Kernel Exports Added for Version 5.0

This page lists the 202 exports that are newly exported from the Windows kernel for the original Windows 2000. Almost all are still exported as of version 10.0.

Also listed are eight that were added for SP1, five for SP3 and two for SP4. The additions for this last service pack are specially notable for the different ways that they do not turn up for Windows XP. One is an exported function only in the long death of Windows 2000, not in Windows XP or any later Windows. The other looks to have been intended first for Windows Server 2003 and then back-fitted into the roughly contemporaneous Windows 2000 SP4 but never into any Windows XP service packs.

Conventions

To convey more detail with less text, the page relies heavily on several types of shortcut.

The first is that although a few of the kernel’s exports are of variables rather than functions, I tend to talk of all as functions, hoping that no confusion will be caused by the loose terminology. The variables are indicated by a parenthetical “data” after their first appearance in the Functions column.

Colours

Documentation status is summarised by colour coding. (Had the website’s scripts run as expected, then hovering over any colour-coded text would produce a tooltip that shows why the text is coloured.) (To decode a colour, hover for a tooltip.)

Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status. If a function is documented as reserved or obsolete, it is shaded red or shaded grey, respectively. Otherwise, functions that have their own non-trivial documentation are left with no background colour.

Many undocumented functions and some variables have C-language declarations in one or another header file. To show them as being not completely undocumented they are shaded orange, except for one special case. Some declarations are known only from “minwin” headers that Microsoft published in early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public disclosure even of the declaration was exceptional.

Actual Availability

The default understanding is that exporting continues for all later versions, and in both the x86 and x64 builds. Exceptions are sketched in a column headed Export History.

The description “x86 only” means that the function is not exported from any known x64 build but is exported from the x86 build of at least some version that has an x64 build. If it had already ceased as an export before Windows Server 2003 SP1, the “x86 only” is left unstated.

That a function is “discontinued in” some version means that the function is exported up to but not including the stated version and not in any later version unless “restored”.

Documented Availability

It’s nothing but fair to note that the majority of these functions were not documented immediately. Even more were then or later said to require later versions. These misrepresentations of actual availability show also in C-language declarations for the functions’ use in programming. Conveying these differences between what the kernel exported and what Microsoft presented for drivers to import is the concern of columns headed Documentation History and Declaration History.

Conventions still in development!

Incompleteness

Many functions in these early versions may have got their first documentation or declaration because their use was specially anticipated for installable file system (IFS) drivers. Microsoft published a separate IFS Kit for these, apparently starting from Windows 2000. For Windows Vista, the IFS Kit was merged into the WDK. Between, there are known to have been IFS Kits for Windows XP and Windows Server 2003, but I have not obtained either for inspection. Where applicable DDK versions are left to the imprecision of “5.1 (IFS) to 6.0”, whatever is described is known from the IFS section of the WDK for Windows Vista and is excluded from the IFS Kit for Windows 2000 and from the ordinary DDK for all of Windows 2000, Windows XP and Windows Server 2003.

Tabulation

As much as I might like to condense into one table as much as might be imagined is possible to summarise about all these functions’ history of availability both in the binary and according to the documentation and headers, many functions both individually and in groups demand additional explanation in text. I therefore break the tabulation according to Microsoft’s scheme of prefixes for separate areas of functionality within the otherwise monolithic kernel. Each function has its own row in one table, but please be sure to check for explanatory text before and (more usually) after the table.

Just more than 60% of these new exports for version 5.0 are nowadays documented. However, more than a sixth of these are documented only as being reserved, and one more only as obsolete. The proportion that are usefully documented is therefore less than half. Of the undocumented, about 20% are at least declared in one or another of the WDK header files.

Cc Functions

Function Declaration History
CcGetFlushedValidData before 5.1 (IFS) to 6.0, not declared
CcRemapBcb  
CcWaitForCurrentLazyWriterActivity before 5.1 (IFS) to 6.0, not declared

Dbg Function

Function Export History
DbgPrintReturnControlC  

Ex Functions

Function Export History Documentation History
ExFreePoolWithTag   before 5.1, undocumented
ExInterlockedFlushSList x86 only  
ExSemaphoreObjectType (data)   since 5.1 (IFS) to 6.0, indirectly documented
ExSetTimerResolution   before 5.1, declared
ExUuidCreate    

As with most exported variables, ExSemaphoreObjectType is not itself documented. It does, however, get mentioned in the documentation of functions for which it is expected as an argument. The first is in the WDK for Windows Vista, for ObOpenObjectByPointer.

The ExSetTimerResolution function is documented in the Windows 2000 DDK but only to reproduce the declaration and to say that “More information on ExSetTimerResolution will be provided in a future release of the DDK.” This is here taken as Microsoft’s own recognition that the function was not yet actually documented.

FsRtl Functions

Function Export History Documentation History Declaration History
FsRtlAcquireFileExclusive   before 5.1 (IFS) to 6.0, undocumented  
FsRtlAllocateFileLock     before 5.1 (IFS) to 6.0, not declared
FsRtlFreeFileLock     before 5.1 (IFS) to 6.0, not declared
FsRtlInsertFilterContext discontinued in 5.1    
FsRtlLookupFilterContextInternal discontinued in 5.1    
FsRtlLookupLastLargeMcbEntryAndIndex   before 5.1 (IFS), undocumented;
documented start is 5.1
 
FsRtlNotifyVolumeEvent   before 5.1 (IFS), undocumented;
documented start is 5.1
 
FsRtlReleaseFile   before 5.1 (IFS) to 6.0, undocumented  
FsRtlRemoveFilterContext discontinued in 5.1    
FsRtlResetLargeMcb   before 5.1 (IFS), undocumented;
documented start is 5.1
 
FsRtlTeardownFilterContexts discontinued in 5.1    

That FsRtlLookupLastLargeMcbEntryAndIndex, FsRtlNotifyVolumeEvent and FsRtlResetLargeMcb are first documented in the IFS Kit for Windows XP is mere supposition. They are not documented in the IFS Kit for Windows 2000, but their documentation in the WDK for Windows Vista dates the functions from Windows XP. A generous inference is that what actually dates from Windows XP is the documentation.

Inbv Functions

Function Documentation History
InbvAcquireDisplayOwnership  
InbvCheckDisplayOwnership  
InbvDisplayString  
InbvEnableBootDriver  
InbvEnableDisplayString  
InbvInstallDisplayStringFilter  
InbvIsBootDriverInstalled  
InbvNotifyDisplayOwnershipLost  
InbvResetDisplay  
InbvSetScrollRegion  
InbvSetTextColor  
InbvSolidColorFill  

One Variable

Function Documentation History
InitSafeBootMode (data) before 6.0, undocumented;
indirectly documented

As usual for exported variables, InitSafeBootMode does not have its own page of documentation. It is, however, presented on a page of Driver Programming Techniques titled Determining Whether the Operating System Is Running in Safe Mode. It is not declared in any header that Microsoft is known to have published.

Io Functions

Function Export History Documentation History Declaration History
IoAcquireRemoveLockEx   indirectly documented  
IoAllocateDriverObjectExtension      
IoAllocateWorkItem      
IoCancelFileOpen   in 5.1 to 5.2, reserved  
IoCheckQuerySetFileInformation   before 5.1 (IFS) to 6.0, undocumented  
IoCheckQuerySetVolumeInformation   before 5.1 (IFS) to 6.0, undocumented  
IoCheckQuotaBufferValidity     before 5.1 (IFS) to 6.0, not declared
IoCreateDriver      
IoCreateStreamFileObjectLite   before 5.1 (IFS) to 6.0, undocumented  
IoDeleteDriver      
IoFreeWorkItem      
IoGetAttachedDeviceReference      
IoGetBootDiskInformation      
IoGetDeviceInterfaceAlias      
IoGetDeviceInterfaces      
IoGetDeviceProperty      
IoGetDmaAdapter      
IoGetDriverObjectExtension      
IoGetRequestorProcessId     before 5.1 (IFS) to 6.0, not declared
IoGetRequestorSessionId   before 5.1 (IFS) to 6.0, undocumented;
since 6.0, documented start is 5.2 SP1
 
