Kernel Exports Added For Version 3.50

The table below lists the 146 functions and variables that are newly exported from the Windows kernel in version 3.50. All were added for the first release. It is here thought that none were added for service packs, but beware that only SP3 has yet been obtained for inspection.

For the table below, documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. (If you read this website with scripts enabled, then hovering the mouse over any coloured text will produce a tooltip that shows why the text is coloured.) Functions that have their own non-trivial documentation are shown with no background colour. If the function is documented as reserved or obsolete, it is shaded red or shaded grey, respectively. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status. Many undocumented functions do at least have C-language declarations in one or another header file from the WDK. These are shaded orange, except for one special case. Some declarations are known only from “minwin” headers that Microsoft published in early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public knowledge even of the declaration is exceptional.

While no DDK for Windows NT 3.50 is found for reference, the default assumption throughout the following table is that whatever is known about a function’s documentation or declarations from the DDK for Windows NT 3.51 can’t be said to have differed in version 3.50.

Function Export History Documentation History Declaration History
CcGetLsnForFileObject      
ExAcquireFastMutexUnsafe   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExAcquireResourceExclusiveLite   since 6.1, documented start is 5.0 since 6.0, declared start is 5.0
ExAcquireResourceSharedLite   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExAcquireSharedWaitForExclusive   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExAllocatePoolWithQuotaTag   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExAllocatePoolWithTag   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExConvertExclusiveToSharedLite   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExDeleteResourceLite   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExDisableResourceBoostLite   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
ExGetExclusiveWaiterCount   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExGetSharedWaiterCount   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExInitializeResourceLite   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExInterlockedAddLargeStatistic x86 only
before 5.0, declared
since 6.1 revision, documented start is 5.0
 
ExInterlockedExtendZone   before 5.0, documented since 5.1, deprecated
since 6.0, declared start is 5.0
ExIsResourceAcquiredExclusiveLite   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExIsResourceAcquiredSharedLite   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExReleaseFastMutexUnsafe   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExReleaseResourceForThreadLite   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ExReleaseResourceLite   before 5.0, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ExfInterlockedAddUlong x86 only    
ExfInterlockedInsertHeadList x86 only    
ExfInterlockedInsertTailList x86 only    
ExfInterlockedPopEntryList x86 only
before 6.1, declared  
ExfInterlockedPushEntryList x86 only
before 6.1, declared  
ExfInterlockedRemoveHeadList x86 only    
Exfi386InterlockedDecrementLong x86 only in 6.0 only, reserved  
Exfi386InterlockedExchangeUlong x86 only in 6.0 only, reserved  
Exfi386InterlockedIncrementLong x86 only in 6.0 only, reserved  

The ExIsResourceAcquiredSharedLite function is another rarity that changes its prototype while documented. If changes from returning a USHORT to returning a ULONG in version 5.0, but the documentation doesn’t catch up until version 6.0.

Function Export History Documentation History Declaration History
FsRtlAllocatePoolWithQuotaTag   before 5.0 (IFS), undocumented  
FsRtlAllocatePoolWithTag   before 5.0 (IFS), undocumented  
FsRtlNotifyFullChangeDirectory   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlNotifyFullReportChange   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlNotifyInitializeSync   before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
FsRtlNotifyUninitializeSync   before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
FsRtlSplitLargeMcb   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlTruncateLargeMcb   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
FsRtlTruncateMcb   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
IoAssignResources   before 5.0, documented since 5.1, deprecated
since 6.0, declared start is 5.0
IoEnqueueIrp      
IoGetDeviceToVerify   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoGetFileObjectGenericMapping   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoGetInitialStack   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
IoGetRequestorProcess   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
IoGetTopLevelIrp   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
IoIsSystemThread   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
IoPageRead   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
IoSetDeviceToVerify   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
IoSetTopLevelIrp   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
IoSynchronousPageWrite   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
IoThreadToProcess   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
IofCallDriver     since 6.0, declared start is 5.0
IofCompleteRequest     since 6.0, declared start is 5.0
KeClearEvent   since 6.1 revision, documented start is 5.0  
KeDeregisterBugCheckCallback   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeEnterCriticalRegion   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeFindConfigurationNextEntry      
KeInitializeQueue   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
KeInsertQueue   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
KeLoaderBlock (data)      
KeReadStateMutant   before 5.1 (IFS) to 6.0, undocumented since 6.0, declared start is 5.0
KeReadStateQueue   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
KeRegisterBugCheckCallback   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
KeRemoveQueue   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
KeSetEventBoostPriority      
KeTickCount (data) x86 only    
KefAcquireSpinLockAtDpcLevel x86 only   since 6.0, declared start is 5.0
KefReleaseSpinLockFromDpcLevel x86 only before 2018, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0

Documentation of KeDeregisterBugCheckCallback and KeRegisterBugCheckCallback is marked “This is preliminary documentation and subject to change” in the DDK for Windows XP.

Though KeEnterCriticalRegion and KeLeaveCriticalRegion plainly are a pair, the one needing always to be balanced by the other, one preceded the other as an exported function. It is here thought that KeEnterCriticalRegion existed in version 3.10 only as the same macro that Microsoft published in NTDDK.H for versions 3.51 up to and including 5.1 (presumably by oversight since it cannot compile without a definition of the KernelApcDisable member of the opaque KTHREAD).

