |
RtlDeleteAtomFromAtomTable | |||
RtlDeleteNoSplay | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
RtlDescribeChunk | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.1 | |
RtlDestroyAtomTable | |||
RtlEmptyAtomTable | |||
RtlGetDefaultCodePage | |||
RtlLookupAtomInAtomTable | |||
RtlMultiByteToUnicodeSize | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
RtlPinAtomInAtomTable | |||
RtlQueryAtomInAtomTable | |||
RtlRaiseException | |||
RtlReserveChunk | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.1 | |
SeAuditingFileOrGlobalEvents | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
SeDeleteObjectAuditAlarm | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
SeOpenObjectForDeleteAuditAlarm | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
SeSetAccessStateGenericMapping | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
SeTokenImpersonationLevel | |||
ZwLoadKey | |||
ZwQueryDefaultLocale | |||
ZwQueryObject | before 6.1, undocumented documented start is 5.0 |
declared start is 5.0 | |
ZwQuerySystemInformation | |||
ZwReplaceKey | |||
ZwSaveKey | before 6.2, undocumented | declared start is 6.1 | |
ZwSetInformationObject | |||
ZwSetSystemTime | |||
ZwTerminateProcess | before 6.0, undocumented since 6.1 revision, documented start is 5.0 |
||
ZwUnloadDriver | before 5.1 (IFS), undocumented documented start is 5.1 |
since 6.0, declared start is 5.0 | |
ZwUnloadKey | |||
ZwYieldExecution |
Function | Export History |
---|---|
_alldiv | x86 only |
_allmul | x86 only |
_allrem | x86 only |
_allshl | x86 only |
_allshr | x86 only |
_aulldiv | x86 only |
_aullrem | x86 only |
_aullshr | x86 only |
_strnset | |
_strrev | |
_strset | |
_wcslwr | |
_wcsnset | |
_wcsrev | |
_wcsupr | |
mbtowc | |
strcat | |
strcmp | |
strcpy | |
strlen | |
strncat | |
strspn | |
towlower | |
towupper | |
wcsncat | |
wcsspn | |
wcstombs | |
wctomb |
Version 4.0 stops exporting a few functions. For each, the version in parentheses tells when the function was first exported:
None had yet been documented. For who knows what reason, three of these functions cease as exports from version 4.0 but then are restored for version 5.0. The function for Power Management seems to have been a first thought that was replaced by a second thought for version 4.0 but then was revived for the large redevelopment of the functionality in version 5.0.