NTDLL 5.0 Named Exports

The table below lists all the NTDLL exports that were added for version 5.0.

Documentation status is conveyed by colour coding. NTDLL functions that actually are documented as exports from NTDLL are shown with no background colour. So too are the NTDLL implementations of documented functions from the C Run-Time Library. Functions that are documented in the Windows Driver Kit (WDK), typically as exports from the NT kernel for use by ring 0 software such as device drivers, but sometimes with non-specific talk of being callable from user mode, are lightly shaded blue. Documented functions that are known not to have been documented immediately they were introduced are a darker blue if the only known documentation is in the WDK, else pink. If the delayed documentation came specifically from its listing among the Settlement Program Interfaces in late 2002, then the function is less pink since Microsoft at least acknowledged that the documentation was late. A function is shaded grey if it seems not to be documented but is known to be the entire low-level implementation of some function in a higher-level DLL such as KERNEL32 or ADVAPI32. Identifying these is a work in progress. Functions that look to be completely undocumented are highlighted yellow. However, an undocumented function is shaded yellow, as semi-documented, if it is at least declared in one or another header file from the WDK or, exceptionally, the SDK. If you browse with scripting enabled, hovering over any text that has a background colour should produce a tooltip that explains the formatting.

Function Remarks
DbgPrintReturnControlC  
LdrAlternateResourcesEnabled discontinued in 6.0
LdrFlushAlternateResourceModules  
LdrLoadAlternateResourceModule  
LdrUnloadAlternateResourceModule  
NtAccessCheckByType  
NtAccessCheckByTypeAndAuditAlarm declaration requires Windows XP and higher
NtAccessCheckByTypeResultList  
NtAccessCheckByTypeResultListAndAuditAlarm declaration requires Windows XP and higher
NtAccessCheckByTypeResultListAndAuditAlarmByHandle declaration requires Windows XP and higher
NtAllocateUserPhysicalPages  
NtAreMappedFilesTheSame  
NtAssignProcessToJobObject  
NtCancelDeviceWakeupRequest discontinued in 6.1
NtCreateJobObject  
NtCreateWaitablePort  
NtFilterToken  
NtFreeUserPhysicalPages  
NtGetDevicePowerState  
NtGetWriteWatch  
NtImpersonateAnonymousToken declaration requires Windows XP and higher
NtInitiatePowerAction  
NtIsSystemResumeAutomatic  
NtMapUserPhysicalPages  
NtMapUserPhysicalPagesScatter  
NtNotifyChangeMultipleKeys  
NtOpenJobObject  
NtPowerInformation  
NtQueryDefaultUILanguage  
NtQueryInformationJobObject  
NtQueryInstallUILanguage  
NtQueryOpenSubKeys  
NtQueryQuotaInformationFile undocumented until 2008-2009;
documentation requires Windows 7 and higher
NtReplyWaitReceivePortEx  
NtRequestDeviceWakeup discontinued in 6.1
NtRequestWakeupLatency discontinued in 6.1
NtResetWriteWatch  
NtSaveMergedKeys  
NtSecureConnectPort  
NtSetDefaultUILanguage  
NtSetInformationJobObject  
NtSetQuotaInformationFile undocumented until 2008-2009;
documentation requires Windows 7 and higher
NtSetThreadExecutionState  
NtSetUuidSeed  
NtTerminateJobObject  
RtlAddAccessAllowedAceEx undocumented until 2008-2009;
documentation requires Windows 2000 and higher;
declaration requires Windows 2000 and higher
RtlAddAccessAllowedObjectAce  
RtlAddAccessDeniedAceEx  
RtlAddAccessDeniedObjectAce  
RtlAddAuditAccessAceEx  
RtlAddAuditAccessObjectAce  
RtlAddRange discontinued in 5.2
RtlCallbackLpcClient discontinued in 5.1
RtlCancelTimer  
RtlCheckForOrphanedCriticalSections  
RtlConvertToAutoInheritSecurityObject  
RtlCopyRangeList discontinued in 5.2
RtlCreateLpcServer discontinued in 5.1
RtlCreateTimer  
RtlCreateTimerQueue  
RtlDebugPrintTimes  
