Geoff Chappell, Software Analyst
The table below lists the 581 exports that are new to NTDLL for version 6.0, i.e., Windows Vista. If only in terms of numbers, this version brings easily the most new functionality since Windows NT 3.51. Hardly any of it is documented. Of the many hundreds of new functions, a handful are documented in their own right from the beginning, more were documented for the first service pack, and a few dozen are documented indirectly as exports from KERNEL32 or ADVAPI32.
Documentation status is conveyed by colour coding. If you browse with scripting enabled, hovering over any text that has a background colour should produce a tooltip that explains the formatting. NTDLL exports that have all along had their own non-trivial documentation as exports from NTDLL are shown with no background colour. So too are the NTDLL implementations of documented functions and variables from the C Run-Time Library. If the whole of the documentation is just that the function is reserved or obsolete, without even giving a prototype, then the function is highlighted red or highlighted pink, respectively. Functions that look to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented immediately, especially in the contemporaneous Software Development Kit (SDK), then it is shaded yellow to retain some of its previous status as undocumented. If the delayed documentation came specifically from the function’s listing among the Settlement Program Interfaces in late 2002, then the shading is less yellow since Microsoft at least acknowledged that the documentation was late. An undocumented function is highlighted orange, as semi-documented, if it is at least declared in one or another header file from an SDK or, exceptionally, a Windows Driver Kit (WDK). NTDLL is low-level enough that some functions are documented in the Windows Driver Kit (WDK), typically as exports from the NT kernel for use by ring 0 software such as device drivers, but sometimes with non-specific talk of being callable from user mode. Such functions are shaded blue if they seem always to have had such documentation, but a brighter blue if the WDK documentation was not immediate. A function is shaded grey if it seems not to be documented but is known to be the entire low-level implementation of some function in a higher-level DLL such as KERNEL32 or ADVAPI32. Identifying these is a work in progress.
| Function | Remarks |
|---|---|
| A_SHAFinal | forwarded from ADVAPI32 function A_SHAFinal in 6.0 and higher |
| A_SHAInit | forwarded from ADVAPI32 function A_SHAInit in 6.0 and higher |
| A_SHAUpdate | forwarded from ADVAPI32 function A_SHAUpdate in 6.0 and higher |
| AlpcAdjustCompletionListConcurrencyCount | |
| AlpcFreeCompletionListMessage | |
| AlpcGetCompletionListLastMessageInformation | |
| AlpcGetCompletionListMessageAttributes | |
| AlpcGetHeaderSize | |
| AlpcGetMessageAttribute | |
| AlpcGetMessageFromCompletionList | |
| AlpcGetOutstandingCompletionListMessageCount | |
| AlpcInitializeMessageAttribute | |
| AlpcMaxAllowedMessageLength | |
| AlpcRegisterCompletionList | |
| AlpcRegisterCompletionListWorkerThread | |
| AlpcUnregisterCompletionList | |
| AlpcUnregisterCompletionListWorkerThread | |
| CsrVerifyRegion | |
| EtwDeliverDataBlock | |
| EtwEnumerateProcessRegGuids | declared in Windows 10 WDK |
| EtwEventActivityIdControl | forwarded from ADVAPI32 function EventActivityIdControl in 6.0 and higher; declared in Windows 10 WDK |
| EtwEventEnabled | forwarded from ADVAPI32 function EventEnabled in 6.0 and higher |
| EtwEventProviderEnabled | forwarded from ADVAPI32 function EventProviderEnabled in 6.0 and higher; declared in Windows 10 WDK |
| EtwEventRegister | forwarded from ADVAPI32 function EventRegister in 6.0 and higher; declared in Windows 10 WDK |
| EtwEventUnregister | forwarded from ADVAPI32 function EventUnregister in 6.0 and higher; declared in Windows 10 WDK |
| EtwEventWrite | forwarded from ADVAPI32 function EventWrite in 6.0 and higher; declared in Windows 10 WDK |
| EtwEventWriteEndScenario | forwarded from ADVAPI32 function EventWriteEndScenario in 6.0 and higher; declared in Windows 10 WDK |
| EtwEventWriteFull | declared in Windows 10 WDK |
| EtwEventWriteStartScenario | forwarded from ADVAPI32 function EventWriteStartScenario in 6.0 and higher; declared in Windows 10 WDK |
| EtwEventWriteString | forwarded from ADVAPI32 function EventWriteString in 6.0 and higher; declared in Windows 10 WDK |
| EtwEventWriteTransfer | forwarded from ADVAPI32 function EventWriteTransfer in 6.0 and higher; declared in Windows 10 WDK |
| EtwLogTraceEvent | forwarded from ADVAPI32 function TraceEvent in 6.0 and higher |
| EtwNotificationRegister | declared in Windows 10 WDK |
| EtwNotificationUnregister | declared in Windows 10 WDK |
| EtwProcessPrivateLoggerRequest | |
| EtwRegisterSecurityProvider | declared in Windows 10 WDK |
| EtwReplyNotification | declared in Windows 10 WDK |
| EtwSendNotification | declared in Windows 10 WDK |
| EtwSetMark | declared in Windows 10 WDK |
| EtwTraceEventInstance | forwarded from ADVAPI32 function TraceEventInstance in 5.2 and higher |
| EtwWriteUMSecurityEvent | declared in Windows 10 WDK |
| EtwpCreateEtwThread | |
| EtwpGetCpuSpeed | |
| EtwpNotificationThread | discontinued in 6.3 |
| ExpInterlockedPopEntrySListEnd8 | x64 only; discontinued in 6.1 |
| ExpInterlockedPopEntrySListFault8 | x64 only; discontinued in 6.1 |
| ExpInterlockedPopEntrySListResume8 | x64 only; discontinued in 6.1 |
| LdrAddLoadAsDataTable | |
| LdrGetFailureData | |
| LdrGetFileNameFromLoadAsDataTable | |
| LdrGetProcedureAddressEx | |
| LdrLoadAlternateResourceModuleEx | |
| LdrQueryModuleServiceTags | |
| LdrRegisterDllNotification | |
| LdrRemoveLoadAsDataTable | |
| LdrResFindResource | |
| LdrResFindResourceDirectory | |
| LdrResRelease | |
| LdrResSearchResource | |
| LdrSetMUICacheType | |
| LdrUnloadAlternateResourceModuleEx | |
| LdrUnregisterDllNotification | |
| LdrVerifyImageMatchesChecksumEx | |
| LdrpResGetMappingSize | begins from Windows Vista SP1 |
| LdrpResGetRCConfig | begins from Windows Vista SP1; discontinued in 6.1 |
| LdrpResGetResourceDirectory | begins from Windows Vista SP1 |
| MD4Final | forwarded from ADVAPI32 function MD4Final in 6.0 and higher |
| MD4Init | forwarded from ADVAPI32 function MD4Init in 6.0 and higher |
| MD4Update | forwarded from ADVAPI32 function MD4Update in 6.0 and higher |
| MD5Final | forwarded from ADVAPI32 function MD5Final in 6.0 and higher; documentation as CRYPTDLL export withdrawn in 2007-2009 |
| MD5Init | forwarded from ADVAPI32 function MD5Init in 6.0 and higher; documentation as CRYPTDLL export withdrawn in 2007-2009 |
| MD5Update | forwarded from ADVAPI32 function MD5Update in 6.0 and higher; documentation as CRYPTDLL export withdrawn in 2007-2009 |
| NtAcquireCMFViewOwnership | discontinued in 6.1 |
| NtAlpcAcceptConnectPort | |
| NtAlpcCancelMessage | |
| NtAlpcConnectPort | |
| NtAlpcCreatePort | |
| NtAlpcCreatePortSection | |
| NtAlpcCreateResourceReserve | |
| NtAlpcCreateSectionView | |
| NtAlpcCreateSecurityContext | |
| NtAlpcDeletePortSection | |
| NtAlpcDeleteResourceReserve | |
| NtAlpcDeleteSectionView | |
| NtAlpcDeleteSecurityContext | |
| NtAlpcDisconnectPort | |
| NtAlpcImpersonateClientOfPort | |
| NtAlpcOpenSenderProcess | |
| NtAlpcOpenSenderThread | |
| NtAlpcQueryInformation | |
| NtAlpcQueryInformationMessage | |
| NtAlpcRevokeSecurityContext | |
| NtAlpcSendWaitReceivePort | |
| NtAlpcSetInformation | |
| NtCancelIoFileEx | |
| NtCancelSynchronousIoFile | |
| NtClearAllSavepointsTransaction | discontinued in Windows Vista SP1 |
| NtClearSavepointTransaction | discontinued in Windows Vista SP1 |
| NtCommitComplete | undocumented until 2008-2009 |
| NtCommitEnlistment | undocumented until 2008-2009 |
| NtCommitTransaction | undocumented until 2008-2009 |
| NtCreateEnlistment | undocumented until 2008-2009 |
| NtCreateKeyTransacted | |
| NtCreatePrivateNamespace | |
| NtCreateResourceManager | undocumented until 2008-2009 |
| NtCreateThreadEx | |
| NtCreateTransaction | undocumented until 2008-2009 |
| NtCreateTransactionManager | undocumented until 2008-2009 |
| NtCreateUserProcess | |
| NtCreateWorkerFactory | |
| NtDeletePrivateNamespace | |
| NtEnumerateTransactionObject | undocumented until 2008-2009 |
| NtFlushInstallUILanguage | |
| NtFlushProcessWriteBuffers | forwarded from KERNEL32 function FlushProcessWriteBuffers in 6.0 and higher; forwarded from KERNELBASE function FlushProcessWriteBuffers in 6.1 and higher |
| NtFreezeRegistry | |
| NtFreezeTransactions | |
