Geoff Chappell, Software Analyst
The large table on this page lists the functions and variables that are newly exported by name from the Windows kernel in its first release for version 6.2, i.e., for the original Windows 8. Several do not survive to the next version.
Few of the new functions for version 6.2 seem to be documented by Microsoft as far as shows up in a search online today (29th February 2016). The apparently undocumented functions are highlighted yellow below. Many are declared in one or another header file from the Windows Driver Kit—but collating those is left for another day.
Function | Remarks |
---|---|
BgkDisplayCharacter | |
BgkGetConsoleState | |
BgkGetCursorState | |
BgkSetCursor | |
CcAddDirtyPagesToExternalCache | |
CcCopyReadEx | |
CcCopyWriteEx | |
CcDeductDirtyPagesFromExternalCache | |
CcFlushCacheToLsn | |
CcIsThereDirtyLoggedPages | |
CcRegisterExternalCache | |
CcScheduleReadAheadEx | |
CcSetAdditionalCacheAttributesEx | |
CcSetLogHandleForFileEx | |
CcSetLoggedDataThreshold | |
CcSetReadAheadGranularityEx | |
CcUnmapFileOffsetFromSystemCache | |
CcUnregisterExternalCache | |
CcZeroDataOnDisk | |
CmCallbackGetKeyObjectIDEx | |
CmCallbackReleaseKeyObjectIDEx | |
ExAcquireFastMutex | |
ExBlockOnAddressPushLock | |
ExBlockPushLock | |
ExCompositionSurfaceObjectType (data) | discontinued in 6.3 |
ExGetFirmwareEnvironmentVariable | |
ExNotifyBootDeviceRemoval | |
ExQueryFastCacheAppOrigin | |
ExQueryFastCacheDevLicense | |
ExQueryTimerResolution | |
ExQueryWnfStateData | |
ExRealTimeIsUniversal | |
ExRegisterBootDevice | |
ExReleaseFastMutex | |
ExSetFirmwareEnvironmentVariable | |
ExSubscribeWnfStateChange | |
ExTimedWaitForUnblockPushLock | |
ExTryQueueWorkItem | |
ExTryToAcquireFastMutex | |
ExUnsubscribeWnfStateChange | |
ExWaitForUnblockPushLock | |
FsRtlAcquireEofLock | |
FsRtlAcquireHeaderMutex | |
FsRtlAreThereWaitingFileLocks | |
FsRtlCheckLockForOplockRequest | |
FsRtlDismountComplete | |
FsRtlGetFilenameInformation | |
FsRtlGetIoAtEof | |
FsRtlGetSectorSizeInformation | |
FsRtlGetSupportedFeatures | |
FsRtlInitializeEofLock | |
FsRtlIsSystemPagingFile | |
FsRtlIssueDeviceIoControl | |
FsRtlKernelFsControlFile | |
FsRtlMdlReadEx | |
FsRtlPrepareMdlWriteEx | |
FsRtlPrepareToReuseEcp | |
FsRtlQueryCachedVdl | |
FsRtlQueryKernelEaFile | |
FsRtlReleaseEofLock | |
FsRtlReleaseFileNameInformation | |
FsRtlReleaseHeaderMutex | |
FsRtlSetKernelEaFile | |
FsRtlTryToAcquireHeaderMutex | |
FsRtlUpdateDiskCounters | |
HvlGetLpIndexFromApicId | |
HvlPerformEndOfInterrupt | x64 only |
HvlQueryActiveHypervisorProcessorCount | |
HvlQueryActiveProcessors | |
HvlQueryHypervisorProcessorNodeNumber | |
HvlQueryProcessorTopology | |
HvlQueryProcessorTopologyCount | |
HvlQueryProcessorTopologyHighestId | |
HvlRegisterInterruptCallback | |
HvlRegisterWheaErrorNotification | |
HvlunregisterInterruptCallback | |
HvlUnregisterWheaErrorNotification | |
InbvNotifyDisplayOwnershipChange | |
IoBoostThreadIo | |
IoClearActivityIdThread | |
