Kernel Version 3.10 Exports

The table below lists the 618 exports from the i386 (x86) build of the Windows kernel in version 3.10. Together with 69 from the contemporaneous HAL, these exported functions and variables are the original kernel-mode programming interface for the Windows that is its own operating system (in contrast to the Windows that ran on DOS). They make up nearly a third of all exports from the kernel over all known versions. All but 37 are still exported from the i386 kernel as of Windows 10, but 60 were never adopted as exports from the amd64 (x64) kernel.

For the table below, documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. (If you read this website with scripts enabled, then hovering the mouse over any coloured text will produce a tooltip that shows why the text is coloured.) Functions that have their own non-trivial documentation are shown with no background colour. If the function is documented as reserved or obsolete, it is shaded red or shaded grey, respectively. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status. Many undocumented functions do at least have C-language declarations in one or another header file from the WDK. These are shaded orange, except for one special case. Some declarations are known only from “minwin” headers that Microsoft published in early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public knowledge even of the declaration is exceptional.

It’s nothing but fair to note that the majority of these original exports were not documented immediately. This applies especially to all but one of the many whose names begin with Cc or FsRtl, and even to most whose names being with Se. Microsoft’s first documentation of these is thought to be the IFS Kit for Windows 2000—and it is, shall we say, less than obvious that this kit was available openly enough to count as documentation. Indeed, Microsoft’s own text from the time is that this kit “consists of a number of interfaces on multiple architectures that are confidential to Microsoft” (presumably meaning that the confidentiality applies to the interfaces not the architectures). Still, for this survey I count them as documented, just not for the several Windows versions that preceded 5.0. Earlier editions of the IFS Kit are known, but without documentation and anyway not from long enough ago that they would count as timely documentation of version 4.0.

Even now, long after the IFS Kit was merged into the WDK, more than 10% of the original functions are neither documented nor declared. This is not to say that any of this remainder ought to be documented or declared, just that they aren't documented or declared. More than a few exist only for communication between the kernel and HAL, whether vitally or just to distribute functionality: either way, there’s no reasonable argument that they be documented for others to call (or interfere with). Of the functions to which this does not apply, it might be thought unlikely that any will be documented by Microsoft any time soon, if ever. After all, if they haven’t been missed after all these years, can they even be worth knowing about? Yet a trickle of ancient functions get newly documented for this or that new release of the WDK, often as if newly introduced. There’s even one, KeIsExecutingDpc, that didn’t get documented until 2018, a quarter-century after its introduction. It’s perhaps someone’s joke that this function’s availability is said to begin with a specific edition of Windows 10.

Function Documentation History Declaration History
CcCanIWrite before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcCopyRead before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
CcCopyWrite before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
CcDeferWrite before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcFlushCache before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcGetDirtyPages before 5.1 (IFS), undocumented
documented start is 5.1
since 6.0, declared start is 5.1
CcGetFileObjectFromBcb before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcGetFileObjectFromSectionPtrs before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcInitializeCacheMap before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcIsThereDirtyData before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcMapData before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcMdlRead before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcMdlReadComplete before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcMdlWriteComplete before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcPinMappedData before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcPinRead before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcPrepareMdlWrite before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcPreparePinWrite before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcPurgeCacheSection before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcRepinBcb before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcScheduleReadAhead before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcSetAdditionalCacheAttributes before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcSetDirtyPageThreshold before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcSetDirtyPinnedData before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcSetFileSizes before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcSetLogHandleForFile before 5.1 (IFS), undocumented
documented start is 5.1
since 6.0, declared start is 5.1
CcSetReadAheadGranularity before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcUninitializeCacheMap before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcUnpinData before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcUnpinDataForThread before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcUnpinRepinnedBcb before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
CcZeroData before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0

Among exported functions that are documented, CcMapData and CcPurgeCacheSection are unusual in having changed their prototypes. For both, what was originally a BOOLEAN argument got widened to a ULONG such that the value 1 which stood for TRUE becomes just one of potentially many bit flags. Changes of prototype in exported functions are rare enough that I might list each of these as two different functions, except that the changes extend the interface compatibly. Still, one if not both functions present the problem that the documentation did not immediately note the change. For CcMapData, the change starts with version 5.1. That it was documented as early as the IFS Kit for Windows XP seems likely, but an error is certain: documentation in the WDK for Windows Vista, and ever since, incorrectly dates the change to version 5.0 (so that one of the WDK documentation’s few explicit acknowledgements that any function existed before Windows 2000 is wrong in the detail). For CcPurgeCacheSection, the new prototype applies first in version 6.0 but does not show in the documentation until version 6.2.

The IFS Kit for Windows XP is listed above as providing the first documentation of CcGetDirtyPages and CcSetLogHandleForFile, but this is mere supposition. Neither is documented in the IFS Kit for Windows 2000. Both are documented in the WDK for Windows Vista. With no intervening IFS Kit for reference, I infer that the version 6.0 documentation requires Windows XP for these ancient functions because it was for Windows XP that Microsoft first documented them. Note that no such generosity of inference is as easily supported for the three that Microsoft later says require Windows 2000.

Function Documentation History Declaration History
DbgBreakPoint in 5.1 to 5.2, documented start is 5.0 since 6.0, declared start is 5.0
DbgLoadImageSymbols    
DbgPrint since 5.1, documented start is 5.0  

The DbgBreakPoint function is the only known example of Microsoft’s having retracted a misrepresentation that a function requires Windows 2000 when in fact its availability is ancient. Perhaps someone with a level head (and the right clout) pointed out the absurdity that the one routine the kernel had from the start for the vital matter of breaking to a debugger had been documented all along but suddenly “can only be used in Windows 2000 and later.”

Function Export History Documentation History Declaration History
ExAcquireResourceExclusive discontinued in 5.1 before 3.50, documented since 5.1, deprecated
ExAcquireResourceShared discontinued in 3.50 before 3.50, undocumented
before 5.0, declared
since 5.1, deprecated
ExAllocatePool   before 5.1, documented since 5.2, deprecated
since 6.0, declared start is 5.0
ExAllocatePoolWithQuota   before 5.1, documented since 5.2, deprecated
since 6.0, declared start is 5.0
ExConvertExclusiveToShared discontinued in 3.50 before 3.50, undocumented
before 5.0, declared
since 5.1, deprecated
ExDeleteResource discontinued in 5.1 before 3.50, documented since 5.1, deprecated
ExDisableResourceBoost discontinued in 3.50 before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
 