| NtGetMUIRegistryInfo | |
| NtGetNextProcess | |
| NtGetNextThread | |
| NtGetNlsSectionPtr | |
| NtGetNotificationResourceManager | undocumented until 2008-2009 |
| NtInitializeNlsFiles | |
| NtIsUILanguageComitted | |
| NtListTransactions | discontinued in Windows Vista SP1 |
| NtMapCMFModule | |
| NtMarshallTransaction | discontinued in Windows Vista SP1 |
| NtOpenEnlistment | undocumented until 2008-2009 |
| NtOpenKeyTransacted | |
| NtOpenPrivateNamespace | |
| NtOpenResourceManager | undocumented until 2008-2009 |
| NtOpenSession | |
| NtOpenTransaction | undocumented until 2008-2009 |
| NtOpenTransactionManager | undocumented until 2008-2009 |
| NtPrePrepareComplete | undocumented until 2008-2009 |
| NtPrePrepareEnlistment | undocumented until 2008-2009 |
| NtPrepareComplete | undocumented until 2008-2009 |
| NtPrepareEnlistment | undocumented until 2008-2009 |
| NtPropagationComplete | |
| NtPropagationFailed | |
| NtPullTransaction | discontinued in Windows Vista SP1 |
| NtQueryInformationEnlistment | undocumented until 2008-2009 |
| NtQueryInformationResourceManager | undocumented until 2008-2009 |
| NtQueryInformationTransaction | undocumented until 2008-2009 |
| NtQueryInformationTransactionManager | undocumented until 2008-2009 |
| NtQueryInformationWorkerFactory | |
| NtQueryLicenseValue | |
| NtReadOnlyEnlistment | undocumented until 2008-2009 |
| NtRecoverEnlistment | undocumented until 2008-2009 |
| NtRecoverResourceManager | undocumented until 2008-2009 |
| NtRecoverTransactionManager | undocumented until 2008-2009 |
| NtRegisterProtocolAddressInformation | |
| NtReleaseCMFViewOwnership | discontinued in 6.1 |
| NtReleaseWorkerFactoryWorker | |
| NtRemoveIoCompletionEx | |
| NtRenameTransactionManager | begins from Windows Vista SP1; undocumented until 2008-2009; declared for Windows Vista and higher |
| NtReplacePartitionUnit | begins from Windows Vista SP1 |
| NtRollbackComplete | undocumented until 2008-2009 |
| NtRollbackEnlistment | undocumented until 2008-2009 |
| NtRollbackSavepointTransaction | discontinued in Windows Vista SP1 |
| NtRollbackTransaction | undocumented until 2008-2009 |
| NtRollforwardTransactionManager | undocumented until 2008-2009 |
| NtSavepointComplete | discontinued in Windows Vista SP1 |
| NtSavepointTransaction | discontinued in Windows Vista SP1 |
| NtSetInformationEnlistment | undocumented until 2008-2009 |
| NtSetInformationResourceManager | undocumented until 2008-2009 |
| NtSetInformationTransaction | undocumented until 2008-2009 |
| NtSetInformationTransactionManager | undocumented until 2008-2009 |
| NtSetInformationWorkerFactory | |
| NtShutdownWorkerFactory | |
| NtSinglePhaseReject | undocumented until 2008-2009 |
| NtStartTm | discontinued in Windows Vista SP1 |
| NtThawRegistry | declared in Windows 10 WDK |
| NtThawTransactions | |
| NtTraceControl | declared in Windows 10 WDK |
| NtWaitForWorkViaWorkerFactory | |
| NtWorkerFactoryWorkerReady | |
| NtWow64CallFunction64 | wow64 only |
| NtWow64CsrVerifyRegion | wow64 only |
| NtWow64WriteVirtualMemory64 | wow64 only |
| NtdllDefWindowProc_A | begins from Windows Vista SP1 |
| NtdllDefWindowProc_W | begins from Windows Vista SP1 |
| NtdllDialogWndProc_A | begins from Windows Vista SP1 |
| NtdllDialogWndProc_W | begins from Windows Vista SP1 |
| ResCCloseRuntimeView | discontinued in Windows Vista SP1 |
| ResCCompareCacheIDs | discontinued in Windows Vista SP1 |
| ResCCreateCultureMap | discontinued in Windows Vista SP1 |
| ResCCreateDefaultCultureMap | discontinued in Windows Vista SP1 |
| ResCCreateRuntimeView | discontinued in Windows Vista SP1 |
| ResCDirectoryCreateAndPopulate | discontinued in Windows Vista SP1 |
| ResCDirectoryCreateMapping | discontinued in Windows Vista SP1 |
| ResCDirectoryFree | discontinued in Windows Vista SP1 |
| ResCDirectoryGetBaseFolder | discontinued in Windows Vista SP1 |
| ResCDirectoryGetEntry | discontinued in Windows Vista SP1 |
| ResCDirectoryGetEntryCopy | discontinued in Windows Vista SP1 |
| ResCDirectoryGetEntryEx | discontinued in Windows Vista SP1 |
| ResCDirectoryGetEntryExCopy | discontinued in Windows Vista SP1 |
| ResCDirectoryGetEntryIndex | discontinued in Windows Vista SP1 |
| ResCDirectoryGetEntryIndexEx | discontinued in Windows Vista SP1 |
