Geoff Chappell - Software Analyst
The HAL exports a handful of functions that were superseded as early as Windows NT 3.50 but indirectly. The new function for each retained the old implementation with only very slight formal differences, mostly from changing to the __fastcall convention for passing arguments. But the old were not documented as obsolete and the new were not documented at all. Programmers were to continue writing as if the old functions continue to exist, and with unchanged documentation, but macros redefined the old in terms of the new. Programmers could be none the wiser unless they bothered to look into the headers for the new functions’ declarations. Meanwhile, to support old code that was built to import the old functions, the new HAL continued to export the old functions as stubs that simply reinterpret the old by calling the new. All the old functions continue to be exported by name from x86 builds of the HAL, though some are nowadays exported merely as forwards to the kernel.
Function | Versions | Remarks |
---|---|---|
KeAcquireSpinLock | all (x86 only) | export in 3.50 to 6.1 is stub that calls KfAcquireSpinLock;
export in 6.2 and higher is forward to KeAcquireSpinLock in kernel |
KeLowerIrql | all (x86 only) | export in 3.50 and higher is stub that calls KfLowerIrql |
KeRaiseIrql | all (x86 only) | export in 3.50 and higher is stub that calls KfRaiseIrql |
KeReleaseSpinLock | all (x86 only) | export in 3.50 to 6.1 is stub that calls KfReleaseSpinLock;
export in 6.2 and higher is forward to KeReleaseSpinLock in kernel |