Geoff Chappell - Software Analyst
This page lists the 202 exports that are newly exported from the Windows kernel for the original Windows 2000. Almost all are still exported as of version 10.0.
Also listed are eight that were added for SP1, five for SP3 and two for SP4. The additions for this last service pack are specially notable for the different ways that they do not turn up for Windows XP. One is an exported function only in the long death of Windows 2000, not in Windows XP or any later Windows. The other looks to have been intended first for Windows Server 2003 and then back-fitted into the roughly contemporaneous Windows 2000 SP4 but never into any Windows XP service packs.
To convey more detail with less text, the page relies heavily on several types of shortcut.
The first is that although a few of the kernel’s exports are of variables rather than functions, I tend to talk of all as functions, hoping that no confusion will be caused by the loose terminology. The variables are indicated by a parenthetical “data” after their first appearance in the Functions column.
Documentation status is summarised by colour coding. (Had the website’s scripts run as expected, then hovering over any colour-coded text would produce a tooltip that shows why the text is coloured.) (To decode a colour, hover for a tooltip.)
Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status. If a function is documented as reserved or obsolete, it is shaded red or shaded grey, respectively. Otherwise, functions that have their own non-trivial documentation are left with no background colour.
Many undocumented functions and some variables have C-language declarations in one or another header file. To show them as being not completely undocumented they are shaded orange, except for one special case. Some declarations are known only from “minwin” headers that Microsoft published in early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public disclosure even of the declaration was exceptional.
The default understanding is that exporting continues for all later versions, and in both the x86 and x64 builds. Exceptions are sketched in a column headed Export History.
The description “x86 only” means that the function is not exported from any known x64 build but is exported from the x86 build of at least some version that has an x64 build. If it had already ceased as an export before Windows Server 2003 SP1, the “x86 only” is left unstated.
That a function is “discontinued in” some version means that the function is exported up to but not including the stated version and not in any later version unless “restored”.
It’s nothing but fair to note that the majority of these functions were not documented immediately. Even more were then or later said to require later versions. These misrepresentations of actual availability show also in C-language declarations for the functions’ use in programming. Conveying these differences between what the kernel exported and what Microsoft presented for drivers to import is the concern of columns headed Documentation History and Declaration History.
Conventions still in development!
Many functions in these early versions may have got their first documentation or declaration because their use was specially anticipated for installable file system (IFS) drivers. Microsoft published a separate IFS Kit for these, apparently starting from Windows 2000. For Windows Vista, the IFS Kit was merged into the WDK. Between, there are known to have been IFS Kits for Windows XP and Windows Server 2003, but I have not obtained either for inspection. Where applicable DDK versions are left to the imprecision of “5.1 (IFS) to 6.0”, whatever is described is known from the IFS section of the WDK for Windows Vista and is excluded from the IFS Kit for Windows 2000 and from the ordinary DDK for all of Windows 2000, Windows XP and Windows Server 2003.
As much as I might like to condense into one table as much as might be imagined is possible to summarise about all these functions’ history of availability both in the binary and according to the documentation and headers, many functions both individually and in groups demand additional explanation in text. I therefore break the tabulation according to Microsoft’s scheme of prefixes for separate areas of functionality within the otherwise monolithic kernel. Each function has its own row in one table, but please be sure to check for explanatory text before and (more usually) after the table.
Just more than 60% of these new exports for version 5.0 are nowadays documented. However, more than a sixth of these are documented only as being reserved, and one more only as obsolete. The proportion that are usefully documented is therefore less than half. Of the undocumented, about 20% are at least declared in one or another of the WDK header files.
| Function | Declaration History |
|---|---|
| CcGetFlushedValidData | before 5.1 (IFS) to 6.0, not declared |
| CcRemapBcb | |
| CcWaitForCurrentLazyWriterActivity | before 5.1 (IFS) to 6.0, not declared |
| Function | Export History |
|---|---|
| DbgPrintReturnControlC |
| Function | Export History | Documentation History |
|---|---|---|
| ExFreePoolWithTag | before 5.1, undocumented | |
| ExInterlockedFlushSList | x86 only | |
| ExSemaphoreObjectType (data) | since 5.1 (IFS) to 6.0, indirectly documented | |
| ExSetTimerResolution | before 5.1, declared | |
| ExUuidCreate |
As with most exported variables, ExSemaphoreObjectType is not itself documented. It does, however, get mentioned in the documentation of functions for which it is expected as an argument. The first is in the WDK for Windows Vista, for ObOpenObjectByPointer.
The ExSetTimerResolution function is documented in the Windows 2000 DDK but only to reproduce the declaration and to say that “More information on ExSetTimerResolution will be provided in a future release of the DDK.” This is here taken as Microsoft’s own recognition that the function was not yet actually documented.
| Function | Export History | Documentation History | Declaration History |
|---|---|---|---|
| FsRtlAcquireFileExclusive | before 5.1 (IFS) to 6.0, undocumented | ||
| FsRtlAllocateFileLock | before 5.1 (IFS) to 6.0, not declared | ||
| FsRtlFreeFileLock | before 5.1 (IFS) to 6.0, not declared | ||
| FsRtlInsertFilterContext | discontinued in 5.1 | ||
| FsRtlLookupFilterContextInternal | discontinued in 5.1 | ||
| FsRtlLookupLastLargeMcbEntryAndIndex | before 5.1 (IFS), undocumented;
documented start is 5.1 |
||
| FsRtlNotifyVolumeEvent | before 5.1 (IFS), undocumented;
documented start is 5.1 |
||
| FsRtlReleaseFile | before 5.1 (IFS) to 6.0, undocumented | ||
| FsRtlRemoveFilterContext | discontinued in 5.1 | ||
| FsRtlResetLargeMcb | before 5.1 (IFS), undocumented;
documented start is 5.1 |
||
| FsRtlTeardownFilterContexts | discontinued in 5.1 |
That FsRtlLookupLastLargeMcbEntryAndIndex, FsRtlNotifyVolumeEvent and FsRtlResetLargeMcb are first documented in the IFS Kit for Windows XP is mere supposition. They are not documented in the IFS Kit for Windows 2000, but their documentation in the WDK for Windows Vista dates the functions from Windows XP. A generous inference is that what actually dates from Windows XP is the documentation.
| Function | Documentation History |
|---|---|
| InbvAcquireDisplayOwnership | |
| InbvCheckDisplayOwnership | |
| InbvDisplayString | |
| InbvEnableBootDriver | |
| InbvEnableDisplayString | |
| InbvInstallDisplayStringFilter | |
| InbvIsBootDriverInstalled | |
| InbvNotifyDisplayOwnershipLost | |
| InbvResetDisplay | |
| InbvSetScrollRegion | |
| InbvSetTextColor | |
| InbvSolidColorFill |
| Function | Documentation History |
|---|---|
| InitSafeBootMode (data) | before 6.0, undocumented; indirectly documented |
As usual for exported variables, InitSafeBootMode does not have its own page of documentation. It is, however, presented on a page of Driver Programming Techniques titled Determining Whether the Operating System Is Running in Safe Mode. It is not declared in any header that Microsoft is known to have published.
| Function | Export History | Documentation History | Declaration History |
|---|---|---|---|
| IoAcquireRemoveLockEx | indirectly documented | ||
| IoAllocateDriverObjectExtension | |||
| IoAllocateWorkItem | |||
| IoCancelFileOpen | in 5.1 to 5.2, reserved | ||
| IoCheckQuerySetFileInformation | before 5.1 (IFS) to 6.0, undocumented | ||
| IoCheckQuerySetVolumeInformation | before 5.1 (IFS) to 6.0, undocumented | ||
| IoCheckQuotaBufferValidity | before 5.1 (IFS) to 6.0, not declared | ||
| IoCreateDriver | |||
| IoCreateStreamFileObjectLite | before 5.1 (IFS) to 6.0, undocumented | ||
| IoDeleteDriver | |||
| IoFreeWorkItem | |||
| IoGetAttachedDeviceReference | |||
| IoGetBootDiskInformation | |||
| IoGetDeviceInterfaceAlias | |||
| IoGetDeviceInterfaces | |||
| IoGetDeviceProperty | |||
| IoGetDmaAdapter | |||
| IoGetDriverObjectExtension | |||
| IoGetRequestorProcessId | before 5.1 (IFS) to 6.0, not declared | ||
| IoGetRequestorSessionId | before 5.1 (IFS) to 6.0, undocumented;
since 6.0, documented start is 5.2 SP1 |
