Geoff Chappell, Software Analyst
The large table on this page lists the 157 exports that were added to the Windows kernel in its first release for version 4.0., i.e., for the original Windows NT 4.0. Almost all are still exported as of version 6.0.
Three variables were added for Windows NT 4.0 SP3 and two functions for Windows NT 4.0 SP4. They are listed separately.
Documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. Functions that have their own non-trivial documentation are shown with no background colour. If the whole of the documentation is just that the function is reserved or obsolete, without even giving a prototype, then the function is highlighted red or highlighted pink, respectively. An undocumented function that is at least declared in one or another header file from the Windows Driver Kit is highlighted orange. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented in the first contemporaneous WDK (or IFS Kit) release, then it is shaded yellow to retain some of its previous status as undocumented.
Just over half of these new exports for version 4.0 are nowadays documented. However, a dozen of these are documented only as being reserved, and one more as obsolete. At the time these functions were documented, it does not seem to have been Microsoft’s standard practice to document which Windows versions have which kernel functions. For all documented functions in the table, including if marked as obsolete or reserved, assume that the WDK documentation has no version information except if stated otherwise in the Remarks column.
The documented functions and four undocumented functions are declared in one or another of the WDK header files. The WDK applies version constraints (in terms of the NTDDI_VERSION macro) to most declarations, but this is a recent practice. When Microsoft decided to start adding this information, it seems no trouble was taken to determine any function’s origin from before Windows 2000. Yet instead of leaving the old declarations without version constraints, trouble was taken to add version information in the full knowledge that the addition would be factually wrong for the overwhelming majority of these old functions. In this way, very nearly all these functions that first appeared in Windows NT 4.0 are said to require at least Windows 2000. Exported variables are always declared without version constraints. When a function is redefined by a macro or is implemented inline, no version constraints apply.
Function | Remarks |
---|---|
CcFastCopyRead | undocumented until 2000 (IFS); declaration requires Windows 2000 and higher |
CcFastCopyWrite | undocumented until 2000 (IFS); declaration requires Windows 2000 and higher |
CcFastMdlReadWait (data) | |
CcFastReadNotPossible (data) | discontinued in 6.0 |
CcFastReadWait (data) | discontinued in 6.0 |
CcSetBcbOwnerPointer | undocumented until 2000 (IFS); declaration requires Windows 2000 and higher |
DbgBreakPointWithStatus | undocumented until 1996-2000; documentation requires Windows 2000 and higher; declaration requires Windows 2000 and higher |
ExAllocateFromPagedLookasideList | x86-only before 5.2 from Windows Server 2003 SP1, and in 6.0 and higher;
declared inline unless _WIN2K_COMPAT_SLIST_USAGE defined (x86 only) |
ExDeleteNPagedLookasideList | declaration requires Windows 2000 and higher |
ExDeletePagedLookasideList | declaration requires Windows 2000 and higher |
ExDesktopObjectType (data) | |
ExEnumHandleTable | |
ExFreeToPagedLookasideList | x86-only before 5.2 from Windows Server 2003 SP1, and in 6.0 and higher;
declared inline unless _WIN2K_COMPAT_SLIST_USAGE defined (x86 only) |
ExGetPreviousMode | undocumented until 1996-2000; declaration requires Windows 2000 and higher |
ExInitializeNPagedLookasideList | declaration requires Windows 2000 and higher |
ExInitializePagedLookasideList | declaration requires Windows 2000 and higher |
ExInterlockedCompareExchange64 | x86 only; undocumented until 1996-2000; redefined by macro using ExfInterlockedCompareExchange64; supported for x64 by macro using compiler intrinsic _InterlockedCompareExchange64 |
ExInterlockedPopEntrySList | x86 only; redefined by macro using InterlockedPopEntrySList unless _WIN2K_COMPAT_SLIST_USAGE defined (x86 only); supported for x64 by macro using ExpInterlockedPopEntrySList |