IoInitializeRemoveLockEx   indirectly documented  
IoInvalidateDeviceRelations      
IoInvalidateDeviceState      
IoIsFileOriginRemote starts in SP3 documented start is 5.1  
IoIsValidNameGraftingBuffer   before 5.1 (IFS) to 6.0, undocumented  
IoIsWdmVersionAvailable      
IoOpenDeviceInterfaceRegistryKey      
IoOpenDeviceRegistryKey      
IoPnPDeliverServicePowerNotification discontinued in 6.1    
IoQueueWorkItem      
IoRegisterBootDriverReinitialization   before 5.1, declared  
IoRegisterDeviceInterface      
IoRegisterLastChanceShutdownNotification   before 5.1, declared  
IoRegisterPlugPlayNotification      
IoReleaseRemoveLockAndWaitEx   indirectly documented  
IoReleaseRemoveLockEx   indirectly documented  
IoReportDetectedDevice      
IoReportResourceForDetection      
IoReportTargetDeviceChange      
IoReportTargetDeviceChangeAsynchronous      
IoRequestDeviceEject      
IoReuseIrp      
IoSetDeviceInterfaceState      
IoSetFileOrigin starts in SP3 documented start is 5.1  
IoSetIoCompletion      
IoSynchronousInvalidateDeviceRelations discontinued in 1703    
IoUnregisterPlugPlayNotification      
IoWMIAllocateInstanceIds      
IoWMIRegistrationControl      
IoWMISuggestInstanceName      
IoWMIWriteEvent      

The exported functions that work with remove locks, e.g., IoAcquireRemoveLockEx, are all documented as reserved, but they are each the essence of a documented macro, e.g., IoAcquireRemoveLock. Still, Microsoft has chosen to divide the work such that the exported functions are documented only as reserved: so be it.

The IoCancelFileOpen function may be another rarity that had parallel documentation in the DDK and IFS Kit. Its first known documentation is in the IFS Kit for Windows 2000. The merging of the IFS Kit into the WDK for Windows Vista leaves this documentation with others for Installable File Systems. Meanwhile, the function was also documented in the DDK for Windows XP and for Windows Server 2003 but only to say it’s reserved. In all versions, the declaration is in NTDDK.H, not NTIFS.H.

When Microsoft got round to documenting the IoRegisterBootDriverReinitialization function, in the DDK for Windows XP, it was “preliminary documentation and subject to change.”

Kd Functions and Variable

Function Documentation History
KdDisableDebugger before 6.1, declared
KdEnableDebugger before 6.1, declared
KdEnteredDebugger (data)  

Ke Functions and Variable

Function Export History Documentation History
KeQueryActiveProcessors   before 5.1, declared
KeQueryInterruptTime x86 only  
KeQueryPriorityThread    
KeRevertToUserAffinityThread   before 6.0, undocumented
KeSaveStateForHibernate (data)    
KeSetSystemAffinityThread   before 6.0, undocumented;
before 6.1, declared;
documented start is 5.0
KeStackAttachProcess   before 5.1 (IFS) to 6.0, undocumented
KeUnstackDetachProcess   before 5.1 (IFS) to 6.0, undocumented
KiEnableTimerWatchdog x86 only;
discontinued in 6.0
 

The KeSetSystemAffinityThread function is not yet formally obsolete but must be soon. Its first documentation, delayed until the WDK for Windows 7, limits its use to “systems before Windows Vista” and specifies KeSetSystemAffinityThreadEx on “Windows Vista and later” without mentioning that the new function hadn’t been documented for Windows Vista.

