Revision in progress. Use caution.

Kernel Exports Added for Windows 10 Version 1703

This page lists the functions that are newly exported from the Windows kernel in its 1703 release. Hardly any seem to be documented by Microsoft as far as shows up in a search online today (7th October 2018). With version 1703 adding almost as many exports as did version 1607, Microsoft makes very clear that Windows is now free to evolve much more rapidly, at least in terms of exported functionality. Two half-yearly updates in succession each change Windows more than any one (roughly yearly) service pack ever did.

For the table below, documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. (If you read this website with scripts enabled, then hovering the mouse over any coloured text will produce a tooltip that shows why the text is coloured.) Functions that have their own non-trivial documentation are shown with no background colour. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status. Many undocumented functions do at least have C-language declarations in one or another header file from the WDK. These are shaded orange, except for one special case. Some declarations are known only from “minwin” headers that Microsoft published in early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public knowledge even of the declaration is exceptional.

It’s here thought that the VslCreateSecureSection and VslDeleteSecureSection functions were left undocumented before they got declared in WDM.H from the WDK for the 1709 release. Even now, in September 2020, the documentation’s first sentence is that “This material is not yet available.” Microsoft dates this document to 30th April 2018 and it’s not impossible that this actually is a date of first publication: that the functions are documented at all may be just a side-effect of the roughly concurrent reorganisation of documentation around which functions are declared in which headers.

Version 1703 also exports WheaAttemptPhysicalPageOffline in the x86 builds, this function having been an x64 export since version 6.1.

Discontinued

The 1703 release is the first of version 10.0 to prune the exported interface. The following are no longer exported from the kernel in version 1703 and higher. For each, the version number in parentheses tells when the function was first exported:

• IoClearDependency
• IoDeleteAllDependencyRelations
• IoSynchronousInvalidateDeviceRelations (5.0)

None were ever documented.