Revision in progress. Use caution.

Kernel Exports Added for Windows 10 Version 1511

This page lists the functions that are newly exported from the Windows kernel in its 1511 release. None at all were yet documented as showed at Microsoft’s website when searching on 27th February 2016. Repeating the survey on 7th October 2018 found that a few have been documented since.

For the table below, documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. (If you read this website with scripts enabled, then hovering the mouse over any coloured text will produce a tooltip that shows why the text is coloured.) Functions that have their own non-trivial documentation are shown with no background colour. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status. Many undocumented functions do at least have C-language declarations in one or another header file from the WDK. These are shaded orange, except for one special case. Some declarations are known only from “minwin” headers that Microsoft published in early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public knowledge even of the declaration is exceptional.

Many declarations of the new exports in version 1511 are inside conditional-compilation blocks that set a minimum NTDDI_VERSION. All such declarations date the function to some other release of Windows 10. Those that would have it that the function is not available until a later release do at least have the merit of matching the delayed documentation.

There was perhaps some plan that PsEqualCurrentServerSilo, PsGetCurrentServerSilo and PsIsCurrentThreadInServerSilo should be exported from the kernel even in the original release of Windows 10. They are declared in NTDDK.H from the WDK for Windows 10 as if for export, but they exist in the corresponding kernel only as internal routines.

What documentation survives of PsGetCurrentServerSiloName, PsGetCurrentSiloObject and PsIsCurrentThreadInServerSilo at Microsoft’s website (today, 17th September 2020) is separate from that of other silo functions, still warns that it “relates to pre-released product”, and now comes with the disclaimer that Microsoft is “no longer updating this content regularly.” The documentation is dated to 10th June 2016, which seems plausible as a date of first publication.

Version 1511 also discontinued the export of some functions, including seven that had only just been introduced for the original version 10.0. These functions for working with silos were apparently so much in flux that version 1607 discontinued more, including some that had been new for version 1511.