Geoff Chappell - Software Analyst
OLD MATERIAL BEING UPDATED OR REWORKED - TAKE CARE
This page tabulates all the functions that are exported from NTDLL in what appears to be the original version 3.10. This is what the Windows that is its own operating system (in contrast to the Windows that runs on DOS) started with as its lowest-level user-mode Application Programming Interface (API).
Of 2,728 functions (and some variables) that had ever been exported from NTDLL in at least one known version up to and including the original release of Windows 10, 812 are original. Most are still exported as of Windows 10. Since by far the largest single addition was for Windows Vista, it is striking that in terms of available functions, though not perhaps in terms of what can or should be done with them, a fully-informed low-level user-mode programmer from the early 1990s would not have had much to learn for well over a decade (and even still might pass as well-equipped).
Also striking is that hardly any of these original functions are yet documented as being available in user mode as exports from NTDLL. This is not to say that all (or even most) should be, just that few are.
Documentation status is summarised by colour coding so that more detail can be conveyed with less text. (Had the website’s scripts run as expected, then hovering over any colour-coded text would produce a tooltip that shows why the text is coloured.) (To decode a colour, hover for a tooltip.)
NTDLL exports that have all along had their own non-trivial documentation as exports from NTDLL are shown with no background colour. So too are the exported NTDLL implementations of documented functions and variables from the C Run-Time Library.
NTDLL is low-level enough that some of its exported functions correspond closely to Windows Kernel Exports. Those that are documented in the Windows Driver Kit (WDK) for use by ring 0 software such as device drivers are shaded green to hint that they are documented in effect (even though the documentation rarely talks more than obliquely of being callable in user mode).
Functions that are explicitly documented as reserved or obsolete—no matter where—are shaded red or shaded grey, respectively, as quick indications that they are better avoided.
Functions that look to be completely undocumented get this website’s conventional distinction of being highlighted yellow. If a function is documented now but is known not to have been documented immediately, especially in the contemporaneous Software Development Kit (SDK), then it is shaded yellow to retain some of its previous status as undocumented. If the delayed documentation came specifically from the function’s listing among the Settlement Program Interfaces in late 2002 (but now long gone from Microsoft’s website), then the shading is less yellow since Microsoft at least acknowledged that the documentation was late. Exports whose WDK documentation took a while get a green tinge.
An undocumented function is shaded orange, as semi-documented, if it is at least declared in one or another header file from an SDK or, exceptionally, a Windows Driver Kit (WDK). Some undocumented functions aren’t declared in any header now but had declarations disclosed by Microsoft in a “minwin” subdirectory of early editions of the WDK for Windows 10 which Microsoft seems since to have been withdrawn from distribution. These are highlighted orange to indicate that public disclosure even of the declaration was exceptional.
Something to write here!
Being loaded into every user-mode process, NTDLL is naturally well-placed to be the client in every process’s communication with the Client-Server Run-Time System Service (CSRSS.EXE). In the early Windows versions, DLLs in this service provide the lowest-level user-mode handling of most Win32 functionality. All versions have one DLL, named CSRSRV, as the server-side receiver of communications to distribute to the other DLLs. Text in NTDLL version 3.10 suggests that the client side of the communications once had its own DLL, named CSRDLL, and early pre-release builds do indeed have a CSR.DLL that exports all the following 22 functions whose names begin with Csr. They were moved to NTDLL at least as early as build 328 (roughly a year before the formal release).
Take these functions as an internal detail of the most vital inter-process communication in the Win32 subsystem, and it should not surprise that none are known ever to have been declared in any header, let alone documented.
| Function | Export History |
|---|---|
| CsrAllocateCaptureBuffer | |
| CsrAllocateCapturePointer | discontinued in 5.0 |
| CsrAllocateMessagePointer | |
| CsrCaptureMessageBuffer | |
| CsrCaptureMessageString | |
| CsrCaptureTimeout | |
| CsrClientCallServer | |
| CsrClientConnectToServer | |
| CsrClientMaxMessage | discontinued in 4.0 |
| CsrClientSendMessage | discontinued in 4.0 |
| CsrClientThreadConnect | discontinued in 4.0 |
| CsrDumpProfile | discontinued in 3.50 |
| CsrFreeCaptureBuffer | |
| CsrIdentifyAlertableThread | |
| CsrNewThread | discontinued in 6.0 SP1 |
| CsrProbeForRead | discontinued in 6.0 |
| CsrProbeForWrite | discontinued in 6.0 |
| CsrSetPriorityClass | |
| CsrStartProfile | discontinued in 3.50 |
| CsrStopDumpProfile | discontinued in 3.50 |
| CsrStopProfile | discontinued in 3.50 |
| CsrpProcessCallbackRequest | discontinued in 4.0 |
Version 4.0 re-architected how Windows works with windows. Almost all functionality that supports the Graphical User Interface (GUI) that Windows users know and love is thereafter not done by inter-process communication with a server process in user mode but is instead directed in-process to a new kernel-mode module named WIN32K.SYS. The immediate consequence for NTDLL is that several of these Csr functions became superfluous and so they cease as exports.
However much this relocation of windowing from WINSRV.DLL in CSRSS to WIN32K.SYS in kernel mode may be celebrated (or, in some circles, mocked), it was not the first relocation from CSRSS to kernel mode. This unstated honour goes to profiling. As a hardware-based statistical sampling of processors’ execution this diagnostic technique necessarily requires kernel-mode support, but although the native API calls such as NtCreateProfile and NtStartProfile that get to the kernel-mode functionality are exported from all NTDLL versions and might be called from any process, the original intention looks to have been that the ones that do the work, rather than just the preparation or analysis, are better constrained to the CSRSS process. For instance, a client process calls the NTDLL function CsrStartProfile to reach CSRSS. On the server side, CSRSRV calls the NTDLL function RtlStartProfile, which in turn calls to kernel mode. Whether this was thought unnecessarily elaborate is not known, but it was scrapped as soon as version 3.50 and NTDLL never again exports Csr or Rtl functions for profiling.
| Function | Export History | Documentation History | Declaration History |
|---|---|---|---|
| DbgBreakPoint | in 5.1 to 5.2, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| DbgPrint | since 5.1, documented start is 5.0 | ||
| DbgPrompt | before 6.0, undocumented | ||
| DbgSsHandleKmApiMsg | discontinued in 5.1 | ||
| DbgSsInitialize | discontinued in 5.1 | ||
| DbgUiConnectToDbg | |||
| DbgUiContinue | |||
| DbgUiWaitStateChange | |||
| DbgUserBreakPoint |
The DbgBreakPoint function is the only known example of Microsoft’s having retracted a misrepresentation that a function requires Windows 2000 when in fact its availability is ancient. Perhaps someone with a level head (and the right clout) pointed out the absurdity that the one routine the kernel had from the start for the vital matter of breaking to a debugger had been documented all along but suddenly “can only be used in Windows 2000 and later.” The case is surely no different for the user-mode export. Either way, the implementation is the single-byte int 3 instruction. Its supposed unavailability until Windows 2000 is plainly absurd. But see that the fiction is maintained for the declaration.
