Kernel Exports Added for Version 4.0

The large table on this page lists the 157 functions and variables that are newly exported from the Windows kernel in its first release for version 4.0., i.e., for the original Windows NT 4.0. Almost all are still exported as of version 10.0. Also listed are five exports that were added in service packs: three variables in SP3 and two functions in SP4.

For the table below, documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. (If you read this website with scripts enabled, then hovering the mouse over any coloured text will produce a tooltip that shows why the text is coloured.) Functions that have their own non-trivial documentation are shown with no background colour. If the function is documented as reserved or obsolete, it is shaded red or shaded grey, respectively. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status. Many undocumented functions do at least have C-language declarations in one or another header file from the WDK. These are shaded orange, except for one special case. Some declarations are known only from “minwin” headers that Microsoft published in early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public knowledge even of the declaration is exceptional.

Function Export History Documentation History Declaration History
CcFastCopyRead   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcFastCopyWrite   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcFastMdlReadWait (data)   before 5.1 (IFS) to 6.0, undocumented  
CcFastReadNotPossible (data) discontinued in 6.0    
CcFastReadWait (data) discontinued in 6.0    
CcSetBcbOwnerPointer   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0

To say that the CcFastMdlReadWait, CcFastReadNotPossible and CcFastReadWait counters are indirectly documented would be a little generous even given the background that exported variables typically aren’t documented directly. Still, they are alluded to in documentation of FsRtlIncrementCcFastMdlReadWait, FsRtlIncrementCcFastReadNotPossible and FsRtlIncrementCcFastReadWait, except that what these functions increment are not variables that are exported from the kernel but the same-named members of the current processor’s KPRCB. Whether any or all were declared in NTIFS.H from an IFS Kit for versions 5.1 or 5.2 before two were discontinued for version 6.0 is not known.

Function Export History Documentation History Declaration History
DbgBreakPointWithStatus   before 5.0, declared
since 5.1, documented start is 5.0
since 6.0, declared start is 5.0
ExAllocateFromPagedLookasideList since 6.0, x86 only since 6.1 revision, documented start is 5.0  
ExAllocatePoolWithTagPriority starts in SP4 since 6.1, documented start is 5.0 since 6.0, declared start is 5.0
ExDeleteNPagedLookasideList   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExDeletePagedLookasideList   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExDesktopObjectType (data)   before 10.0, undocumented
indirectly documented
declared start is 10.0
ExEnumHandleTable      
ExFreeToPagedLookasideList since 6.0, x86 only since 6.1 revision, documented start is 5.0  
ExGetPreviousMode   before 5.0, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ExInitializeNPagedLookasideList   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExInitializePagedLookasideList   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExInterlockedCompareExchange64 x86 only before 5.0, declared
since 6.1 revision, documented start is 5.0
 
ExInterlockedPopEntrySList x86 only since 6.1 revision, documented start is 5.0  
ExInterlockedPushEntrySList x86 only since 6.1 revision, documented start is 5.0  
ExIsProcessorFeaturePresent   before 5.0, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ExSetResourceOwnerPointer   before 5.0, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ExWindowStationObjectType (data)      

Although the ExDesktopObjectType variable is not itself documented, it does get a mention in the WDK for Windows 10, specifically in documentation of the OB_OPERATION_REGISTRATION structure. It is there said, presumably just for the page’s limited purpose, to be “supported in Windows 10 and not in the earlier versions of the operating system.”

Function Export History Documentation History Declaration History
FsRtlAddToTunnelCache   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlDeleteKeyFromTunnelCache   before 5.0 (IFS), undocumented
in 6.1, documented start is 5.0
since 6.0, declared start is 5.0
FsRtlDeleteTunnelCache   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlFindInTunnelCache   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlGetFileSize   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
FsRtlInitializeTunnelCache   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlMdlReadComplete      
FsRtlMdlReadCompleteDev   before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.0
FsRtlMdlReadDev   before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.0
FsRtlMdlWriteComplete      
FsRtlMdlWriteCompleteDev   before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.0
FsRtlPrepareMdlWriteDev   before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.0
InterlockedCompareExchange x86 only since 6.1 revision, documented start is 5.0  
InterlockedExchangeAdd x86 only since 6.1 revision, documented start is 5.0  
IoAttachDeviceToDeviceStack   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoCreateNotificationEvent   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoDeviceHandlerObjectSize (data)      
IoDeviceHandlerObjectType (data)      
IoFastQueryNetworkAttributess   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
IoGetBaseFileSystemDeviceObject   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
IoGetStackLimits   before 5.0, declared
since 6.1 revision, documented start is 5.0
 
IoOpenDeviceInstanceKey discontinued in 5.0    
IoQueryDeviceEnumInfo discontinued in 5.0    
IoQueueThreadIrp   before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.0
IoSetThreadHardErrorMode   before 5.0, declared
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
KeBoostCurrentThread discontinued in 5.0    
KeI386Call16BitCStyleFunction x86 only;
discontinued in 6.2
   
KeInitializeTimerEx   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeRaiseUserException      
KeRestoreFloatingPointState   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
 
KeRundownQueue   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
KeSaveFloatingPointState   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
 