||
| IoInitializeRemoveLockEx | indirectly documented | ||
| IoInvalidateDeviceRelations | |||
| IoInvalidateDeviceState | |||
| IoIsFileOriginRemote | starts in SP3 | documented start is 5.1 | |
| IoIsValidNameGraftingBuffer | before 5.1 (IFS) to 6.0, undocumented | ||
| IoIsWdmVersionAvailable | |||
| IoOpenDeviceInterfaceRegistryKey | |||
| IoOpenDeviceRegistryKey | |||
| IoPnPDeliverServicePowerNotification | discontinued in 6.1 | ||
| IoQueueWorkItem | |||
| IoRegisterBootDriverReinitialization | before 5.1, declared | ||
| IoRegisterDeviceInterface | |||
| IoRegisterLastChanceShutdownNotification | before 5.1, declared | ||
| IoRegisterPlugPlayNotification | |||
| IoReleaseRemoveLockAndWaitEx | indirectly documented | ||
| IoReleaseRemoveLockEx | indirectly documented | ||
| IoReportDetectedDevice | |||
| IoReportResourceForDetection | |||
| IoReportTargetDeviceChange | |||
| IoReportTargetDeviceChangeAsynchronous | |||
| IoRequestDeviceEject | |||
| IoReuseIrp | |||
| IoSetDeviceInterfaceState | |||
| IoSetFileOrigin | starts in SP3 | documented start is 5.1 | |
| IoSetIoCompletion | |||
| IoSynchronousInvalidateDeviceRelations | discontinued in 1703 | ||
| IoUnregisterPlugPlayNotification | |||
| IoWMIAllocateInstanceIds | |||
| IoWMIRegistrationControl | |||
| IoWMISuggestInstanceName | |||
| IoWMIWriteEvent |
The exported functions that work with remove locks, e.g., IoAcquireRemoveLockEx, are all documented as reserved, but they are each the essence of a documented macro, e.g., IoAcquireRemoveLock. Still, Microsoft has chosen to divide the work such that the exported functions are documented only as reserved: so be it.
The IoCancelFileOpen function may be another rarity that had parallel documentation in the DDK and IFS Kit. Its first known documentation is in the IFS Kit for Windows 2000. The merging of the IFS Kit into the WDK for Windows Vista leaves this documentation with others for Installable File Systems. Meanwhile, the function was also documented in the DDK for Windows XP and for Windows Server 2003 but only to say it’s reserved. In all versions, the declaration is in NTDDK.H, not NTIFS.H.
When Microsoft got round to documenting the IoRegisterBootDriverReinitialization function, in the DDK for Windows XP, it was “preliminary documentation and subject to change.”
| Function | Documentation History |
|---|---|
| KdDisableDebugger | before 6.1, declared |
| KdEnableDebugger | before 6.1, declared |
| KdEnteredDebugger (data) |
| Function | Export History | Documentation History |
|---|---|---|
| KeQueryActiveProcessors | before 5.1, declared | |
| KeQueryInterruptTime | x86 only | |
| KeQueryPriorityThread | ||
| KeRevertToUserAffinityThread | before 6.0, undocumented | |
| KeSaveStateForHibernate (data) | ||
| KeSetSystemAffinityThread | before 6.0, undocumented; before 6.1, declared; documented start is 5.0 |
|
| KeStackAttachProcess | before 5.1 (IFS) to 6.0, undocumented | |
| KeUnstackDetachProcess | before 5.1 (IFS) to 6.0, undocumented | |
| KiEnableTimerWatchdog | x86 only; discontinued in 6.0 |
The KeSetSystemAffinityThread function is not yet formally obsolete but must be soon. Its first documentation, delayed until the WDK for Windows 7, limits its use to “systems before Windows Vista” and specifies KeSetSystemAffinityThreadEx on “Windows Vista and later” without mentioning that the new function hadn’t been documented for Windows Vista.