Incidentally, though DbgBreakPoint is not formally documented for user mode, a jmp to it is the whole implementation of the documented KERNEL32 function DebugBreak in versions 3.10 to 6.0.
| Function | Export History |
|---|---|
| KiUserApcDispatcher | |
| KiUserExceptionDispatcher |
| Function | Export History |
|---|---|
| LdrAccessResource | |
| LdrFindEntryForAddress | |
| LdrFindResourceDirectory_U | |
| LdrFindResource_U | |
| LdrGetDllHandle | |
| LdrGetProcedureAddress | |
| LdrInitializeThunk | |
| LdrLoadDll | |
| LdrProcessRelocationBlock | |
| LdrQueryImageFileExecutionOptions | |
| LdrQueryProcessModuleInformation | |
| LdrShutdownProcess | |
| LdrShutdownThread | |
| LdrUnloadDll | |
| LdrVerifyImageMatchesChecksum |
| Function | Export History |
|---|---|
| NPXEMULATORTABLE (data) | discontinued in 5.1 |
| Function | Export History | Documentation History | Declaration History |
|---|---|---|---|
| NtAcceptConnectPort | |||
| NtAccessCheck | |||
| NtAccessCheckAndAuditAlarm | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.1 | |
| NtAdjustGroupsToken | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.1 | |
| NtAdjustPrivilegesToken | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| NtAlertResumeThread | |||
| NtAlertThread | |||
| NtAllocateLocallyUniqueId | before 6.1, undocumented; documented start is 6.0 |
not declared | |
| NtAllocateVirtualMemory | before 5.1 (IFS) to 6.0, undocumented; before 6.1, declared; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| NtCancelIoFile | |||
| NtCancelTimer | |||
| NtClose | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| NtCloseObjectAuditAlarm | |||
| NtCompleteConnectPort | |||
| NtConnectPort | in 6.0 only, declared | declared start is 5.1 | |
| NtContinue | |||
| NtCreateDirectoryObject | |||
| NtCreateEvent | before 6.1, undocumented; documented start is 5.1 |
not declared | |
| NtCreateEventPair | |||
| NtCreateFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| NtCreateKey | |||
| NtCreateMailslotFile | |||
| NtCreateMutant | |||
| NtCreateNamedPipeFile | |||
| NtCreatePagingFile | |||
| NtCreatePort | |||
| NtCreateProcess | |||
| NtCreateProfile | |||
| NtCreateSection | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.1 | |
| NtCreateSemaphore | |||
| NtCreateSymbolicLinkObject | |||
| NtCreateThread | |||
| NtCreateTimer | |||
| NtCreateToken | |||
| NtCurrentTeb | x86 only | ||
| NtDelayExecution | |||
| NtDeleteKey | |||
| NtDeleteValueKey | |||
| NtDeviceIoControlFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| NtDisplayString | |||
| NtDuplicateObject | before 6.1, undocumented; documented start is 5.0 |
not declared | |
| NtDuplicateToken | before 5.0 (IFS), undocumented;
before 6.1, declared; documented start is 5.0 |
since 6.0, declared start is 5.1 | |
| NtEnumerateKey | |||
| NtEnumerateValueKey | |||
| NtExtendSection | |||
| NtFlushBuffersFile | |||
| NtFlushInstructionCache | |||
| NtFlushKey | |||
| NtFlushVirtualMemory | |||
| NtFlushWriteBuffer | |||
| NtFreeVirtualMemory | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| NtFsControlFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| NtGetContextThread | |||
| NtGetTickCount | discontinued in 5.1; restored in 5.2 |
||
| NtImpersonateClientOfPort | |||
| NtImpersonateThread | |||
| NtInitializeRegistry | |||
| NtInitializeVDM | discontinued in 3.50 | ||
| NtListenPort | |||
| NtLoadDriver | |||
| NtLoadKey | |||
| NtLockFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; documented start is 6.1 |
since 6.0, declared start is 5.0 | |
| NtLockVirtualMemory | |||
| NtMakeTemporaryObject | |||
| NtMapViewOfSection | before 6.1, undocumented; since 6.1 revision, documented start is 5.0 |
not declared | |
| NtNotifyChangeDirectoryFile | |||
| NtNotifyChangeKey | |||
| NtOpenDirectoryObject | |||
| NtOpenEvent | |||
| NtOpenEventPair | |||
| NtOpenFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| NtOpenKey | |||
| NtOpenMutant | |||
| NtOpenObjectAuditAlarm | |||
| NtOpenProcess | before 6.1, declared; since 6.1 revision, documented start is 5.0 |
||
| NtOpenProcessToken | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| NtOpenSection | |||
| NtOpenSemaphore | |||
| NtOpenSymbolicLinkObject | |||
| NtOpenThread | |||
| NtOpenThreadToken | since 6.0, declared start is 5.0 | ||
| NtOpenTimer | |||
| NtPrivilegeCheck | |||
| NtPrivilegeObjectAuditAlarm | |||
| NtPrivilegedServiceAuditAlarm | |||
| NtProtectVirtualMemory | |||
| NtPulseEvent | |||
| NtQueryDefaultLocale | |||
| NtQueryDirectoryFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| NtQueryDirectoryObject | |||
| NtQueryEaFile | |||
| NtQueryEvent | |||
| NtQueryInformationFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| NtQueryInformationPort | |||
| NtQueryInformationProcess | |||
| NtQueryInformationThread | |||
| NtQueryInformationToken | before 5.0 (IFS), undocumented;
before 6.1, declared; documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| NtQueryIntervalProfile | |||
| NtQueryKey | |||
| NtQueryMutant | |||
| NtQueryObject | |||
| NtQueryPerformanceCounter | |||
| NtQuerySection | |||
| NtQuerySecurityObject | before 5.1 (IFS), undocumented;
before 6.1, declared; documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| NtQuerySemaphore | |||
| NtQuerySymbolicLinkObject | |||
| NtQuerySystemEnvironmentValue | |||
| NtQuerySystemInformation | |||
| NtQuerySystemTime | |||
| NtQueryTimer | |||
| NtQueryValueKey | |||
| NtQueryVirtualMemory | |||
| NtQueryVolumeInformationFile | before 5.1 (IFS), undocumented;
before 6.1, declared; documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| NtRaiseException | |||
| NtRaiseHardError | |||
| NtReadFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| NtReadRequestData | |||
| NtReadVirtualMemory | |||
| NtRegisterThreadTerminatePort | |||
| NtReleaseMutant | |||
| NtReleaseProcessMutant | discontinued in 4.0 | ||
| NtReleaseSemaphore | |||
| NtRenameValueKey | discontinued in 3.50 | ||
| NtReplaceKey | |||
| NtReplyPort | |||
| NtReplyWaitReceivePort | |||
| NtReplyWaitReplyPort | |||
| NtRequestPort | |||
| NtRequestWaitReplyPort | in 6.0 only, declared | declared start is 5.1 | |
| NtResetEvent | |||
| NtRestoreKey | |||
| NtResumeThread | |||
| NtSaveKey | |||
| NtSetContextThread | |||
| NtSetDefaultHardErrorPort | |||
| NtSetDefaultLocale | |||
| NtSetEaFile | |||
| NtSetEvent | before 6.1, undocumented; documented start is 5.1 |
not declared | |
| NtSetHighEventPair | |||
| NtSetHighWaitLowEventPair | |||
| NtSetHighWaitLowThread | discontinued in 5.0 | ||
| NtSetInformationFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| NtSetInformationKey | |||
| NtSetInformationProcess | |||
| NtSetInformationThread | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.1 | |
| NtSetInformationToken | |||
| NtSetIntervalProfile | |||
| NtSetLdtEntries | |||
| NtSetLowEventPair | |||
| NtSetLowWaitHighEventPair | |||
| NtSetLowWaitHighThread | discontinued in 5.0 | ||
| NtSetSecurityObject | before 5.1 (IFS), undocumented;
before 6.1, declared; documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| NtSetSystemEnvironmentValue | |||
| NtSetSystemTime | |||
| NtSetTimer | |||
| NtSetValueKey | |||
| NtSetVolumeInformationFile | before 5.2 (IFS), undocumented; before 6.1, declared; documented start is 5.2 |
||
| NtShutdownSystem | |||
| NtStartProfile | |||
| NtStopProfile | |||
| NtSuspendThread | |||
| NtSystemDebugControl | |||
| NtTerminateProcess | |||
| NtTerminateThread | |||
| NtTestAlert | |||
| NtUnloadDriver | |||
| NtUnloadKey | |||
| NtUnlockFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; documented start is 6.1 |
since 6.0, declared start is 5.0 | |
| NtUnlockVirtualMemory | |||
| NtUnmapViewOfSection | |||
| NtVdmControl | |||
| NtVdmStartExecution | discontinued in 3.50 | ||
| NtWaitForMultipleObjects | |||
| NtWaitForProcessMutant | discontinued in 4.0 | ||
| NtWaitForSingleObject | before 6.1, undocumented; documented start is 5.1 |
not declared | |
| NtWaitHighEventPair | |||
| NtWaitLowEventPair | |||
| NtWriteFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| NtWriteRequestData | |||
| NtWriteVirtualMemory |
The functions whose names begin with Nt correspond closely to functions whose names have the Zw prefix instead (see below). Put aside some general points about how the two differ, and documentation of an Nt function is to a large extent implied by documentation of the corresponding Zw function. Microsoft started making this explicit some time after releasing the WDK for Windows Vista. Documentation in the WDK for Windows 7 gives each Nt function its own page and directs attention to the page for the corresponding Zw function. The former warns expressly “Do not call this routine from kernel-mode code”, which is here taken as documenting the functions as reserved for kernel-mode use but not as NTDLL exports.
One oddity had better be remarked on now lest it be thought a mistake in the table. The NtGetTickCount function was dropped just for version 5.1. Its companion, ZwGetTickCount, was also dropped for version 5.1 but only NtGetTickCount reappears for version 5.2.
The NtNotifyChangeDirectoryFile function is mentioned in comments in NTIFS.H starting from the IFS Kit for Windows 2000 and in WDM.H starting from the WDK for Windows Vista, but has never yet been declared. The story is only slightly different for NtQueryEaFile: it too is mentioned in a comment in NTIFS.H from the IFS Kit for Windows 2000, but the comment then moves to WDM.H.
The NtQueryInformationThread function is mentioned in a comment in NTDDK.H from at least as far back as the Windows NT 3.51 DDK, presumably for its export from NTDLL.DLL in user mode, but has never yet been declared for use in programming.
Every known DDK and WDK mentions NtQuerySystemInformation in a comment, apparently meaning its export from NTDLL.DLL in user mode, without ever presenting a declaration.
The NtSetEaFile function is mentioned in a comment, first in the NTIFS.H from the Windows 2000 IFS Kit and then in WDM.H since the WDK for Windows Vista.
More obscurely, NtRequestPort and NtRequestWaitReplyPort share a comment in the NTIFS.H from the WDK for Windows Vista, which is never repeated in later editions. The second of this pair is notable because this header also declares the function (and also NtConnectPort). It is here speculated, though with some confidence, that these declarations started as early as an IFS Kit for Windows XP. For however long they were published, they’re long gone now.
The NtSetInformationProcess function is mentioned in increasingly many comments in NTDDK.H, starting as long ago as the DDK for Windows NT 3.51, yet it too never has been declared.