ExExtendZone   before 5.0, documented since 5.1, deprecated
since 6.0, declared start is 5.0
ExFreePool   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExInitializeResource discontinued in 5.1 before 3.50, documented since 5.1, deprecated
ExInitializeZone   before 5.0, documented since 5.1, deprecated
since 6.0, declared start is 5.0
ExInterlockedAddLargeInteger   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExInterlockedAddUlong   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExInterlockedDecrementLong x86 only before 3.51, documented since 5.1, deprecated
ExInterlockedExchangeUlong x86 only
before 3.51, documented since 5.1, deprecated
ExInterlockedIncrementLong x86 only before 3.51, documented since 5.1, deprecated
ExInterlockedInsertHeadList   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExInterlockedInsertTailList   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExInterlockedPopEntryList   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExInterlockedPushEntryList   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExInterlockedRemoveHeadList   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExIsResourceAcquiredShared discontinued in 3.50 before 3.50, undocumented
before 5.2 SP1, declared
since 5.1, deprecated
ExLocalTimeToSystemTime   before 3.50 to 3.51, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ExQueryPoolBlockSize   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
ExQueueWorkItem   in 5.0 to 5.2, obsolete since 5.1, deprecated
since 6.0, declared start is 5.0
ExRaiseHardError      
ExRaiseStatus   before 3.51, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ExReleaseResource discontinued in 3.50
before 3.50, documented since 5.1, deprecated
ExReleaseResourceForThread discontinued in 5.1
before 3.50, documented since 5.1, deprecated
ExSystemExceptionFilter      
ExSystemTimeToLocalTime   before 3.50 to 3.51, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
Exi386InterlockedDecrementLong x86 only before 3.50, declared  
Exi386InterlockedExchangeUlong x86 only before 3.50, declared  
Exi386InterlockedIncrementLong x86 only before 3.50, declared  

The nine functions that work with the Executive’s synchronisation resource have a complicated history. The implementation was significantly redeveloped for the very next version but its reduction of the ERESOURCE structure meant that new drivers, allowing only for a smaller size, could not safely use the old functions when running with an old kernel. For new drivers, version 3.50 exports a new set of functions (which are mostly named from the old just by appending Lite). For old drivers, the old functions live on in two ways. First, all the old functions are redefined by macro in terms of the new so that an old driver rebuilt with a new DDK (presumably as early as the one for version 3.50) is in effect a new driver without having needed any rewriting of source code. Second, so that old drivers that are not rebuilt might run on the next few Windows versions, four of the original five functions that had been documented continue to be exported up to and including version 5.0. The other that had been documented had already been redefined by macro such that old drivers should not be importing it. This function and the four that had never been documented cease as exports right from version 3.50. The five that had been documented stayed documented but as the first kernel functions to be documented as obsolete. The other four might have been left to oblivion, but the Windows 2000 DDK revived them just to document them as obsolete.

The ExQueueWorkItem function is unusual for having been obsolete and then not, and also for having been documented differently concurrently. For version 6.0, but perhaps as early as version 5.1, the function has one page of documentation for programming that uses just the DDK and another for the more specialised use that is catered to by the IFS Kit. The function became obsolete in version 5.0, which introduced IoQueueWorkItem for drivers to use instead. For versions 5.1 and 5.2 the function stayed obsolete in the DDK, but apparently not in the IFS Kit. Certainly for Windows Vista, the IFS Kit looks to have revived the function’s documentation from before Windows 2000, with warnings added about needing “extreme caution”. The WDK for Windows Vista has both the DDK and IFS documentation. Later WDKs retain only the latter, such that the function is no longer obsolete—as far as spelled out in the documentation. The status is a little different in the headers. Starting with the WDK for Windows 7, an annotation for Microsoft’s tools for static code analysis states clearly that the function is “Obsolete in all drivers for Vista. Obsolete downlevel except for limited use in IFS. See the documentation”, not that the documentation is even nearly so definite.

The ExRaiseStatus function may be documented as early as version 3.50 but is here conjectured not to have been, it being thought more natural to have got documented for version 3.51 while working on the latter to introduce ExRaiseAccessViolation and ExRaiseDatatypeMisalignment. Against this, of course, is that these two functions for version 3.51 weren’t also documented.

The three functions whose names start with Exi386 are notable for reversing the usual transition in which undocumented functions get declared (and eventually documented). In version 3.10, they are the explicitly declared exports for their interlocked operations but they are left undocumented as a platform-specific implementation detail. The documented functions, which are platform-independent and do not have i386 in their names, are exported but NTDDK.H redefines them by macro when building for the x86. Version 3.50 has new platform-specific variants with a different calling convention and the new prefix Exfi386 in their names. If there was a DDK for Windows NT 3.50, it surely will have changed to declaring the Exfi386 functions, leaving the Exi386 functions to be lost from the declarations and become undocumented. The documented platform-independent ExInterlockedDecrementLong, etc., will then have become obsolete when version 3.51 simplified to InterlockedDecrement, etc.

Function Documentation History Declaration History
FsRtlAddLargeMcbEntry before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlAddMcbEntry before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlAllocatePool before 5.0 (IFS), undocumented  
FsRtlAllocatePoolWithQuota before 5.0 (IFS), undocumented  
FsRtlAllocateResource before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
FsRtlAreNamesEqual before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlBalanceReads before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
FsRtlCheckLockForReadAccess before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlCheckLockForWriteAccess before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlCheckOplock before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
FsRtlCopyRead before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlCopyWrite before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlCurrentBatchOplock before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
FsRtlDeregisterUncProvider before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlDissectDbcs before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
FsRtlDissectName before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlDoesDbcsContainWildCards before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
FsRtlDoesNameContainWildCards before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlFastCheckLockForRead before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
FsRtlFastCheckLockForWrite before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
FsRtlFastUnlockAll before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlFastUnlockAllByKey before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlFastUnlockSingle before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
FsRtlGetNextFileLock before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlGetNextLargeMcbEntry before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlGetNextMcbEntry before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlInitializeFileLock before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlInitializeLargeMcb before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlInitializeMcb before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlInitializeOplock before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
FsRtlIsDbcsInExpression before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlIsFatDbcsLegal before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
FsRtlIsHpfsDbcsLegal before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
FsRtlIsNameInExpression before 5.0 (IFS), undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
FsRtlIsNtstatusExpected before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlIsTotalDeviceFailure before 5.0 (IFS), declared
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
FsRtlLegalAnsiCharacterArray (data) before 5.0 (IFS), undocumented  
FsRtlLookupLargeMcbEntry before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlLookupLastLargeMcbEntry before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlLookupLastMcbEntry before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlLookupMcbEntry before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlMdlRead    
FsRtlNormalizeNtstatus before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlNotifyChangeDirectory    
FsRtlNotifyCleanup before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlNotifyReportChange    
FsRtlNumberOfRunsInLargeMcb before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlNumberOfRunsInMcb before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlOplockFsctrl before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
FsRtlOplockIsFastIoPossible before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
FsRtlPostStackOverflow before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
FsRtlPrepareMdlWrite    
FsRtlPrivateLock before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
FsRtlProcessFileLock before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlRegisterUncProvider before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlRemoveLargeMcbEntry before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlRemoveMcbEntry before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlSyncVolumes    
FsRtlUninitializeFileLock before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlUninitializeLargeMcb before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlUninitializeMcb before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlUninitializeOplock before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0

Of kernel exports for which the first known documentation is the IFS Kit for Windows 2000, FsRtlIsTotalDeviceFailure is alone in having been declared in earlier editions of the ordinary DDK—indeed, right from the DDK for Windows NT 3.10.

Though no public documentation of FsRtlMdlRead is known, nor even a declaration except in NTOSP.H from those early editions of the WDK for Windows 10, the function does get mentioned among the Remarks in documentation of FsRtlIncrementCcFastMdlReadWait. This starts for Windows 8, which happens also to be the version that introduces FsRtlMdlReadEx.

