Kernel Exports Added For Version 3.51

The table below lists the 103 functions and variables that are newly exported from the the Windows kernel for the original release of version 3.51. All but seven are still exported in version 10.0. Also listed are four which first appear in version 3.51 but after its original release. One was added for SP1 or SP2 (the former having not been found for inspection). Three more first appear in SP5, i.e., are not exported from SP4.

For the table below, documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. (If you read this website with scripts enabled, then hovering the mouse over any coloured text will produce a tooltip that shows why the text is coloured.) Functions that have their own non-trivial documentation are shown with no background colour. If the function is documented as reserved or obsolete, it is shaded red or shaded grey, respectively. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status. Many undocumented functions do at least have C-language declarations in one or another header file from the WDK. These are shaded orange, except for one special case. Some declarations are known only from “minwin” headers that Microsoft published in early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public knowledge even of the declaration is exceptional.

As with most exported variables, ExEventObjectType is not itself documented. Starting with the DDK for Windows 2000, however, it gets mentioned in the documentation of exported functions such as ObReferenceObjectByHandle from its being intended as an argument.

Of the few kernel exports that have ever been discontinued selectively, KeServiceDescriptorTable is the oldest. It exists in all x64 kernels but it very plausibly was never meant to be exported from any. That it is exported from the very first x64 kernel, i.e., version 5.2 SP1, is perhaps an oversight which was corrected as soon as SP2.

By the time RtlAllocateAndInitializeSid got documented in the WDK, the kernel had stopped exporting it. Even in the two versions that do have it as a kernel-mode export, no kernel-mode use of it is known. In user mode, the function is exported from NTDLL in all versions.