| Function | Documentation History | Declaration History |
|---|---|---|
| PfxFindPrefix | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 |
| PfxInitialize | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 |
| PfxInsertPrefix | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 |
| PfxRemovePrefix | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 |
| Function | Export History |
|---|---|
| RestoreEm87Context | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| Function | Export History | Documentation History | Declaration History |
|---|---|---|---|
| RtlAbortRXact | |||
| RtlAbsoluteToSelfRelativeSD | before 5.2 SP1 (IFS), undocumented;
documented start is 5.2 SP1 |
since 6.0, declared start is 5.2 SP1 | |
| RtlAcquirePebLock | |||
| RtlAcquireResourceExclusive | |||
| RtlAcquireResourceShared | |||
| RtlAddAccessAllowedAce | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlAddAccessDeniedAce | |||
| RtlAddAce | before 5.1 (IFS) to 6.0, undocumented;
documented start is 5.2 SP1 |
since 6.0, declared start is 5.0 | |
| RtlAddActionToRXact | |||
| RtlAddAttributeActionToRXact | |||
| RtlAddAuditAccessAce | |||
| RtlAdjustPrivilege | |||
| RtlAllocateAndInitializeSid | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.0 | |
| RtlAllocateHeap | before 5.1 (IFS), undocumented;
documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| RtlAnalyzeProfile | discontinued in 3.50 | ||
| RtlAnsiCharToUnicodeChar | before 6.1, undocumented; documented start is 5.0; documented but not declared |
||
| RtlAnsiStringToUnicodeSize | since 6.1 revision, documented start is 5.0 | ||
| RtlAnsiStringToUnicodeString | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlAppendAsciizToString | |||
| RtlAppendStringToString | before 5.0 (IFS), undocumented;
since 6.1, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlAppendUnicodeStringToString | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlAppendUnicodeToString | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlApplyRXact | |||
| RtlApplyRXactNoFlush | |||
| RtlAreAllAccessesGranted | |||
| RtlAreAnyAccessesGranted | |||
| RtlAreBitsClear | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlAreBitsSet | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlAssert | before 5.1, declared | ||
| RtlCaptureStackBackTrace | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; documented start is 5.1 |
since 6.0, declared start is 5.1 | |
| RtlCharToInteger | before 3.51, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlCheckRegistryKey | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlClearAllBits | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlClearBits | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlCompactHeap | |||
| RtlCompareMemory | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlCompareMemoryUlong | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlCompareString | before 3.50 to 3.51, undocumented;
since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlCompareUnicodeString | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlConsoleMultiByteToUnicodeN | |||
| RtlConvertExclusiveToShared | |||
| RtlConvertLongToLargeInteger | x86 only | since 6.1 revision, documented start is 5.0 | since 5.1, deprecated; since 6.0, deprecated (5.1) |
| RtlConvertSharedToExclusive | |||
| RtlConvertSidToUnicodeString | before 6.1, undocumented; documented start is 5.0 |
declared start is 5.0 | |
| RtlConvertUiListToApiList | discontinued in 6.3 | ||
| RtlConvertUlongToLargeInteger | x86 only | since 6.1 revision, documented start is 5.0 | since 5.1, deprecated; since 6.0, deprecated (5.1) |
| RtlCopyLuid | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlCopyLuidAndAttributesArray | |||
| RtlCopySecurityDescriptor | |||
| RtlCopySid | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlCopySidAndAttributesArray | |||
| RtlCopyString | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlCopyUnicodeString | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlCreateAcl | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlCreateAndSetSD | |||
| RtlCreateEnvironment | |||
| RtlCreateHeap | before 5.1 (IFS), undocumented;
documented start is 5.1 |
since 6.0, declared start is 5.1 | |
| RtlCreateProcessParameters | |||
| RtlCreateRegistryKey | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlCreateSecurityDescriptor | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlCreateUnicodeString | before 5.0 (IFS), undocumented; since 5.1 (IFS) to 6.0, documented start is 5.0 |
before 5.1 (IFS) to 6.0, not declared; since 6.0, declared start is 5.0 |
|
| RtlCreateUnicodeStringFromAsciiz | |||
| RtlCreateUserProcess | |||
| RtlCreateUserSecurityObject | |||
| RtlCreateUserThread | |||
| RtlCustomCPToUnicodeN | before 5.0 (IFS), undocumented;
before 5.1 (IFS) to 6.0, declared |
since 6.0, declared start is 5.0 | |
| RtlDeNormalizeProcessParams | |||
| RtlDelete | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlDeleteAce | before 5.1 (IFS) to 6.0, undocumented;
documented start is 5.2 SP1 |
||
| RtlDeleteCriticalSection | |||
| RtlDeleteElementGenericTable | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlDeleteRegistryValue | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlDeleteResource | |||
| RtlDeleteSecurityObject | |||
| RtlDestroyEnvironment | |||
| RtlDestroyHeap | before 5.1 (IFS), undocumented;
documented start is 5.1 |
since 6.0, declared start is 5.1 | |
| RtlDestroyProcessParameters | |||
| RtlDetermineDosPathNameType_U | |||
| RtlDoesFileExists_U | |||
| RtlDosPathNameToNtPathName_U | |||
| RtlDosSearchPath_U | |||
| RtlDumpResource | |||
| RtlEnlargedIntegerMultiply | x86 only | before 3.50 to 3.51, documented | since 5.1, deprecated |
| RtlEnlargedUnsignedDivide | x86 only; discontinued in 6.2 |
before 3.50 to 3.51, documented | since 5.1, deprecated |
| RtlEnlargedUnsignedMultiply | x86 only | before 3.50 to 3.51, documented | since 5.1, deprecated |
| RtlEnterCriticalSection | |||
| RtlEnumerateGenericTable | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlEnumerateGenericTableWithoutSplaying | before 5.0 (IFS), undocumented;
since 6.2, documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| RtlEqualComputerName | |||
| RtlEqualDomainName | |||
| RtlEqualLuid | before 4.0, undocumented; before 5.0, declared; since 6.1 revision, documented start is 5.0 |
||
| RtlEqualPrefixSid | |||
| RtlEqualSid | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlEqualString | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlEqualUnicodeString | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlEraseUnicodeString | |||
| RtlExpandEnvironmentStrings | discontinued in 3.50; partly restored in 6.0 |
||
| RtlExpandEnvironmentStrings_U | |||
| RtlExtendedIntegerMultiply | x86 only | before 3.50 to 3.51, documented | since 5.1, deprecated; since 6.0, declared start is 5.0 |
| RtlExtendedLargeIntegerDivide | x86 only | before 3.50 to 3.51, documented | since 5.1, deprecated; since 6.0, declared start is 5.0 |
