Geoff Chappell, Software Analyst
Kernel Version 6.3 Exports
This page lists the functions and variables that are newly exported by name from
the Windows kernel in its first release for version 6.3, i.e., for the original
Windows 8.1.
Few of the new functions for version 6.3 seem to be documented by Microsoft as
far as shows up in a search online today (29th February 2016). The apparently undocumented
functions are highlighted yellow below. Many are
declared in one or another header file from the Windows Driver Kit—but collating
those is left for another day.
- DbgkWerCaptureLiveKernelDump
- ExAcquireCacheAwarePushLockExclusiveEx
- ExAcquireCacheAwarePushLockSharedEx
- ExAcquirePushLockExclusiveEx
- ExAcquirePushLockSharedEx
- ExAllocateTimer
- ExCancelTimer
- ExCompositionObjectType (data)
- ExDeleteTimer
- ExReleaseCacheAwarePushLockExclusiveEx
- ExReleaseCacheAwarePushLockSharedEx
- ExReleasePushLockEx
- ExReleasePushLockExclusiveEx
- ExReleasePushLockSharedEx
- ExSetTimer
- ExTryAcquirePushLockExclusiveEx
- ExTryAcquirePushLockSharedEx
- ExTryConvertPushLockSharedToExclusiveEx
- ExTryToAcquireResourceExclusiveLite
- ExUnblockOnAddressPushLockEx
- ExUnblockPushLockEx
- FsRtlCheckUpperOplock
- FsRtlHeatInit
- FsRtlHeatLogIo
- FsRtlHeatLogTierMove
- FsRtlHeatUninit
- FsRtlInsertReservedPerFileContext
- FsRtlInsertReservedPerStreamContext
- FsRtlLookupReservedPerFileContext
- FsRtlLookupReservedPerStreamContext
- FsRtlRemoveReservedPerFileContext
- FsRtlRemoveReservedPerStreamContext
- FsRtlSendModernAppTermination
- FsRtlUpperOplockFsctrl
- HvlQueryNumaDistance
- InterlockedPushListSList
- IoConvertFileHandleToKernelHandle
- IoGetGenericIrpExtension
- IoLoadCrashDumpDriver (x64 only)
- IoPropagateIrpExtension
- IoQueryFullDriverPath
- IoSetGenericIrpExtension
- IoSizeofGenericIrpExtension
- IoTestDependency
- KdAcquireDebuggerLock
- KdDeregisterPowerHandler
- KdRegisterPowerHandler
- KdReleaseDebuggerLock
- KeClockInterruptNotify
- KeClockTimerPowerChange
- KeFindFirstSetRightAffinityEx
- KeGetClockOwner
- KeGetClockTimerResolution
- KeGetNextClockTickDuration
- KeRemoveQueueDpcEx
- KitLogFeatureUsage
- MmCopyMemory
- MmGetCacheAttribute
- MmMdlPagesAreZero
- PoFxPowerOnCrashdumpDevice
- PoFxRegisterCrashdumpDevice
- PsGetProcessProtection
- PsIsProtectedProcessLight
- RtlAvlInsertNodeEx
- RtlAvlRemoveNode
- RtlGetAppContainerParent
- RtlGetAppContainerSidType
- RtlImageNtHeaderEx
- RtlInterlockedClearBitRun
- RtlInterlockedSetBitRun
- RtlInterlockedSetClearRun
- SeAdjustAccessStateForTrustLabel
- SeGetCachedSigningLevel
- SeIsParentOfChildAppContainer
- SeRegisterImageVerificationCallback
- SeShouldCheckForAccessRightsFromParent
- SeUnregisterImageVerificationCallback
- VfInsertContext
- VfQueryDeviceContext
- VfQueryDispatchTable
- VfQueryDriverContext
- VfQueryIrpContext
- VfQueryThreadContext
- VfRemoveContext
- ZwAssociateWaitCompletionPacket
- ZwCancelIoFileEx
- ZwCreateWaitCompletionPacket
- ZwLockVirtualMemory
- ZwProtectVirtualMemory
- ZwQuerySystemInformationEx
Version 6.3 discontinues more than a few exports:
- ExCompositionSurfaceObjectType (data)
- ExQueryAttributeInformation
- ExRegisterAttributeInformationCallback
- ExUnregisterAttributeInformationCallback
- IoClearReservedDependency
- KeGetNextTimerExpirationDueTime
- KeSetTimeIncrement
- KeUpdateRunTime
- KeUpdateTime
- KeUpdateTimeAssist
- KiCoprocessorError (previously x86 only)
- KiCpuId
- PoAllProcessorsDeepIdle
- PoNotifyDisableDynamicTick