Geoff Chappell - Software Analyst
The table below lists all the NTDLL exports that were added for version 4.0. Something to note is that a high proportion of these additions were soon rejected, many as soon as version 5.0 and most by version 5.1.
Documentation status is conveyed by colour coding. NTDLL functions that actually are documented as exports from NTDLL are shown with no background colour. So too are the NTDLL implementations of documented functions from the C Run-Time Library. Functions that are documented in the Windows Driver Kit (WDK), typically as exports from the NT kernel for use by ring 0 software such as device drivers, but sometimes with non-specific talk of being callable from user mode, are lightly shaded blue. Documented functions that are known not to have been documented immediately they were introduced are a darker blue if the only known documentation is in the WDK, else pink. If the delayed documentation came specifically from its listing among the Settlement Program Interfaces in late 2002, then the function is less pink since Microsoft at least acknowledged that the documentation was late. A function is shaded grey if it seems not to be documented but is known to be the entire low-level implementation of some function in a higher-level DLL such as KERNEL32 or ADVAPI32. Identifying these is a work in progress. Functions that look to be completely undocumented are highlighted yellow. However, an undocumented function is shaded yellow, as semi-documented, if it is at least declared in one or another header file from the WDK or, exceptionally, the SDK. If you browse with scripting enabled, hovering over any text that has a background colour should produce a tooltip that explains the formatting.
| Function | Remarks |
|---|---|
| ?Allocate@CBufferAllocator@@UAEPAXK@Z | discontinued in 5.0 |
| KiRaiseUserExceptionDispatcher | |
| NlsAnsiCodePage | |
| NtAddAtom | |
| NtCreateChannel | discontinued in 5.1 |
| NtDeleteAtom | |
| NtDeleteObjectAuditAlarm | declaration requires Windows XP and higher |
| NtFindAtom | |
| NtListenChannel | discontinued in 5.1 |
| NtLoadKey2 | |
| NtOpenChannel | discontinued in 5.1 |
| NtQueryFullAttributesFile | undocumented until 2008-2009; documentation requires Windows 2000 and higher; not declared |
| NtQueryInformationAtom | |
| NtQueryMultipleValueKey | |
| NtQueryOleDirectoryFile | discontinued in 5.0 |
| NtQueueApcThread | |
| NtReadFileScatter | begins from Windows NT 4.0 SP3 |
| NtReplyWaitSendChannel | discontinued in 5.1 |
| NtSendWaitReplyChannel | discontinued in 5.1 |
| NtSetContextChannel | discontinued in 5.1 |
| NtSignalAndWaitForSingleObject | |
| NtWriteFileGather | begins from Windows NT 4.0 SP3 |
| NtYieldExecution | |
| PropertyLengthAsVariant | discontinued in 6.0 |
| RtlAddAtomToAtomTable | |
| RtlAddCompoundAce | |
| RtlAllocateHandle | |
| RtlClosePropertySet | discontinued in 5.0 |
| RtlCompareVariants | discontinued in 5.0 |
| RtlConvertPropertyToVariant | discontinued in 6.0 |
| RtlConvertVariantToProperty | discontinued in 6.0 |
| RtlCreateAtomTable | |
| RtlCreatePropertySet | discontinued in 5.0 |
| RtlDeleteAtomFromAtomTable | |
| RtlDeleteNoSplay | undocumented until 2000; declaration requires Windows 2000 and higher |
| RtlDestroyAtomTable | |
| RtlDestroyHandleTable | |
| RtlDowncaseUnicodeString | undocumented until 2000; declaration requires Windows 2000 and higher |
| RtlEmptyAtomTable | |
| RtlEnumerateProperties | discontinued in 5.0 |
| RtlFlushPropertySet | discontinued in 5.0 |
| RtlFreeHandle | |
| RtlFreeUserThreadStack | discontinued in 6.0 |
| RtlGuidToPropertySetName | discontinued in 5.0 |
| RtlImageRvaToSection | |
| RtlImageRvaToVa | |
| RtlInitializeAtomPackage | |
| RtlInitializeCriticalSectionAndSpinCount | begins from Windows NT 4.0 SP3 |
| RtlInitializeHandleTable | |
| RtlIsValidHandle | |
| RtlIsValidIndexHandle | |
| RtlLookupAtomInAtomTable | |
| RtlOnMappedStreamEvent | begins from Windows NT 4.0 SP3 |
| RtlPinAtomInAtomTable | |
| RtlPropertySetNameToGuid | discontinued in 5.0 |
| RtlQueryAtomInAtomTable | |
| RtlQueryProperties | discontinued in 5.0 |
| RtlQueryPropertyNames | discontinued in 5.0 |
| RtlQueryPropertySet | discontinued in 5.0 |
| RtlSetAttributesSecurityDescriptor | |
| RtlSetCriticalSectionSpinCount | begins from Windows NT 4.0 SP3; forwarded from KERNEL32 function SetCriticalSectionSpinCount in corresponding 4.0, and higher; forwarded from KERNELBASE function SetCriticalSectionSpinCount in 6.1 and higher |
| RtlSetProperties | discontinued in 5.0 |
| RtlSetPropertyNames | discontinued in 5.0 |
| RtlSetPropertySetClassId | discontinued in 5.0 |
| RtlSetUnicodeCallouts | discontinued in 6.0 |
| RtlTryEnterCriticalSection | forwarded from KERNEL32 function TryEnterCriticalSection
in 4.0 and higher; forwarded from KERNELBASE function TryEnterCriticalSection in 6.1 and higher |
| ZwAddAtom | |
| ZwCreateChannel | discontinued in 5.1 |
| ZwDeleteAtom | |
| ZwDeleteObjectAuditAlarm | |
| ZwFindAtom | |
| ZwListenChannel | discontinued in 5.1 |
| ZwLoadKey2 | |
| ZwOpenChannel | discontinued in 5.1 |
| ZwQueryFullAttributesFile | undocumented until 2008-2009; documentation requires Windows XP and higher; declaration requires Windows 2000 and higher |
| ZwQueryInformationAtom | |
| ZwQueryMultipleValueKey | declaration requires Windows 7 and higher |
| ZwQueryOleDirectoryFile | discontinued in 5.0 |
| ZwQueueApcThread | |
| ZwReadFileScatter | begins from Windows NT 4.0 SP3 |
| ZwReplyWaitSendChannel | discontinued in 5.1 |
| ZwSendWaitReplyChannel | discontinued in 5.1 |
| ZwSetContextChannel | discontinued in 5.1 |
| ZwSignalAndWaitForSingleObject | |
| ZwWriteFileGather | begins from Windows NT 4.0 SP3 |
| ZwYieldExecution | |
| __isascii | |
| __iscsym | |
| __iscsymf | |
| __toascii | |
| _alldiv | x86 only; undocumented until 2001-2002 |
| _allmul | x86 only |
| _allrem | x86 only |
| _allshl | x86 only |
| _allshr | x86 only |
| _atoi64 | |
| _aulldiv | x86 only |
| _aullrem | x86 only |
| _aullshr | x86 only |
| _i64toa | |
| _i64tow | |
| _itow | |
| _ltow | |
| _tolower | discontinued in 6.0 |
| _toupper | discontinued in 6.0 |
| _ultow | |
| _wtoi | |
| _wtoi64 | |
| _wtol | |
| isalnum | |
| iscntrl | |
| isgraph | |
| ispunct | |
| strtol | |
| strtoul |