IoClearReservedDependency | discontinued in 6.3 |
IoCompletionObjectType (data) | |
IoCopyDeviceObjectHint | |
IoCreateStreamFileObjectEx2 | |
IoCreateSystemThread | |
IoDecrementKeepAliveCount | |
IoDeleteAllDependencyRelations | |
IoGetActivityIdIrp | |
IoGetActivityIdThread | |
IoGetDeviceInterfacePropertyData | |
IoGetInitiatorProcess | |
IoGetOplockKeyContextEx | |
IoIncrementKeepAliveCount | |
IoInitializeMiniCompletionPacket | |
IoIsActivityTracingEnabled | |
IoIsInitiator32bitProcess | |
IoIsValidIrpStatus | |
IoPropagateActivityIdToThread | |
IoQueueWorkItemToNode | |
IoRegisterBootDriverCallback | |
IoRegisterIoTracking | |
IoReportInterruptActive | |
IoReportInterruptInactive | |
IoReserveDependency | |
IoResolveDependency | |
IoSetActivityIdIrp | |
IoSetActivityIdThread | |
IoSetDeviceInterfacePropertyData | |
IoSetMasterIrpStatus | |
IoSynchronousCallDriver | |
IoTransferActivityId | |
IoTryQueueWorkItem | |
IoUnregisterBootDriverCallback | |
IoUnregisterIoTracking | |
IoVolumeDeviceToGuid | |
IoVolumeDeviceToGuidPath | |
KdLogDbgPrint | |
KeAcquireSpinLock | x86 only |
KeDispatchSecondaryInterrupt | |
KeForceEnableNx | |
KeGetNextTimerExpirationDueTime | discontinued in 6.3 |
KeHwPolicyLocateResource | |
KeInitializeSecondaryInterruptServices | |
KeLoadMTRR | |
KeQueryEffectivePriorityThread | |
KeQueryInterruptTimePrecise | |
KeQuerySystemTimePrecise | |
KeQueryTotalCycleTimeThread | |
KeReleaseInStackQueuedSpinLock | |
KeStallWhileFrozen | |
KeSweepLocalCaches | |
KeUpdateTime | discontinued in 6.3 |
KeUpdateTimeAssist | discontinued in 6.3 |
KeWriteProtectPAT | |
KfAcquireSpinLock | x86 only |
KfReleaseSpinLock | x86 only |
KiEndThreadAccountingPeriod | x86 only |
KiEntropyQueueDpc | x86 only |
KseQueryDeviceData | |
KseQueryDeviceDataList | |
KseQueryDeviceFlags | |
KseRegisterShim | |
KseRegisterShimEx | |
KseSetDeviceFlags | |
KseUnregisterShim | |
MmAllocateContiguousNodeMemory | |
MmAllocateMdlForIoSpace | |
MmAllocateNodePagesForMdlEx | |
MmAreMdlPagesCached | |
MmGetMaximumFileSectionSize | |
MmIsDriverSuspectForVerifier | |
MmMapViewInSystemSpaceEx | |
MmMapViewInSessionSpaceEx | |
MmMdlPageContentsState | |
MmPrefetchVirtualAddresses | |
NtSetCachedSigningLevel | |
NtSetInformationVirtualMemory | |
ObDuplicateObject | |
ObReferenceObjectSafe | |
ObReferenceObjectSafeWithTag | |
ObWaitForMultipleObjects | |
ObWaitForSingleObject | |
PoAllProcessorsDeepIdle | discontinued in 6.3 |
PoFxCompleteDevicePowerNotRequired | |
PoFxCompleteIdleCondition | |
PoFxCompleteIdleState | |
PoFxIdleComponent | |
PoFxNotifySurprisePowerOn | |
PoFxPowerControl | |
PoFxProcessorNotification | |
PoFxRegisterCoreDevice | |
PoFxRegisterDevice | |
PoFxRegisterPlugin | |
PoFxRegisterPluginEx | |
PoFxRegisterPrimaryDevice | |
PoFxReportDevicePoweredOn | |
PoFxSetComponentLatency | |
PoFxSetComponentResidency | |
PoFxSetComponentWake | |
PoFxSetDeviceIdleTimeout | |
PoFxStartDevicePowerManagement | |
PoFxUnregisterDevice | |
PoGetProcessorIdleAccounting | |