| Function | Export History |
|---|---|
| LpcPortObjectType (data) | |
| LpcRequestWaitReplyPort |
| Function | Documentation History |
|---|---|
| Mm64BitPhysicalAddress (data) | before 6.1, declared |
| MmAddPhysicalMemory | before 5.1, declared |
| MmAllocateContiguousMemorySpecifyCache | |
| MmAllocatePagesForMdl | |
| MmFreeContiguousMemorySpecifyCache | |
| MmFreePagesFromMdl | |
| MmGetPhysicalMemoryRanges | before 5.1, declared |
| MmGetSystemRoutineAddress | before 5.1, declared |
| MmGetVirtualForPhysical | before 5.1, declared |
| MmIsDriverVerifying | before 5.1, declared; before 6.1, reserved |
| MmMapUserAddressesToPage | before 5.1, declared |
| MmMapViewInSessionSpace | before 5.1, declared |
| MmProbeAndLockProcessPages | before 5.1, declared |
| MmProbeAndLockSelectedPages | before 6.2, undocumented; before 2015-2018, declared |
| MmRemovePhysicalMemory | before 5.1, declared |
| MmTrimAllSystemPagableMemory | |
| MmUnmapViewInSessionSpace | before 5.1, declared |
Though Mm64BitPhysicalAddress is not formally documented (with its own page) until the WDK for Windows 7, it is mentioned on a page titled Performing DMA in 64-Bit Windows as far back as the DDK for Windows XP.
The MmGetVirtualForPhysical function is declared in NTDDK.H from the DDK for Windows NT 4.0, but the corresponding x86 kernel does not export the function, nor have it as an internal routine.
From the DDK for Windows XP up to and including the WDK for Windows 7, MmIsDriverVerifying is on a list of Memory Manager Routines that are reserved for system use. But also in the WDK for Windows 7, and since, the function gets its own page of documentation which says nothing about its being reserved.
The MmProbeAndLockSelectedPages certainly is not known to the Windows 10 WDK documentation as integrated into Visual Studio 2015. I have no record of seeing it in surveys of Microsoft’s online documentation on 27th February 2016 or even on 7th October 2018. Yet what I see there today, 17th September 2020, is dated 30th April 2018. So, who knows when it was first documented, except that it was long, long, long after it was first exported.
| Function | Export History |
|---|---|
| NlsOemCodePage (data) |
The functions whose names begin with Nt correspond closely to functions whose names have the Zw prefix instead (see below). Put aside some general points about how the two differ—see The Native API— and documentation of an Nt function is to a large extent implied by documentation of the corresponding Zw function.
Though this correspondence will have been understood well enough by all competent kernel-mode programmers, Microsoft didn’t make it explicit until some time after releasing the WDK for Windows Vista. This is here taken as an intention to leave the Nt functions undocumented (if not declared) before version 6.1.
Documentation in the WDK for Windows 7 gives each Nt function its own page and directs attention to the page for the corresponding Zw function. The Zw documentation might then be treated as counting for both, except that the Nt documentation warns expressly “Do not call this routine from kernel-mode code.” This is here taken as documenting the Nt functions as reserved in version 6.1 (certainly for kernel-mode use, which is this survey’s focus).
Microsoft loosened the text significantly for Windows 8 to note that the Nt and Zw versions “can behave differently” and to refer to a page of guidance. These changes, though slight, are taken here as formally permitting the Nt functions’ kernel-mode use, such that they must now be counted as documented (though delayed).
While each Nt function is documented only by reference to the Zw function, whatever documented availability Microsoft gives for the latter is here taken as intended also for the former. In the headers, however, the two functions necessarily each have their own declaration (if they have any), and so any “declared start” shown below is specifically for the Nt function.
| Function | Documentation History |
|---|---|
| NtQueryQuotaInformationFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; in 6.1, reserved; documented start is 6.1 |
| NtQuerySystemInformation | |
| NtSetEaFile | |
| NtSetQuotaInformationFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, declared; in 6.1, reserved; documented start is 6.1 |
| NtSetVolumeInformationFile | before 5.2 (IFS), undocumented;
before 6.1, declared; in 6.1, reserved; documented start is 5.2 |
Every known DDK and WDK mentions NtQuerySystemInformation in a comment, apparently meaning its export from NTDLL.DLL in user mode, without ever presenting a declaration.
