Geoff Chappell, Software Analyst
The large table on this page lists the 247 exports that were added to the Windows kernel in its first release for version 5.1., i.e., for the original Windows XP. All but five are still exported as of version 6.0.
The few additions for Windows XP SP1 are listed separately, as are the more additions for Windows XP SP2. A handful of other exports perhaps were designed for version 5.1, and are mostly dated to Windows XP by Microsoft, but appear first, in order of version number, as additions for Windows 2000 SP3.
Documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. Functions that have their own non-trivial documentation are shown with no background colour. If the whole of the documentation is just that the function is reserved or obsolete, without even giving a prototype, then the function is highlighted red or highlighted pink, respectively. An undocumented function that is at least declared in one or another header file from the Windows Driver Kit is highlighted orange. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented in the first contemporaneous WDK (or IFS Kit) release, then it is shaded yellow to retain some of its previous status as undocumented.
Just more than 40% of these new exports for version 5.1 are nowadays documented. For most, the documentation states that the function is “available on Microsoft Windows XP and later”. Six functions are documented only as being reserved, without even saying which versions have them. Another four are documented as obsolete, again without saying which versions have them. A small proportion of the new functions are undocumented but with declarations in one or another of the WDK header files. Declarations, both of these and the documented functions, are mostly for Windows XP and higher. Nearly a half of the new functions have neither documentation nor declaration.
Function | Remarks |
---|---|
CcMdlWriteAbort | |
CmRegisterCallback | undocumented until 2002-2005; documented as obsolete for Windows Vista and higher |
CmUnRegisterCallback | undocumented until 2002-2005 |
DbgPrintEx | |
DbgQueryDebugFilterState | |
DbgSetDebugFilterState | |
ExAcquireRundownProtection | |
ExGetCurrentProcessorCounts | |
ExGetCurrentProcessorCpuUsage | |
ExInitializeRundownProtection | |
ExReInitializeRundownProtection | |
ExReleaseRundownProtection | |
ExRundownCompleted | |
ExVerifySuite | undocumented until 2002-2005 |
ExWaitForRundownProtectionRelease | |
ExfInterlockedCompareExchange64 | x86 only |
FsRtlIncrementCcFastReadNoWait | |
FsRtlIncrementCcFastReadNotPossible | |
FsRtlIncrementCcFastReadResourceMiss | |
FsRtlIncrementCcFastReadWait | |
FsRtlInsertPerFileObjectContext | undocumented until 2008-2009; documentation requires Windows Vista and higher |
FsRtlInsertPerStreamContext | documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher |
FsRtlIsPagingFile | documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher |
FsRtlLookupPerFileObjectContext | undocumented until 2008-2009; documentation requires Windows Vista and higher |
FsRtlLookupPerStreamContextInternal | |
FsRtlNotifyFilterChangeDirectory | documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher |
FsRtlNotifyFilterReportChange | documentation requires Update Rollup for Windows 2000 SP4, else Windows
XP and higher; declaration requires Windows 2000 and higher |
FsRtlRegisterFileSystemFilterCallbacks | documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher |
FsRtlRemovePerFileObjectContext | undocumented until 2008-2009; documentation requires Windows Vista and higher |
FsRtlRemovePerStreamContext | documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher |
FsRtlTeardownPerStreamContexts | documentation requires Update Rollup for Windows 2000 SP4, else Windows
XP and higher; declaration requires Windows 2000 and higher |
HalExamineMBR | previously supported (and documented) as macro using HalDispatchTable |
HeadlessDispatch | |
InterlockedPopEntrySList | x86 only; supported for x64 by macro using ExpInterlockedPopEntrySList; also exported from KERNEL32 version 5.1 and higher; documentation is in SDK for KERNEL32 |
InterlockedPushEntrySList | x86 only; supported for x64 by macro using ExpInterlockedPushEntrySList; also exported from KERNEL32 version 5.1 and higher; documentation is in SDK for KERNEL32 |
IoAssignDriveLetters | discontinued in 6.1 |
IoAttachDeviceToDeviceStackSafe | documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher |
IoCreateDisk | |
IoCreateFileSpecifyDeviceObjectHint | |
IoCreateStreamFileObjectEx | |
IoCsqInitialize | documents earlier availability through statically-linked library CSQ.LIB for Windows 2000 |
IoCsqInsertIrp | documents earlier availability through statically-linked library CSQ.LIB for Windows 2000 |
IoCsqRemoveIrp | documents earlier availability through statically-linked library CSQ.LIB for Windows 2000 |
IoCsqRemoveNextIrp | documents earlier availability through statically-linked library CSQ.LIB for Windows 2000 |
IoEnumerateDeviceObjectList | documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher |
IoForwardAndCatchIrp | redefined by macro as IoForwardIrpSynchronously |
IoForwardIrpSynchronously | |
IoFreeErrorLogEntry | |
IoGetDeviceAttachmentBaseRef | documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher |
IoGetDiskDeviceObject | documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher |
IoGetLowerDeviceObject | documentation requires Update Rollup for Windows 2000 SP4, else Windows XP and higher |
IoQueryFileDosDeviceName | |
IoReadDiskSignature | |
IoReadPartitionTable | also exported from HAL version 3.51 and higher; deprecated |
IoReadPartitionTableEx | |
IoSetCompletionRoutineEx | |
IoSetPartitionInformation | also exported from HAL version 3.51 and higher; deprecated |
IoSetPartitionInformationEx | |
IoSetStartIoAttributes | |
IoSetSystemPartition | |
IoVerifyPartitionTable | |
IoVolumeDeviceToDosName | |
IoWMIDeviceObjectToInstanceName | |
IoWMIExecuteMethod | |
IoWMIHandleToInstanceName | |
IoWMIOpenBlock | |
IoWMIQueryAllData | |
IoWMIQueryAllDataMultiple | |
IoWMIQuerySingleInstance | |
IoWMIQuerySingleInstanceMultiple | declaration requires Windows 2000 and higher |
IoWMISetNotificationCallback | |
IoWMISetSingleInstance | |
IoWMISetSingleItem | |
IoWritePartitionTable | also exported from HAL version 3.51 and higher; deprecated |
IoWritePartitionTableEx | |
KdPowerTransition | |
KeAcquireInStackQueuedSpinLockAtDpcLevel | |
KeAcquireInterruptSpinLock | |
KeAreApcsDisabled | |
KeGetRecommendedSharedDataAlignment | |
KeIsAttachedProcess | |
KeQueryRuntimeThread | |
KeReleaseInStackQueuedSpinLockFromDpcLevel | |
KeReleaseInterruptSpinLock | |
KeRemoveByKeyDeviceQueueIfBusy | |
KeRemoveSystemServiceTable | |
MmAddVerifierThunks | undocumented until 2005-2006 |
MmAdvanceMdl | |
MmAllocateMappingAddress | |
MmFreeMappingAddress | |
MmIsVerifierEnabled | undocumented until 2005-2006 |
MmMapLockedPagesWithReservedMapping | |
MmMarkPhysicalMemoryAsBad | not declared |
MmMarkPhysicalMemoryAsGood | not declared |
MmPrefetchPages | |