KeSetAffinityThread      
KeSetIdealProcessorThread   before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.0
KeSetKernelStackSwapEnable   before 5.1 (IFS) to 6.0, undocumented
before 6.1 revision, reserved
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
KeSetProfileIrql      
KeSetSwapContextNotifyRoutine discontinued in 5.1    
KeSetThreadSelectNotifyRoutine discontinued in 5.1    
KeSetTimeUpdateNotifyRoutine discontinued in 5.2 before 5.1, declared  
KeSetTimerEx   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KiBugCheckData (data)      
LdrFindResourceDirectory_U      
MmGrowKernelStack      
MmHighestUserAddress (data) starts in SP3    
MmMapLockedPagesSpecifyCache starts in SP4 since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
MmMapVideoDisplay   before 5.1, declared since 6.0, declared start is 5.0
MmSystemRangeStart (data) starts in SP3    
MmUnmapVideoDisplay   before 5.1, declared since 6.0, declared start is 5.0
MmUserProbeAddress (data) starts in SP3    

The MmHighestUserAddress and MmUserProbeAddress variables allow for what was, in Windows NT 4.0 SP3, the new feature of dynamically reconfiguring how much of the virtual address space is accessible from user mode. The ancient MM_HIGHEST_USER_ADDRESS and MM_USER_PROBE_ADDRESS macros had evaluated to constants but could now—well, in the next DDK—be variable.

Function Export History Documentation History Declaration History
NlsAnsiCodePage (data)      
NtAddAtom      
NtDeleteAtom      
NtFindAtom      
NtQueryInformationAtom      
NtQueryOleDirectoryFile discontinued in 5.0    
ObAssignSecurity      
ObCheckCreateObjectAccess      
ObCheckObjectAccess      
ObFindHandleForObject      
ObGetObjectSecurity   before 5.0, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ObOpenObjectByName      
ObQueryObjectAuditingByHandle   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
ObReferenceObjectByName      
ObReleaseObjectSecurity   before 5.0, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ObSetSecurityDescriptorInfo      
ObfReferenceObject   before 5.0, declared
before 2015-2018, indirectly documented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0

Who’s to know why, but although the DDK for Windows XP does not much change the documentation of ObGetObjectSecurity and ObReleaseObjectSecurity, it warns that “This is preliminary documentation and subject to change.”

As just an implementation detail for the ObReferenceObject macro, the ObfReferenceObject function is indirectly documented since version 5.0. But Microsoft nowadays gives the function its own page. When exactly this started is not known. It is not in the Windows 10 WDK documentation as integrated into Visual Studio 2015, but it is at Microsoft’s website today, 17th September 2020. As with almost all of Microsoft’s online WDK documentation since its reorganisation around which functions are declared in which headers, it is dated 30th April 2018.

Function Export History Documentation History Declaration History
PoSetDeviceIdleDetection discontinued in 5.0    
PsAssignImpersonationToken   before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.0
PsCreateWin32Process discontinued in 5.0    
PsGetCurrentProcessId   before 5.0, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
PsGetCurrentThreadId   before 5.0, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
PsGetVersion   before 5.0, declared
before 5.1, documented
since 6.0, declared start is 5.0
PsImpersonateClient   before 5.1 (IFS), undocumented
documented start is 5.1
since 6.0, declared start is 5.0
PsRevertToSelf   before 5.1 (IFS), undocumented
before 6.1, declared
documented start is 5.1
since 6.0, declared start is 5.0
PsSetCreateThreadNotifyRoutine   before 5.0, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
PsSetLegoNotifyRoutine      
RtlAddAtomToAtomTable      
RtlAnsiCharToUnicodeChar   before 6.1, undocumented
documented start is 5.0
documented but not declared
 
RtlAreAnyAccessesGranted      
RtlCompressChunks   before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.1
RtlCreateAtomTable      
RtlDecompressChunks   before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.1
RtlDeleteAtomFromAtomTable      
RtlDeleteNoSplay   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlDescribeChunk   before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.1
RtlDestroyAtomTable      
RtlEmptyAtomTable      
RtlGetDefaultCodePage      
RtlLookupAtomInAtomTable      
RtlMultiByteToUnicodeSize   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlPinAtomInAtomTable      
RtlQueryAtomInAtomTable      
RtlRaiseException      
RtlReserveChunk   before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.1
SeAuditingFileOrGlobalEvents   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SeDeleteObjectAuditAlarm   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SeOpenObjectForDeleteAuditAlarm   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SeSetAccessStateGenericMapping   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SeTokenImpersonationLevel      
ZwLoadKey      
ZwQueryDefaultLocale      
ZwQueryObject   before 6.1, undocumented
documented start is 5.0
declared start is 5.0
ZwQuerySystemInformation      
ZwReplaceKey      
ZwSaveKey   before 6.2, undocumented declared start is 6.1
ZwSetInformationObject      
ZwSetSystemTime      
ZwTerminateProcess   before 6.0, undocumented
since 6.1 revision, documented start is 5.0
 
ZwUnloadDriver   before 5.1 (IFS), undocumented
documented start is 5.1
since 6.0, declared start is 5.0
ZwUnloadKey      
ZwYieldExecution      

Function Export History
_alldiv x86 only
_allmul x86 only
_allrem x86 only
_allshl x86 only
_allshr x86 only
_aulldiv x86 only
_aullrem x86 only
_aullshr x86 only
_strnset  
_strrev  
_strset  
_wcslwr  
_wcsnset  
_wcsrev  
_wcsupr  
mbtowc  
strcat  
strcmp  
strcpy  
strlen  
strncat  
strspn  
towlower  
towupper  
wcsncat  
wcsspn  
wcstombs  
wctomb  

Discontinued

Version 4.0 stops exporting a few functions. For each, the version in parentheses tells when the function was first exported:

None had yet been documented. For who knows what reason, three of these functions cease as exports from version 4.0 but then are restored for version 5.0. The function for Power Management seems to have been a first thought that was replaced by a second thought for version 4.0 but then was revived for the large redevelopment of the functionality in version 5.0.