The NtSetEaFile function is mentioned in a comment, first in the NTIFS.H from the Windows 2000 IFS Kit but in WDM.H since the WDK for Windows Vista.
| Function | Export History |
|---|---|
| ObDeleteCapturedInsertInfo | starts in SP4; discontinued in 5.1; restored in 5.2 |
| Function | Documentation History |
|---|---|
| PoCallDriver | |
| PoCancelDeviceNotify | |
| PoRegisterDeviceNotify | |
| PoRegisterSystemState | |
| PoRequestPowerIrp | |
| PoSetHiberRange | before 6.2, undocumented |
| PoSetPowerState | |
| PoSetSystemState | |
| PoShutdownBugCheck | |
| PoStartNextPowerIrp | |
| PoUnregisterSystemState |
| Function | Export History | Documentation History |
|---|---|---|
| PsDisableImpersonation | before 5.1 (IFS) to 6.0, undocumented | |
| PsJobType (data) | before 10.0, undocumented; before 1607, declared |
|
| PsRestoreImpersonation | before 5.1 (IFS) to 6.0, undocumented | |
| PsSetLoadImageNotifyRoutine | ||
| PsSetNewKSecDD | starts in SP4; discontinued in 5.1 |
The only declaration that Microsoft had been known to have published of the PsJobType variable is in the NTOSP.H whose distribution with early editions of the WDK for Windows 10 was surely some mistake. Yet in the very next edition, for Version 1607, the declaration is in both NTDDK.H and WDM.H.
| Function | Export History | Documentation History | Declaration History |
|---|---|---|---|
| RtlAddRange | before 6.0, declared | ||
| RtlCaptureContext | before 5.1 (IFS) to 6.0, undocumented;
before 6.1, reserved; since 6.1, documented start is 5.1 |
||
| RtlCopyRangeList | before 6.0, declared | ||
| RtlDeleteAce | before 5.1 (IFS) to 6.0, undocumented;
documented start is 5.2 SP1 |
||
| RtlDeleteOwnersRanges | before 6.0, declared | ||
| RtlDeleteRange | before 6.0, declared | ||
| RtlFindClearRuns | |||
| RtlFindLastBackwardRunClear | |||
| RtlFindLeastSignificantBit | |||
| RtlFindMostSignificantBit | |||
| RtlFindNextForwardRunClear | |||
| RtlFindRange | before 6.0, declared | ||
| RtlFreeRangeList | before 6.0, declared | ||
| RtlGUIDFromString | |||
| RtlGetAce | before 5.1 (IFS), undocumented;
documented start is 5.1 |
||
| RtlGetFirstRange | before 6.0, declared | ||
| RtlGetNextRange | before 6.0, declared | ||
| RtlGetNtGlobalFlags | |||
| RtlGetSaclSecurityDescriptor | before 5.2 SP1 (IFS), undocumented;
documented start is 5.2 SP1 |
since 6.0, declared start is 5.2 SP1 | |
| RtlImageDirectoryEntryToData | |||
| RtlInitializeRangeList | before 6.0, declared | ||
| RtlInsertElementGenericTableFull | before 5.1 (IFS) to 6.0, undocumented | ||
| RtlInvertRangeList | before 6.0, declared | ||
| RtlIsGenericTableEmpty | in 5.0 (IFS), documented but not declared | ||
| RtlIsRangeAvailable | before 6.0, declared | ||
| RtlIsValidOemCharacter | in 5.0 (IFS), documented but not declared | ||
| RtlLookupElementGenericTableFull | before 5.1 (IFS) to 6.0, undocumented | ||
| RtlMergeRangeLists | before 6.0, declared | ||
| RtlPrefetchMemoryNonTemporal | starts in SP3 | before 6.1, declared; documented start is 5.2 |
|
| RtlRealPredecessor | in 5.0 (IFS), documented but not declared | ||
| RtlRealSuccessor | in 5.0 (IFS), documented but not declared | ||
| RtlSelfRelativeToAbsoluteSD | before 5.2 SP1 (IFS), undocumented;
documented start is 5.2 SP1 |
since 6.0, declared start is 5.2 SP1 | |
| RtlSelfRelativeToAbsoluteSD2 | |||
| RtlSizeHeap | |||
| RtlStringFromGUID | |||
| RtlSubtreePredecessor | before 5.1 (IFS) to 6.0, documented but not declared | ||
| RtlSubtreeSuccessor | before 5.1 (IFS) to 6.0, documented but not declared | ||
| RtlTraceDatabaseAdd | starts in SP1 | ||
| RtlTraceDatabaseCreate | starts in SP1 | ||
| RtlTraceDatabaseDestroy | starts in SP1 | ||
| RtlTraceDatabaseEnumerate | starts in SP1 | ||
| RtlTraceDatabaseFind | starts in SP1 | ||
| RtlTraceDatabaseLock | starts in SP1 | ||
| RtlTraceDatabaseUnlock | starts in SP1 | ||
| RtlTraceDatabaseValidate | starts in SP1 | ||
| RtlUlongByteSwap | x86 only | since 6.1 revision, documented start is 5.0 | |
| RtlUlonglongByteSwap | x86 only | since 6.1 revision, documented start is 5.0 | |
| RtlUshortByteSwap | x86 only | since 6.1 revision, documented start is 5.0 | |
| RtlValidRelativeSecurityDescriptor | before 6.0, declared | ||
| RtlVolumeDeviceToDosName | before 5.1, documented | ||
| RtlWalkFrameChain | before 6.1, declared |
The dozen newly added functions that work with ranges and range lists must count now as undocumented though they did at first have declarations in NTDDK.H. Withdrawal of declarations for functions that continue to be exported is relatively rare, so it may be worth noting that these functions have since been added to, in versions 6.0 and 6.1, and they remain in use by some of Microsoft’s drivers.
That RtlVolumeDeviceToDosName is obsolete still comes with qualification: even in 2020 the documentation spells out that the function “is obsolete for Windows XP and later”.
| Function | Export History | Documentation History | Declaration History |
|---|---|---|---|
| SeAssignSecurityEx | |||
| SeAuditHardLinkCreation | starts in SP3 | before 5.1 (IFS) to 6.0, undocumented | since 6.0, declared start is 5.1 |
| SeAuditingHardLinkEvents | starts in SP3 | before 5.1 (IFS) to 6.0, undocumented | |
| SeCreateClientSecurityFromSubjectContext | before 5.1 (IFS) to 6.0, not declared | ||
| SeImpersonateClientEx | before 5.1 (IFS) to 6.0, not declared | ||
| SeQueryInformationToken | before 5.1 (IFS) to 6.0, not declared | ||
| SeQuerySessionIdToken | before 5.1 (IFS) to 6.0, undocumented | ||
| SeSetSecurityDescriptorInfoEx | before 5.1 (IFS) to 6.0, not declared | ||
| SeTokenIsAdmin | before 5.1 (IFS) to 6.0, not declared; since 6.0, declared start is 5.0 |
||
| SeTokenIsRestricted | before 5.1 (IFS) to 6.0, not declared; since 6.0, declared start is 5.0 |
| Function | Documentation History | Declaration History |
|---|---|---|
| ZwAdjustPrivilegesToken | ||
| ZwCancelIoFile | ||
| ZwCancelTimer | before 6.0, declared | |
| ZwFlushVirtualMemory | before 5.1 (IFS), undocumented;
documented start is 5.1 |
|
| ZwInitiatePowerAction | ||
| ZwOpenTimer | before 6.0, declared | |
| ZwPowerInformation | before 6.1, undocumented; before 10.0, declared; documented start is 6.2 |
|
| ZwQueryDefaultUILanguage | ||
| ZwQueryDirectoryObject | ||
| ZwQueryEaFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.2, declared |
|
| ZwQueryInstallUILanguage | ||
| ZwRestoreKey | before 6.2, undocumented | declared start is 6.1 |
| ZwSetDefaultUILanguage | ||
| ZwSetEaFile | before 5.1 (IFS) to 6.0, undocumented;
before 6.2, declared |
|
| ZwSetSecurityObject | before 5.1 (IFS), undocumented;
documented start is 5.1 |
|
| ZwSetVolumeInformationFile | before 5.2 (IFS), undocumented;
documented start is 5.2 |
| Function | Export History |
|---|---|
| _except_handler3 | x86 only |
| _itow |
References to the _except_handler3 function are generated by sufficiently early—but not too early—versions of Microsoft’s compilers for the prologue code of C and C++ functions that use Structured Exception Handling (SEH). Earlier compilers instead generate _except_handler2, which the kernel supports as an original export. The new function has its own page in the Alphabetical Function Reference of the C Run-Time Library Reference for Visual Studio 2012. Documentation for Visual Studio 2015 moved it to the Internal CRT Globals and Functions.
A few functions that the kernel had stopped exporting are restored as exports from version 5.0:
Version 5.0 stops exporting a few functions. For each, the version in parentheses tells when the function was first exported:
As usual, none had yet been documented.