Geoff Chappell, Software Analyst
The large table on this page lists the 375 exports that were added to the Windows kernel for version 6.0., i.e., for the original Windows Vista. These represent by far the biggest change in the kernel’s exported functionality over the whole history of Windows.
The version 6.0 from Windows Vista SP1 and Windows Server 2008 adds yet more functions. These 35 additions for Windows Vista SP1 and Windows Server 2008 are listed separately. Curiously, twenty functions from the original do not survive.
Documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. Functions that have their own non-trivial documentation are shown with no background colour. If the whole of the documentation is just that the function is reserved or obsolete, without even giving a prototype, then the function is highlighted red or highlighted pink, respectively. An undocumented function that is at least declared in one or another header file from the Windows Driver Kit is highlighted orange. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented in the first contemporaneous WDK (or IFS Kit) release, then it is shaded yellow to retain some of its previous status as undocumented.
Barely a sixth of these new exports for version 6.0 were documented for the contemporaneous WDK, though many more have got documented since. Most are said correctly to be available starting with Windows Vista. No indication is given whether this availability was not generally disclosed until a later WDK. One function is documented only as being reserved. Not quite a half of the new functions, and five exports of data, are undocumented but with declarations in one or another of the WDK header files. Declarations, both of these and the documented functions, are mostly for Windows Vista and higher, but some have no version constraint at all and a few functions are declared for much older versions. The other third of the new functions have neither documentation nor declaration.
Function | Remarks |
---|---|
AlpcGetHeaderSize | |
AlpcGetMessageAttribute | |
AlpcInitializeMessageAttribute | |
CcGetFileObjectFromSectionPtrsRef | |
CcIsThereDirtyDataEx | undocumented until 2008-2009 |
CcSetFileSizesEx | |
CcSetParallelFlushFile | |
CcTestControl | |
CmCallbackGetKeyObjectID | |
CmGetBoundTransaction | |
CmGetCallbackVersion | |
CmRegisterCallbackEx | |
CmSetCallbackObjectContext | |
DbgSetDebugPrintCallback | |
EmClientQueryRuleState | |
EmClientRuleDeregisterNotification | |
EmClientRuleEvaluate | |
EmClientRuleRegisterNotification | |
EmProviderDeregister | |
EmProviderDeregisterEntry | |
EmProviderRegister | |
EmProviderRegisterEntry | |
EmpProviderRegister | |
EtwActivityIdControl | |
EtwEnableTrace | |
EtwEventEnabled | |
EtwProviderEnabled | |
EtwRegister | |
EtwUnregister | |
EtwWrite | |
EtwWriteEndScenario | |
EtwWriteStartScenario | |
EtwWriteString | |
EtwWriteTransfer | |
ExAcquireCacheAwarePushLockExclusive | |
ExAllocateCacheAwarePushLock | |
ExDeleteLookasideListEx | |
ExFetchLicenseData | |
ExFlushLookasideListEx | |
ExFreeCacheAwarePushLock | |
ExGetLicenseTamperState | |
ExInitializeLookasideListEx | |
ExInitializePushLock | |
ExReleaseCacheAwarePushLockExclusive | |
ExSetLicenseTamperState | |
ExUpdateLicenseData | discontinued in 6.2; restored in 10.0 and higher |
ExfTryAcquirePushLockShared | |
FirstEntrySList | |
FsRtlAcknowledgeEcp | undocumented until 2007 |