Function Documentation History Declaration History
IoAcquireCancelSpinLock since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoAcquireVpbSpinLock before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
IoAdapterObjectType (data)    
IoAllocateAdapterChannel before 5.0, documented since 5.1, deprecated
since 6.0, declared start is 5.0
IoAllocateController since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoAllocateErrorLogEntry since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoAllocateIrp since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoAllocateMdl since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoAttachDevice since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoAttachDeviceByPointer before 5.0, documented since 5.1, deprecated
since 6.0, declared start is 5.0
IoBuildAsynchronousFsdRequest since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoBuildDeviceIoControlRequest since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoBuildPartialMdl since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoBuildSynchronousFsdRequest since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoCallDriver since 6.1 revision, documented start is 5.0  
IoCancelIrp since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoCheckDesiredAccess before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
IoCheckEaBufferValidity before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
IoCheckFunctionAccess before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
IoCheckShareAccess since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoCompleteRequest since 6.1 revision, documented start is 5.0  
IoConnectInterrupt since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoCreateController since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoCreateDevice since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoCreateFile before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
IoCreateStreamFileObject before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
IoCreateSymbolicLink since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoCreateSynchronizationEvent since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoCreateUnprotectedSymbolicLink since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoDeleteController since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoDeleteDevice since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoDeleteSymbolicLink since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoDetachDevice since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoDeviceObjectType (data)    
IoDisconnectInterrupt since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoFileObjectType (data) before 3.50 to 3.51, undocumented
since 5.0, indirectly documented
 
IoFreeController since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoFreeIrp since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoFreeMdl since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoGetConfigurationInformation since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoGetCurrentProcess before 3.50 to 3.51, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
IoGetDeviceObjectPointer since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoGetRelatedDeviceObject since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoInitializeIrp since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoInitializeTimer since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoIsOperationSynchronous before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
IoMakeAssociatedIrp since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoQueryDeviceDescription before 5.0, documented since 5.1, deprecated
since 6.0, declared start is 5.0
IoRaiseHardError since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoRaiseInformationalHardError since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoReadOperationCount (data) before 5.0 (IFS), undocumented  
IoReadTransferCount (data) before 5.0 (IFS), undocumented  
IoRegisterDriverReinitialization since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoRegisterFileSystem before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
IoRegisterShutdownNotification since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoReleaseCancelSpinLock since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoReleaseVpbSpinLock before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
IoRemoveShareAccess since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoReportHalResourceUsage    
IoReportResourceUsage before 5.0, documented since 5.1, deprecated
since 6.0, declared start is 5.0
IoSetHardErrorOrVerifyDevice since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoSetInformation before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
IoSetShareAccess since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoStartNextPacket since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoStartNextPacketByKey since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoStartPacket since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoStartTimer since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoStatisticsLock (data) before 5.0 (IFS), undocumented  
IoStopTimer since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoUnregisterFileSystem before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
IoUnregisterShutdownNotification since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoUpdateShareAccess since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoVerifyVolume before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
IoWriteErrorLogEntry since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoWriteOperationCount (data) before 5.0 (IFS), undocumented  
IoWriteTransferCount (data) before 5.0 (IFS), undocumented  

As with most exported variables, IoFileObjectType is not itself documented. Starting with the DDK for Windows 2000, however, it gets mentioned in the documentation of exported functions such as ObReferenceObjectByHandle from its being intended as an argument.

Though IoReportHalResourceUsage is not known ever to have been documented or declared, it features in a comment in NTDDK.H starting with the DDK for Windows 2000. Some measure of what undocumented can mean is that the (single-line) comment is for a member of an undocumented enumeration that NTDDK.H shows only as a member of an undocumented structure that is presented only as being accessed from four more undocumented structures that are in turn only in an undocumented union whose address can be passed among the arguments of an undocumented function type, a pointer to which can be a member of an undocumented structure that neither NTDDK.H nor any other WDK header refers to.

In version 3.10, IoStatisticsLock is the spin lock that protects the 64-bit counters such as IoReadTransferCount that eventually get declared together in NTIFS.H. What makes it notable for a historical survey is that it got declared only after the kernel had stopped using it—indeed, long after, since this last known use did not survive even to version 3.50.

Function Documentation History
KdDebuggerEnabled (data) since 5.2 SP1, indirectly documented
documented start is 5.1
KdDebuggerNotPresent (data) since 5.2 SP1, indirectly documented
documented start is 5.1
KdPollBreakIn  

The indirect documentation of the KdDebuggerEnabled and KdDebuggerNotPresent variables is through the macros KD_DEBUGGER_ENABLED and KD_DEBUGGER_NOT_PRESENT which are each presented as a “global kernel variable”. The macros are first documented in the DDK for Windows Server 2003 SP1. The variables are there dated to Windows XP. The macros are indeed defined first in the DDK for Windows XP but the variables are declared even in the DDK for Windows NT 3.1.

Function Export History Documentation History Declation History
Ke386CallBios x86 only;
discontinued in 6.2
   
Ke386IoSetAccessProcess x86 only    
Ke386QueryIoAccessMap x86 only    
Ke386SetIoAccessMap x86 only    
KeAcquireSpinLockAtDpcLevel   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeAttachProcess   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
KeBugCheck   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeBugCheckEx   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeCancelTimer   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeConnectInterrupt      
KeDcacheFlushCount discontinued in 5.2    
KeDelayExecutionThread   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeDetachProcess   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
KeDisconnectInterrupt discontinued in 6.0    
KeEnterKernelDebugger   before 5.1, declared  
KeFindConfigurationEntry      
KeFlushEntireTb      
KeGetCurrentThread   before 5.0, declared
since 6.1 revision, documented start is 5.0
 
KeGetPreviousMode x86 only    
KeI386AbiosCall x86 only;
discontinued in 6.2
   
KeI386AllocateGdtSelectors x86 only;
discontinued in 6.2
   
KeI386FlatToGdtSelector x86 only;
discontinued in 6.2
   
KeI386GetLid x86 only;
discontinued in 6.2
   
KeI386MachineType (data) x86 only    
KeI386ReleaseLid x86 only;
discontinued in 6.2
   
KeIcacheFlushCount discontinued in 5.2    
KeInitializeApc      
KeInitializeDeviceQueue   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeInitializeDpc   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeInitializeEvent   since 6.1 revision, documented start is 5.0  
KeInitializeInterrupt      
KeInitializeMutant   before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.0
KeInitializeMutex   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeInitializePowerStatus discontinued in 3.50    
KeInitializeSemaphore   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeInitializeSpinLock x86 only since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeInitializeTimer   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeInsertByKeyDeviceQueue   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeInsertDeviceQueue   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeInsertQueueApc      
KeInsertQueueDpc   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeInsertQueuePowerStatus discontinued in 3.50    
KeIsExecutingDpc before 6.0, x86 only before 1803, undocumented
documented start is 1803
declared start is 1803
KeLeaveCriticalRegion   before 3.50 to 3.51, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
KeNumberProcessors (data)   before 6.1, declared  
KeProfileInterrupt x86 only;
discontinued in 6.2
   