Lpc Functions

Function Export History
LpcPortObjectType (data)  
LpcRequestWaitReplyPort  

Mm Functions and Variable

Function Documentation History
Mm64BitPhysicalAddress (data) before 6.1, declared
MmAddPhysicalMemory before 5.1, declared
MmAllocateContiguousMemorySpecifyCache  
MmAllocatePagesForMdl  
MmFreeContiguousMemorySpecifyCache  
MmFreePagesFromMdl  
MmGetPhysicalMemoryRanges before 5.1, declared
MmGetSystemRoutineAddress before 5.1, declared
MmGetVirtualForPhysical before 5.1, declared
MmIsDriverVerifying before 5.1, declared;
before 6.1, reserved
MmMapUserAddressesToPage before 5.1, declared
MmMapViewInSessionSpace before 5.1, declared
MmProbeAndLockProcessPages before 5.1, declared
MmProbeAndLockSelectedPages before 6.2, undocumented;
before 2015-2018, declared
MmRemovePhysicalMemory before 5.1, declared
MmTrimAllSystemPagableMemory  
MmUnmapViewInSessionSpace before 5.1, declared

Though Mm64BitPhysicalAddress is not formally documented (with its own page) until the WDK for Windows 7, it is mentioned on a page titled Performing DMA in 64-Bit Windows as far back as the DDK for Windows XP.

The MmGetVirtualForPhysical function is declared in NTDDK.H from the DDK for Windows NT 4.0, but the corresponding x86 kernel does not export the function, nor have it as an internal routine.

From the DDK for Windows XP up to and including the WDK for Windows 7, MmIsDriverVerifying is on a list of Memory Manager Routines that are reserved for system use. But also in the WDK for Windows 7, and since, the function gets its own page of documentation which says nothing about its being reserved.

The MmProbeAndLockSelectedPages certainly is not known to the Windows 10 WDK documentation as integrated into Visual Studio 2015. I have no record of seeing it in surveys of Microsoft’s online documentation on 27th February 2016 or even on 7th October 2018. Yet what I see there today, 17th September 2020, is dated 30th April 2018. So, who knows when it was first documented, except that it was long, long, long after it was first exported.

Nls Variable

Function Export History
NlsOemCodePage (data)  

Nt Functions

The functions whose names begin with Nt correspond closely to functions whose names have the Zw prefix instead (see below). Put aside some general points about how the two differ—see The Native API— and documentation of an Nt function is to a large extent implied by documentation of the corresponding Zw function.

Though this correspondence will have been understood well enough by all competent kernel-mode programmers, Microsoft didn’t make it explicit until some time after releasing the WDK for Windows Vista. This is here taken as an intention to leave the Nt functions undocumented (if not declared) before version 6.1.

Documentation in the WDK for Windows 7 gives each Nt function its own page and directs attention to the page for the corresponding Zw function. The Zw documentation might then be treated as counting for both, except that the Nt documentation warns expressly “Do not call this routine from kernel-mode code.” This is here taken as documenting the Nt functions as reserved in version 6.1 (certainly for kernel-mode use, which is this survey’s focus).

Microsoft loosened the text significantly for Windows 8 to note that the Nt and Zw versions “can behave differently” and to refer to a page of guidance. These changes, though slight, are taken here as formally permitting the Nt functions’ kernel-mode use, such that they must now be counted as documented (though delayed).

While each Nt function is documented only by reference to the Zw function, whatever documented availability Microsoft gives for the latter is here taken as intended also for the former. In the headers, however, the two functions necessarily each have their own declaration (if they have any), and so any “declared start” shown below is specifically for the Nt function.

Function Documentation History
NtQueryQuotaInformationFile before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared;
in 6.1, reserved;
documented start is 6.1
NtQuerySystemInformation  
NtSetEaFile  
NtSetQuotaInformationFile before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared;
in 6.1, reserved;
documented start is 6.1
NtSetVolumeInformationFile before 5.2 (IFS), undocumented;
before 6.1, declared;
in 6.1, reserved;
documented start is 5.2

Every known DDK and WDK mentions NtQuerySystemInformation in a comment, apparently meaning its export from NTDLL.DLL in user mode, without ever presenting a declaration.

The NtSetEaFile function is mentioned in a comment, first in the NTIFS.H from the Windows 2000 IFS Kit but in WDM.H since the WDK for Windows Vista.