FsRtlAddBaseMcbEntryEx | |
FsRtlAllocateExtraCreateParameter | undocumented until 2007 |
FsRtlAllocateExtraCreateParameterFromLookasideList | |
FsRtlAllocateExtraCreateParameterList | undocumented until 2007 |
FsRtlAreVolumeStartupApplicationsComplete | undocumented until 2007 |
FsRtlCancellableWaitForMultipleObjects | |
FsRtlCancellableWaitForSingleObject | |
FsRtlChangeBackingFileObject | |
FsRtlCurrentOplock | undocumented until 2008-2009 |
FsRtlDeleteExtraCreateParameterLookasideList | |
FsRtlFindExtraCreateParameter | undocumented until 2007 |
FsRtlFreeExtraCreateParameter | undocumented until 2007 |
FsRtlFreeExtraCreateParameterList | undocumented until 2007 |
FsRtlGetEcpListFromIrp | undocumented until 2007 |
FsRtlGetNextExtraCreateParameter | undocumented until 2007 |
FsRtlIncrementCcFastMdlReadWait | |
FsRtlInitExtraCreateParameterLookasideList | |
FsRtlInitializeBaseMcbEx | |
FsRtlInsertExtraCreateParameter | undocumented until 2007 |
FsRtlInsertPerFileContext | |
FsRtlIsEcpAcknowledged | undocumented until 2007 |
FsRtlIsEcpFromUserMode | |
FsRtlLogCcFlushError | |
FsRtlLookupPerFileContext | |
FsRtlMupGetProviderIdFromName | undocumented until 2008-2009 |
FsRtlMupGetProviderInfoFromFileObject | undocumented until 2008-2009 |
FsRtlNotifyCleanupAll | |
FsRtlNotifyVolumeEventEx | |
FsRtlOplockBreakToNone | undocumented until 2008-2009 |
FsRtlRegisterFltMgrCalls | |
FsRtlRegisterMupCalls | |
FsRtlRegisterUncProviderEx | |
FsRtlRemoveDotsFromPath | |
FsRtlRemoveExtraCreateParameter | undocumented until 2007 |
FsRtlRemovePerFileContext | |
FsRtlSetEcpListIntoIrp | |
FsRtlTeardownPerFileContexts | |
FsRtlValidateReparsePointBuffer | |
HvlQueryConnection | |
IoAllocateMiniCompletionPacket | |
IoAllocateSfioStreamIdentifier | |
IoApplyPriorityInfoThread | |
IoCallDriverStackSafe | discontinued in 6.1; declaration withdrawn in 2006-2007 |
IoCheckShareAccessEx | |
IoClearIrpExtraCreateParameter | |
IoConnectInterruptEx | documents earlier availability through statically-linked library IOINTEX.LIB for Windows 2000 and higher |
IoCreateArcName | |
IoCreateFileEx | |
IoDisconnectInterruptEx | documents earlier availability through statically-linked library IOINTEX.LIB for Windows 2000 and higher |
IoFreeMiniCompletionPacket | |
IoFreeSfioStreamIdentifier | |
IoGetBootDiskInformationLite | |
IoGetDevicePropertyData | undocumented until 2007 |
IoGetIoPriorityHint | |
IoGetIrpExtraCreateParameter | |
IoGetSfioStreamIdentifier | |
IoGetTransactionParameterBlock | |
IoInitializeWorkItem | |
IoIsFileObjectIgnoringSharing | |
IoQueueWorkItemEx | |
IoRequestDeviceEjectEx | |
IoRetrievePriorityInfo | |
IoSetDevicePropertyData | undocumented until 2007 |
IoSetIoCompletionEx | |
IoSetIoPriorityHint | |
IoSetIoPriorityHintIntoFileObject | |
IoSetIoPriorityHintIntoThread | |
IoSetIrpExtraCreateParameter | |
IoSetShareAccessEx | |
IoSizeofWorkItem | |
IoUninitializeWorkItem | |
IoWithinStackLimits | undocumented until 2007 |
KeAlertThread | |
KeAllocateCalloutStack | |
KeExpandKernelStackAndCalloutEx | |
KeFreeCalloutStack | |
KeInvalidateRangeAllCaches | |
KeQueryActiveProcessorCount | not declared unless SINGLE_GROUP_LEGACY_API defined |
KeQueryDpcWatchdogInformation | undocumented until 2008-2009 |
KeQueryMaximumProcessorCount | undocumented until 2007; not declared unless SINGLE_GROUP_LEGACY_API defined |