RtlDefaultNpAcl  
RtlDeleteOwnersRanges discontinued in 5.2
RtlDeleteRange discontinued in 5.2
RtlDeleteTimer  
RtlDeleteTimerQueue  
RtlDeleteTimerQueueEx  
RtlDeregisterWait  
RtlDeregisterWaitEx  
RtlDnsHostNameToComputerName  
RtlEnableEarlyCriticalSectionEventCreation  
RtlFindLastBackwardRunClear  
RtlFindLeastSignificantBit  
RtlFindMostSignificantBit  
RtlFindNextForwardRunClear  
RtlFindRange discontinued in 5.2
RtlFreeRangeList discontinued in 5.2
RtlGUIDFromString  
RtlGetFirstRange discontinued in 5.2
RtlGetNextRange discontinued in 5.2
RtlGetSecurityDescriptorRMControl  
RtlGetVersion documentation since 2001-2002 requires Windows XP and higher
RtlImpersonateLpcClient discontinued in 5.1
RtlInitializeRangeList discontinued in 5.2
RtlInt64ToUnicodeString  
RtlInvertRangeList discontinued in 5.2
RtlIsRangeAvailable discontinued in 5.2
RtlMergeRangeLists discontinued in 5.2
RtlNewSecurityObjectEx  
RtlQueueWorkItem  
RtlRegisterWait  
RtlSelfRelativeToAbsoluteSD2  
RtlSetControlSecurityDescriptor  
RtlSetIoCompletionCallback  
RtlSetSecurityDescriptorRMControl  
RtlSetSecurityObjectEx  
RtlSetThreadPoolStartFunc  
RtlSetTimer  
RtlShutdownLpcServer discontinued in 5.1
RtlStringFromGUID  
RtlTraceDatabaseAdd begins from SP1
RtlTraceDatabaseCreate begins from SP1
RtlTraceDatabaseDestroy begins from SP1
RtlTraceDatabaseEnumerate begins from SP1
RtlTraceDatabaseFind begins from SP1
RtlTraceDatabaseLock begins from SP1
RtlTraceDatabaseUnlock begins from SP1
RtlTraceDatabaseValidate begins from SP1
RtlUlongByteSwap x86 only;
conditionally redefined by macro in terms of compiler intrinsic _byteswap_ulong
RtlUlonglongByteSwap x86 only;
conditionally redefined by macro in terms of compiler intrinsic _byteswap_uint64
RtlUpdateTimer  
RtlUshortByteSwap x86 only;
conditionally redefined by macro in terms of compiler intrinsic _byteswap_ushort
RtlValidRelativeSecurityDescriptor undocumented until 2005-2006
RtlVerifyVersionInfo documentation since 2001-2002 requires Windows XP and higher
RtlWalkFrameChain undocumented until 2006-2007;
documented as “reserved for system use”
VerSetConditionMask forwarded from KERNEL32 function VerSetConditionMask in 5.0 and higher
ZwAccessCheckByType  
ZwAccessCheckByTypeAndAuditAlarm  
ZwAccessCheckByTypeResultList  
ZwAccessCheckByTypeResultListAndAuditAlarm  
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle  
ZwAllocateUserPhysicalPages  
ZwAreMappedFilesTheSame  
ZwAssignProcessToJobObject  
ZwCancelDeviceWakeupRequest discontinued in 6.1
ZwCreateJobObject  
ZwCreateWaitablePort  
ZwFilterToken  
ZwFreeUserPhysicalPages  
ZwGetDevicePowerState  
ZwGetWriteWatch  
ZwImpersonateAnonymousToken  
ZwInitiatePowerAction  
ZwIsSystemResumeAutomatic  
ZwMapUserPhysicalPages  
ZwMapUserPhysicalPagesScatter  
ZwNotifyChangeMultipleKeys declaration requires Windows 7 and higher
ZwOpenJobObject  
ZwPowerInformation  
ZwQueryDefaultUILanguage  
ZwQueryInformationJobObject  
ZwQueryInstallUILanguage  
ZwQueryOpenSubKeys  
ZwQueryQuotaInformationFile undocumented until 2000-2006;
documentation until 2008-2009 requires Windows XP and higher;
documentation since 2008-2009 requires Windows 7 and higher;
declaration requires Windows Vista and higher
ZwReplyWaitReceivePortEx  
ZwRequestDeviceWakeup discontinued in 6.1
ZwRequestWakeupLatency discontinued in 6.1
ZwResetWriteWatch  
ZwSaveMergedKeys  
ZwSecureConnectPort  
ZwSetDefaultUILanguage  
ZwSetInformationJobObject  
ZwSetQuotaInformationFile undocumented until 2000-2006;
documentation until 2008-2009 requires Windows XP and higher;
documentation since 2008-2009 requires Windows 7 and higher;
declaration requires Windows Vista and higher
ZwSetThreadExecutionState  
ZwSetUuidSeed  
ZwTerminateJobObject  
_ui64toa  
iswdigit  
iswlower  
iswspace  
iswxdigit