ExInterlockedPushEntrySList | x86 only; redefined by macro using InterlockedPushEntrySList unless _WIN2K_COMPAT_SLIST_USAGE defined (x86 only); supported for x64 by macro using ExpInterlockedPushEntrySList |
ExIsProcessorFeaturePresent | undocumented until 1996-2000; declaration requires Windows 2000 and higher |
ExSetResourceOwnerPointer | undocumented until 1996-2000; declaration requires Windows 2000 and higher |
ExWindowStationObjectType (data) | |
FsRtlAddToTunnelCache | undocumented until 2000 (IFS); declaration requires Windows 2000 and higher |
FsRtlDeleteKeyFromTunnelCache | undocumented until 2000 (IFS); documentation since 2008-2009 requires Windows 2000 and higher; declaration requires Windows 2000 and higher |
FsRtlDeleteTunnelCache | undocumented until 2000 (IFS); declaration requires Windows 2000 and higher |
FsRtlFindInTunnelCache | undocumented until 2000 (IFS); declaration requires Windows 2000 and higher |
FsRtlGetFileSize | undocumented until 2000-2006 (IFS); declaration requires Windows 2000 and higher |
FsRtlInitializeTunnelCache | undocumented until 2000 (IFS); declaration requires Windows 2000 and higher |
FsRtlMdlReadComplete | |
FsRtlMdlReadCompleteDev | undocumented until 2000-2006 (IFS); declaration requires Windows 2000 and higher |
FsRtlMdlReadDev | undocumented until 2000-2006 (IFS); declaration requires Windows 2000 and higher |
FsRtlMdlWriteComplete | |
FsRtlMdlWriteCompleteDev | undocumented until 2000-2006 (IFS); declaration requires Windows 2000 and higher |
FsRtlPrepareMdlWriteDev | undocumented until 2000-2006 (IFS); declaration requires Windows 2000 and higher |
InterlockedCompareExchange | x86 only; conditionally redefined by macro as compiler intrinsic _InterlockedCompareExchange or by inline assembly language using lock cmpxchg instruction; supported for x64 by macro as compiler intrinsic _InterlockedCompareExchange |
InterlockedExchangeAdd | x86 only; conditionally redefined by macro as compiler intrinsic _InterlockedExchangeAdd or by inline assembly language using lock xadd instruction; supported for x64 by macro as compiler intrinsic _InterlockedExchangeAdd |
IoAttachDeviceToDeviceStack | declaration requires Windows 2000 and higher |
IoCreateNotificationEvent | declaration requires Windows 2000 and higher |
IoDeviceHandlerObjectSize | |
IoDeviceHandlerObjectType | |
IoFastQueryNetworkAttributes | undocumented until 2000-2006 (IFS); declaration requires Windows 2000 and higher |
IoGetBaseFileSystemDeviceObject | undocumented until 2000-2006 (IFS); declaration requires Windows 2000 and higher |
IoGetStackLimits | undocumented until 1996-2000 |
IoOpenDeviceInstanceKey | discontinued in 5.0 |
IoQueryDeviceEnumInfo | discontinued in 5.0 |
IoQueueThreadIrp | undocumented until 2000-2006 (IFS); declaration requires Windows 2000 and higher |
IoSetThreadHardErrorMode | undocumented until 1996-2000; documentation since 2008-2009 requires Windows 2000 and higher; declaration requires Windows 2000 and higher |
KeBoostCurrentThread | discontinued in 5.0 |
KeI386Call16BitCStyleFunction | x86 only; discontinued in 6.2 |
KeInitializeTimerEx | declaration requires Windows 2000 and higher |
KeRaiseUserException | |
KeRestoreFloatingPointState | undocumented until 1996-2000; defined inline to succeed trivially (x64) |
KeRundownQueue | undocumented until 2000 (IFS); declaration requires Windows 2000 and higher |
KeSaveFloatingPointState | undocumented until 1996-2000; defined inline to succeed trivially (x64) |
KeSetAffinityThread | |
KeSetIdealProcessorThread | undocumented until 2000-2006 (IFS); declaration requires Windows 2000 and higher |
KeSetKernelStackSwapEnable | undocumented until 2000-2006 (IFS); declaration requires Windows 2000 and higher |
KeSetProfileIrql | |
KeSetSwapContextNotifyRoutine | discontinued in 5.1 |
KeSetThreadSelectNotifyRoutine | discontinued in 5.1 |
KeSetTimeUpdateNotifyRoutine | discontinued in 5.2; undocumented until 2000-2002; not declared |
KeSetTimerEx | declaration requires Windows 2000 and higher |
KiBugCheckData (data) | |
LdrFindResourceDirectory_U | |
MmGrowKernelStack | |
