HAL Thunk Functions

The HAL exports a handful of functions that were superseded as early as Windows NT 3.50 but indirectly. The new function for each retained the old implementation with only very slight formal differences, mostly from changing to the __fastcall convention for passing arguments. But the old were not documented as obsolete and the new were not documented at all. Programmers were to continue writing as if the old functions continue to exist, and with unchanged documentation, but macros redefined the old in terms of the new. Programmers could be none the wiser unless they bothered to look into the headers for the new functions’ declarations. Meanwhile, to support old code that was built to import the old functions, the new HAL continued to export the old functions as stubs that simply reinterpret the old by calling the new. All the old functions continue to be exported by name from x86 builds of the HAL, though some are nowadays exported merely as forwards to the kernel.

Function Versions Remarks
KeAcquireSpinLock all (x86 only) export in 3.50 to 6.1 is stub that calls KfAcquireSpinLock;
export in 6.2 and higher is forward to KeAcquireSpinLock in kernel
KeLowerIrql all (x86 only) export in 3.50 and higher is stub that calls KfLowerIrql
KeRaiseIrql all (x86 only) export in 3.50 and higher is stub that calls KfRaiseIrql
KeReleaseSpinLock all (x86 only) export in 3.50 to 6.1 is stub that calls KfReleaseSpinLock;
export in 6.2 and higher is forward to KeReleaseSpinLock in kernel