KeQuerySystemTime x86 only since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeQueryTickCount x86 only since 6.1 revision, documented start is 5.0  
KeQueryTimeIncrement   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeReadStateEvent   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeReadStateMutex   since 6.1 revision, documented start is 5.0 in 3.50 to 5.0, not declared
since 6.0, declared start is 5.0
KeReadStateSemaphore   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeReadStateTimer   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeReleaseMutant   before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.0
KeReleaseMutex   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeReleaseSemaphore   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeReleaseSpinLockFromDpcLevel   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeRemoveByKeyDeviceQueue   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeRemoveDeviceQueue   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeRemoveEntryDeviceQueue   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeRemoveQueueDpc   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeRemoveQueuePowerStatus discontinued in 3.50    
KeResetEvent   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeSetBasePriorityThread   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeSetEvent   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeSetPriorityThread   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeSetTimeIncrement discontinued in 6.3    
KeSetTimer   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeSynchronizeExecution   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeTerminateThread discontinued in 6.1    
KeTimeIncrement (data) discontinued in 3.50    
KeUpdateRunTime discontinued in 6.3    
KeUpdateSystemTime discontinued in 6.2    
KeWaitForMultipleObjects   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeWaitForMutexObject   before 3.50, undocumented
since 6.1 revision, documented start is 5.0
 
KeWaitForSingleObject   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
Kei386EoiHelper x86 only    
KiAcquireSpinLock x86 only    
KiCoprocessorError x86 only;
discontinued in 6.3
   
KiDeliverApc x86 only    
KiDispatchInterrupt x86 only    
KiIpiSend discontinued in 4.0    
KiIpiServiceRoutine x86 only    
KiReleaseSpinLock x86 only    
KiUnexpectedInterrupt x86 only    
Kii386SpinOnSpinLock x86 only;
discontinued in 6.1
   

In all versions of x86 Windows that have both, KeGetPreviousMode has the same address as ExGetPreviousMode. The x64 kernel exports only the latter and the former seems never to have been documented for any architecture. Among the headers from the driver kits that are available for inspection, KeGetPreviousMode appears only once: the NTDDK.H in the DDK for Windows XP has it (conditionally) as a macro that can’t compile without whatever private header defines the PreviousMode member of the opaque KTHREAD.

Though practical use of KeNumberProcessors was demonstrated by Microsoft in source code samples published as far back as the DDK for Windows 2000, this variable’s first documentation is only in passing, where the WDK for Windows Vista warns that “Device drivers that are built for Windows Vista and later” should use the new KeQueryActiveProcessorCount function instead. The variable first gets its own page in the WDK for Windows 7, but only then to say formally that it’s obsolete (starting from Windows Vista SP1).

The kernel started with the mutant and mutex as separate types of synchronisation object. Their unification for version 3.50 was problematic because the mutex, which had been documented, was in effect redefined to be the same as the mutant, which had not been documented. For the KeReadStateMutex function, the redefinition is literal: headers in the next few versions of the DDK define KeReadStateMutex by macro as KeReadStateMutant. The problem is that the latter is not declared. For all practical effect, at least for programmers outside Microsoft, KeReadStateMutex was documented but not declared.

In version 3.10 only, KeWaitForMutexObject and KeWaitForSingleObject have separate implementations. The former was specialised to waiting on a single object that is known to be a mutex, but it was neither documented nor declared. The more general function was also good for waiting on a mutex. Later kernels lose the mutex-specific implementation. Both functions continue as exports but with the same address. The DDK for subsequent versions redefines the one into the other by macro and documents both. Up to and including the WDK for Windows 7, this documentation of KeWaitForMutexObject presents what looks to be the original declaration, with the function needing the address of a mutex specifically. This declaration does not exist in the headers.

Function Documentation History
LsaCallAuthenticationPackage before 3.50 to 3.51, undocumented
before 6.2, declared
LsaDeregisterLogonProcess before 3.50 to 3.51, undocumented
before 6.2, declared
LsaFreeReturnBuffer before 3.50 to 3.51, undocumented
LsaLogonUser before 3.50 to 3.51, undocumented
LsaLookupAuthenticationPackage before 3.50 to 3.51, undocumented
before 6.2, declared
LsaRegisterLogonProcess before 3.50 to 3.51, undocumented

The kernel’s six Local Security Authority (LSA) functions are specially difficult for a historical survey of documentation status. All six have long been documented for user-mode programming—the earliest that I have found, from a Platform SDK for January 2000, even says each function “Requires Windows NT 3.1 or later”—but if Microsoft has ever documented any of them for use in kernel mode, then I don’t know where. This might not matter. After all, the kernel’s exported implementations of C Run-Time (CRT) functions are not explicitly documented for kernel-mode use, yet nobody could sensibly count them as undocumented. The complication for the LSA functions is that Microsoft hasn’t just left kernel-mode use as unstated. Things have been done that differentiate the kernel-mode exports from the same-named user-mode exports, and I think this must be taken as deliberate such that kernel-mode use actually is meant not to be documented.

Since neither the DDK nor SDK for Windows NT 3.1 has any mention of these functions either in documentation or in any header for inclusion in source code, there surely can be no dispute that all six are initially undocumented even in user mode. The DDK for Windows NT 3.51 has NTSECAPI.H with declarations of all six. It and the DDK for Windows NT 4.0 also have an LSAAUTH.HLP file that does not formally document any of the functions but does mention four of them and even says that “services” are “callable from both user mode and kernel mode.”

That all six are declared in a header that shipped with the DDK does not obviously mean that all were intended for kernel-mode use. Notably, NTSECAPI.H has the declarations in a conditional-compilation block so that they are dropped if NTIFS.H is included first. For version 3.51, NTIFS.H was still many years away from open distribution. In its first version that’s more or less readily available, with the Windows 2000 IFS Kit, NTIFS.H declares just LsaRegisterLogonProcess and LsaFreeReturnBuffer (and mentions LsaCallAuthenticationPackage and LsaLogonUser in comments). Some time after, but certainly by the WDK for Windows Vista, LsaLogonUser gets declared too. Three of the functions, then, are unambiguously intended for kernel-mode use, at least since the NTIFS.H from version 5.0, even if not documented for it.

The declarations in NTSECAPI.H remain to this day. They’re also in a new header named NTLSA.H, starting with the WDK for Windows Vista. In the WDK for Windows 8, however, a reorganisation of headers into subdirectories named “km”, “um” and “shared” surely is intended by Microsoft as showing which headers are for kernel-mode programming, user-mode programming and both. Since NTSECAPI.H and NTLSA.H both move to the “um” subdirectory, I think their declarations cannot be counted as intended for kernel-mode use.

Function Export History Documentation History Declaration History
MmAllocateContiguousMemory   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
MmAllocateNonCachedMemory   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
MmBuildMdlForNonPagedPool   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
MmCreateMdl   before 5.0, documented since 5.1, deprecated
since 6.0, declared start is 5.0
MmDbgTranslatePhysicalAddress discontinued in 5.0    
MmFlushImageSection   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
MmForceSectionClosed   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
MmFreeContiguousMemory   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
MmFreeNonCachedMemory   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
MmGetPhysicalAddress   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
MmIsAddressValid   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
MmIsNonPagedSystemAddressValid   before 4.0, documented since 5.1, deprecated
since 6.0, declared start is 5.0
MmMapIoSpace   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
MmMapLockedPages   before 5.2, documented since 6.0, declared start is 5.0
since 6.0, deprecated
MmProbeAndLockPages   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
MmQuerySystemSize   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
MmSetAddressRangeModified   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
MmSizeOfMdl   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
MmUnlockPages   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
MmUnmapIoSpace   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
MmUnmapLockedPages   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0

Documentation of MmMapLockedPages is qualified: even now, in 2020, it is “obsolete for Windows 2000 and later”. When this was first said of the function, the point will have been that continued use was anticipated for drivers that find themselves running on an earlier Windows. This would be unremarkable except that by late 2009 it becomes one of the few examples of Microsoft acknowledging a kernel export as being available before Windows 2000. It also presents the quirk that the opposite function, MmUnmapLockedPages, is only “Available starting with Windows 2000.”

Function Documentation History
NlsLeadByteInfo (data)  
NlsMbCodePageTag (data) before 3.50, undocumented
since 6.1, indirectly documented as reserved

The indirect documentation of NlsMbCodePageTag is through the macro NLS_MB_CODE_PAGE_TAG which is presented as a “global variable”. The first documentation is in the WDK for Windows 7. Unusually for any kernel export, it is explicitly said to be “Available in all versions”. Less unusually, the macro is also said to be “reserved for system use.”

Function Documentation History Declaration History
NtAdjustPrivilegesToken before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
NtAllocateLocallyUniqueId before 6.1, undocumented
before 6.2, reserved
documented start is 6.0
not declared
NtAllocateVirtualMemory before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
since 6.1 revision, documented start is 5.0
before 6.2, reserved
since 6.0, declared start is 5.0
NtClose before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
since 6.1 revision, documented start is 5.0
before 6.2, reserved
since 6.0, declared start is 5.0
NtConnectPort in 6.0 only, declared declared start is 5.1
NtCreateEvent before 6.1, undocumented
documented start is 5.1
before 6.2, reserved
not declared
NtCreateFile before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
documented start is 5.0
before 6.2, reserved
since 6.0, declared start is 5.0
NtCreateSection before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
since 6.1 revision, documented start is 5.0
before 6.2, reserved
since 6.0, declared start is 5.1
NtDeviceIoControlFile before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
since 6.1 revision, documented start is 5.0
before 6.2, reserved
since 6.0, declared start is 5.0
NtDuplicateObject before 6.1, undocumented
before 6.2, reserved
documented start is 5.0
not declared
NtDuplicateToken before 5.0 (IFS), undocumented
before 6.1, declared
documented start is 5.0
before 6.2, reserved
since 6.0, declared start is 5.1
NtFreeVirtualMemory before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
since 6.1 revision, documented start is 5.0
before 6.2, reserved
since 6.0, declared start is 5.0
NtFsControlFile before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
since 6.1 revision, documented start is 5.0
before 6.2, reserved
since 6.0, declared start is 5.0
NtGlobalFlag (data)    
NtLockFile before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
documented start is 6.1
before 6.2, reserved
since 6.0, declared start is 5.0
NtMapViewOfSection before 6.1, undocumented
since 6.1 revision, documented start is 5.0
before 6.2, reserved
not declared
NtNotifyChangeDirectoryFile    
NtOpenFile before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
since 6.1 revision, documented start is 5.0
before 6.2, reserved
since 6.0, declared start is 5.0
NtOpenProcessToken before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
NtQueryDirectoryFile before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
documented start is 5.1
before 6.2, reserved
since 6.0, declared start is 5.0
NtQueryEaFile    
NtQueryInformationFile before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
since 6.1 revision, documented start is 5.0
before 6.2, reserved
since 6.0, declared start is 5.0
NtQueryInformationToken before 5.0 (IFS), undocumented
before 6.1, declared
documented start is 5.1
before 6.2, reserved
since 6.0, declared start is 5.0
NtQuerySecurityObject before 5.1 (IFS), undocumented
before 6.1, declared
documented start is 5.1
before 6.2, reserved
since 6.0, declared start is 5.0
NtQueryVolumeInformationFile before 5.1 (IFS), undocumented
before 6.1, declared
before 6.2, reserved
documented start is 5.1
since 6.0, declared start is 5.0
NtReadFile before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
since 6.1 revision, documented start is 5.0
before 6.2, reserved
since 6.0, declared start is 5.0
NtRequestPort    
NtRequestWaitReplyPort in 6.0 only, declared declared start is 5.1
NtSetEvent before 6.1, undocumented
documented start is 5.1
before 6.2, reserved
not declared
NtSetInformationFile before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
since 6.1 revision, documented start is 5.0
before 6.2, reserved
since 6.0, declared start is 5.0
NtSetInformationProcess    
NtSetInformationThread before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
since 6.1 revision, documented start is 5.0
before 6.2, reserved
since 6.0, declared start is 5.1
NtSetSecurityObject before 5.1 (IFS), undocumented
before 6.1, declared
documented start is 5.1
before 6.2, reserved
since 6.0, declared start is 5.0
NtUnlockFile before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
documented start is 6.1
before 6.2, reserved
since 6.0, declared start is 5.0
NtVdmControl    
NtWaitForSingleObject before 6.1, undocumented
documented start is 5.1
before 6.2, reserved
not declared
NtWriteFile before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
since 6.1 revision, documented start is 5.0
before 6.2, reserved
since 6.0, declared start is 5.0

The functions whose names begin with Nt correspond closely to functions whose names have the Zw prefix instead (see below). Put aside some general points about how the two differ, and documentation of an Nt function is to a large extent implied by documentation of the corresponding Zw function. Microsoft started making this explicit some time after releasing the WDK for Windows Vista. Documentation in the WDK for Windows 7 gives each Nt function its own page and directs attention to the page for the corresponding Zw function. The latter might be thought to count for both, except that the former warns expressly “Do not call this routine from kernel-mode code.” This is here taken as documenting the functions as reserved (certainly for kernel-mode use, which is this survey’s focus). Microsoft loosened the text significantly for Windows 8 to note that the Nt and Zw versions “can behave differently”, which is here taken as formally permitting their use, such that they are no longer documented as reserved.

Though NtGlobalFlag is not formally documented, nor quite counts as indirectly documented, it is well known to kernel-mode programmers as the variable where the kernel keeps what Microsoft’s GFLAGS.EXE tool calls Kernel Flags. Microsoft’s early description of this tool (as for the Knowledge Base article Q206848, titled Windows NT Service Pack 4.0 Tools Not Included on CD-ROM and long gone from Microsoft’s website) was that it “edits the NtGlobalFlag settings for Windows in the registry.” Even before this, some programmers will have known that the -x switch causes I386KD to execute an eb command that sets this variable to 9.

The NtNotifyChangeDirectoryFile function is mentioned in comments in NTIFS.H starting from the IFS Kit for Windows 2000 and in WDM.H starting from the WDK for Windows Vista, but has never yet been declared. The story is only slightly different for NtQueryEaFile: it too is mentioned in a comment in NTIFS.H from the IFS Kit for Windows 2000, but the comment then moves to WDM.H.

More obscurely, NtRequestPort and NtRequestWaitReplyPort share a comment in the NTIFS.H from the WDK for Windows Vista, which is never repeated in later editions. The second of this pair is notable because this header also declares the function (and also NtConnectPort). It is here speculated, though with some confidence, that these declarations started as early as an IFS Kit for Windows XP. For however long they were published, they’re long gone now.