| ResCDirectoryGetFirstEntry | discontinued in Windows Vista SP1 |
| ResCDirectoryGetFirstEntryIndex | discontinued in Windows Vista SP1 |
| ResCDirectoryGetSegmentIndex | discontinued in Windows Vista SP1 |
| ResCDirectoryGetSegmentName | discontinued in Windows Vista SP1 |
| ResCDirectoryLoadFixedSize | discontinued in Windows Vista SP1 |
| ResCDirectoryOpenMapping | discontinued in Windows Vista SP1 |
| ResCFreeCultureMap | discontinued in Windows Vista SP1 |
| ResCGetCacheIndices | discontinued in Windows Vista SP1 |
| ResCGetCultureID | discontinued in Windows Vista SP1 |
| ResCGetCultureIndex | discontinued in Windows Vista SP1 |
| ResCGetCultureName | discontinued in Windows Vista SP1 |
| ResCGetHighestCacheIndex | discontinued in Windows Vista SP1 |
| ResCGetHighestConsecutiveCacheIndex | discontinued in Windows Vista SP1 |
| ResCGetIndexedName | discontinued in Windows Vista SP1 |
| ResCGetName | discontinued in Windows Vista SP1 |
| ResCGetRegistryBaseFolder | discontinued in Windows Vista SP1 |
| ResCGetRegistryConfig | discontinued in Windows Vista SP1 |
| ResCGetRegistryLatestIndex | discontinued in Windows Vista SP1 |
| ResCGetRegistryMappingPrefix | discontinued in Windows Vista SP1 |
| ResCGetRegistryStatus | discontinued in Windows Vista SP1 |
| ResCGetSubIndexedName | discontinued in Windows Vista SP1 |
| ResCInitRuntimeView | discontinued in Windows Vista SP1 |
| ResCInitRuntimeViewEx | discontinued in Windows Vista SP1 |
| ResCKeDirectoryOpenMapping | discontinued in Windows Vista SP1 |
| ResCKeGetBaseFolder | discontinued in Windows Vista SP1 |
| ResCKeGetCacheIndices | discontinued in Windows Vista SP1 |
| ResCKeInitRuntimeViewEx | discontinued in Windows Vista SP1 |
| ResCKeSegmentOpenMapping | discontinued in Windows Vista SP1 |
| ResCLoadCultureMap | discontinued in Windows Vista SP1 |
| ResCOpenRegistryKey | discontinued in Windows Vista SP1 |
| ResCOpenRuntimeView | discontinued in Windows Vista SP1 |
| ResCReleaseInitMutex | discontinued in Windows Vista SP1 |
| ResCReloadCultureMap | discontinued in Windows Vista SP1 |
| ResCRequestInitMutex | discontinued in Windows Vista SP1 |
| ResCRuntimeGetAnySegmentData | discontinued in Windows Vista SP1 |
| ResCRuntimeGetCultureID | discontinued in Windows Vista SP1 |
| ResCRuntimeGetEntryData | discontinued in Windows Vista SP1 |
| ResCRuntimeGetEntryDataEx | discontinued in Windows Vista SP1 |
| ResCRuntimeGetResourceData | discontinued in Windows Vista SP1 |
| ResCRuntimeGetResourceDataEx | discontinued in Windows Vista SP1 |
| ResCRuntimeGetResourceDataForCulture | discontinued in Windows Vista SP1 |
| ResCRuntimeGetSegmentData | discontinued in Windows Vista SP1 |
| ResCRuntimeGetSegmentDataEx | discontinued in Windows Vista SP1 |
| ResCRuntimeViewLoadCultureMap | discontinued in Windows Vista SP1 |
| ResCSaveRegistryBaseFolder | discontinued in Windows Vista SP1 |
| ResCSaveRegistryConfig | discontinued in Windows Vista SP1 |
| ResCSaveRegistryLatestIndex | discontinued in Windows Vista SP1 |
| ResCSaveRegistryStatus | discontinued in Windows Vista SP1 |
| ResCSegmentCreateAndPopulate | discontinued in Windows Vista SP1 |
| ResCSegmentCreateMapping | discontinued in Windows Vista SP1 |
| ResCSegmentFree | discontinued in Windows Vista SP1 |
| ResCSegmentGetData | discontinued in Windows Vista SP1 |
| ResCSegmentLoadFixedSize | discontinued in Windows Vista SP1 |
| ResCSegmentOpenMapping | discontinued in Windows Vista SP1 |
| ResCSegmentReserveMapping | discontinued in Windows Vista SP1 |
| ResCSetCacheSecurityType | discontinued in Windows Vista SP1 |
| RtlAcquireSRWLockExclusive | forwarded from KERNEL32 function AcquireSRWLockExclusive in 6.0 and higher; forwarded from KERNELBASE function AcquireSRWLockExclusive in 6.1 and higher |
| RtlAcquireSRWLockShared | forwarded from KERNEL32 function AcquireSRWLockShared in 6.0 and higher; forwarded from KERNELBASE function AcquireSRWLockShared in 6.1 and higher |
| RtlAddMandatoryAce | |
| RtlAddSIDToBoundaryDescriptor | |
| RtlAllocateMemoryBlockLookaside | |
| RtlAllocateMemoryZone | |
| RtlBarrier | |
| RtlBarrierForDelete | |
| RtlCleanUpTEBLangLists | |
| RtlCloneUserProcess | |
| RtlCmDecodeMemIoResource | |
| RtlCmEncodeMemIoResource | |
| RtlCommitDebugInfo | |
| RtlCompareAltitudes | |