KeRevertToUserAffinityThreadEx | undocumented until 2007; not declared unless SINGLE_GROUP_LEGACY_API defined |
KeSetActualBasePriorityThread | |
KeSetSystemAffinityThreadEx | undocumented until 2007; not declared unless SINGLE_GROUP_LEGACY_API defined |
KeStartDynamicProcessor | |
LdrFindResourceEx_U | |
LdrResFindResource | |
LdrResFindResourceDirectory | |
LdrResSearchResource | |
LpcReplyWaitReplyPort | |
LpcRequestWaitReplyPortEx | |
LpcSendWaitReceivePort | |
MmAllocateContiguousMemorySpecifyCacheNode | undocumented until 2007; declaration requires Windows 2000 and higher |
MmBadPointer (data) | undocumented until 2007 |
MmCopyVirtualMemory | |
MmIsDriverVerifyingByAddress | undocumented until 2007 |
MmRotatePhysicalView | |
MmSetUserExceptionCallout | discontinued in 6.1 |
NtBuildGUID (data) | |
NtBuildLab (data) | |
NtClearAllSavepointsTransaction | discontinued in SP1 |
NtClearSavepointTransaction | discontinued in SP1 |
NtCommitComplete | undocumented until 2008-2009 |
NtCommitEnlistment | undocumented until 2008-2009 |
NtCommitTransaction | undocumented until 2008-2009 |
NtCreateEnlistment | undocumented until 2008-2009 |
NtCreateResourceManager | undocumented until 2008-2009 |
NtCreateTransaction | undocumented until 2008-2009 |
NtEnumerateTransactionObject | undocumented until 2008-2009 |
NtFreezeTransactions | |
NtGetNotificationResourceManager | undocumented until 2008-2009 |
NtMarshallTransaction | discontinued in SP1 |
NtOpenEnlistment | undocumented until 2008-2009 |
NtOpenResourceManager | undocumented until 2008-2009 |
NtOpenTransaction | undocumented until 2008-2009 |
NtPrePrepareEnlistment | undocumented until 2008-2009 |
NtPrepareComplete | undocumented until 2008-2009 |
NtPrepareEnlistment | undocumented until 2008-2009 |
NtPullTransaction | discontinued in SP1 |
NtQueryInformationEnlistment | undocumented until 2008-2009 |
NtQueryInformationResourceManager | undocumented until 2008-2009 |
NtQueryInformationTransaction | undocumented until 2008-2009 |
NtQueryInformationTransactionManager | undocumented until 2008-2009 |
NtRollbackEnlistment | undocumented until 2008-2009 |
NtRollbackTransaction | undocumented until 2008-2009 |
NtSavepointComplete | discontinued in SP1 |
NtSavepointTransaction | discontinued in SP1 |
NtSetInformationEnlistment | undocumented until 2008-2009 |
NtSetInformationResourceManager | undocumented until 2008-2009 |
NtSetInformationTransaction | undocumented until 2008-2009 |
NtStartTm | discontinued in SP1 |
NtThawTransactions | |
NtTraceControl | |
ObDereferenceObjectDeferDelete | undocumented until 2007; documentation until 2008-2009 requires Windows XP and higher |
ObIsDosDeviceLocallyMapped | |
ObIsKernelHandle | undocumented until 2007 |
POGOBuffer (data) | |
PfFileInfoNotify | |
PoDisableSleepStates | |
PoGetSystemWake | |
PoReenableSleepStates | |
PoRegisterPowerSettingCallback | |
PoSetFixedWakeSource | |
PoSetSystemWake | |
PoUnregisterPowerSettingCallback | |
PoUserShutdownInitiated | |
PsAcquireProcessExitSynchronization | |
PsChargeProcessCpuCycles | discontinued for x64 in 6.1; discontinued for x86 in 6.2 |
PsEnterPriorityRegion | |
PsIsCurrentThreadPrefetching | |
PsIsProtectedProcess | |
PsLeavePriorityRegion | |
PsReferenceProcessFilePointer | |
PsReleaseProcessExitSynchronization | |
PsResumeProcess | |
PsSetCurrentThreadPrefetching | |
PsSuspendProcess | |
PsUILanguageComitted (data) | |
RtlCmDecodeMemIoResource | |
