Kernel Exports Added for Windows 2000 SP4

The table below lists the two exports that were first added to the Windows kernel for the version 5.0 from Windows 2000 SP4. Note that Microsoft’s documentation in the Windows Vista Windows Driver Kit (WDK) talks of an “Update Rollup” for Windows 2000 SP4. This has not been found for these notes. The Windows 2000 SP4 that is meant here is just the original service pack from 2003.

Of the two additions, one is exported from no other known build of any version. The other seems to have been added for Windows Server 2003, then back-fitted into the roughly contemporaneous Windows 2000 SP4, skipping Windows XP entirely.

Neither of these functions is documented. The one whose export continues has, however, been presented publicly by Microsoft as a C-language declaration. This was just the once, possibly by oversight, in a header in the “minwin” subdirectory of what seem otherwise intended as user-mode inclusions for the 1511 edition of the Enterprise WDK for Windows 10.

Function Remarks
ObDeleteCapturedInsertInfo not in 5.1, restored for 5.2 and higher
PsSetNewKSecDD discontinued in 5.1