| RtlCompareUnicodeStrings | declaration requires Windows 2000 and higher |
| RtlCompleteProcessCloning | x64 only |
| RtlConnectToSm | |
| RtlConvertLCIDToString | |
| RtlCreateBoundaryDescriptor | |
| RtlCreateEnvironmentEx | |
| RtlCreateMemoryBlockLookaside | |
| RtlCreateMemoryZone | |
| RtlCreateProcessParametersEx | |
| RtlCreateServiceSid | |
| RtlCreateUserStack | |
| RtlCultureNameToLCID | |
| RtlDeCommitDebugInfo | |
| RtlDeleteBarrier | |
| RtlDeleteBoundaryDescriptor | forwarded from KERNEL32 function DeleteBoundaryDescriptor in 6.0 and higher |
| RtlDeregisterSecureMemoryCacheCallback | begins from Windows Vista SP1 |
| RtlDestroyMemoryBlockLookaside | |
| RtlDestroyMemoryZone | |
| RtlExitUserProcess | forwarded from KERNEL32 function ExitProcess in 6.0 and higher (x64 only) |
| RtlExpandEnvironmentStrings | |
| RtlExtendMemoryBlockLookaside | |
| RtlExtendMemoryZone | |
| RtlFindAceByType | |
| RtlFindClosestEncodableLength | declared in Windows 10 WDK |
| RtlFlsAlloc | |
| RtlFlsFree | |
| RtlFreeMemoryBlockLookaside | |
| RtlFreeUserStack | |
| RtlGetCurrentTransaction | |
| RtlGetFileMUIPath | |
| RtlGetIntegerAtom | |
| RtlGetParentLocaleName | |
| RtlGetProductInfo | |
| RtlGetSystemPreferredUILanguages | |
| RtlGetThreadLangIdByIndex | |
| RtlGetThreadPreferredUILanguages | |
| RtlGetUILanguageInfo | |
| RtlGetUnloadEventTraceEx | documentation withdrawn in 2007-2008 |
| RtlGetUserPreferredUILanguages | |
| RtlHeapTrkInitialize | |
| RtlIdnToAscii | |
| RtlIdnToNameprepUnicode | |
| RtlIdnToUnicode | |
| RtlImpersonateSelfEx | |
| RtlInitBarrier | |
| RtlInitializeConditionVariable | forwarded from KERNEL32 function InitializeConditionVariable in 6.0 and higher |
| RtlInitializeCriticalSectionEx | |
| RtlInitializeExceptionChain | begins from Windows Vista SP1; x86 only |
| RtlInitializeNtUserPfn | |
| RtlInitializeSRWLock | forwarded from KERNEL32 function InitializeSRWLock in 6.0 and higher; forwarded from KERNELBASE function InitializeSRWLock in 6.1 and higher |
| RtlIoDecodeMemIoResource | |
| RtlIoEncodeMemIoResource | |
| RtlIsCurrentThreadAttachExempt | |
| RtlIsNormalizedString | |
| RtlIsValidLocaleName | |
| RtlLCIDToCultureName | |
| RtlLcidToLocaleName | |
| RtlLocaleNameToLcid | |
| RtlLockCurrentThread | |
| RtlLockMemoryBlockLookaside | |
| RtlLockMemoryZone | |
| RtlLockModuleSection | |
| RtlNormalizeString | |
| RtlNtdllName | x64 only |
| RtlNumberOfSetBitsUlongPtr | begins from Windows Vista SP1; declaration requires Windows Vista and higher |
| RtlOwnerAcesPresent | |
| RtlPrepareForProcessCloning | x64 only |
| RtlProcessFlsData | |
| RtlQueryActivationContextApplicationSettings | |
| RtlQueryCriticalSectionOwner | |
| RtlQueryDynamicTimeZoneInformation | |
| RtlQueryElevationFlags | declared in Windows 10 WDK |
| RtlQueryEnvironmentVariable | |
| RtlQueryModuleInformation | |
| RtlRegisterThreadWithCsrss | |
| RtlReleaseSRWLockExclusive | forwarded from KERNEL32 function ReleaseSRWLockExclusive in 6.0 and higher; forwarded from KERNELBASE function ReleaseSRWLockExclusive in 6.1 and higher |
| RtlReleaseSRWLockShared | forwarded from KERNEL32 function ReleaseSRWLockShared in 6.0 and higher; forwarded from KERNELBASE function ReleaseSRWLockShared in 6.1 and higher |
| RtlRemovePrivileges | |
| RtlReportException | |
| RtlResetMemoryBlockLookaside | |
| RtlResetMemoryZone | |
| RtlRetrieveNtUserPfn | |
| RtlRunOnceBeginInitialize | |
| RtlRunOnceComplete | |
| RtlRunOnceExecuteOnce | |
| RtlRunOnceInitialize | forwarded from KERNEL32 function InitOnceInitialize in 6.0 and higher |
| RtlSendMsgToSm | |
| RtlSetCurrentTransaction | |
| RtlSetDynamicTimeZoneInformation | |
| RtlSetEnvironmentVar | |
| RtlSetProcessDebugInformation | |
| RtlSetThreadPreferredUILanguages | |
| RtlSetUserCallbackExceptionFilter | begins from SP1; wow64 only |
| RtlSidDominates | |
| RtlSidEqualLevel | |
| RtlSidHashInitialize | |
| RtlSidHashLookup | |
| RtlSidIsHigherLevel | |
| RtlSleepConditionVariableCS | |
| RtlSleepConditionVariableSRW | |
| RtlTestBit | documentation requires Windows XP and higher; declaration requires Windows XP and higher |
| RtlTryAcquirePebLock | |
| RtlUnlockCurrentThread | |
| RtlUnlockMemoryBlockLookaside | |
| RtlUnlockMemoryZone | |
| RtlUnlockModuleSection | |
| RtlUpdateClonedCriticalSection | |
| RtlUpdateClonedSRWLock | |
| RtlUserThreadStart | |
| RtlWakeAllConditionVariable | forwarded from KERNEL32 function WakeAllConditionVariable in 6.0 and higher |
| RtlWakeConditionVariable | forwarded from KERNEL32 function WakeConditionVariable in 6.0 and higher |
| RtlWerpReportException | |
| RtlWow64CallFunction64 | |
| RtlWow64GetThreadContext | x64 only |
| RtlWow64LogMessageInEventLogger | x64 and wow64 only |
| RtlWow64SetThreadContext | x64 only |
| RtlWow64SuspendThread | x64 only |
| RtlpCheckDynamicTimeZoneInformation | begins from Windows Vista SP1 |
| RtlpCleanupRegistryKeys | |
| RtlpConvertCultureNamesToLCIDs | |
| RtlpConvertLCIDsToCultureNames | |
| RtlpCreateProcessRegistryInfo | |
| RtlpGetLCIDFromLangInfoNode | |
| RtlpGetNameFromLangInfoNode | |
| RtlpGetSystemDefaultUILanguage | |
| RtlpGetUserOrMachineUILanguage4NLS | |
| RtlpInitializeLangRegistryInfo | |
| RtlpInterlockedPopEntrySeqSListEnd | begins from SP2; wow64 only |
| RtlpInterlockedPopEntrySeqSListFault | begins from SP2; wow64 only |
| RtlpInterlockedPopEntrySeqSListResume | begins from SP2; wow64 only |
| RtlpIsQualifiedLanguage | |
| RtlpLoadMachineUIByPolicy | |
| RtlpLoadUserUIByPolicy | |
| RtlpMuiFreeLangRegistryInfo | |
| RtlpMuiRegCreateRegistryInfo | |
| RtlpMuiRegFreeRegistryInfo | |
| RtlpMuiRegLoadRegistryInfo | |
| RtlpQueryDefaultUILanguage | |
| RtlpQueryProcessDebugInformationFromWow64 | x64 only |
| RtlpQueryProcessDebugInformationRemote | wow64 only |
| RtlpRefreshCachedUILanguage | |
| RtlpSetInstallLanguage | |
| RtlpSetPreferredUILanguages | |
| RtlpSetUserPreferredUILanguages | |
| RtlpVerifyAndCommitUILanguageSettings | |
| ShipAssert | |
| ShipAssertGetBufferInfo | |
| ShipAssertMsgA | |
| ShipAssertMsgW | |
| TpAllocAlpcCompletion | |
| TpAllocCleanupGroup | |
| TpAllocIoCompletion | |
| TpAllocPool | |
| TpAllocTimer | |
| TpAllocWait | |
| TpAllocWork | |
| TpCallbackLeaveCriticalSectionOnCompletion | forwarded from KERNEL32 function LeaveCriticalSectionWhenCallbackReturns in 6.0 and higher; forwarded from KERNELBASE function LeaveCriticalSectionWhenCallbackReturns in 6.1 and higher |
| TpCallbackMayRunLong | forwarded from KERNEL32 function CallbackMayRunLong in 6.0 and higher |
| TpCallbackReleaseMutexOnCompletion | forwarded from KERNEL32 function ReleaseMutexWhenCallbackReturns in 6.0 and higher; forwarded from KERNELBASE function ReleaseMutexWhenCallbackReturns in 6.1 and higher |
| TpCallbackReleaseSemaphoreOnCompletion | forwarded from KERNEL32 function ReleaseSemaphoreWhenCallbackReturns in 6.0 and higher; forwarded from KERNELBASE function ReleaseSemaphoreWhenCallbackReturns in 6.1 and higher |
| TpCallbackSetEventOnCompletion | forwarded from KERNEL32 function SetEventWhenCallbackReturns in 6.0 and higher; forwarded from KERNELBASE function SetEventWhenCallbackReturns in 6.1 and higher |
| TpCallbackUnloadDllOnCompletion | forwarded from KERNEL32 function FreeLibraryWhenCallbackReturns in 6.0 and higher; forwarded from KERNELBASE function FreeLibraryWhenCallbackReturns in 6.1 and higher |
| TpCancelAsyncIoOperation | forwarded from KERNEL32 function CancelThreadpoolIo in 6.0 and higher; forwarded from KERNELBASE function CancelThreadpoolIo in 6.1 and higher |
| TpCaptureCaller | |
| TpCheckTerminateWorker | |
| TpDbgDumpHeapUsage | |
| TpDbgSetLogRoutine | |
| TpDisassociateCallback | forwarded from KERNEL32 function DisassociateCurrentThreadFromCallback in 6.0 and higher; forwarded from KERNELBASE function DisassociateCurrentThreadFromCallback in 6.1 and higher |
| TpIsTimerSet | forwarded from KERNEL32 function IsThreadpoolTimerSet in 6.0 and higher; forwarded from KERNELBASE function IsThreadpoolTimerSet in 6.1 and higher |
| TpPostWork | forwarded from KERNEL32 function SubmitThreadpoolWork in 6.0 and higher; forwarded from KERNELBASE function SubmitThreadpoolWork in 6.1 and higher |
| TpReleaseAlpcCompletion | |
| TpReleaseCleanupGroup | forwarded from KERNEL32 function CloseThreadpoolCleanupGroup in 6.0 and higher; forwarded from KERNELBASE function CloseThreadpoolCleanupGroup in 6.1 and higher |
| TpReleaseCleanupGroupMembers | forwarded from KERNEL32 function CloseThreadpoolCleanupGroupMembers in 6.0 and higher; forwarded from KERNELBASE function CloseThreadpoolCleanupGroupMembers in 6.1 and higher |
