Kernel Version 6.3 Exports By Name

This page lists the functions and variables that are newly exported by name from the Windows kernel in its first release for version 6.3, i.e., for the original Windows 8.1.

For the table below, documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. (If you read this website with scripts enabled, then hovering the mouse over any coloured text will produce a tooltip that shows why the text is coloured.) Functions that have their own non-trivial documentation are shown with no background colour. If the function is documented as reserved or obsolete, it is shaded red or shaded grey, respectively. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status. Many undocumented functions do at least have C-language declarations in one or another header file from the WDK. These are shaded orange, except for one special case. Some declarations are known only from “minwin” headers that Microsoft published in early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public knowledge even of the declaration is exceptional.

Few of the new functions for version 6.3 appear in the documentation that Microsoft offered when saying “The Windows Driver Kit (WDK) is integrated with Microsoft Visual Studio” whether in 2014 for Windows 8.1 or even in 2015 for Windows 10. Some show in a search online today (29th February 2016).

Name Export History Documentation History Notes
DbgkWerCaptureLiveKernelDump      
ExAcquireCacheAwarePushLockExclusiveEx      
ExAcquireCacheAwarePushLockSharedEx      
ExAcquirePushLockExclusiveEx      
ExAcquirePushLockSharedEx      
ExAllocateTimer   before 2013-2016, declared ok
ExCancelTimer   before 2013-2016, declared ok
ExCompositionObjectType (data)      
ExDeleteTimer   before 2013-2016, declared ok
ExReleaseCacheAwarePushLockExclusiveEx      
ExReleaseCacheAwarePushLockSharedEx      
ExReleasePushLockEx      
ExReleasePushLockExclusiveEx      
ExReleasePushLockSharedEx      
ExSetTimer   before 2013-2016, declared ok
ExTryAcquirePushLockExclusiveEx      
ExTryAcquirePushLockSharedEx      
ExTryConvertPushLockSharedToExclusiveEx      
ExTryToAcquireResourceExclusiveLite   in 3.51 to 5.2, declared doc: 3.51 etc
decl: 3.51 etc
ExUnblockOnAddressPushLockEx      
ExUnblockPushLockEx      

For the four functions that work with Executive Timer objects, the WDK documentation for Windows 8.1 and Windows 10 that Microsoft presents as “integrated” with successive editions of Visual Studio has a page titled ExXxxTimer Routines and EX_TIMER Objects that lists the functions, and even describes them, but the links to what might have been the documentation of the functions themselves are broken. Whether, or for how long, the supposedly same documentation online had this deficiency is not known, but each function’s documentation was seen to be available online in 2016.

Name Export History Documentation History Notes
FsRtlCheckUpperOplock     ok
FsRtlHeatInit      
FsRtlHeatLogIo      
FsRtlHeatLogTierMove      
FsRtlHeatUninit      
FsRtlInsertReservedPerFileContext discontinued in 1809    
FsRtlInsertReservedPerStreamContext discontinued in 1809    
FsRtlLookupReservedPerFileContext discontinued in 1809    
FsRtlLookupReservedPerStreamContext discontinued in 1809    
FsRtlRemoveReservedPerFileContext discontinued in 1809    
FsRtlRemoveReservedPerStreamContext discontinued in 1809    
FsRtlSendModernAppTermination      
FsRtlUpperOplockFsctrl     ok
HvlQueryNumaDistance     declared start is 6.2
InterlockedPushListSList     decl: 6.0 plus
since 6.0, declared start is 5.1
IoConvertFileHandleToKernelHandle      
IoGetGenericIrpExtension      
IoLoadCrashDumpDriver x64 only    
IoPropagateIrpExtension      
IoQueryFullDriverPath   before 2015-2016, declared ok
IoSetGenericIrpExtension      
IoSizeofGenericIrpExtension      
IoTestDependency      
KdAcquireDebuggerLock      
KdDeregisterPowerHandler      
KdRegisterPowerHandler      
KdReleaseDebuggerLock      
KeClockInterruptNotify      
KeClockTimerPowerChange      
KeFindFirstSetRightAffinityEx      
KeGetClockOwner      
KeGetClockTimerResolution      
KeGetNextClockTickDuration      
KeRemoveQueueDpcEx     ok
KitLogFeatureUsage      
MmCopyMemory   before 2015-2016, declared ok
MmGetCacheAttribute     ok
MmMdlPagesAreZero     ok
PoFxPowerOnCrashdumpDevice   before 10.0, declared ok
PoFxRegisterCrashdumpDevice   beofre 10.0, declared ok
PsGetProcessProtection      
PsIsProtectedProcessLight      
RtlAvlInsertNodeEx      
RtlAvlRemoveNode      
RtlGetAppContainerParent      
RtlGetAppContainerSidType      
RtlImageNtHeaderEx      
RtlInterlockedClearBitRun      
RtlInterlockedSetBitRun      
RtlInterlockedSetClearRun      
SeAdjustAccessStateForTrustLabel     ok
SeGetCachedSigningLevel      
SeIsParentOfChildAppContainer      
SeRegisterImageVerificationCallback     ok
SeShouldCheckForAccessRightsFromParent     ok
SeUnregisterImageVerificationCallback     ok
VfInsertContext      
VfQueryDeviceContext      
VfQueryDispatchTable      
VfQueryDriverContext      
VfQueryIrpContext      
VfQueryThreadContext      
VfRemoveContext      
ZwAssociateWaitCompletionPacket      
ZwCancelIoFileEx      
ZwCreateWaitCompletionPacket      
ZwLockVirtualMemory      
ZwProtectVirtualMemory      
ZwQuerySystemInformationEx      

Version 6.3 discontinues notably many exports, none of which are known ever to have been documented or declared. For each, the version in parentheses tells when exporting started: