Geoff Chappell, Software Analyst
New Kernel Version 10.0 Exports
This page lists the 209 functions and 5 variables that are newly exported from
the Windows kernel in its first release for version 10.0, i.e., for the original
Windows 10. Two of the new functions are exported only in 32-bit Windows (x86) and
twenty only in 64-bit Windows (x64).
Hardly any of the new functions for version 10.0 seem to be documented by Microsoft
as far as shows up in a search online today (27th February 2016). The apparently
undocumented functions are highlighted yellow
below. Many are declared in one or another header file from the Windows Driver Kit—but
collating those is left for another day.
- CcAsyncCopyRead
- EtwSetInformation
- ExAcquireAutoExpandPushLockExclusive
- ExAcquireAutoExpandPushLockShared
- ExAllocateAutoExpandPushLock
- ExCleanupAutoExpandPushLock
- ExCleanupRundownProtectionCacheAware
- ExConvertPushLockExclusiveToShared
- ExFreeAutoExpandPushLock
- ExInitializeAutoExpandPushLock
- ExInitializeRundownProtectionCacheAwareEx
- ExIsManufacturingModeEnabled
- ExRawInputManagerObjectType (data)
- ExReleaseAutoExpandPushLockExclusive
- ExReleaseAutoExpandPushLockShared
- ExShareAddressSpaceWithDevice
- ExSizeOfAutoExpandPushLock
- ExTimerObjectType (data)
- ExTryAcquireAutoExpandPushLockExclusive
- ExTryAcquireAutoExpandPushLockShared
- ExTryAcquireCacheAwarePushLockExclusiveEx
- ExTryAcquireCacheAwarePushLockSharedEx
- FsRtlIsMobileOS
- FsRtlNotifyFilterChangeDirectoryLite
- FsRtlNotifyFilterReportChangeLite
- FsRtlQueryInformationFile
- FsRtlRegisterUncProviderEx2
- FsRtlSetDriverBacking
- HviGetDebugDeviceOptions
- HviGetEnlightenmentInformation
- HviGetHardwareFeatures
- HviGetHypervisorFeatures
- HviGetHypervisorInterface
- HviGetHypervisorVendorAndMaxFunction
- HviGetHypervisorVersion
- HviGetImplementationLimits
- HviIsAnyHypervisorPresent
- HviIsHypervisorMicrosoftCompatible
- HviIsHypervisorVendorMicrosoft
- HviIsIommuInUse
- HvlReadPerformanceStateCounters
-
IoAllocateIrpEx
- IoGetFsTrackOffsetState
- IoGetFsZeroingOffset
-
IoInitializeIrpEx
- IoIrpHasFsTrackOffsetExtensionType
- IoMakeAssociatedIrpEx
- IoPropagateIrpExtensionEx
- IoQueryInterface
- IoRequestDeviceRemovalForReset
- IoSetFsTrackOffsetState
- IoSetFsZeroingOffset
- IoSetFsZeroingOffsetRequired
-
IoSizeOfIrpEx
- IoSteerInterrupt
- KdEventLoggingEnabled (data)
- KdGetDebugDevice
- KdSetEventLoggingPresent
- KeCancelTimer2
- KeConnectInterruptForHal (x64 only)
- KeConvertAuxiliaryCounterToPerformanceCounter
- KeConvertPerformanceCounterToAuxiliaryCounter
- KeDeregisterBoundCallback
- KeFlushIoBuffers
- KeInitializeEnumerationContextFromAffinity
- KeInitializeTimer2
- KeNotifyProcessorFreezeSupported
- KeQueryAuxiliaryCounterFrequency
- KeQueryHeteroCpuPolicyThread
- KeRegisterBoundCallback
- KeReportCacheIncoherentDevice
- KeSetHeteroCpuPolicyThread
- KeSetSelectedCpuSetsThread
- KeSetTimer2
- KeShouldYieldProcessor
- KeSynchronizeTimeToQpc
- KeSystemFullyCacheCoherent
- KeUpdateThreadTag
- KiAccumulateCycleStats (x86 only)
- KiBeginThreadAccountingPeriod (x86 only)
- MmAddVerifierSpecialThunks
- MmChangeImageProtection
- MmLoadSystemImage
- MmMapIoSpaceEx
- MmUnloadSystemImage
- PoCpuIdledSinceLastCallImprecise
- PoCreateThermalRequest
- PoDeleteThermalRequest
- PoEnergyEstimationEnabled
- PoFxEnableDStateReporting
- PoFxIssueComponentPerfStateChange
- PoFxIssueComponentPerfStateChangeMultiple
- PoFxQueryCurrentComponentPerfState
- PoFxRegisterComponentPerfStates
- PoGetThermalRequestSupport
- PoNotifyMediaBuffering
- PoSetThermalActiveCooling
- PoSetThermalPassiveCooling
- PsAllocateMonitorContextServerSilo
- PsAttachSiloToCurrentThread
- PsDeleteMonitorContextServerSilo
- PsDereferenceMonitorContextServerSilo
- PsDetachSiloFromCurrentThread
- PsEqualCurrentSilo
- PsGetCurrentSilo
- PsGetEffectiveContainerId
- PsGetJobProperty
- PsGetMonitorContextServerSilo
- PsGetServerSiloDefaultCompartmentId
- PsGetServerSiloServiceSessionId
- PsGetSiloObject
- PsGetSiloObjectFromJob
- PsGetThreadCreateTime
- PsGetThreadProperty
- PsInsertSiloObject
- PsInsertSiloObjectFromJob
- PsIsDpcActive
- PsIsHostSilo
- PsIsProcessInAppSilo
- PsLoadedModuleList (data)
- PsLoadedModuleResource (data)
- PsReferenceMonitorContextServerSilo
- PsRegisterMonitorServerSilo
- PsRegisterPicoProvider
- PsRemoveSiloObject
- PsRemoveSiloObjectFromJob
- PsSetCreateThreadNotifyRoutineEx
- PsSetJobProperty
- PsSetMonitorContextServerSilo
- PsSetThreadProperty
- PsStartMonitorServerSilo
- PsUnregisterMonitorServerSilo
- PsUpdateComponentPower
- PspDereferenceSiloObject
- PspReferenceSiloObject
- RtlAddAccessAllowedObjectAce
- RtlAddAccessDeniedAceEx
- RtlAddAccessDeniedObjectAce
- RtlAddAuditAccessAceEx
- RtlAddAuditAccessObjectAce
- RtlAddProcessTrustLabelAce
- RtlAreBitsClearEx (x64 only)
- RtlAreBitsSetEx (x64 only)
- RtlCapabilityCheck
- RtlClearAllBitsEx (x64 only)
- RtlClearBitEx (x64 only)
- RtlClearBitsEx (x64 only)
- RtlDecompressBufferEx2
- RtlDecompressFragmentEx
- RtlEndStrongEnumerationHashTable
- RtlFindClearBitsAndSetEx (x64 only)
- RtlFindClearBitsEx (x64 only)
- RtlFindExportedRoutineByName
- RtlFindNextForwardRunClearEx (x64 only)
- RtlFindSetBitsAndClearEx (x64 only)
- RtlFindSetBitsEx (x64 only)
- RtlFirstFreeAce
- RtlGetControlSecurityDescriptor
- RtlInitStringEx
- RtlInitStrongEnumerationHashTable
- RtlInitializeBitMapEx (x64 only)
- RtlInitializeSidEx
- RtlIsMultiSessionSku
- RtlIsSandboxedToken
- RtlLargeIntegerToChar
- RtlNumberOfClearBitsEx (x64 only)
- RtlNumberOfSetBitsEx (x64 only)
- RtlOsDeploymentState
- RtlQueryPackageClaims
- RtlRbReplaceNode
- RtlSetAllBitsEx (x64 only)
- RtlSetBitEx (x64 only)
- RtlSetBitsEx (x64 only)
- RtlStronglyEnumerateEntryHashTable
- RtlSuffixUnicodeString
- RtlTestBitEx (x64 only)
- RtlUnicodeStringToInt64
- RtlValidAcl
- SeCompareSigningLevels
- SeMarkLogonSessionForTerminationNotificationEx
- SeQueryServerSiloToken
- SeQuerySessionIdTokenEx
- SeRegisterLogonSessionTerminatedRoutineEx
- SeSetSecurityAttributesTokenEx
- SeUnregisterLogonSessionTerminatedRoutineEx
- SkAcquirePushLockExclusive
- SkAllocatePool
- SkFreePool
- SkInitializePushLock
- SkIsSecureKernel
- SkQuerySecureKernelInformation
- SkReleasePushLockExclusive
- VfCheckNxPagePriority
- VfCheckNxPageProtection
- VfCheckNxPoolType
- VmAccessFault
- VmCreateMemoryRange
- VmDeleteMemoryRange
- VslExchangeEntropy
- VslRetrieveMailbox
- ZwAlpcOpenSenderThread
- ZwAlpcQueryInformationMessage
- ZwCompareTokens
- ZwGetCachedSigningLevel
- ZwGetNextProcess
- ZwNotifyChangeDirectoryFile
- ZwTraceControl
- _finite
- _wcslwr_s
- iswalnum
- iswdigit
- iswspace
- sqrt (x64 only)
- sqrtf (x64 only)
Additionally, ExUpdateLicenseData,
which is exported from versions 6.0 and 6.1 but then not from 6.2 or 6.3, is restored
as an export for version 10.0. Another function, RtlPcToFileHeader,
which earlier versions export only from x64 builds, becomes exported for x86 builds too.