| TpReleaseIoCompletion | forwarded from KERNEL32 function CloseThreadpoolIo in 6.0 and higher; forwarded from KERNELBASE function CloseThreadpoolIo in 6.1 and higher |
| TpReleasePool | forwarded from KERNEL32 function CloseThreadpool in 6.0 and higher; forwarded from KERNELBASE function CloseThreadpool in 6.1 and higher |
| TpReleaseTimer | forwarded from KERNEL32 function CloseThreadpoolTimer in 6.0 and higher; forwarded from KERNELBASE function CloseThreadpoolTimer in 6.1 and higher |
| TpReleaseWait | forwarded from KERNEL32 function CloseThreadpoolWait in 6.0 and higher; forwarded from KERNELBASE function CloseThreadpoolWait in 6.1 and higher |
| TpReleaseWork | forwarded from KERNEL32 function CloseThreadpoolWork in 6.0 and higher; forwarded from KERNELBASE function CloseThreadpoolWork in 6.1 and higher |
| TpSetPoolMaxThreads | forwarded from KERNEL32 function SetThreadpoolThreadMaximum in 6.0 and higher; forwarded from KERNELBASE function SetThreadpoolThreadMaximum in 6.1 and higher |
| TpSetPoolMinThreads | |
| TpSetTimer | forwarded from KERNEL32 function SetThreadpoolTimer in 6.0 and higher; forwarded from KERNELBASE function SetThreadpoolTimer in 6.1 and higher |
| TpSetWait | forwarded from KERNEL32 function SetThreadpoolWait in 6.0 and higher forwarded from KERNELBASE function SetThreadpoolWait in 6.1 and higher |
| TpSimpleTryPost | |
| TpStartAsyncIoOperation | forwarded from KERNEL32 function StartThreadpoolIo in 6.0 and higher; forwarded from KERNELBASE function StartThreadpoolIo in 6.1 and higher |
| TpWaitForAlpcCompletion | |
| TpWaitForIoCompletion | forwarded from KERNEL32 function WaitForThreadpoolIoCallbacks in 6.0 and higher forwarded from KERNELBASE function WaitForThreadpoolIoCallbacks in 6.1 and higher |
| TpWaitForTimer | forwarded from KERNEL32 function WaitForThreadpoolTimerCallbacks in 6.0 and higher forwarded from KERNELBASE function WaitForThreadpoolTimerCallbacks in 6.1 and higher |
| TpWaitForWait | forwarded from KERNEL32 function WaitForThreadpoolWaitCallbacks in 6.0 and higher forwarded from KERNELBASE function WaitForThreadpoolWaitCallbacks in 6.1 and higher |
| TpWaitForWork | forwarded from KERNEL32 function WaitForThreadpoolWorkCallbacks in 6.0 and higher forwarded from KERNELBASE function WaitForThreadpoolWorkCallbacks in 6.1 and higher |
| WerCheckEventEscalation | discontinued in 6.1 |
| WerReportSQMEvent | |
| WerReportWatsonEvent | discontinued in 6.1 |
| WinSqmAddToStream | |
| WinSqmEndSession | |
| WinSqmEventEnabled | |
| WinSqmEventWrite | |
| WinSqmIsOptedIn | |
| WinSqmSetString | |
| WinSqmStartSession | |
| ZwAcquireCMFViewOwnership | discontinued in 6.1 |
| ZwAlpcAcceptConnectPort | declared in Windows 10 WDK |
| ZwAlpcCancelMessage | declared in Windows 10 WDK |
| ZwAlpcConnectPort | declared in Windows 10 WDK |
| ZwAlpcCreatePort | declared in Windows 10 WDK |
| ZwAlpcCreatePortSection | declared in Windows 10 WDK |
| ZwAlpcCreateResourceReserve | declared in Windows 10 WDK |
| ZwAlpcCreateSectionView | declared in Windows 10 WDK |
| ZwAlpcCreateSecurityContext | declared in Windows 10 WDK |
| ZwAlpcDeletePortSection | declared in Windows 10 WDK |
| ZwAlpcDeleteResourceReserve | declared in Windows 10 WDK |
| ZwAlpcDeleteSectionView | declared in Windows 10 WDK |
| ZwAlpcDeleteSecurityContext | declared in Windows 10 WDK |
| ZwAlpcDisconnectPort | declared in Windows 10 WDK |
| ZwAlpcImpersonateClientOfPort | declared in Windows 10 WDK |
| ZwAlpcOpenSenderProcess | declared in Windows 10 WDK |
| ZwAlpcOpenSenderThread | declared in Windows 10 WDK |
| ZwAlpcQueryInformation | declared in Windows 10 WDK |
| ZwAlpcQueryInformationMessage | declared in Windows 10 WDK |
| ZwAlpcRevokeSecurityContext | declared in Windows 10 WDK |
| ZwAlpcSendWaitReceivePort | declared in Windows 10 WDK |
| ZwAlpcSetInformation | declared in Windows 10 WDK |
| ZwCancelIoFileEx | declared in Windows 10 WDK |
| ZwCancelSynchronousIoFile | declared in Windows 10 WDK |
| ZwClearAllSavepointsTransaction | discontinued in Windows Vista SP1 |
| ZwClearSavepointTransaction | discontinued in Windows Vista SP1 |
| ZwCommitComplete | undocumented until 2007 |
| ZwCommitEnlistment | undocumented until 2007 |
| ZwCommitTransaction | |
| ZwCreateEnlistment | |
| ZwCreateKeyTransacted | undocumented until 2008-2009 |
