Kernel Exports Added for Version 5.0

The large table on this page lists the 202 exports that were added to the Windows kernel in its first release for version 5.0., i.e., for the original Windows 2000. Almost all are still exported as of version 10.0. Also listed are eight that were added for Windows 2000 SP1, five for Windows 2000 SP3 and two for Windows SP4. The additions for this last service pack are specially notable for the different ways that they do not turn up for Windows XP. One is an exported function only in the long death of Windows 2000, not in Windows XP or any later Windows. The other looks to have been intended first for Windows Server 2003 and then back-fitted into the roughly contemporaneous Windows 2000 SP4 but never into any Windows XP service packs.

For the table below, documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. (If you read this website with scripts enabled, then hovering the mouse over any coloured text will produce a tooltip that shows why the text is coloured.) Functions that have their own non-trivial documentation are shown with no background colour. If the function is documented as reserved or obsolete, it is shaded red or shaded grey, respectively. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status. Many undocumented functions do at least have C-language declarations in one or another header file from the WDK. These are shaded orange, except for one special case. Some declarations are known only from “minwin” headers that Microsoft published in early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public knowledge even of the declaration is exceptional.

Just more than 60% of these new exports for version 5.0 are nowadays documented. However, more than a sixth of these are documented only as being reserved, and one more only as obsolete. The proportion that are usefully documented is therefore less than half. Of the undocumented, about 20% are at least declared in one or another of the WDK header files.

Function Export History Documentation History Declaration History
CcGetFlushedValidData     before 5.1 (IFS) to 6.0, not declared
CcRemapBcb      
CcWaitForCurrentLazyWriterActivity     before 5.1 (IFS) to 6.0, not declared
DbgPrintReturnControlC      
ExFreePoolWithTag   before 5.1, undocumented  
ExInterlockedFlushSList x86 only    
ExSemaphoreObjectType (data)   since 5.1 (IFS) to 6.0, indirectly documented  
ExSetTimerResolution   before 5.1, declared  
ExUuidCreate      

As with most exported variables, ExSemaphoreObjectType is not itself documented. It does, however, get mentioned in the documentation of functions for which it is expected as an argument. The first is in the WDK for Windows Vista, for ObOpenObjectByPointer.

The ExSetTimerResolution function is documented in the Windows 2000 DDK but only to reproduce the declaration and to say that “More information on ExSetTimerResolution will be provided in a future release of the DDK.” This is here taken as Microsoft’s own recognition that the function was not yet actually documented.

Function Export History Documentation History Declaration History
FsRtlAcquireFileExclusive   before 5.1 (IFS) to 6.0, undocumented  
FsRtlAllocateFileLock     before 5.1 (IFS) to 6.0, not declared
FsRtlFreeFileLock     before 5.1 (IFS) to 6.0, not declared
FsRtlInsertFilterContext discontinued in 5.1    
FsRtlLookupFilterContextInternal discontinued in 5.1    
FsRtlLookupLastLargeMcbEntryAndIndex   before 5.1 (IFS), undocumented
documented start is 5.1
 
FsRtlNotifyVolumeEvent   before 5.1 (IFS), undocumented
documented start is 5.1
 
FsRtlReleaseFile   before 5.1 (IFS) to 6.0, undocumented  
FsRtlRemoveFilterContext discontinued in 5.1    
FsRtlResetLargeMcb   before 5.1 (IFS), undocumented
documented start is 5.1
 
FsRtlTeardownFilterContexts discontinued in 5.1    

That FsRtlLookupLastLargeMcbEntryAndIndex, FsRtlNotifyVolumeEvent and FsRtlResetLargeMcb are first documented in the IFS Kit for Windows XP is mere supposition. They are not documented in the IFS Kit for Windows 2000, but their documentation in the WDK for Windows Vista dates the functions from Windows XP. A generous inference is that what actually dates from Windows XP is the documentation.