MmMapVideoDisplay | undocumented until 2000-2002; declaration requires Windows 2000 and higher |
MmUnmapVideoDisplay | undocumented until 2000-2002; declaration requires Windows 2000 and higher |
NlsAnsiCodePage (data) | |
NtAddAtom | |
NtDeleteAtom | |
NtFindAtom | |
NtQueryInformationAtom | |
NtQueryOleDirectoryFile | discontinued in 5.0 |
ObAssignSecurity | |
ObCheckCreateObjectAccess | |
ObCheckObjectAccess | |
ObFindHandleForObject | |
ObGetObjectSecurity | undocumented until 1996-2000; declaration requires Windows 2000 and higher |
ObOpenObjectByName | |
ObQueryObjectAuditingByHandle | undocumented until 2000-2006 (IFS); declaration requires Windows 2000 and higher |
ObReferenceObjectByName | |
ObReleaseObjectSecurity | undocumented until 1996-2000; declaration requires Windows 2000 and higher |
ObSetSecurityDescriptorInfo | |
ObfReferenceObject | declaration requires Windows 2000 and higher |
PoSetDeviceIdleDetection | discontinued in 5.0 |
PsAssignImpersonationToken | declaration requires Windows 2000 and higher |
PsCreateWin32Process | discontinued in 5.0 |
PsGetCurrentProcessId | undocumented until 1996-2000; declaration requires Windows 2000 and higher |
PsGetCurrentThreadId | undocumented until 1996-2000; declaration requires Windows 2000 and higher |
PsGetVersion | undocumented until 1996-2000; documented since 2000-2002 as obsolete for Windows XP and higher; declaration requires Windows 2000 and higher |
PsImpersonateClient | undocumented until 2000-2006 (IFS); documentation requires Windows XP and higher; declaration requires Windows 2000 and higher |
PsRevertToSelf | undocumented until 2007; documentation requires Windows XP and higher; declaration requires Windows 2000 and higher |
PsSetCreateThreadNotifyRoutine | undocumented until 1996-2000; declaration requires Windows 2000 and higher |
PsSetLegoNotifyRoutine | |
RtlAddAtomToAtomTable | |
RtlAnsiCharToUnicodeChar | undocumented until 2008-2009; documentation requires Windows 2000 and higher; not declared |
RtlAreAnyAccessesGranted | |
RtlCompressChunks | undocumented until 2000-2006 (IFS); declaration requires Windows XP and higher |
RtlCreateAtomTable | |
RtlDecompressChunks | undocumented until 2000-2006 (IFS); declaration requires Windows XP and higher |
RtlDeleteAtomFromAtomTable | |
RtlDeleteNoSplay | undocumented until 2000 (IFS); declaration requires Windows 2000 and higher |
RtlDescribeChunk | undocumented until 2000-2006 (IFS); declaration requires Windows XP and higher |
RtlDestroyAtomTable | |
RtlEmptyAtomTable | |
RtlGetDefaultCodePage | |
RtlLookupAtomInAtomTable | |
RtlMultiByteToUnicodeSize | undocumented until 2000 (IFS); declaration requires Windows 2000 and higher |
RtlPinAtomInAtomTable | |
RtlQueryAtomInAtomTable | |
RtlRaiseException | |
RtlReserveChunk | undocumented until 2000-2006 (IFS); declaration requires Windows XP and higher |
SeAuditingFileOrGlobalEvents | undocumented until 2000 (IFS); declaration requires Windows 2000 and higher |
SeDeleteObjectAuditAlarm | undocumented until 2000 (IFS); declaration requires Windows 2000 and higher |
SeOpenObjectForDeleteAuditAlarm | undocumented until 2000 (IFS); declaration requires Windows 2000 and higher |
SeSetAccessStateGenericMapping | undocumented until 2000 (IFS); declaration requires Windows 2000 and higher |
SeTokenImpersonationLevel | |
ZwLoadKey | |
ZwQueryDefaultLocale | |
ZwQueryObject | undocumented until 2007; documentation requires Windows 2000 and higher; declaration requires Windows 2000 and higher |
ZwQuerySystemInformation | |
ZwReplaceKey | |
ZwSaveKey | |
ZwSetInformationObject | |
ZwSetSystemTime | |
ZwTerminateProcess | undocumented until 2005-2006 |
ZwUnloadDriver | undocumented until 2000-2006 (IFS); documentation requires Windows XP and higher; declaration requires Windows 2000 and higher |
ZwUnloadKey | |
ZwYieldExecution | |
_alldiv | x86 only |
_allmul | x86 only |
_allrem | x86 only |
_allshl | x86 only |
_allshr | x86 only |
_aulldiv | x86 only |
_aullrem | x86 only |
_aullshr | x86 only |
_strnset | |
_strrev | |
_strset | |
_wcslwr | |
_wcsnset | |
_wcsrev | |
_wcsupr | |
mbtowc | |
strcat | |
strcmp | |
strcpy | |
strlen | |
strncat | |
strspn | |
towlower | |
towupper | |
wcsncat | |
wcsspn | |
wcstombs | |
wctomb |