MmProtectMdlSystemAddress | |
MmUnmapReservedMapping | |
NtMakePermanentObject | |
NtOpenProcessTokenEx | undocumented until 2008-2009 |
NtOpenThread | |
NtOpenThreadToken | declaration requires Windows 2000 and higher |
NtOpenThreadTokenEx | undocumented until 2008-2009 |
NtQueryInformationThread | |
NtShutdownSystem | |
NtTraceEvent | |
ObCloseHandle | |
ObCreateObjectType | |
ObDereferenceSecurityDescriptor | |
ObLogSecurityDescriptor | |
ObReferenceSecurityDescriptor | |
ObSetHandleAttributes | |
ObSetSecurityObjectByPointer | |
PoQueueShutdownWorkItem | |
PoRequestShutdownEvent | |
PsChargeProcessNonPagedPoolQuota | |
PsChargeProcessPagedPoolQuota | |
PsChargeProcessPoolQuota | |
PsDereferenceImpersonationToken | documented before exported, as early as 2000 |
PsDereferencePrimaryToken | documented before exported, as early as 2000 |
PsGetCurrentProcess | documented before exported, as early as 1996; redefined by macro as IoGetCurrentProcess; not declared |
PsGetCurrentProcessSessionId | |
PsGetCurrentThread | documented before exported, as early as 1996; defined inline using KeGetCurrentThread |
PsGetCurrentThreadPreviousMode | |
PsGetCurrentThreadStackBase | |
PsGetCurrentThreadStackLimit | |
PsGetJobLock | |
PsGetJobSessionId | |
PsGetJobUIRestrictionsClass | |
PsGetProcessCreateTimeQuadPart | undocumented until 2007 |
PsGetProcessDebugPort | |
PsGetProcessExitProcessCalled | |
PsGetProcessExitStatus | |
PsGetProcessId | undocumented until 2005-2006 |
PsGetProcessImageFileName | |
PsGetProcessInheritedFromUniqueProcessId | |
PsGetProcessJob | |
PsGetProcessPeb | |
PsGetProcessPriorityClass | |
PsGetProcessSectionBaseAddress | |
PsGetProcessSecurityPort | |
PsGetProcessSessionId | |
PsGetProcessWin32Process | |
PsGetProcessWin32WindowStation | |
PsGetThreadFreezeCount | |
PsGetThreadHardErrorsAreDisabled | |
PsGetThreadId | |
PsGetThreadProcess | |
PsGetThreadProcessId | declaration requires Windows Server 2003 and higher |
PsGetThreadSessionId | |
PsGetThreadTeb | |
PsGetThreadWin32Thread | |
PsIsProcessBeingDebugged | |
PsIsSystemThread | undocumented until 2007 |
PsIsThreadImpersonating | |
PsRemoveCreateThreadNotifyRoutine | undocumented until 2002-2005 |
PsRemoveLoadImageNotifyRoutine | undocumented until 2002-2005 |
PsReturnProcessNonPagedPoolQuota | |
PsReturnProcessPagedPoolQuota | |
PsRevertThreadToSelf | |
PsSetJobUIRestrictionsClass | discontinued in 6.2 |
PsSetProcessPriorityClass | |
PsSetProcessSecurityPort | |
PsSetProcessWin32Process | |
PsSetProcessWindowStation | |
PsSetThreadHardErrorsAreDisabled | |
PsSetThreadWin32Thread | |
RtlClearBit | undocumented until 2005-2006 |
RtlCreateSystemVolumeInformationFolder | |
RtlDeleteElementGenericTableAvl | |
RtlEnumerateGenericTableAvl | |
RtlEnumerateGenericTableLikeADirectory | |
RtlEnumerateGenericTableWithoutSplayingAvl | |
RtlGetElementGenericTableAvl | undocumented until 2008-2009 |
RtlGetSetBootStatusData | |
RtlGetVersion | documented before exported, as early as 2000; documentation since 2000-2002 requires Windows XP and higher; declaration requires Windows 2000 and higher |
RtlHashUnicodeString | undocumented until 2005-2006 |
RtlInitializeGenericTableAvl | |
RtlInsertElementGenericTableAvl | |
RtlInsertElementGenericTableFullAvl | |
RtlInt64ToUnicodeString | documented before exported, as early as 2000; declaration requires Windows 2000 and higher |
RtlIntegerToUnicode | |
RtlIpv4AddressToStringA | also exported from NTDLL version 5.1 and higher; documentation and declaration are in SDK for NTDLL; documentation requires Windows Vista and higher; declaration requires Windows Vista and higher |