Function Documentation History
InbvAcquireDisplayOwnership  
InbvCheckDisplayOwnership  
InbvDisplayString  
InbvEnableBootDriver  
InbvEnableDisplayString  
InbvInstallDisplayStringFilter  
InbvIsBootDriverInstalled  
InbvNotifyDisplayOwnershipLost  
InbvResetDisplay  
InbvSetScrollRegion  
InbvSetTextColor  
InbvSolidColorFill  
InitSafeBootMode (data) before 6.0, undocumented
indirectly documented

As usual for exported variables, InitSafeBootMode does not have its own page of documentation. It is, however, presented on a page of Driver Programming Techniques titled Determining Whether the Operating System Is Running in Safe Mode. It is not declared in any header that Microsoft is known to have published.

Function Export History Documentation History Declaration History
IoAcquireRemoveLockEx   indirectly documented  
IoAllocateDriverObjectExtension      
IoAllocateWorkItem      
IoCancelFileOpen   in 5.1 to 5.2, reserved  
IoCheckQuerySetFileInformation   before 5.1 (IFS) to 6.0, undocumented  
IoCheckQuerySetVolumeInformation   before 5.1 (IFS) to 6.0, undocumented  
IoCheckQuotaBufferValidity     before 5.1 (IFS) to 6.0, not declared
IoCreateDriver      
IoCreateStreamFileObjectLite   before 5.1 (IFS) to 6.0, undocumented  
IoDeleteDriver      
IoFreeWorkItem      
IoGetAttachedDeviceReference      
IoGetBootDiskInformation      
IoGetDeviceInterfaceAlias      
IoGetDeviceInterfaces      
IoGetDeviceProperty      
IoGetDmaAdapter      
IoGetDriverObjectExtension      
IoGetRequestorProcessId     before 5.1 (IFS) to 6.0, not declared
IoGetRequestorSessionId   before 5.1 (IFS) to 6.0, undocumented
since 6.0, documented start is 5.2 SP1
 
IoInitializeRemoveLockEx   indirectly documented  
IoInvalidateDeviceRelations      
IoInvalidateDeviceState      
IoIsFileOriginRemote starts in SP3 documented start is 5.1  
IoIsValidNameGraftingBuffer   before 5.1 (IFS) to 6.0, undocumented  
IoIsWdmVersionAvailable      
IoOpenDeviceInterfaceRegistryKey      
IoOpenDeviceRegistryKey      
IoPnPDeliverServicePowerNotification discontinued in 6.1    
IoQueueWorkItem      
IoRegisterBootDriverReinitialization   before 5.1, declared  
IoRegisterDeviceInterface      
IoRegisterLastChanceShutdownNotification   before 5.1, declared  
IoRegisterPlugPlayNotification      
IoReleaseRemoveLockAndWaitEx   indirectly documented  
IoReleaseRemoveLockEx   indirectly documented  
IoReportDetectedDevice      
IoReportResourceForDetection      
IoReportTargetDeviceChange      
IoReportTargetDeviceChangeAsynchronous      
IoRequestDeviceEject      
IoReuseIrp      
IoSetDeviceInterfaceState      
IoSetFileOrigin starts in SP3 documented start is 5.1  
IoSetIoCompletion      
IoSynchronousInvalidateDeviceRelations discontinued in 1703    
IoUnregisterPlugPlayNotification      
IoWMIAllocateInstanceIds      
IoWMIRegistrationControl      
IoWMISuggestInstanceName      
IoWMIWriteEvent      

The exported functions that work with remove locks, e.g., IoAcquireRemoveLockEx, are all documented as reserved, but they are each the essence of a documented macro, e.g., IoAcquireRemoveLock. Still, Microsoft has chosen to divide the work such that the exported functions are documented only as reserved: so be it.

The IoCancelFileOpen function may be another rarity that had parallel documentation in the DDK and IFS Kit. Its first known documentation is in the IFS Kit for Windows 2000. The merging of the IFS Kit into the WDK for Windows Vista leaves this documentation with others for Installable File Systems. Meanwhile, the function was also documented in the DDK for Windows XP and for Windows Server 2003 but only to say it’s reserved. In all versions, the declaration is in NTDDK.H, not NTIFS.H.

When Microsoft got round to documenting the IoRegisterBootDriverReinitialization function, in the DDK for Windows XP, it was “preliminary documentation and subject to change.”

Function Export History Documentation History
KdDisableDebugger   before 6.1, declared
KdEnableDebugger   before 6.1, declared
KdEnteredDebugger (data)    
KeQueryActiveProcessors   before 5.1, declared
KeQueryInterruptTime x86 only  
KeQueryPriorityThread    
KeRevertToUserAffinityThread   before 6.0, undocumented
KeSaveStateForHibernate (data)    
KeSetSystemAffinityThread   before 6.0, undocumented
before 6.1, declared
documented start is 5.0
KeStackAttachProcess   before 5.1 (IFS) to 6.0, undocumented
KeUnstackDetachProcess   before 5.1 (IFS) to 6.0, undocumented
KiEnableTimerWatchdog x86 only;
discontinued in 6.0
 

The KeSetSystemAffinityThread function is not yet formally obsolete but must be soon. Its first documentation, delayed until the WDK for Windows 7, limits its use to “systems before Windows Vista” and specifies KeSetSystemAffinityThreadEx on “Windows Vista and later” without mentioning that the new function hadn’t been documented for Windows Vista.

Function Documentation History
LpcPortObjectType (data)  
LpcRequestWaitReplyPort  
Mm64BitPhysicalAddress (data) before 6.1, declared
MmAddPhysicalMemory before 5.1, declared
MmAllocateContiguousMemorySpecifyCache  
MmAllocatePagesForMdl  
MmFreeContiguousMemorySpecifyCache  
MmFreePagesFromMdl  
MmGetPhysicalMemoryRanges before 5.1, declared
MmGetSystemRoutineAddress before 5.1, declared
MmGetVirtualForPhysical before 5.1, declared
MmIsDriverVerifying before 5.1, declared
before 6.1, reserved
MmMapUserAddressesToPage before 5.1, declared
MmMapViewInSessionSpace before 5.1, declared
MmProbeAndLockProcessPages before 5.1, declared
MmProbeAndLockSelectedPages before 6.2, undocumented
before 2015-2018, declared
MmRemovePhysicalMemory before 5.1, declared
MmTrimAllSystemPagableMemory  
MmUnmapViewInSessionSpace before 5.1, declared

Though Mm64BitPhysicalAddress is not formally documented (with its own page) until the WDK for Windows 7, it is mentioned on a page titled Performing DMA in 64-Bit Windows as far back as the DDK for Windows XP.

The MmGetVirtualForPhysical function is declared in NTDDK.H from the DDK for Windows NT 4.0, but the corresponding x86 kernel does not export the function, nor have it as an internal routine.

From the DDK for Windows XP up to and including the WDK for Windows 7, MmIsDriverVerifying is on a list of Memory Manager Routines that are reserved for system use. But also in the WDK for Windows 7, and since, the function gets its own page of documentation which says nothing about its being reserved.

The MmProbeAndLockSelectedPages certainly is not known to the Windows 10 WDK documentation as integrated into Visual Studio 2015. I have no record of seeing it in surveys of Microsoft’s online documentation on 27th February 2016 or even on 7th October 2018. Yet what I see there today, 17th September 2020, is dated 30th April 2018. So, who knows when it was first documented, except that it was long, long after it was first exported.

Function Documentation History
NlsOemCodePage (data)  
NtQueryQuotaInformationFile before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
in 6.1, reserved
documented start is 6.1
NtQuerySystemInformation  
NtSetEaFile  
NtSetQuotaInformationFile before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
in 6.1, reserved
documented start is 6.1
NtSetVolumeInformationFile before 5.2 (IFS), undocumented
before 6.1, declared
in 6.1, reserved
documented start is 5.2

Every known DDK and WDK mentions NtQuerySystemInformation in a comment, apparently meaning its export from NTDLL.DLL in user mode, without ever presenting a declaration.