RtlCmEncodeMemIoResource | |
RtlCompareAltitudes | |
RtlComputeCrc32 | |
RtlCopyLuidAndAttributesArray | |
RtlCopySidAndAttributesArray | |
RtlDuplicateUnicodeString | declaration requires Windows XP and higher |
RtlFindClosestEncodableLength | |
RtlFormatMessage | |
RtlGetIntegerAtom | |
RtlGetProductInfo | |
RtlGetThreadLangIdByIndex | |
RtlIdnToAscii | |
RtlIdnToNameprepUnicode | |
RtlIdnToUnicode | |
RtlInvertRangeListEx | |
RtlIoDecodeMemIoResource | |
RtlIoEncodeMemIoResource | |
RtlIsNormalizedString | |
RtlIsNtDdiVersionAvailable | conditionally redefined by macro as WdmlibRtlIsNtDdiVersionAvailable,
typically resolved from statically-linked library RTLVER.LIB; not declared |
RtlIsServicePackVersionInstalled | conditionally redefined by macro as WdmlibRtlIsNtDdiVersionAvailable,
typically resolved from statically-linked library RTLVER.LIB; not declared |
RtlLocalTimeToSystemTime | |
RtlLookupFirstMatchingElementGenericTableAvl | perhaps documented as RtlLookupFirstMatchingElementGenericTable
instead; declaration requires Windows XP and higher |
RtlNormalizeString | |
RtlNumberOfSetBitsUlongPtr | |
RtlQueryDynamicTimeZoneInformation | |
RtlQueryElevationFlags | |
RtlQueryModuleInformation | |
RtlRunOnceBeginInitialize | |
RtlRunOnceComplete | |
RtlRunOnceExecuteOnce | |
RtlRunOnceInitialize | |
RtlSetDynamicTimeZoneInformation | |
RtlSidHashInitialize | |
RtlSidHashLookup | |
RtlSystemTimeToLocalTime | |
RtlValidateUnicodeString | declaration requires Windows XP and higher |
SeAccessCheckFromState | |
SeAuditHardLinkCreationWithTransaction | |
SeAuditTransactionStateChange | |
SeCaptureSubjectContextEx | |
SeCloseObjectAuditAlarmForNonObObject | |
SeComputeAutoInheritByObjectType | |
SeCreateAccessStateEx | |
SeDeleteObjectAuditAlarmWithTransaction | |
SeExamineSacl | |
SeGetLinkedToken | |
SeLocateProcessImageName | |
SeOpenObjectAuditAlarmForNonObObject | |
SeOpenObjectAuditAlarmWithTransaction | |
SeOpenObjectForDeleteAuditAlarmWithTransaction | |
SeReportSecurityEventWithSubCategory | |
SeSetAuthorizationCallbacks | |
TmCancelPropagationRequest | |
TmCommitComplete | undocumented until 2007 |
TmCommitEnlistment | undocumented until 2007 |
TmCommitTransaction | undocumented until 2007 |
TmCreateEnlistment | undocumented until 2007 |
TmCurrentTransaction | |
TmDefaultTmOpenFileCount | discontinued in SP1 |
TmDereferenceEnlistmentKey | undocumented until 2007 |
TmEnableCallbacks | undocumented until 2007 |
TmEndPropagationRequest | |
TmEnlistmentObjectType (data) | mentioned since 2007 in documentation of ObReferenceObjectByHandle, etc |
TmFreezeTransactions | |
TmGetTransactionId | undocumented until 2007 |
TmInitDefaultTemporaryTm | discontinued in SP1 |
TmInitSystem | |
TmInitSystemPhase2 | |
TmInitializeResourceManager | discontinued in 6.2 |
TmInitializeTransaction | discontinued in 6.2 |
TmIsTransactionActive | undocumented until 2007 |
TmMarshallTransaction | discontinued in SP1 |
TmPrePrepareComplete | undocumented until 2007 |
TmPrePrepareEnlistment | undocumented until 2007 |
TmPrepareComplete | undocumented until 2007 |
TmPrepareEnlistment | undocumented until 2007 |
TmPropagationComplete | |
TmPropagationFailed | |
TmPullTransaction | discontinued in SP1 |
TmReadOnlyEnlistment | undocumented until 2007 |
TmRecoverEnlistment | undocumented until 2007 |
TmRecoverResourceManager | undocumented until 2007 |
TmRecoverTransactionManager | undocumented until 2007 |
TmReferenceEnlistmentKey | undocumented until 2007 |
TmRequestOutcomeEnlistment | undocumented until 2007 |
TmResourceManagerObjectType (data) | mentioned since 2007 in documentation of ObReferenceObjectByHandle, etc |
TmRmIsNotificationQueueEmpty_Temporary | discontinued in SP1 |
TmRollbackComplete | undocumented until 2007 |
TmRollbackEnlistment | undocumented until 2007 |
TmRollbackTransaction | undocumented until 2007 |
TmSavepointComplete | discontinued in SP1 |
TmSavepointTransaction | discontinued in SP1 |
TmSetCurrentTransaction | |
TmSetPreviousModeToKernel | discontinued in SP1 |
TmThawTransactions | |
TmTransactionManagerObjectType (data) | mentioned since 2007 in documentation of ObReferenceObjectByHandle, etc |
TmTransactionObjectType (data) | mentioned since 2007 in documentation of ObReferenceObjectByHandle, etc |
WheaRegisterErrSrcInitializer | discontinued in 6.1 |
WheaReportHwError | |
ZwAllocateLocallyUniqueId | |
ZwAlpcAcceptConnectPort | |
ZwAlpcCancelMessage | |
ZwAlpcConnectPort | |
ZwAlpcCreatePort | |
ZwAlpcCreatePortSection | |
ZwAlpcCreateResourceReserve | |
ZwAlpcCreateSectionView | |
ZwAlpcCreateSecurityContext | |
ZwAlpcDeletePortSection | |
ZwAlpcDeleteResourceReserve | |
ZwAlpcDeleteSectionView | |
ZwAlpcDeleteSecurityContext | |
ZwAlpcDisconnectPort | |
ZwAlpcQueryInformation | |
ZwAlpcSendWaitReceivePort | |
ZwAlpcSetInformation | |
ZwCommitEnlistment | undocumented until 2007 |
ZwCommitTransaction | |
ZwCreateEnlistment | |
ZwCreateIoCompletion | |
ZwCreateKeyTransacted | undocumented until 2008-2009 |
ZwCreateResourceManager | |
ZwCreateTransaction | |
ZwCreateTransactionManager | |
ZwEnumerateTransactionObject | undocumented until 2007 |
ZwFlushBuffersFile | |
ZwGetNotificationResourceManager | undocumented until 2007 |
ZwImpersonateAnonymousToken | |
ZwLoadKeyEx | |
ZwLockProductActivationKeys | |
ZwMarshallTransaction | discontinued in SP1 |
ZwOpenEnlistment | |
ZwOpenKeyTransacted | undocumented until 2008-2009 |
ZwOpenResourceManager | |
ZwOpenTransaction | |
ZwOpenTransactionManager | |
ZwPrePrepareEnlistment | undocumented until 2007 |
ZwPrepareComplete | undocumented until 2007 |
ZwPrepareEnlistment | undocumented until 2007 |
ZwPullTransaction | discontinued in SP1 |
ZwQueryInformationEnlistment | |
ZwQueryInformationResourceManager | |
ZwQueryInformationTransaction | |
ZwQueryInformationTransactionManager | |
ZwQueryLicenseValue | |
ZwQueryVirtualMemory | |
ZwRecoverEnlistment | undocumented until 2007 |
ZwRecoverResourceManager | |
ZwRecoverTransactionManager | |
ZwRemoveIoCompletion | |
ZwRemoveIoCompletionEx | |
ZwRequestPort | |
ZwRollbackEnlistment | undocumented until 2007 |
ZwRollbackTransaction | |
ZwSavepointComplete | discontinued in SP1 |
ZwSavepointTransaction | discontinued in SP1 |
ZwSetInformationEnlistment | |
ZwSetInformationTransaction | |
ZwUnloadKeyEx | |
_alloca_probe_16 | x86 only |
_alloca_probe_8 | x86 only |
_chkstk | x86 only |
_strtoui64 | |
_swprintf | |
_vswprintf | |
bsearch | |
psMUITest (data) |
Additionally, the KeIsExecutingDpc function, exported from x86 builds in version 3.51 and higher, starts being exported from x64 builds in version 6.0. But the two functions ExAllocateFromPagedLookasideList and ExFreeToPagedLookasideList, first exported in version 4.0 and retained for the first x64 builds, are dropped from x64 builds in version 6.0.