Kernel Exports Added for Version 4.0

The large table on this page lists the 157 functions and variables that are newly exported from the Windows kernel in its first release for version 4.0., i.e., for the original Windows NT 4.0. Almost all are still exported as of version 10.0. Also listed are five exports that were added in service packs: three variables in SP3 and two functions in SP4.

For the table below, documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. (If you read this website with scripts enabled, then hovering the mouse over any coloured text will produce a tooltip that shows why the text is coloured.) Functions that have their own non-trivial documentation are shown with no background colour. If the function is documented as reserved or obsolete, it is shaded red or shaded grey, respectively. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status. Many undocumented functions do at least have C-language declarations in one or another header file from the WDK. These are shaded orange, except for one special case. Some declarations are known only from “minwin” headers that Microsoft published in early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public knowledge even of the declaration is exceptional.

To say that the CcFastMdlReadWait, CcFastReadNotPossible and CcFastReadWait counters are indirectly documented would be a little generous even given the background that exported variables typically aren’t documented directly. Still, they are alluded to in documentation of FsRtlIncrementCcFastMdlReadWait, FsRtlIncrementCcFastReadNotPossible and FsRtlIncrementCcFastReadWait, except that what these functions increment are not variables that are exported from the kernel but the same-named members of the current processor’s KPRCB. Whether any or all were declared in NTIFS.H from an IFS Kit for versions 5.1 or 5.2 before two were discontinued for version 6.0 is not known.

Although the ExDesktopObjectType variable is not itself documented, it does get a mention in the WDK for Windows 10, specifically in documentation of the OB_OPERATION_REGISTRATION structure. It is there said, presumably just for the page’s limited purpose, to be “supported in Windows 10 and not in the earlier versions of the operating system.”

The MmHighestUserAddress and MmUserProbeAddress variables allow for what was, in Windows NT 4.0 SP3, the new feature of dynamically reconfiguring how much of the virtual address space is accessible from user mode. The ancient MM_HIGHEST_USER_ADDRESS and MM_USER_PROBE_ADDRESS macros had evaluated to constants but could now—well, in the next DDK—be variable.

Who’s to know why, but although the DDK for Windows XP does not much change the documentation of ObGetObjectSecurity and ObReleaseObjectSecurity, it warns that “This is preliminary documentation and subject to change.”

As just an implementation detail for the ObReferenceObject macro, the ObfReferenceObject function is indirectly documented since version 5.0. But Microsoft nowadays gives the function its own page. When exactly this started is not known. It is not in the Windows 10 WDK documentation as integrated into Visual Studio 2015, but it is at Microsoft’s website today, 17th September 2020. As with almost all of Microsoft’s online WDK documentation since its reorganisation around which functions are declared in which headers, it is dated 30th April 2018.

Discontinued

Version 4.0 stops exporting a few functions. For each, the version in parentheses tells when the function was first exported:

• KiIpiSend (3.10)
• PoRegisterDeviceForIdleDetection (3.51), but see note
• ZwCreateTimer (3.51), but see note
• ZwSetTimer (3.51), but see note

None had yet been documented. For who knows what reason, three of these functions cease as exports from version 4.0 but then are restored for version 5.0. The function for Power Management seems to have been a first thought that was replaced by a second thought for version 4.0 but then was revived for the large redevelopment of the functionality in version 5.0.