Geoff Chappell, Software Analyst
Windows 8 brought something new to the NT kernel: two new functions are exported only by ordinal. Microsoft’s typical practice is that such functions are not documented. Microsoft has, however, published C-language declarations for both, just the once, plausibly by mistake, in the 1511 edition of the Enterprise WDK for Windows 10.
| Ordinal | Function |
|---|---|
| 1 | PsCaptureUserProcessParameters |
| 2 | ZwCreateUserProcess |