| RtlExtendedMagicDivide | x86 only | before 3.50 to 3.51, documented | since 5.1, deprecated; since 6.0, declared start is 5.0 |
| RtlFillMemory | since 6.1 revision, documented start is 5.0 | ||
| RtlFillMemoryUlong | x86 only | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.1 |
| RtlFindClearBits | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlFindClearBitsAndSet | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlFindLongestRunClear | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlFindLongestRunSet | discontinued in 5.0 | in 5.0 (IFS), declared | |
| RtlFindMessage | |||
| RtlFindSetBits | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlFindSetBitsAndClear | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlFirstFreeAce | |||
| RtlFormatMessage | |||
| RtlFreeAnsiString | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlFreeHeap | before 5.1 (IFS), undocumented;
documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| RtlFreeOemString | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlFreeSid | |||
| RtlFreeUnicodeString | since 6.1 revision, documented start is 5.0 | ||
| RtlGenerate8dot3Name | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlGetAce | before 5.1 (IFS), undocumented; documented start is 5.1 |
||
| RtlGetCallersAddress | before 3.50 to 3.51, undocumented;
before 5.1, declared |
since 6.0, declared start is 5.0 | |
| RtlGetControlSecurityDescriptor | |||
| RtlGetCurrentDirectory_U | |||
| RtlGetDaclSecurityDescriptor | before 5.2 SP1 (IFS), undocumented;
documented start is 5.2 SP1 |
since 6.0, declared start is 5.0 | |
| RtlGetElementGenericTable | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlGetFullPathName_U | |||
| RtlGetGroupSecurityDescriptor | before 5.2 SP1 (IFS), undocumented;
documented start is 5.2 SP1 |
since 6.0, declared start is 5.2 SP1 | |
| RtlGetHandleValueHeap | discontinued in 3.50 | ||
| RtlGetHeapUserValue | discontinued in 3.50 | ||
| RtlGetNtGlobalFlags | |||
| RtlGetNtProductType | |||
| RtlGetOwnerSecurityDescriptor | before 5.0 (IFS), undocumented;
since 6.0, documented start is 5.0 |
before 5.1 (IFS) to 6.0, not declared; since 6.0, declared start is 5.0 |
|
| RtlGetSaclSecurityDescriptor | before 5.2 SP1 (IFS), undocumented; documented start is 5.2 SP1 |
since 6.0, declared start is 5.2 SP1 | |
| RtlIdentifierAuthoritySid | |||
| RtlImageDirectoryEntryToData | |||
| RtlImageNtHeader | |||
| RtlImpersonateSelf | |||
| RtlInitAnsiString | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlInitCodePageTable | before 5.0 (IFS), undocumented;
before 5.1 (IFS) to 6.0, declared |
since 6.0, declared start is 5.0 | |
| RtlInitNlsTables | |||
| RtlInitString | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlInitUnicodeString | since 6.1 revision, documented start is 5.0 | ||
| RtlInitializeBitMap | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlInitializeContext | |||
| RtlInitializeCriticalSection | |||
| RtlInitializeGenericTable | before 5.0 (IFS), undocumented;
since 6.1, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlInitializeProfile | discontinued in 3.50 | ||
| RtlInitializeRXact | |||
| RtlInitializeResource | |||
| RtlInitializeSid | before 5.0 (IFS), undocumented; since 5.1 (IFS) to 6.0, documented start is 5.0 |
before 5.1 (IFS) to 6.0, not declared; since 6.0, declared start is 5.0 |
|
| RtlInitializeStackTraceDataBase | discontinued in 3.50; restored in 5.1 SP2; discontinued in 6.0 |
||
| RtlInsertElementGenericTable | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlIntegerToChar | |||
| RtlIntegerToUnicodeString | |||
| RtlIsDosDeviceName_U | |||
| RtlIsGenericTableEmpty | in 5.0 (IFS), documented but not declared | ||
| RtlLargeIntegerAdd | x86 only | before 3.50 to 3.51, documented | since 5.1, deprecated |
| RtlLargeIntegerArithmeticShift | x86 only | before 3.50 to 3.51, documented | since 5.1, deprecated; since 6.0, deprecated (5.1) |
| RtlLargeIntegerDivide | x86 only | before 3.50 to 3.51, documented | since 5.1, deprecated; since 6.0, declared start is 5.0 |
| RtlLargeIntegerNegate | x86 only | before 3.50 to 3.51, documented | since 5.1, deprecated |
| RtlLargeIntegerShiftLeft | x86 only | before 3.50 to 3.51, documented | since 5.1, deprecated; since 6.0, deprecated (5.1) |
| RtlLargeIntegerShiftRight | x86 only | before 3.50 to 3.51, documented | since 5.1, deprecated; since 6.0, deprecated (5.1) |
| RtlLargeIntegerSubtract | x86 only | before 3.50 to 3.51, documented | since 5.1, deprecated |
| RtlLargeIntegerToChar | |||
| RtlLeaveCriticalSection | |||
| RtlLengthRequiredSid | before 5.0 (IFS), undocumented;
since 5.1 (IFS) to 6.0, documented start is 5.0 |
before 5.1 (IFS) to 6.0, not declared; since 6.0, declared start is 5.0 |
|
| RtlLengthSecurityDescriptor | before 3.50 to 3.51, undocumented;
since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlLengthSid | before 5.0 (IFS), undocumented; | since 6.0, declared start is 5.0 | |
| RtlLocalTimeToSystemTime | |||
| RtlLockHeap | |||
| RtlLogStackBackTrace | discontinued in 3.50; restored in 5.1 |
||
| RtlLookupElementGenericTable | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlLookupSymbolByAddress | discontinued in 3.50 | ||
| RtlLookupSymbolByName | discontinued in 3.50 | ||
| RtlMakeSelfRelativeSD | |||
| RtlMapGenericMask | before 4.0, undocumented; before 5.1, declared; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlMoveMemory | since 6.1 revision, documented start is 5.0 | ||
| RtlMultiByteToUnicodeN | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlMultiByteToUnicodeSize | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlNewInstanceSecurityObject | |||
| RtlNewSecurityGrantedAccess | |||
| RtlNewSecurityObject | |||
| RtlNormalizeProcessParams | |||
| RtlNtStatusToDosError | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, reserved; since 6.1, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlNumberGenericTableElements | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlNumberOfClearBits | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlNumberOfSetBits | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlOemStringToUnicodeSize | before 5.0 (IFS), undocumented | ||
| RtlOemStringToUnicodeString | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlOemToUnicodeN | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlOpenCurrentUser | |||
| RtlPcToFileHeader | documented only in SDK | ||
| RtlPrefixString | before 6.2, undocumented | ||
| RtlPrefixUnicodeString | before 4.0, undocumented; before 5.0, declared; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlQueryEnvironmentVariable | discontinued in 3.50; restored in 6.0 |
||
| RtlQueryEnvironmentVariable_U | |||
| RtlQueryInformationAcl | |||
| RtlQueryModuleInformation | discontinued in 3.50; restored in 6.0 |
||
| RtlQueryProcessBackTraceInformation | |||
| RtlQueryProcessHeapInformation | |||
| RtlQueryProcessLockInformation | |||
| RtlQueryRegistryValues | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlQuerySecurityObject | |||
| RtlQueryTimeZoneInformation | |||
| RtlRaiseException | |||
| RtlRaiseStatus | |||
| RtlRandom | before 5.0 (IFS), undocumented;
since 6.2, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlReAllocateHeap | |||
| RtlRealPredecessor | in 5.0 (IFS), documented but not declared | ||
| RtlRealSuccessor | in 5.0 (IFS), documented but not declared | ||
| RtlReleasePebLock | |||
| RtlReleaseResource | |||
| RtlRemoteCall | |||
| RtlResetRtlTranslations | |||
| RtlRunDecodeUnicodeString | |||
| RtlRunEncodeUnicodeString | |||
| RtlSecondsSince1970ToTime | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlSecondsSince1980ToTime | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlSelfRelativeToAbsoluteSD | before 5.2 SP1 (IFS), undocumented; documented start is 5.2 SP1 |
since 6.0, declared start is 5.2 SP1 | |
| RtlSetAllBits | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlSetBits | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlSetCurrentDirectory_U | |||
| RtlSetCurrentEnvironment | |||
| RtlSetDaclSecurityDescriptor | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlSetEnvironmentVariable | |||
| RtlSetGroupSecurityDescriptor | before 5.2 SP1 (IFS), undocumented;
documented start is 5.2 SP1 |
since 6.0, declared start is 5.2 SP1 | |
| RtlSetHandleValueHeap | discontinued in 3.50 | ||
| RtlSetHeapUserValue | discontinued in 3.50 | ||
| RtlSetInformationAcl | |||
| RtlSetOwnerSecurityDescriptor | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlSetSaclSecurityDescriptor | |||
| RtlSetSecurityObject | |||
| RtlSetTimeZoneInformation | |||
| RtlSizeHeap | |||
| RtlSnapshotHeap | discontinued in 3.50 | ||
| RtlSplay | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlStartProfile | discontinued in 3.50 | ||
| RtlStartRXact | |||
| RtlStopProfile | discontinued in 3.50 | ||
| RtlSubAuthorityCountSid | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.1 | |
| RtlSubAuthoritySid | before 5.0 (IFS), undocumented;
since 6.0, documented start is 5.0 |
before 5.1 (IFS) to 6.0, not declared; since 6.0, declared start is 5.0 |
|
| RtlSubtreePredecessor | before 5.1 (IFS) to 6.0, documented but not declared | ||
| RtlSubtreeSuccessor | before 5.1 (IFS) to 6.0, documented but not declared | ||
| RtlSystemTimeToLocalTime | |||
| RtlTimeFieldsToTime | before 3.50 to 3.51, undocumented;
since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlTimeToElapsedTimeFields | |||
| RtlTimeToSecondsSince1970 | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlTimeToSecondsSince1980 | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlTimeToTimeFields | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlUnicodeStringToAnsiSize | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
||
| RtlUnicodeStringToAnsiString | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlUnicodeStringToCountedOemString | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlUnicodeStringToInteger | since 6.1 revision, documented start is 5.0 | before 4.0, not declared; since 6.0, declared start is 5.0 |
|
| RtlUnicodeStringToOemSize | before 5.0 (IFS), undocumented | ||
| RtlUnicodeStringToOemString | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlUnicodeToCustomCPN | before 5.0 (IFS), undocumented;
before 5.1 (IFS) to 6.0, declared |
since 6.0, declared start is 5.0 | |
| RtlUnicodeToMultiByteN | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlUnicodeToMultiByteSize | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlUnicodeToOemN | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlUniform | |||
| RtlUnlockHeap | |||
| RtlUnwind | documented only in SDK | ||
| RtlUpcaseUnicodeChar | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlUpcaseUnicodeString | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlUpcaseUnicodeStringToAnsiString | |||
| RtlUpcaseUnicodeStringToCountedOemString | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlUpcaseUnicodeStringToOemString | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlUpcaseUnicodeToCustomCPN | before 5.0 (IFS), undocumented;
before 5.1 (IFS) to 6.0, declared |
since 6.0, declared start is 5.0 | |
| RtlUpcaseUnicodeToMultiByteN | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlUpcaseUnicodeToOemN | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlUpperChar | before 4.0, undocumented; before 5.0, declared; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlUpperString | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlValidAcl | |||
| RtlValidSecurityDescriptor | before 3.50 to 3.51, undocumented;
since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| RtlValidSid | before 5.0 (IFS), undocumented | since 6.0, declared start is 5.0 | |
| RtlValidateHeap | |||
| RtlWriteRegistryValue | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| RtlZeroMemory | since 6.1 revision, documented start is 5.0 | ||
| RtlpInitializeRtl | discontinued in 4.0 | ||
| RtlpNtCreateKey | |||
| RtlpNtEnumerateSubKey | |||
| RtlpNtMakeTemporaryKey | |||
| RtlpNtOpenKey | |||
| RtlpNtQueryValueKey | |||
| RtlpNtSetValueKey | |||
| RtlpUnWaitCriticalSection | |||
| RtlpWaitForCriticalSection |
Some Rtl functions are supposed above to have been documented first in an IFS Kit for Windows XP or for Windows Server 2003 SP1 even though neither kit has been obtained for inspection. In each such case, the function’s documentation in the WDK for Windows Vista is in the IFS section and already gives the earlier version as the minimum. The inference is that although the minimum is entirely fictitious for when the function is first exported from the kernel, it is credibly correct about when the function was first documented for use by non-Microsoft programmers. Beware of a further inference: conditional-compilation blocks that the WDK for Windows Vista adds to the declarations are here dismissed as having been written independently of the documentation, else RtlCreateHeap and RtlDestroyHeap were documented as early as the Windows XP IFS Kit while RtlAllocateHeap and RtlFreeHeap were not.
Though RtlEqualLuid is exported from all known versions of the Windows kernel, no known edition of NTDDK.H and WDM.H declares it as a function: all define it by macro.
That RtlFindLongestRunSet ceases as an exported function in version 5.0 may have been a late decision: it’s still declared in the NTIFS.H from the Windows 2000 IFS Kit.
The RtlFreeHeap function has the rare distinction of having changed its prototype while documented. Its return type widens from BOOLEAN to LOGICAL in version 6.2. This may have been motivated by a long-running off-and-on problem with matching the NTDLL implementation of RtlFreeHeap (returning a BOOLEAN) to the Win32 HeapFree function (returning a BOOL).
Another change of prototype affects RtlGenerate8dot3Name. Starting with version 6.0 SP1, it returns an NTSTATUS instead of returning nothing. Not until the WDK for Windows 8 does the documentation even show the new return type under the Syntax heading, but nothing in the Remarks alerts to the reader to any change of functionality and the textual description of the “Return value” persists as “None”. This didn’t get addressed until some time after the first WDK for Windows 10.