RtlIpv4AddressToStringW | also exported from NTDLL version 5.1 and higher; documentation and declaration are in SDK for NTDLL; documentation requires Windows Vista and higher; declaration requires Windows Vista and higher |
RtlIpv4StringToAddressA | also exported from NTDLL version 5.1 and higher; documentation and declaration are in SDK for NTDLL; documentation requires Windows Vista and higher; declaration requires Windows Vista and higher |
RtlIpv4StringToAddressW | also exported from NTDLL version 5.1 and higher; documentation and declaration are in SDK for NTDLL; documentation requires Windows Vista and higher; declaration requires Windows Vista and higher |
RtlIpv6AddressToStringA | also exported from NTDLL version 5.1 and higher; documentation and declaration are in SDK for NTDLL; documentation requires Windows Vista and higher; declaration requires Windows Vista and higher |
RtlIpv6AddressToStringW | also exported from NTDLL version 5.1 and higher; documentation and declaration are in SDK for NTDLL; documentation requires Windows Vista and higher; declaration requires Windows Vista and higher |
RtlIpv6StringToAddressA | also exported from NTDLL version 5.1 and higher; documentation and declaration are in SDK for NTDLL; documentation requires Windows Vista and higher; declaration requires Windows Vista and higher |
RtlIpv6StringToAddressW | also exported from NTDLL version 5.1 and higher; documentation and declaration are in SDK for NTDLL; documentation requires Windows Vista and higher; declaration requires Windows Vista and higher |
RtlIsGenericTableEmptyAvl | |
RtlLockBootStatusData | |
RtlLookupElementGenericTableAvl | |
RtlLookupElementGenericTableFullAvl | |
RtlMapSecurityErrorToNtStatus | |
RtlNumberGenericTableElementsAvl | |
RtlRandomEx | |
RtlSetBit | undocumented until 2005-2006 |
RtlTestBit | undocumented until 2005-2006 |
RtlTimeToElapsedTimeFields | |
RtlUnlockBootStatusData | |
RtlVerifyVersionInfo | documented before exported, as early as 2000; declaration requires Windows 2000 and higher |
SeFilterToken | |
SeTokenObjectType (data) | mentioned since 2008-2009 in documentation of ObReferenceObjectByHandle, etc |
VerSetConditionMask | declaration requires Windows 2000 and higher |
VfFailDeviceNode | |
VfFailDriver | |
VfFailSystemBIOS | |
VfIsVerificationEnabled | |
WmiFlushTrace | discontinued in 6.0 |
WmiGetClock | |
WmiQueryTrace | discontinued in 6.0 |
WmiQueryTraceInformation | |
WmiStartTrace | discontinued in 6.0 |
WmiStopTrace | discontinued in 6.0 |
WmiTraceMessage | |
WmiTraceMessageVa | |
WmiUpdateTrace | discontinued in 6.0 |
XIPDispatch | |
ZwAddBootEntry | |
ZwAssignProcessToJobObject | |
ZwCreateJobObject | |
ZwDeleteBootEntry | |
ZwEnumerateBootEntries | |
ZwIsProcessInJob | |
ZwOpenJobObject | |
ZwOpenProcessTokenEx | |
ZwOpenThreadTokenEx | |
ZwQueryBootEntryOrder | |
ZwQueryBootOptions | |
ZwQueryFullAttributesFile | undocumented until 2008-2009; documentation requires Windows 2000 and higher; declaration requires Windows 2000 and higher |
ZwQueryInformationJobObject | |
ZwQueryInformationThread | |
ZwSaveKeyEx | |
ZwSetBootEntryOrder | |
ZwSetBootOptions | |
ZwSetInformationJobObject | |
ZwTerminateJobObject | |
ZwTranslateFilePath | |
_CIcos | x86 only |
_CIsin | x86 only |
_CIsqrt | x86 only |
_alldvrm | x86 only |
_alloca_probe | x86 only |
_aulldvrm | x86 only |
_vsnwprintf | |
vDbgPrintEx | undocumented until 2005-2006 |
vDbgPrintExWithPrefix | undocumented until 2007 |