Named Exports Added For NTDLL 6.1

The table below lists the 196 named NTDLL exports that are new to NTDLL for version 6.1, i.e., for Windows 7. Another eight new functions for version 6.1 are exported only by ordinal and are listed separately. Of the new functions exported by name, hardly any are yet documented, though a few are at least declared in one or another header file from the contemporaneous Software Development Kit or Windows Driver Kit.

Documentation status is conveyed by colour coding. If you browse with scripting enabled, hovering over any text that has a background colour should produce a tooltip that explains the formatting. NTDLL exports that have all along had their own non-trivial documentation as exports from NTDLL are shown with no background colour. So too are the NTDLL implementations of documented functions and variables from the C Run-Time Library. If the whole of the documentation is just that the function is reserved or obsolete, without even giving a prototype, then the function is highlighted red or highlighted pink, respectively. Functions that look to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented immediately, especially in the contemporaneous Software Development Kit (SDK), then it is shaded yellow to retain some of its previous status as undocumented. If the delayed documentation came specifically from the function’s listing among the Settlement Program Interfaces in late 2002, then the shading is less yellow since Microsoft at least acknowledged that the documentation was late. An undocumented function is highlighted orange, as semi-documented, if it is at least declared in one or another header file from an SDK or, exceptionally, a Windows Driver Kit (WDK). NTDLL is low-level enough that some functions are documented in the Windows Driver Kit (WDK), typically as exports from the NT kernel for use by ring 0 software such as device drivers, but sometimes with non-specific talk of being callable from user mode. Such functions are shaded blue if they seem always to have had such documentation, but a brighter blue if the WDK documentation was not immediate. A function is shaded grey if it seems not to be documented but is known to be the entire low-level implementation of some function in a higher-level DLL such as KERNEL32 or ADVAPI32. Identifying these is a work in progress.

That RtlFillMemoryUlonglong appears only as late as Windows 7 is conspicuous. It has for some years been documented in the WDK’s section for Installable File Systems, and declared in NTIFS.H as an importable function. Yet no import library supplied with the WDK for Windows Vista (for instance) resolves the corresponding import symbol. All builds of both the NT kernel and NTDLL from at least as far back as Windows 2000 have code for the function but only as an internal routine . Could it be that the function was meant to be exported all along, consistently with the documentation, but was neglected by an oversight that took years for anyone to notice (or bother correcting)?

Valediction

Version 6.1 discontinues a few exports, including some that had been added only as recently as the version 6.0 from Windows Vista SP2:

• ExpInterlockedPopEntrySListEnd8 (previously x64 only)
• ExpInterlockedPopEntrySListFault8 (previously x64 only)
• ExpInterlockedPopEntrySListResume8 (previously x64 only)
• LdrpResGetRCConfig
• NtAcquireCMFViewOwnership
• NtCancelDeviceWakeupRequest
• NtReleaseCMFViewOwnership
• NtRequestDeviceWakeup
• NtRequestWakeupLatency
• WerCheckEventEscalation
• WerReportWatsonEvent
• ZwAcquireCMFViewOwnership
• ZwCancelDeviceWakeupRequest
• ZwReleaseCMFViewOwnership
• ZwRequestDeviceWakeup
• ZwRequestWakeupLatency