Geoff Chappell - Software Analyst
OLD MATERIAL BEING UPDATED OR REWORKED - TAKE CARE
This page lists the 136 exports that were newly added to NTDLL for version 3.50. This was the second version of what was then the new Windows that is its own operating system. It brought some rethinking, not just to add functionality but to prune: 27 of the original exports are discontinued.
Documentation status is summarised by colour coding so that more detail can be conveyed with less text. (Had the website’s scripts run as expected, then hovering over any colour-coded text would produce a tooltip that shows why the text is coloured.) (To decode a colour, hover for a tooltip.)
NTDLL exports that have all along had their own non-trivial documentation as exports from NTDLL are shown with no background colour. So too are the exported NTDLL implementations of documented functions and variables from the C Run-Time Library.
NTDLL is low-level enough that some of its exported functions correspond closely to Windows Kernel Exports. Those that are documented in the Windows Driver Kit (WDK) for use by ring 0 software such as device drivers are shaded green to hint that they are documented in effect (even though the documentation rarely talks more than obliquely of being callable in user mode).
Functions that are explicitly documented as reserved or obsolete—no matter where—are shaded red or shaded grey, respectively, as quick indications that they are better avoided.
Functions that look to be completely undocumented get this website’s conventional distinction of being highlighted yellow. If a function is documented now but is known not to have been documented immediately, especially in the contemporaneous Software Development Kit (SDK), then it is shaded yellow to retain some of its previous status as undocumented. If the delayed documentation came specifically from the function’s listing among the Settlement Program Interfaces in late 2002 (but now long gone from Microsoft’s website), then the shading is less yellow since Microsoft at least acknowledged that the documentation was late. Exports whose WDK documentation took a while get a green tinge.
An undocumented function is shaded orange, as semi-documented, if it is at least declared in one or another header file from an SDK or, exceptionally, a Windows Driver Kit (WDK). Some undocumented functions aren’t declared in any header now but had declarations disclosed by Microsoft in a “minwin” subdirectory of early editions of the WDK for Windows 10 which Microsoft seems since to have been withdrawn from distribution. These are highlighted orange to indicate that public disclosure even of the declaration was exceptional.
| Function | Export History | Remarks |
|---|---|---|
| LdrDisableThreadCalloutsForDll | ||
| NlsMbCodePageTag (data) | documented in 2008-2009 as NLS_MB_CODE_PAGE_TAG macro | |
| NlsMbOemCodePageTag (data) | ||
| NtClearEvent | ||
| NtCreateIoCompletion | ||
| NtDeleteFile | undocumented until 2008-2009; documentation requires Windows XP and higher; not declared |
|
| NtOpenIoCompletion | ||
| NtQueryAttributesFile | ||
| NtQueryIoCompletion | ||
| NtQueryTimerResolution | ||
| NtRemoveIoCompletion | ||
| NtSetInformationObject | ||
| NtSetSystemInformation | ||
| NtSetTimerResolution | ||
| RtlCompressBuffer | undocumented until 2000-2006; documented until 2007 as “reserved for system use”; documentation since 2007 requires Windows XP and higher; declaration requires Windows XP and higher |
|
| RtlCutoverTimeToSystemTime | declared in Windows 10 WDK | |
| RtlDecompressBuffer | undocumented until 2000-2006; documented until 2007 as “reserved for system use”; documentation since 2007 requires Windows XP and higher; declaration requires Windows XP and higher |
|