The NtSetInformationProcess function is mentioned in increasingly many comments in NTDDK.H, starting as long ago as the DDK for Windows NT 3.51, yet it too never has been declared.

Function Documentation History Declaration History
ObCreateObject    
ObDereferenceObject since 6.1 revision, documented start is 5.0  
ObInsertObject before 5.1 (IFS) to 6.0, undocumented
before 6.1, declared
since 6.0, declared start is 5.0
ObOpenObjectByPointer before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
ObQueryNameString before 5.0 (IFS), undocumented
since 6.2, documented start is 5.0
since 6.0, declared start is 5.0
ObReferenceObjectByHandle since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ObReferenceObjectByPointer since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0

Who’s to know why, but documentation of ObReferenceObjectByHandle and ObReferenceObjectByPointer was marked as “preliminary documentation and subject to change” in the DDK for Windows XP (specifically).

Function Export History Documentation History Declaration History
PfxFindPrefix   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
PfxInitialize   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
PfxInsertPrefix   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
PfxRemovePrefix   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
ProbeForRead discontinued in 3.50;
restored in 5.0
before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ProbeForWrite   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0

Though the kernel does not export ProbeForRead in versions 3.50 to 4.0, the function can be identified in these versions as an internal routine—not just in the kernel but in Microsoft’s drivers that had imported it from the kernel in version 3.10. It seems to have been considered simple enough for definition as an inline routine (or even as a macro) in headers that Microsoft kept for its own programming. Perhaps only in version 5.0 did Microsoft care (or realise) that non-Microsoft programmers would better have easy access to a standard way to test the plausibility of inputs received from user mode. The early history of this function, which exists only for security, may be useful as a data point in assessing modern perceptions of security’s early neglect.

Function Export History Documentation History Declaration History
PsChargePoolQuota   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
PsCreateSystemProcess discontinued in 6.0    
PsCreateSystemThread   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
PsInitialSystemProcess (data)   before 6.1, undocumented
before 6.1 revision, documented start is 4.0
documented start is 5.0
 
PsProcessType (data)   before 6.0, undocumented
indirectly documented
 
PsReturnPoolQuota   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
PsTerminateSystemThread   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
PsThreadType (data)   before 5.0 (IFS), undocumented
since 6.0, indirectly documented
 

For the second edition of the WDK for Windows 7, numbered 7600.16385.1, the most extensive revision was that almost all of the kernel’s original exports became documented as being “Available in Windows 2000 and later versions of Windows.” From some perspective, stating this among the Requirements is even generous: the WDK for Windows 7 explicitly does not support development of drivers for execution on anything older than Windows XP, so why mention Windows 2000 at all? Still, the aim surely was to dismiss earlier versions as if they had never existed. For some measure of Microsoft’s determination in this tidying of history by wiping it out, consider PsInitialSystemProcess. When it was newly documented with its own page in the first edition, numbered 7600.16385.0, license was taken to start its availability at Microsoft Windows NT 4.0. This was not allowed to stand even for six months. Call me cynical, but Microsoft is rarely so swift even with true corrections.

Though PsProcessType and PsThreadType are not themselves documented, they get mentioned in the documentation of exported functions such as ObReferenceObjectByHandle from being intended as an argument. This starts with the WDK for Windows Vista.

Function Export History Documentation History
READ_REGISTER_BUFFER_UCHAR x86 only since 6.2, documented start is 5.0
READ_REGISTER_BUFFER_ULONG x86 only since 6.2, documented start is 5.0
READ_REGISTER_BUFFER_USHORT x86 only since 6.2, documented start is 5.0
READ_REGISTER_UCHAR x86 only since 6.2, documented start is 5.0
READ_REGISTER_ULONG x86 only since 6.2, documented start is 5.0
READ_REGISTER_USHORT x86 only since 6.2, documented start is 5.0

The READ_REGISTER functions have x64 support as inlined routines defined in WDM.H. Exported or not, they abstract the reading of I/O registers in memory space. The HAL exports counterparts that do the same but from I/O space. All have been documented from the start under some such heading as Hardware Abstraction Layer Routines which may be just separate enough that they were missed when a revision of the WDK for Windows 7 spuriously dated almost all the ancient documented functions to Windows 2000. If this was an oversight, it was soon put right, so to speak.

Function Export History Documentation History Declaration History
RtlAbsoluteToSelfRelativeSD   before 5.2 SP1 (IFS), undocumented
documented start is 5.2 SP1
since 6.0, declared start is 5.2 SP1
RtlAddAccessAllowedAce   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlAllocateHeap   before 5.1 (IFS), undocumented
documented start is 5.1
since 6.0, declared start is 5.0
RtlAnsiStringToUnicodeSize   since 6.1 revision, documented start is 5.0  
RtlAnsiStringToUnicodeString   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlAppendAsciizToString      
RtlAppendStringToString   before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
RtlAppendUnicodeStringToString   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlAppendUnicodeToString   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlAreBitsClear   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlAreBitsSet   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlAssert   before 5.1, declared  
RtlCharToInteger   before 3.51, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlCheckRegistryKey   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlClearAllBits   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlClearBits   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlCompareMemory   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlCompareMemoryUlong   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlCompareString   before 3.50 to 3.51, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlCompareUnicodeString   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlConvertLongToLargeInteger x86 only since 6.1 revision, documented start is 5.0 since 5.1, deprecated
since 6.0, deprecated (5.1)
RtlConvertSidToUnicodeString   before 6.1, undocumented
documented start is 5.0
declared start is 5.0
RtlConvertUlongToLargeInteger x86 only since 6.1 revision, documented start is 5.0 since 5.1, deprecated
since 6.0, deprecated (5.1)
RtlCopyLuid   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlCopySid   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlCopyString   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlCopyUnicodeString   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlCreateAcl   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlCreateHeap   before 5.1 (IFS), undocumented
documented start is 5.1
since 6.0, declared start is 5.1
RtlCreateRegistryKey   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlCreateSecurityDescriptor   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlCustomCPToUnicodeN   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
RtlDelete   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlDeleteElementGenericTable   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlDeleteRegistryValue   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlDestroyHeap   before 5.1 (IFS), undocumented
documented start is 5.1
since 6.0, declared start is 5.1
RtlEnlargedIntegerMultiply x86 only before 3.50 to 3.51, documented since 5.1, deprecated
RtlEnlargedUnsignedDivide x86 only before 3.50 to 3.51, documented since 5.1, deprecated
RtlEnlargedUnsignedMultiply x86 only before 3.50 to 3.51, documented since 5.1, deprecated
RtlEnumerateGenericTable   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlEnumerateGenericTableWithoutSplaying   before 5.0 (IFS), undocumented
since 6.2, documented start is 5.1
since 6.0, declared start is 5.0
RtlEqualLuid   before 4.0, undocumented
before 5.0, declared
since 6.1 revision, documented start is 5.0
 
RtlEqualSid   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlEqualString   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlEqualUnicodeString   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlExtendedIntegerMultiply x86 only before 3.50 to 3.51, documented since 5.1, deprecated
since 6.0, declared start is 5.0
RtlExtendedLargeIntegerDivide x86 only before 3.50 to 3.51, documented since 5.1, deprecated
since 6.0, declared start is 5.0
RtlExtendedMagicDivide x86 only before 3.50 to 3.51, documented since 5.1, deprecated
since 6.0, declared start is 5.0
RtlFillMemory   since 6.1 revision, documented start is 5.0  
RtlFillMemoryUlong x86 only before 5.0 (IFS), undocumented since 6.0, declared start is 5.1
RtlFindClearBits   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlFindClearBitsAndSet   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlFindFirstRunClear   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlFindFirstRunSet discontinued in 5.0 in 5.0 (IFS), declared  
RtlFindLongestRunClear   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlFindLongestRunSet discontinued in 5.0 in 5.0 (IFS), declared  
RtlFindSetBits   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlFindSetBitsAndClear   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlFindUnicodePrefix   before 5.0 (IFS), undocumented
since 6.2, documented start is 5.1
since 6.0, declared start is 5.0
RtlFreeAnsiString   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlFreeHeap   before 5.1 (IFS), undocumented
documented start is 5.1
since 6.0, declared start is 5.0
RtlFreeOemString   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlFreeUnicodeString   since 6.1 revision, documented start is 5.0  
RtlGenerate8dot3Name   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlGetCallersAddress   before 3.50 to 3.51, undocumented
before 5.1, declared
since 6.0, declared start is 5.0
RtlGetDaclSecurityDescriptorriptor   before 5.2 SP1 (IFS), undocumented
documented start is 5.2 SP1
since 6.0, declared start is 5.0
RtlGetElementGenericTable   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlGetGroupSecurityDescriptor   before 5.2 SP1 (IFS), undocumented
documented start is 5.2 SP1
since 6.0, declared start is 5.2 SP1
RtlGetHeapUserValue discontinued in 3.50    
RtlGetOwnerSecurityDescriptor   before 5.0 (IFS), undocumented
since 6.0, documented start is 5.0
before 5.1 (IFS) to 6.0, not declared
since 6.0, declared start is 5.0
RtlInitAnsiString   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlInitCodePageTable   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
RtlInitString   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlInitUnicodeString   since 6.1 revision, documented start is 5.0  
RtlInitializeBitMap   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlInitializeGenericTable   before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
RtlInitializeUnicodePrefix   before 5.0 (IFS), undocumented
since 6.2, documented start is 5.1
since 6.0, declared start is 5.0
RtlInsertElementGenericTable   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlInsertUnicodePrefix   before 5.0 (IFS), undocumented
since 6.2, documented start is 5.1
since 6.0, declared start is 5.0
RtlIntegerToUnicodeString   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlLargeIntegerAdd x86 only before 3.50 to 3.51, documented since 5.1, deprecated
RtlLargeIntegerArithmeticShift x86 only before 3.50 to 3.51, documented since 5.1, deprecated
since 6.0, deprecated (5.1)
RtlLargeIntegerDivide x86 only before 3.50 to 3.51, documented since 5.1, deprecated
since 6.0, declared start is 5.0
RtlLargeIntegerNegate x86 only before 3.50 to 3.51, documented since 5.1, deprecated
RtlLargeIntegerShiftLeft x86 only before 3.50 to 3.51, documented since 5.1, deprecated
since 6.0, deprecated (5.1)
RtlLargeIntegerShiftRight x86 only before 3.50 to 3.51, documented since 5.1, deprecated
since 6.0, deprecated (5.1)
RtlLargeIntegerSubtract x86 only before 3.50 to 3.51, documented since 5.1, deprecated
RtlLengthRequiredSid   before 5.0 (IFS), undocumented
since 5.1 (IFS) to 6.0, documented start is 5.0
before 5.1 (IFS) to 6.0, not declared
since 6.0, declared start is 5.0
RtlLengthSecurityDescriptor   before 3.50 to 3.51, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlLengthSid   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlLookupElementGenericTable   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlMapGenericMask   before 4.0, undocumented
before 5.1, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlMoveMemory   since 6.1 revision, documented start is 5.0  
RtlNextUnicodePrefix   before 5.0 (IFS), undocumented
since 6.2, documented start is 5.1
since 6.0, declared start is 5.0
RtlNtStatusToDosError   before 5.1 (IFS) to 6.0, undocumented
before 6.1, reserved
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
RtlNtStatusToDosErrorNoTeb   before 5.1 (IFS) to 6.0, undocumented
before 10.0, reserved
since 10.0, documented start is 5.0
since 6.0, declared start is 5.1
RtlNumberGenericTableElements   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlNumberOfClearBits   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlNumberOfSetBits   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlOemStringToCountedUnicodeString   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlOemStringToUnicodeSize   before 5.0 (IFS), undocumented  
RtlOemStringToUnicodeString   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlOemToUnicodeN   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlPrefixString   before 6.2, undocumented  
RtlPrefixUnicodeString   before 4.0, undocumented
before 5.0, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlQueryRegistryValues   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlQueryTimeZoneInformation      
RtlRandom   before 5.0 (IFS), undocumented
since 6.2, documented start is 5.0
since 6.0, declared start is 5.0
RtlRemoveUnicodePrefix   before 5.0 (IFS), undocumented
since 6.2, documented start is 5.1
since 6.0, declared start is 5.0
RtlSecondsSince1970ToTime   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlSecondsSince1980ToTime   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlSetAllBits   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlSetBits   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlSetDaclSecurityDescriptor   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlSetGroupSecurityDescriptor   before 5.2 SP1 (IFS), undocumented
documented start is 5.2 SP1
since 6.0, declared start is 5.2 SP1
RtlSetHeapUserValue discontinued in 3.50    
RtlSetOwnerSecurityDescriptor   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlSetTimeZoneInformation      
RtlSplay   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlSubAuthorityCountSid   before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.1
RtlSubAuthoritySid   before 5.0 (IFS), undocumented
since 6.0, documented start is 5.0
before 5.1 (IFS) to 6.0, not declared
since 6.0, declared start is 5.0
RtlTimeFieldsToTime   before 3.50 to 3.51, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlTimeToSecondsSince1970   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlTimeToSecondsSince1980   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlTimeToTimeFields   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlUnicodeStringToAnsiSize   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
 
RtlUnicodeStringToAnsiString   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlUnicodeStringToCountedOemString   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlUnicodeStringToOemSize   before 5.0 (IFS), undocumented  
RtlUnicodeStringToOemString   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlUnicodeToCustomCPN   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
RtlUnicodeToMultiByteN   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlUnicodeToOemN   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlUnwind   documented only in SDK  
RtlUpcaseUnicodeChar   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlUpcaseUnicodeString   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlUpcaseUnicodeStringToAnsiString      
RtlUpcaseUnicodeStringToCountedOemString   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlUpcaseUnicodeStringToOemString   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlUpcaseUnicodeToCustomCPN   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
RtlUpcaseUnicodeToMultiByteN   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlUpcaseUnicodeToOemN   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlUpperChar   before 4.0, undocumented
before 5.0, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlUpperString   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlValidSecurityDescriptor   before 3.50 to 3.51, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlValidSid   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlWriteRegistryValue   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
RtlZeroMemory   since 6.1 revision, documented start is 5.0  

Some Rtl functions are supposed above to have been documented first in an IFS Kit for Windows XP or for Windows Server 2003 SP1 even though neither kit has been obtained for inspection. In each such case, the function’s documentation in the WDK for Windows Vista is in the IFS section and already gives the earlier version as the minimum. The inference is that although the minimum is entirely fictitious for when the function is first exported from the kernel, it is credibly correct about when the function was first documented for use by non-Microsoft programmers. Beware of a further inference: conditional-compilation blocks that the WDK for Windows Vista adds to the declarations are here dismissed as having been written independently of the documentation, else RtlCreateHeap and RtlDestroyHeap were documented as early as the Windows XP IFS Kit while RtlAllocateHeap and RtlFreeHeap were not.

Though RtlEqualLuid is exported from all known versions of the Windows kernel, no known edition of NTDDK.H and WDM.H declares it as a function: all define it by macro.

That RtlFindFirstRunSet and RtlFindLongestRunSet cease as exported functions in version 5.0 may have been a late decision: both are declared in the NTIFS.H from the Windows 2000 IFS Kit.

The RtlFreeHeap function is another rarity for having changed its prototype while documented. Its return type widens from BOOLEAN to LOGICAL in version 6.2. There are in practice no implications for compatibility in kernel mode (even allowing that any programmers ever do check this function for failure). The change was documented immediately. Conditional compilation ensures that new drivers that are built to run on an old Windows are for this purpose old drivers: they expect the smaller return type and are not troubled if run on a new Windows. The change appears instead to have been motivated by user-mode considerations, there having been a long-running off-and-on problem with matching the NTDLL implementation of RtlFreeHeap (returning a BOOLEAN) to the Win32 HeapFree function (returning a BOOL).

Another change of prototype affects RtlGenerate8dot3Name. Starting with version 6.0 SP1, it returns an NTSTATUS instead of returning nothing. Again, conditional compilation ensures that the new return type is known only to new drivers that are built to run only on new Windows. This change, however, was not documented immediately. Not until the WDK for Windows 8 does the documentation even show the new return type under the Syntax heading, but nothing in the Remarks alerts to the reader to any change of functionality and the textual description of the “Return value” persists as “None”. This didn’t get addressed until some time after the first WDK for Windows 10.

Function Documentation History Declaration History
SeAccessCheck since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
SeAppendPrivileges before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SeAssignSecurity since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
SeAuditingFileEvents before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SeCaptureSubjectContext before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SeCreateClientSecurity before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SeDeassignSecurity since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
SeExports (data) before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
indirectly documented
 
SeFreePrivileges before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SeImpersonateClient before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SeLockSubjectContext before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SeOpenObjectAuditAlarm before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SePublicDefaultDacl (data)    
SeQueryAuthenticationIdToken before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SeQuerySecurityDescriptorInfo before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SeReleaseSubjectContext before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SeSetSecurityDescriptorInfo before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
SeSinglePrivilegeCheck since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
SeSystemDefaultDacl (data)    
SeTokenType before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
SeUnlockSubjectContext before 5.0 (IFS), undocumented since 6.0, declared start is 5.0

The SeExports variable has its own page of documention in the WDK for Windows Vista and again for Windows 7, yet is not itself documented explicitly. The documentation is instead of the SE_EXPORTS structure, which is what later kits use for the page’s title. In all, the variable is presented as a “large external static SE_EXPORTS structure”.

Function Export History Documentation History
WRITE_REGISTER_BUFFER_UCHAR x86 only since 6.2, documented start is 5.0
WRITE_REGISTER_BUFFER_ULONG x86 only since 6.2, documented start is 5.0
WRITE_REGISTER_BUFFER_USHORT x86 only since 6.2, documented start is 5.0
WRITE_REGISTER_UCHAR x86 only since 6.2, documented start is 5.0
WRITE_REGISTER_ULONG x86 only since 6.2, documented start is 5.0
WRITE_REGISTER_USHORT x86 only since 6.2, documented start is 5.0

As with the READ_REGISTER functions, the WRITE_REGISTER functions have x64 support as inlined routines and are unusual for having been overlooked, at first, when a revision of the WDK for Windows 7 misleadingly marked most of the ancient documented functions as requiring Windows 2000.

Function Documentation History Declaration History
ZwAccessCheckAndAuditAlarm    
ZwAllocateVirtualMemory before 5.0 (IFS), undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ZwClose since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwCloseObjectAuditAlarm    
ZwCreateDirectoryObject since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwCreateFile before 3.50 to 3.51, undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
ZwCreateKey since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwCreateSection before 5.0 (IFS), undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ZwCreateSymbolicLinkObject    
ZwDeleteKey before 3.50 to 3.51, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ZwDeleteValueKey before 5.1, undocumented
before 6.1, documented start is 5.1
documented start is 5.0
since 6.0, declared start is 5.0
ZwDeviceIoControlFile before 5.0 (IFS), undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ZwDisplayString before 6.1, undocumented declared start is 5.0
ZwDuplicateObject before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
before 6.2, reserved
since 6.2, documented start is 5.0
since 6.0, declared start is 5.0
ZwEnumerateKey since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwEnumerateValueKey since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwFlushKey since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwFreeVirtualMemory before 5.0 (IFS), undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ZwLoadDriver before 5.1 (IFS), undocumented
documented start is 5.1
since 6.0, declared start is 5.0
ZwMakeTemporaryObject since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwMapViewOfSection since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwOpenDirectoryObject before 5.1 (IFS), undocumented
documented start is 5.1
since 6.0, declared start is 5.0
ZwOpenFile before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ZwOpenKey since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwOpenProcessToken    
ZwOpenSection since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwOpenSymbolicLinkObject before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ZwOpenThreadToken    
ZwQueryInformationFile before 3.50 to 3.51, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ZwQueryInformationToken before 5.1 (IFS), undocumented
documented start is 5.1
since 6.0, declared start is 5.0
ZwQueryKey since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwQuerySymbolicLinkObject before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ZwQueryValueKey since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwQueryVolumeInformationFile before 5.1 (IFS) to 6.0, undocumented
since 6.2, documented start is 5.1
since 6.0, declared start is 5.0
ZwReadFile before 3.50 to 3.51, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ZwSetInformationProcess    
ZwSetValueKey since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwUnmapViewOfSection since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwWriteFile before 3.50 to 3.51, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0

The documentation history of ZwDeleteValueKey is complicated by documentation in parallel. No documentation or declaration is known from any DDK before Windows XP. In the WDK for Windows Vista, however, it has two pages: one under Installable File System; the other in the general section for Driver Support Routines. Presumably, it had been documented in an IFS Kit before the merger into the WDK for Windows Vista. The IFS documentation starts the function’s availability at Windows XP. Without a Windows XP IFS Kit for reference, it can’t be discounted as the first documentation. The less developed documentation in the general section appears first in the DDK for Windows Server 2003 SP1 and says nothing about availability. The WDK for Windows 7 drops it in favour of the IFS documentation, but with the function’s availability changed to Windows 2000 and later.

Function Export History
_except_handler2 x86 only
_itoa  
_local_unwind2 x86 only
_stricmp  
_strnicmp  
_vsnprintf  
_wcsnicmp  
sprintf  
strncpy  
strstr  
wcschr  
wcscpy  
wcscspn  
wcslen  
wcsstr