| ZwCreatePrivateNamespace | declared in Windows 10 WDK |
| ZwCreateResourceManager | |
| ZwCreateThreadEx | declared in Windows 10 WDK |
| ZwCreateTransaction | |
| ZwCreateTransactionManager | |
| ZwCreateUserProcess | declared in Windows 10 WDK |
| ZwCreateWorkerFactory | |
| ZwDeletePrivateNamespace | declared in Windows 10 WDK |
| ZwEnumerateTransactionObject | undocumented until 2007 |
| ZwFlushInstallUILanguage | declared in Windows 10 WDK |
| ZwFlushProcessWriteBuffers | declared in Windows 10 WDK |
| ZwFreezeRegistry | declared in Windows 10 WDK |
| ZwFreezeTransactions | declared in Windows 10 WDK |
| ZwGetMUIRegistryInfo | declared in Windows 10 WDK |
| ZwGetNextProcess | declared in Windows 10 WDK |
| ZwGetNextThread | declared in Windows 10 WDK |
| ZwGetNlsSectionPtr | declared in Windows 10 WDK |
| ZwGetNotificationResourceManager | undocumented until 2007 |
| ZwInitializeNlsFiles | declared in Windows 10 WDK |
| ZwIsUILanguageComitted | declared in Windows 10 WDK |
| ZwListTransactions | discontinued in Windows Vista SP1 |
| ZwMapCMFModule | declared in Windows 10 WDK |
| ZwMarshallTransaction | discontinued in Windows Vista SP1 |
| ZwOpenEnlistment | |
| ZwOpenKeyTransacted | undocumented until 2008-2009 |
| ZwOpenPrivateNamespace | declared in Windows 10 WDK |
| ZwOpenResourceManager | |
| ZwOpenSession | declared in Windows 10 WDK |
| ZwOpenTransaction | declared in Windows 10 WDK |
| ZwOpenTransactionManager | |
| ZwPrePrepareComplete | undocumented until 2007 |
| ZwPrePrepareEnlistment | undocumented until 2007 |
| ZwPrepareComplete | undocumented until 2007 |
| ZwPrepareEnlistment | undocumented until 2007 |
| ZwPropagationComplete | declared in Windows 10 WDK |
| ZwPropagationFailed | declared in Windows 10 WDK |
| ZwPullTransaction | discontinued in Windows Vista SP1 |
| ZwQueryInformationEnlistment | |
| ZwQueryInformationResourceManager | |
| ZwQueryInformationTransaction | |
| ZwQueryInformationTransactionManager | |
| ZwQueryInformationWorkerFactory | |
| ZwQueryLicenseValue | declared in Windows 10 WDK |
| ZwReadOnlyEnlistment | undocumented until 2007 |
| ZwRecoverEnlistment | undocumented until 2007 |
| ZwRecoverResourceManager | |
| ZwRecoverTransactionManager | |
| ZwRegisterProtocolAddressInformation | declared in Windows 10 WDK |
| ZwReleaseCMFViewOwnership | discontinued in 6.1 |
| ZwReleaseWorkerFactoryWorker | |
| ZwRemoveIoCompletionEx | declared in Windows 10 WDK |
| ZwRenameTransactionManager | begins from Windows Vista SP1; declared in Windows 10 WDK |
| ZwReplacePartitionUnit | begins from Windows Vista SP1; declared in Windows 10 WDK |
| ZwRollbackComplete | undocumented until 2007 |
| ZwRollbackEnlistment | undocumented until 2007 |
| ZwRollbackSavepointTransaction | discontinued in Windows Vista SP1 |
| ZwRollbackTransaction | |
| ZwRollforwardTransactionManager | |
| ZwSavepointComplete | discontinued in Windows Vista SP1 |
| ZwSavepointTransaction | discontinued in Windows Vista SP1 |
| ZwSetInformationEnlistment | |
| ZwSetInformationResourceManager | documented since 2007 as “not used” |
| ZwSetInformationTransaction | |
| ZwSetInformationTransactionManager | |
| ZwSetInformationWorkerFactory | |
| ZwShutdownWorkerFactory | |
| ZwSinglePhaseReject | undocumented until 2007 |
| ZwStartTm | discontinued in Windows Vista SP1 |
| ZwThawRegistry | |
| ZwThawTransactions | declared in Windows 10 WDK |
| ZwTraceControl | declared in Windows 10 WDK |
| ZwWaitForWorkViaWorkerFactory | |
| ZwWorkerFactoryWorkerReady | |
| ZwWow64CallFunction64 | wow64 only |
| ZwWow64CsrVerifyRegion | wow64 only |
| ZwWow64WriteVirtualMemory64 | wow64 only |
| _ResCGetRegistryFlags | discontinued in Windows Vista SP1 |
| _ResCMatchFlags | discontinued in Windows Vista SP1 |
| _ResCSaveRegistryFlags | discontinued in Windows Vista SP1 |
| _alloca_probe_16 | x86 only |
| _alloca_probe_8 | x86 only |
| _swprintf | |
| _vswprintf |
Several functions that date from version 5.1 aren’t exported from wow64 builds until version 6.0:
Version 6.0 started, in its build for the original Windows Vista, not only by adding more to the API than had any previous version but also by taking away:
The version 6.0 from Windows Vista SP1 discontinues more, including many that had only just been introduced: