KERNEL32 3.51 Exports

The table below lists all the functions that are exported from KERNEL32 version 3.51. For the purpose of this study, without having found an earlier (32-bit) Windows NT for inspection, these functions are treated as original. Almost all are still exported as of version 10.0, though many are now implemented in other DLLs.

A summary of documentation status is conveyed by colour coding. If you browse with scripting enabled, hovering over any text that has a background colour should produce a tooltip that explains the formatting. Most exports from KERNEL32 exist to be used as the basis for Win32 programming by arbitrary hands and have therefore had non-trivial documentation all along. These are shown with no background colour. If the whole of the documentation is just that the function is reserved or obsolete, without even giving a prototype, then the function is highlighted red or highlighted pink, respectively. Functions that look to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented immediately, especially in the contemporaneous Software Development Kit (SDK), then it is shaded yellow to retain some of its previous status as undocumented. If the delayed documentation came specifically from the function’s listing among the Settlement Program Interfaces in late 2002, then the shading is less yellow since Microsoft at least acknowledged that the documentation was late. An undocumented function is highlighted orange, as semi-documented, if it is at least declared in one or another header file from an SDK or, exceptionally, a Windows Driver Kit (WDK). KERNEL32 is low-level enough that some functions are documented in the Windows Driver Kit (WDK), typically as exports from the NT kernel for use by ring 0 software such as device drivers, but sometimes with non-specific talk of being callable from user mode. Such functions are shaded blue if they seem always to have had such documentation, but a brighter blue if the WDK documentation was not immediate.

Though almost all KERNEL32 functions are nowadays documented, not all these original functions have been documented from the beginning. These are marked below with as much precision as I happen to know by looking at MSDN Library editions on CD, each dated January for 2001, 2004 and 2007. For example, if a function is not yet documented for the MSDN Library on CD dated January 2001 but is by January 2004, it is marked as “undocumented until 2001-2003”. Microsoft would have it believed that some of these late-documented functions require at least Windows XP.

Microsoft’s documentation is surely not intended nowadays, if it ever was, as a historical record of when any functions were first exported from KERNEL32. Though some of these original functions retain “Windows 95, Windows NT 3.1” as the “minimum operating systems”, references to early Windows versions have mostly been pruned from the documentation, presumably as those versions drop from being supported. Thus, where the MSDN Library from January 2001 typically dates these original functions to a “Windows NT 3.1” (not found for this study), the corresponding documentation from January 2004 and even January 2007 talks less specifically of “Windows NT Workstation” and “Windows NT Server”. In 2009, in the SDK for Windows 7, these original functions are typically said by Microsoft to require at least Windows 2000. Only if that SDK’s documentation would restrict a function to an even later version is it remarked on in the table.

All functions that are exported from version 3.51 are exported from at least some later version. However, some carry to version 4.0 only in the NT builds, i.e., not for Windows 95. If such a function is not exported from the KERNEL32 for any later versions of the Windows that runs on DOS, it is marked “NT only”. A function that is marked “NT-only in 4.0” is skipped for Windows 95 but is picked up for Windows 98, i.e., version 4.10.

It ought perhaps also to be stressed here that a function’s appearance in this table means only that the function is exported from KERNEL32 as early as some build of version 3.51. It does not mean that the function is implemented non-trivially in that version, let alone in any later versions. It does not mean that the function works, whether as documented by Microsoft or as supposed by anyone else. It means just that the function is exported and therefore can be located and called from outside KERNEL32, for better or worse.

Some few of these original functions seem always—at least in the NT builds—to have been implemented only as forwards to another module, such that although the function appears in the KERNEL32 export table, it has no code in KERNEL32. Many more become forwards in later versions.

A handful of functions eventually cease to be forwarded. One case is notable because it is a bug fix. Forwarding HeapFree to the NTDLL function RtlFreeHeap had the effect of making HeapFree appear to return only an 8-bit BOOLEAN instead of the documented 32-bit BOOL. This was not corrected until version 6.0. (It would be a very rare programmer who ever, let alone habitually, checks what HeapFree returns.)

Especially in version 6.1 and higher, many functions—indeed, most that are in everyday use by real-word programmers—are implemented within KERNEL32 only as stubs, to jump to a more substantial implementation elsewhere. Some stubs are nothing but an indirect jmp instruction through a pointer in the Import Address Table. Others have some amount of prolog code. Identifying these exported functions that are implemented as jumps can involve some editorial assessment and is anyway likely to be always a work in progress.