Ob Function

Function Export History
ObDeleteCapturedInsertInfo starts in SP4;
discontinued in 5.1;
restored in 5.2

Po Functions

Function Documentation History
PoCallDriver  
PoCancelDeviceNotify  
PoRegisterDeviceNotify  
PoRegisterSystemState  
PoRequestPowerIrp  
PoSetHiberRange before 6.2, undocumented
PoSetPowerState  
PoSetSystemState  
PoShutdownBugCheck  
PoStartNextPowerIrp  
PoUnregisterSystemState  

Ps Functions and Variable

Function Export History Documentation History
PsDisableImpersonation   before 5.1 (IFS) to 6.0, undocumented
PsJobType (data)   before 10.0, undocumented;
before 1607, declared
PsRestoreImpersonation   before 5.1 (IFS) to 6.0, undocumented
PsSetLoadImageNotifyRoutine    
PsSetNewKSecDD starts in SP4;
discontinued in 5.1
 

The only declaration that Microsoft had been known to have published of the PsJobType variable is in the NTOSP.H whose distribution with early editions of the WDK for Windows 10 was surely some mistake. Yet in the very next edition, for Version 1607, the declaration is in both NTDDK.H and WDM.H.

Rtl Functions

Function Export History Documentation History Declaration History
RtlAddRange   before 6.0, declared  
RtlCaptureContext   before 5.1 (IFS) to 6.0, undocumented;
before 6.1, reserved;
since 6.1, documented start is 5.1
 
RtlCopyRangeList   before 6.0, declared  
RtlDeleteAce   before 5.1 (IFS) to 6.0, undocumented;
documented start is 5.2 SP1
 
RtlDeleteOwnersRanges   before 6.0, declared  
RtlDeleteRange   before 6.0, declared  
RtlFindClearRuns      
RtlFindLastBackwardRunClear      
RtlFindLeastSignificantBit      
RtlFindMostSignificantBit      
RtlFindNextForwardRunClear      
RtlFindRange   before 6.0, declared  
RtlFreeRangeList   before 6.0, declared  
RtlGUIDFromString      
RtlGetAce   before 5.1 (IFS), undocumented;
documented start is 5.1
 
RtlGetFirstRange   before 6.0, declared  
RtlGetNextRange   before 6.0, declared  
RtlGetNtGlobalFlags      
RtlGetSaclSecurityDescriptor   before 5.2 SP1 (IFS), undocumented;
documented start is 5.2 SP1
since 6.0, declared start is 5.2 SP1
RtlImageDirectoryEntryToData      
RtlInitializeRangeList   before 6.0, declared  
RtlInsertElementGenericTableFull   before 5.1 (IFS) to 6.0, undocumented  
RtlInvertRangeList   before 6.0, declared  
RtlIsGenericTableEmpty   in 5.0 (IFS), documented but not declared  
RtlIsRangeAvailable   before 6.0, declared  
RtlIsValidOemCharacter   in 5.0 (IFS), documented but not declared  
RtlLookupElementGenericTableFull   before 5.1 (IFS) to 6.0, undocumented  
RtlMergeRangeLists   before 6.0, declared  
RtlPrefetchMemoryNonTemporal starts in SP3 before 6.1, declared;
documented start is 5.2
 
RtlRealPredecessor   in 5.0 (IFS), documented but not declared  
RtlRealSuccessor   in 5.0 (IFS), documented but not declared  
RtlSelfRelativeToAbsoluteSD   before 5.2 SP1 (IFS), undocumented;
documented start is 5.2 SP1
since 6.0, declared start is 5.2 SP1
RtlSelfRelativeToAbsoluteSD2      
RtlSizeHeap      
RtlStringFromGUID      
RtlSubtreePredecessor   before 5.1 (IFS) to 6.0, documented but not declared  
RtlSubtreeSuccessor   before 5.1 (IFS) to 6.0, documented but not declared  
RtlTraceDatabaseAdd starts in SP1    
RtlTraceDatabaseCreate starts in SP1    
RtlTraceDatabaseDestroy starts in SP1    
RtlTraceDatabaseEnumerate starts in SP1    
RtlTraceDatabaseFind starts in SP1    
RtlTraceDatabaseLock starts in SP1    
RtlTraceDatabaseUnlock starts in SP1    
RtlTraceDatabaseValidate starts in SP1    
RtlUlongByteSwap x86 only since 6.1 revision, documented start is 5.0  
RtlUlonglongByteSwap x86 only since 6.1 revision, documented start is 5.0  
RtlUshortByteSwap x86 only since 6.1 revision, documented start is 5.0  
RtlValidRelativeSecurityDescriptor   before 6.0, declared  
RtlVolumeDeviceToDosName   before 5.1, documented  
RtlWalkFrameChain   before 6.1, declared  

The dozen newly added functions that work with ranges and range lists must count now as undocumented though they did at first have declarations in NTDDK.H. Withdrawal of declarations for functions that continue to be exported is relatively rare, so it may be worth noting that these functions have since been added to, in versions 6.0 and 6.1, and they remain in use by some of Microsoft’s drivers.

That RtlVolumeDeviceToDosName is obsolete still comes with qualification: even in 2020 the documentation spells out that the function “is obsolete for Windows XP and later”.

Se Functions

Function Export History Documentation History Declaration History
SeAssignSecurityEx      
SeAuditHardLinkCreation starts in SP3 before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.1
SeAuditingHardLinkEvents starts in SP3 before 5.1 (IFS) to 6.0, undocumented  
SeCreateClientSecurityFromSubjectContext     before 5.1 (IFS) to 6.0, not declared
SeImpersonateClientEx     before 5.1 (IFS) to 6.0, not declared
SeQueryInformationToken     before 5.1 (IFS) to 6.0, not declared
SeQuerySessionIdToken   before 5.1 (IFS) to 6.0, undocumented  
SeSetSecurityDescriptorInfoEx     before 5.1 (IFS) to 6.0, not declared
SeTokenIsAdmin     before 5.1 (IFS) to 6.0, not declared;
since 6.0, declared start is 5.0
SeTokenIsRestricted     before 5.1 (IFS) to 6.0, not declared;
since 6.0, declared start is 5.0

Zw Functions

Function Documentation History Declaration History
ZwAdjustPrivilegesToken    
ZwCancelIoFile    
ZwCancelTimer before 6.0, declared  
ZwFlushVirtualMemory before 5.1 (IFS), undocumented;
documented start is 5.1
 
ZwInitiatePowerAction    
ZwOpenTimer before 6.0, declared  
ZwPowerInformation before 6.1, undocumented;
before 10.0, declared;
documented start is 6.2
 
ZwQueryDefaultUILanguage    
ZwQueryDirectoryObject    
ZwQueryEaFile before 5.1 (IFS) to 6.0, undocumented;
before 6.2, declared
 
ZwQueryInstallUILanguage    
ZwRestoreKey before 6.2, undocumented declared start is 6.1
ZwSetDefaultUILanguage    
ZwSetEaFile before 5.1 (IFS) to 6.0, undocumented;
before 6.2, declared
 
ZwSetSecurityObject before 5.1 (IFS), undocumented;
documented start is 5.1
 
ZwSetVolumeInformationFile before 5.2 (IFS), undocumented;
documented start is 5.2
 

C Run-Time (CRT) Functions

Function Export History
_except_handler3 x86 only
_itow  

References to the _except_handler3 function are generated by sufficiently early—but not too early—versions of Microsoft’s compilers for the prologue code of C and C++ functions that use Structured Exception Handling (SEH). Earlier compilers instead generate _except_handler2, which the kernel supports as an original export. The new function has its own page in the Alphabetical Function Reference of the C Run-Time Library Reference for Visual Studio 2012. Documentation for Visual Studio 2015 moved it to the Internal CRT Globals and Functions.

Old Friends

A few functions that the kernel had stopped exporting are restored as exports from version 5.0:

Discontinued

Version 5.0 stops exporting a few functions. For each, the version in parentheses tells when the function was first exported:

As usual, none had yet been documented.