| RtlDecompressFragment | undocumented until 2000-2006; documented until 2007 as “reserved for system use”; documentation since 2007 requires Windows XP and higher; declaration requires Windows XP and higher |
|
| RtlFormatCurrentUserKeyPath | ||
| RtlGetCompressionWorkSpaceSize | undocumented until 2000-2006; documented until 2007 as “reserved for system use”; documentation since 2007 requires Windows XP and higher; declaration requires Windows XP and higher |
|
| RtlGetUserFlagsHeap | discontinued in 3.51 | |
| RtlGetUserValueHeap | discontinued in 3.51 | |
| RtlIsTextUnicode | ||
| RtlSetUserFlagsHeap | ||
| RtlSetUserValueHeap | ||
| RtlWalkHeap | ||
| RtlZeroHeap | ||
| RtlxAnsiStringToUnicodeSize | undocumented until 2005-2006; declaration requires Windows 2000 and higher |
|
| RtlxOemStringToUnicodeSize | undocumented until 2007; documented as “reserved for system use” |
|
| RtlxUnicodeStringToAnsiSize | undocumented until 1996-2000; declaration requires Windows 2000 and higher |
|
| RtlxUnicodeStringToOemSize | undocumented until 2007; documented as “reserved for system use” |
|
| ZwClearEvent | declared in Windows 10 WDK | |
| ZwCreateIoCompletion | declared in Windows 10 WDK | |
| ZwDeleteFile | undocumented until 2000-2006; documentation requires XP and higher; declaration requires Windows 2000 and higher |
|
| ZwOpenIoCompletion | declared in Windows 10 WDK | |
| ZwQueryAttributesFile | declared in Windows 10 WDK | |
| ZwQueryIoCompletion | declared in Windows 10 WDK | |
| ZwQueryTimerResolution | declared in Windows 10 WDK | |
| ZwRemoveIoCompletion | declared in Windows 10 WDK | |
| ZwSetInformationObject | declared in Windows 10 WDK | |
| ZwSetSystemInformation | declared in Windows 10 WDK | |
| ZwSetTimerResolution | declared in Windows 10 WDK | |
| _CIpow | x86 only | |
| _abnormal_termination | discontinued in 3.51 | |
| _chkstk | x86 only | undocumented until 2001-2002 |
| _except_handler2 | discontinued in 3.51 | |
| _fltused (data) | ||
| _ftol | x86 only | |
| _global_unwind2 | discontinued in 3.51 | |
| _itoa | ||
| _local_unwind2 | discontinued in 3.51 | |
| _ltoa | ||
| _memccpy | ||
| _memicmp | ||
| _snprintf | ||
| _snwprintf | ||
| _splitpath | ||
| _strcmpi | ||
| _stricmp | ||
| _strlwr | ||
| _strnicmp | ||
| _strupr | ||
| _ultoa | ||
| _vsnprintf | ||
| _wcsicmp | ||
| _wcslwr | ||
| _wcsnicmp | ||
| _wcsupr | ||
| abs | ||
| atan | ||
| atoi | ||
| atol | ||
| ceil | ||
| cos | ||
| fabs | ||
| floor | ||
| isalpha | ||
| isdigit | ||
| islower | ||
| isprint | ||
| isspace | ||
| isupper | ||
| iswalpha | ||
| iswctype | ||
| isxdigit | ||
| labs | ||
| log | ||
| mbstowcs | ||
| memchr | ||
| memcmp | ||
| memcpy | ||
| memmove | ||
| memset | ||
| pow | ||
| qsort | ||
| sin | ||
| sprintf | ||
| sqrt | ||
| sscanf | ||
| strcat | ||
| strchr | ||
| strcmp | ||
| strcpy | ||
| strcspn | ||
| strlen | ||
| strncat | ||
| strncmp | ||
| strncpy | ||
| strpbrk | ||
| strrchr | ||
| strspn | ||
| strstr | ||
| swprintf | ||
| tan | ||
| tolower | ||
| toupper | ||
| towlower | ||
| towupper | ||
| vsprintf | ||
| wcscat | ||
| wcschr | ||
| wcscmp | ||
| wcscpy | ||
| wcscspn | ||
| wcslen | ||
| wcsncat | ||
| wcsncmp | ||
| wcsncpy | ||
| wcspbrk | ||
| wcsrchr | ||
| wcsspn | ||
| wcsstr | ||
| wcstok | discontinued in 4.0 | |
| wcstol | ||
| wcstombs | ||
| wcstoul |
Roughly two dozen of the original exports did not survive to the second version. None are known ever to have been documented:
Curiously, several of these exports that were dropped so early become exported again after a break. The first is RtlLogStackBackTrace, which is revived for version 5.1 and higher. The related function RtlInitializeStackTraceDataBase waited for re-export until version 5.1 SP2 but was dropped again at version 6.0. Three more are exported again in version 6.0 and higher: