Geoff Chappell, Software Analyst
Revision in progress. Use caution.
This page lists the functions and variables that are newly exported from the Windows kernel in the 1803 release for Windows 10. Surprisingly many, relative to previous releases of Windows 10, are documented by Microsoft as far as shows up in a search online today (13th October 2018). Undocumented functions that are declared in one or another header file from one or another edition of the Windows Driver Kit are shaded orange. Otherwise, they are highlighted yellow as this site’s usual indication of undocumented status.
Name | Documentation History |
---|---|
EtwpDisableStackWalkApc | |
EtwpReenableStackWalkApc | |
FsRtlIsNameInUnUpcasedExpression |
It’s certainly not impossible that I overlooked FsRtlIsNameInUnUpcasedExpression in my survey of Microsoft’s online documentation on 13th October 2018. The documentation that’s there today, 17th September 2020, is dated 19th October 2018, but so are others that were new for 1803 and which I did record as having seen six days earlier. Though I think it’s likely this function wasn’t documented immediately, I can’t say so definitely.
Name | Export History | Documentation History |
---|---|---|
IoGetDeviceDirectory | ||
IoGetDriverDirectory | ||
IoGetIommuInterface | ||
IoOpenDriverRegistryKey | ||
KeAddTriageDumpDataBlock | ||
KeFlushCurrentTbImmediately | x64 only | |
KeInitializeTriageDumpDataArray | ||
KeInvalidateRangeAllCachesNoIpi | ||
MmForceSectionClosedEx | ||
PoReportDirectedDripsCandidateDevice | discontinued in 1903 | |
PsWow64IsMachineSupported | ||
RtlGetEnabledExtendedAndSupervisorFeatures | ||
RtlGetPersistedStateLocation | ||
RtlLocateSupervisorFeature | ||
RtlQueryProcessPlaceholderCompatibilityMode | ||
RtlQueryRegistryValueWithFallback | before 1809, undocumented documented start is 1809 |
|
RtlRaiseCustomSystemEventTrigger | ||
RtlSetProcessPlaceholderCompatibilityMode | ||
VslGetSecurePciDeviceAlternateFunctionNumberForVtl0Dma | ||
qsort_s |
The KeConnectInterruptForHal function, which is exported by the x64 builds of all releases of version 10.0, becomes an x86 export too in version 1803.