PoInitiateProcessorWake | |
PoLatencySensitivityHint | |
PoNotifyDisableDynamicTick | discontinued in 6.3 |
PoNotifyVSyncChange | |
PoRegisterCoalescingCallback | |
PoSetUserPresent | |
PoUnregisterCoalescingCallback | |
PoUserShutdownCancelled | |
PsChargeProcessWakeCounter | |
PsCreateSystemThreadEx | |
PsDereferenceKernelStack | |
PsGetProcessCommonJob | |
PsGetProcessSignatureLevel | |
PsGetThreadExitStatus | |
PsIsDiskCountersEnabled | |
PsQueryProcessAttributesByToken | |
PsQueryTotalCycleTimeProcess | |
PsReferenceKernelStack | |
PsReleaseProcessWakeCounter | |
PsUpdateDiskCounters | |
RtlAddAtomToAtomTableEx | |
RtlAddResourceAttributeAce | |
RtlCheckPortableOperatingSystem | |
RtlCheckTokenCapability | |
RtlCheckTokenMembership | |
RtlCheckTokenMembershipEx | |
RtlCopyBitMap | |
RtlCrc32 | |
RtlCrc64 | |
RtlCreateAtomTableEx | |
RtlCreateHashTableEx | |
RtlCreateUserThread | |
RtlCultureNameToLCID | |
RtlDecompressBufferEx | |
RtlDeleteElementGenericTableAvlEx | |
RtlEqualWnfChangeStamps | |
RtlExtractBitMap | |
RtlGenerateClass5Guid | |
RtlGetAppContainerNamedObjectPath | |
RtlIsUntrustedObject | |
RtlLCIDToCultureName | |
RtlNumberOfClearBitsInRange | |
RtlNumberOfSetBitsInRange | |
RtlOpenCurrentUser | |
RtlQueryInformationAcl | |
RtlQueryPackageIdentity | |
RtlQueryRegistryValuesEx | |
RtlQueryValidationRunLevel | |
RtlRbInsertNodeEx | |
RtlRbRemoveNode | |
RtlSetControlSecurityDescriptor | |
RtlSetPortableOperatingSystem | |
SeAccessCheckFromStateEx | |
SeAuditingAnyFileEventsWithContextEx | |
SeAuditingFileEventsWithContextEx | |
SeCreateClientSecurityEx | |
SeCreateClientSecurityFromSubjectContextEx | |
SeGetLogonSessionToken | |
SeQuerySecureBootPolicyValue | |
SeSecurityAttributePresent | |
SeSystemDefaultSd | |
SeTokenFromAccessInformation | |
TmInitializeTransactionManager | |
TmIsKTMCommitCoordinator | |
TmRenameTransactionManager | |
TmSinglePhaseReject | |
WheaRegisterInUsePageOfflineNotification | x64 only |
WheaUnregisterInUsePageOfflineNotification | x64 only |
ZwAlpcConnectPortEx | |
ZwCreateWnfStateName | |
ZwDeleteWnfStateData | |
ZwDeleteWnfStateName | |
ZwFlushBuffersFileEx | |
ZwQuerySystemEnvironmentValueEx | |
ZwQueryWnfStateData | |
ZwQueryWnfStateNameInformation | |
ZwSetCachedSigningLevel | |
ZwSetInformationKey | |
ZwSetInformationVirtualMemory | |
ZwSetSystemEnvironmentValueEx | |
ZwUnlockVirtualMemory | |
ZwUpdateWnfStateData | |
bsearch_s |
Several more functions that are exported from all earlier versions of x64 builds are now exported from x86 builds too. One, however, is discontinued as an export from both builds in the very next version.
Function | Remarks |
---|---|
KeAcquireInStackQueuedSpinLock | |
KeAcquireInStackQueuedSpinLockRaiseToSynch | |
KeAcquireQueuedSpinLock | |
KeAcquireQueuedSpinLockRaiseToSynch | |
KeAcquireSpinLockRaiseToSynch | |
KeReleaseQueuedSpinLock | |
KeReleaseSpinLock | |
KeTryToAcquireQueuedSpinLock | |
KeTryToAcquireQueuedSpinLockRaiseToSynch | |
KiCpuId | discontinued in 6.3 |
memcmp |