| Function | Export History | Documentation History | Declaration History |
|---|---|---|---|
| SaveEm87Context | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| Function | Export History | Documentation History | Declaration History |
|---|---|---|---|
| ZwAcceptConnectPort | |||
| ZwAccessCheck | |||
| ZwAccessCheckAndAuditAlarm | |||
| ZwAdjustGroupsToken | |||
| ZwAdjustPrivilegesToken | |||
| ZwAlertResumeThread | |||
| ZwAlertThread | |||
| ZwAllocateLocallyUniqueId | |||
| ZwAllocateVirtualMemory | before 5.0 (IFS), undocumented;
since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| ZwCancelIoFile | |||
| ZwCancelTimer | before 6.0, declared | ||
| ZwClose | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwCloseObjectAuditAlarm | |||
| ZwCompleteConnectPort | |||
| ZwConnectPort | in 5.1 (IFS) to 6.0, declared | in 6.0, declared start is 6.0 | |
| ZwContinue | |||
| ZwCreateDirectoryObject | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwCreateEvent | before 5.0 (IFS), undocumented; before 5.1 (IFS), declared; documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| ZwCreateEventPair | |||
| ZwCreateFile | before 3.50 to 3.51, undocumented;
since 6.1, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| ZwCreateKey | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwCreateMailslotFile | |||
| ZwCreateMutant | |||
| ZwCreateNamedPipeFile | |||
| ZwCreatePagingFile | |||
| ZwCreatePort | |||
| ZwCreateProcess | |||
| ZwCreateProfile | |||
| ZwCreateSection | before 5.0 (IFS), undocumented;
since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| ZwCreateSemaphore | |||
| ZwCreateSymbolicLinkObject | |||
| ZwCreateThread | |||
| ZwCreateTimer | before 4.0, undocumented; before 6.0, declared |
since 6.0, declared start is 5.0 | |
| ZwCreateToken | |||
| ZwDelayExecution | |||
| ZwDeleteKey | before 3.50 to 3.51, undocumented;
since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| ZwDeleteValueKey | before 5.1, undocumented; before 6.1, documented start is 5.1; documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| ZwDeviceIoControlFile | before 5.0 (IFS), undocumented;
since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| ZwDisplayString | before 6.1, undocumented | declared start is 5.0 | |
| ZwDuplicateObject | before 5.0 (IFS), undocumented;
before 5.1 (IFS) to 6.0, declared; before 6.2, reserved; since 6.2, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| ZwDuplicateToken | before 6.1, undocumented; documented start is 5.0 |
||
| ZwEnumerateKey | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwEnumerateValueKey | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwExtendSection | |||
| ZwFlushBuffersFile | |||
| ZwFlushInstructionCache | |||
| ZwFlushKey | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwFlushVirtualMemory | before 5.1 (IFS), undocumented; documented start is 5.1 |
||
| ZwFlushWriteBuffer | |||
| ZwFreeVirtualMemory | before 5.0 (IFS), undocumented;
since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| ZwFsControlFile | before 5.1 (IFS) to 6.0, undocumented;
since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| ZwGetContextThread | |||
| ZwGetTickCount | discontinued in 5.1 | ||
| ZwImpersonateClientOfPort | |||
| ZwImpersonateThread | |||
| ZwInitializeRegistry | |||
| ZwInitializeVDM | discontinued in 3.50 | ||
| ZwListenPort | |||
| ZwLoadDriver | before 5.1 (IFS), undocumented;
documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| ZwLoadKey | |||
| ZwLockFile | |||
| ZwLockVirtualMemory | |||
| ZwMakeTemporaryObject | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwMapViewOfSection | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwNotifyChangeDirectoryFile | |||
| ZwNotifyChangeKey | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| ZwOpenDirectoryObject | before 5.1 (IFS), undocumented;
documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| ZwOpenEvent | before 6.0, undocumented; documented start is 5.2 |
since 6.0, declared start is 5.2 | |
| ZwOpenEventPair | |||
| ZwOpenFile | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| ZwOpenKey | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwOpenMutant | |||
| ZwOpenObjectAuditAlarm | |||
| ZwOpenProcess | before 6.0, undocumented; since 6.1 revision, documented start is 5.0 |
||
| ZwOpenProcessToken | |||
| ZwOpenSection | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwOpenSemaphore | |||
| ZwOpenSymbolicLinkObject | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| ZwOpenThread | |||
| ZwOpenThreadToken | |||
| ZwOpenTimer | before 6.0, declared | ||
| ZwPrivilegeCheck | |||
| ZwPrivilegeObjectAuditAlarm | |||
| ZwPrivilegedServiceAuditAlarm | |||
| ZwProtectVirtualMemory | |||
| ZwPulseEvent | |||
| ZwQueryDefaultLocale | |||
| ZwQueryDirectoryFile | before 5.0 (IFS), undocumented; since 5.1 (IFS), documented start is 5.1 |
before 5.1 (IFS), not declared; since 6.0, declared start is 5.0 |
|
| ZwQueryDirectoryObject | |||
| ZwQueryEaFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.2, declared |
||
| ZwQueryEvent | |||
| ZwQueryInformationFile | before 3.50 to 3.51, undocumented;
since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| ZwQueryInformationPort | |||
| ZwQueryInformationProcess | |||
| ZwQueryInformationThread | |||
| ZwQueryInformationToken | before 5.1 (IFS), undocumented;
documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| ZwQueryIntervalProfile | |||
| ZwQueryKey | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwQueryMutant | |||
| ZwQueryObject | before 6.1, undocumented; documented start is 5.0 |
declared start is 5.0 | |
| ZwQueryPerformanceCounter | |||
| ZwQuerySection | |||
| ZwQuerySecurityObject | before 5.1 (IFS), undocumented; documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| ZwQuerySemaphore | |||
| ZwQuerySymbolicLinkObject | before 5.0, undocumented; since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| ZwQuerySystemEnvironmentValue | |||
| ZwQuerySystemInformation | |||
| ZwQuerySystemTime | |||
| ZwQueryTimer | |||
| ZwQueryValueKey | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwQueryVirtualMemory | |||
| ZwQueryVolumeInformationFile | before 5.1 (IFS) to 6.0, undocumented;
since 6.2, documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| ZwRaiseException | |||
| ZwRaiseHardError | |||
| ZwReadFile | before 3.50 to 3.51, undocumented;
since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| ZwReadRequestData | |||
| ZwReadVirtualMemory | |||
| ZwRegisterThreadTerminatePort | |||
| ZwReleaseMutant | |||
| ZwReleaseProcessMutant | discontinued in 4.0 | ||
| ZwReleaseSemaphore | |||
| ZwRenameValueKey | discontinued in 3.50 | ||
| ZwReplaceKey | |||
| ZwReplyPort | |||
| ZwReplyWaitReceivePort | |||
| ZwReplyWaitReplyPort | |||
| ZwRequestPort | |||
| ZwRequestWaitReplyPort | in 5.1 (IFS) to 6.0, declared | in 6.0, declared start is 5.0 | |
| ZwResetEvent | |||
| ZwRestoreKey | before 6.2, undocumented | declared start is 6.1 | |
| ZwResumeThread | |||
| ZwSaveKey | before 6.2, undocumented | declared start is 6.1 | |
| ZwSetContextThread | |||
| ZwSetDefaultHardErrorPort | |||
| ZwSetDefaultLocale | |||
| ZwSetEaFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.2, declared |
||
| ZwSetEvent | before 5.0 (IFS), undocumented; before 5.1 (IFS), declared; documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| ZwSetHighEventPair | |||
| ZwSetHighWaitLowEventPair | |||
| ZwSetHighWaitLowThread | discontinued in 5.0 | ||
| ZwSetInformationFile | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwSetInformationKey | |||
| ZwSetInformationProcess | |||
| ZwSetInformationThread | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwSetInformationToken | |||
| ZwSetIntervalProfile | |||
| ZwSetLdtEntries | |||
| ZwSetLowEventPair | |||
| ZwSetLowWaitHighEventPair | |||
| ZwSetLowWaitHighThread | discontinued in 5.0 | ||
| ZwSetSecurityObject | before 5.1 (IFS), undocumented; documented start is 5.1 |
||
| ZwSetSystemEnvironmentValue | |||
| ZwSetSystemTime | |||
| ZwSetTimer | before 4.0, undocumented; before 6.0, declared |
since 6.0, declared start is 5.0 | |
| ZwSetValueKey | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwSetVolumeInformationFile | before 5.2 (IFS), undocumented; documented start is 5.2 |
||
| ZwShutdownSystem | |||
| ZwStartProfile | |||
| ZwStopProfile | |||
| ZwSuspendThread | |||
| ZwSystemDebugControl | |||
| ZwTerminateProcess | before 6.0, undocumented; since 6.1 revision, documented start is 5.0 |
||
| ZwTerminateThread | |||
| ZwTestAlert | |||
| ZwUnloadDriver | before 5.1 (IFS), undocumented; documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| ZwUnloadKey | |||
| ZwUnlockFile | |||
| ZwUnlockVirtualMemory | |||
| ZwUnmapViewOfSection | since 6.1 revision, documented start is 5.0 | since 6.0, declared start is 5.0 | |
| ZwVdmControl | |||
| ZwVdmStartExecution | discontinued in 3.50 | ||
| ZwWaitForMultipleObjects | |||
| ZwWaitForProcessMutant | discontinued in 4.0 | ||
| ZwWaitForSingleObject | before 5.0 (IFS), undocumented; before 5.1 (IFS), declared; documented start is 5.1 |
since 6.0, declared start is 5.0 | |
| ZwWaitHighEventPair | |||
| ZwWaitLowEventPair | |||
| ZwWriteFile | before 3.50 to 3.51, undocumented;
since 6.1 revision, documented start is 5.0 |
since 6.0, declared start is 5.0 | |
| ZwWriteRequestData | |||
| ZwWriteVirtualMemory |
The documentation history of ZwDeleteValueKey is complicated by documentation in parallel. No documentation or declaration is known from any DDK before Windows XP. In the WDK for Windows Vista, however, it has two pages: one under Installable File System; the other in the general section for Driver Support Routines. Presumably, it had been documented in an IFS Kit before the merger into the WDK for Windows Vista. The IFS documentation starts the function’s availability at Windows XP. Without a Windows XP IFS Kit for reference, it can’t be discounted as the first documentation. The less developed documentation in the general section appears first in the DDK for Windows Server 2003 SP1 and says nothing about availability. The WDK for Windows 7 drops it in favour of the IFS documentation, but with the function’s availability changed to Windows 2000 and later.
Though ZwQueryDirectoryFile is documented in the Windows 2000 IFS Kit, it comes with a warning in red that “This is preliminary documentation and subject to change” and the NTIFS.H from the same kit does not declare the function. Presumably, the documentation was settled in time for the Windows XP IFS Kit and Microsoft has ever since meant that Windows XP is when the function became documented for use. A declaration was perhaps also settled on as early as the Windows XP IFS Kit. Certainly, a declaration is presented in the WDK for Windoiws Vista, but with a conditional-compilation block that doesn’t agree with the documentation.
| Function | Export History |
|---|---|
| __eCommonExceptions | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eEmulatorInit | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eF2XM1 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFABS | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFADD32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFADD64 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFADDPreg | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFADDreg | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFADDtop | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFCHS | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFCOM | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFCOM32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFCOM64 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFCOMP | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFCOMP32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFCOMP64 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFCOMPP | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFCOS | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFDECSTP | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFDIV32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFDIV64 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFDIVPreg | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFDIVR32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFDIVR64 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFDIVRPreg | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFDIVRreg | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFDIVRtop | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFDIVreg | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFDIVtop | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFFREE | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFIADD16 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFIADD32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFICOM16 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFICOM32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFICOMP16 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFICOMP32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFIDIV16 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFIDIV32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFIDIVR16 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFIDIVR32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFILD16 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFILD32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFILD64 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFIMUL16 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFIMUL32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFINCSTP | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFINIT | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFIST16 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFIST32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFISTP16 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFISTP32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFISTP64 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFISUB16 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFISUB32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFISUBR16 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFISUBR32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFLD1 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFLD32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFLD64 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFLD80 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFLDCW | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFLDENV | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFLDL2E | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFLDLN2 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFLDPI | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFLDZ | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFMUL32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFMUL64 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFMULPreg | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFMULreg | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFMULtop | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFPATAN | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFPREM | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFPREM1 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFPTAN | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFRNDINT | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFRSTOR | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSAVE | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSCALE | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSIN | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSQRT | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFST | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFST32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFST64 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSTCW | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSTENV | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSTP | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSTP32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSTP64 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSTP80 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSTSW | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSUB32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSUB64 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSUBPreg | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSUBR32 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSUBR64 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSUBRPreg | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSUBRreg | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSUBRtop | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSUBreg | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFSUBtop | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFTST | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFUCOM | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFUCOMP | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFUCOMPP | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFXAM | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFXCH | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFXTRACT | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFYL2X | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eFYL2XP1 | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
| __eGetStatusWord | discontinued in 5.1 SP2; discontinued in 5.2 SP1; discontinued in 6.0 |
These several dozen functions for floating-point emulation eventually got discontinued in what looks to have been a clean-up across multiple versions (contemporaneous with the release of 64-bit Windows for the x64 platform). These functions drop out from version 5.1 at Windows XP SP2 and from version 5.2 at Windows Server 2003 SP1 and do not survive at all to version 6.0. Some may say this was long past time, especially since even the original Windows XP requires the cmpxchg8b instruction and thus in practice (if only for processors made by Intel) a CPU that’s recent enough to be sure of having a built-in floating-point unit.
| Function | Export History |
|---|---|
| xRtlDosPathNameToNtPathName | discontinued in 3.50 |