The NtSetEaFile function is mentioned in a comment, first in the NTIFS.H from the Windows 2000 IFS Kit but in WDM.H since the WDK for Windows Vista.

Function Export History Documentation History
ObDeleteCapturedInsertInfo starts in SP4;
discontinued in 5.1;
restored in 5.2
 
PoCallDriver    
PoCancelDeviceNotify    
PoRegisterDeviceNotify    
PoRegisterSystemState    
PoRequestPowerIrp    
PoSetHiberRange   before 6.2, undocumented
PoSetPowerState    
PoSetSystemState    
PoShutdownBugCheck    
PoStartNextPowerIrp    
PoUnregisterSystemState    
PsDisableImpersonation   before 5.1 (IFS) to 6.0, undocumented
PsJobType (data)   before 10.0, undocumented
before 1607, declared
PsRestoreImpersonation   before 5.1 (IFS) to 6.0, undocumented
PsSetLoadImageNotifyRoutine    
PsSetNewKSecDD starts in SP4;
discontinued in 5.1
 

The only declaration that Microsoft had been known to have published of the PsJobType variable is in the NTOSP.H whose distribution with early editions of the WDK for Windows 10 was surely some mistake. Yet in the very next edition, for Version 1607, the declaration is in both NTDDK.H and WDM.H.

Function Export History Documentation History Declaration History
RtlAddRange   before 6.0, declared  
RtlCaptureContext   before 5.1 (IFS) to 6.0, undocumented
before 6.1, reserved
since 6.1, documented start is 5.1
 
RtlCopyRangeList   before 6.0, declared  
RtlDeleteAce   before 5.1 (IFS) to 6.0, undocumented
documented start is 5.2 SP1
 
RtlDeleteOwnersRanges   before 6.0, declared  
RtlDeleteRange   before 6.0, declared  
RtlFindClearRuns      
RtlFindLastBackwardRunClear      
RtlFindLeastSignificantBit      
RtlFindMostSignificantBit      
RtlFindNextForwardRunClear      
RtlFindRange   before 6.0, declared  
RtlFreeRangeList   before 6.0, declared  
RtlGUIDFromString      
RtlGetAce   before 5.1 (IFS), undocumented
documented start is 5.1
 
RtlGetFirstRange   before 6.0, declared  
RtlGetNextRange   before 6.0, declared  
RtlGetNtGlobalFlags      
RtlGetSaclSecurityDescriptor   before 5.2 SP1 (IFS), undocumented
documented start is 5.2 SP1
since 6.0, declared start is 5.2 SP1
RtlImageDirectoryEntryToData      
RtlInitializeRangeList   before 6.0, declared  
RtlInsertElementGenericTableFull   before 5.1 (IFS) to 6.0, undocumented  
RtlInvertRangeList   before 6.0, declared  
RtlIsGenericTableEmpty   in 5.0 (IFS), documented but not declared  
RtlIsRangeAvailable   before 6.0, declared  
RtlIsValidOemCharacter   in 5.0 (IFS), documented but not declared  
RtlLookupElementGenericTableFull   before 5.1 (IFS) to 6.0, undocumented  
RtlMergeRangeLists   before 6.0, declared  
RtlPrefetchMemoryNonTemporal starts in SP3 before 6.1, declared
documented start is 5.2
 
RtlRealPredecessor   in 5.0 (IFS), documented but not declared  
RtlRealSuccessor   in 5.0 (IFS), documented but not declared  
RtlSelfRelativeToAbsoluteSD   before 5.2 SP1 (IFS), undocumented
documented start is 5.2 SP1
since 6.0, declared start is 5.2 SP1
RtlSelfRelativeToAbsoluteSD2      
RtlSizeHeap      
RtlStringFromGUID      
RtlSubtreePredecessor   before 5.1 (IFS) to 6.0, documented but not declared  
RtlSubtreeSuccessor   before 5.1 (IFS) to 6.0, documented but not declared  
RtlTraceDatabaseAdd starts in SP1    
RtlTraceDatabaseCreate starts in SP1    
RtlTraceDatabaseDestroy starts in SP1    
RtlTraceDatabaseEnumerate starts in SP1    
RtlTraceDatabaseFind starts in SP1    
RtlTraceDatabaseLock starts in SP1    
RtlTraceDatabaseUnlock starts in SP1    
RtlTraceDatabaseValidate starts in SP1    
RtlUlongByteSwap x86 only since 6.1 revision, documented start is 5.0  
RtlUlonglongByteSwap x86 only since 6.1 revision, documented start is 5.0  
RtlUshortByteSwap x86 only since 6.1 revision, documented start is 5.0  
RtlValidRelativeSecurityDescriptor   before 6.0, declared  
RtlVolumeDeviceToDosName   before 5.1, documented  
RtlWalkFrameChain   before 6.1, declared  

The dozen newly added functions that work with ranges and range lists must count now as undocumented though they did at first have declarations in NTDDK.H. Withdrawal of declarations for functions that continue to be exported is relatively rare, so it may be worth noting that these functions have since been added to, in versions 6.0 and 6.1, and they remain in use by some of Microsoft’s drivers.

That RtlVolumeDeviceToDosName is obsolete still comes with qualification: even in 2020 the documentation spells out that the function “is obsolete for Windows XP and later”.

Function Export History Documentation History Declaration History
SeAssignSecurityEx      
SeAuditHardLinkCreation starts in SP3 before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.1
SeAuditingHardLinkEvents starts in SP3 before 5.1 (IFS) to 6.0, undocumented  
SeCreateClientSecurityFromSubjectContext     before 5.1 (IFS) to 6.0, not declared
SeImpersonateClientEx     before 5.1 (IFS) to 6.0, not declared
SeQueryInformationToken     before 5.1 (IFS) to 6.0, not declared
SeQuerySessionIdToken   before 5.1 (IFS) to 6.0, undocumented  
SeSetSecurityDescriptorInfoEx     before 5.1 (IFS) to 6.0, not declared
SeTokenIsAdmin     before 5.1 (IFS) to 6.0, not declared
since 6.0, declared start is 5.0
SeTokenIsRestricted     before 5.1 (IFS) to 6.0, not declared
since 6.0, declared start is 5.0
ZwAdjustPrivilegesToken      
ZwCancelIoFile      
ZwCancelTimer   before 6.0, declared  
ZwFlushVirtualMemory   before 5.1 (IFS), undocumented
documented start is 5.1
 
ZwInitiatePowerAction      
ZwOpenTimer   before 6.0, declared  
ZwPowerInformation   before 6.1, undocumented
before 10.0, declared
documented start is 6.2
 
ZwQueryDefaultUILanguage      
ZwQueryDirectoryObject      
ZwQueryEaFile   before 5.1 (IFS) to 6.0, undocumented
before 6.2, declared
 
ZwQueryInstallUILanguage      
ZwRestoreKey   before 6.2, undocumented declared start is 6.1
ZwSetDefaultUILanguage      
ZwSetEaFile   before 5.1 (IFS) to 6.0, undocumented
before 6.2, declared
 
ZwSetSecurityObject   before 5.1 (IFS), undocumented
documented start is 5.1
 
ZwSetVolumeInformationFile   before 5.2 (IFS), undocumented
documented start is 5.2
 
_except_handler3 x86 only    
_itow      

Old Friends

A few functions that the kernel had stopped exporting are restored as exports from version 5.0:

Discontinued

Version 5.0 stops exporting a few functions. For each, the version in parentheses tells when the function was first exported:

As usual, none had yet been documented.