What documentation I see online today, 17th September 2020, for KefReleaseSpinLockFromDpcLevel is dated 30th April 2018 as is most other online documentation since Microsoft’s reorganisation of it in terms of which headers declare which functions. Who knows when this documentation was written but its publication plausibly is just a side-effect of the reorganisation. What little is presented as Remarks is just for the long-documented KeReleaseSpinLockFromDpcLevel and the page has no partner for KefAcquireSpinLockAtDpcLevel. Still, documented it is.

Function Documentation History Declaration History
MmCanFileBeTruncated before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
MmDisableModifiedWriteOfSection    
MmIsRecursiveIoFault before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
MmIsThisAnNtAsSystem before 5.2 SP1, documented since 6.0, declared start is 5.0
MmLockPagableImageSection    
MmMapMemoryDumpMdl    
MmUnlockPagableImageSection since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0

Documentation of MmIsThisAnNtAsSystem as obsolete is qualified: even now in 2020 it is “obsolete for Windows XP and later versions”.

Function Documentation History
NlsMbOemCodePageTag (data)  
NlsOemLeadByteInfo (data) before 5.0 (IFS), undocumented

Both NlsMbOemCodePageTag and NlsOemLeadByteInfo are declared through macros—NLS_MB_OEM_CODE_PAGE_TAG and NLS_OEM_LEAD_BYTE_INFO, respectively—but neither is known to have ever been documented.

Function Export History Documentation History Declaration History
NtDeleteFile   before 6.1, undocumented
documented start is 5.1
before 6.2, reserved
not declared
NtOpenProcess   before 6.1, declared
since 6.1 revision, documented start is 5.0
before 6.2, reserved
 
NtQueryInformationProcess      
ObGetObjectPointerCount discontinued in 5.1
before 5.0 (IFS), undocumented  
ObMakeTemporaryObject   before 5.0 (IFS), undocumented
before 5.1 (IFS) to 6.0, declared
since 6.0, declared start is 5.0
ObfDereferenceObject     since 6.0, declared start is 5.0
PsGetProcessExitTime   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
PsIsThreadTerminating   before 5.0 (IFS), undocumented
since 6.1, documented start is 5.0
since 6.0, declared start is 5.0
PsLookupProcessThreadByCid      
PsSetCreateProcessNotifyRoutine   before 4.0, undocumented
before 5.0, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlCompressBuffer   before 5.1 (IFS) to 6.0, undocumented
before 6.1, reserved
since 6.1, documented start is 5.1
since 6.0, declared start is 5.1
RtlDecompressBuffer   before 5.1 (IFS) to 6.0, undocumented
before 6.1, reserved
since 6.1, documented start is 5.1
since 6.0, declared start is 5.1
RtlDecompressFragment   before 5.1 (IFS) to 6.0, undocumented
before 6.1, reserved
since 6.1, documented start is 5.1
since 6.0, declared start is 5.1
RtlDowncaseUnicodeString   before 5.0 (IFS), undocumented since 6.0, declared start is 5.0
RtlGetCompressionWorkSpaceSize   before 5.1 (IFS), undocumented
before 6.1, reserved
since 6.1, documented start is 5.1
since 6.0, declared start is 5.1
RtlxAnsiStringToUnicodeSize   before 6.0, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlxOemStringToUnicodeSize   before 5.0 (IFS), undocumented
before 6.1, declared
since 6.0, declared start is 5.0
RtlxUnicodeStringToAnsiSize   before 5.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
RtlxUnicodeStringToOemSize   before 5.0 (IFS), undocumented
before 6.1, declared
since 6.0, declared start is 5.0
SeValidSecurityDescriptor   before 5.0, declared
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ZwConnectPort   in 5.1 (IFS) to 6.0, declared in 6.0, declared start is 6.0
ZwCreateEvent   before 5.0 (IFS), undocumented
before 5.1 (IFS), declared
documented start is 5.1
since 6.0, declared start is 5.0
ZwDeleteFile   before 5.1 (IFS), undocumented
documented start is 5.1
since 6.0, declared start is 5.0
ZwFlushInstructionCache      
ZwFsControlFile   before 5.1 (IFS) to 6.0, undocumented
since 6.1 revision, documented start is 5.0
since 6.0, declared start is 5.0
ZwOpenEvent   before 6.0, undocumented
documented start is 5.2
since 6.0, declared start is 5.2
ZwQueryDirectoryFile   before 5.0 (IFS), undocumented
since 5.1 (IFS), documented start is 5.1
before 5.1 (IFS), not declared
since 6.0, declared start is 5.0
ZwQuerySection      
ZwRequestWaitReplyPort   in 5.1 (IFS) to 6.0, declared in 6.0, declared start is 5.0
ZwSetEvent   before 5.0 (IFS), undocumented
before 5.1 (IFS), declared
documented start is 5.1
since 6.0, declared start is 5.0
ZwSetInformationFile   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwSetInformationThread   since 6.1 revision, documented start is 5.0 since 6.0, declared start is 5.0
ZwWaitForSingleObject   before 5.0 (IFS), undocumented
before 5.1 (IFS), declared
documented start is 5.1
since 6.0, declared start is 5.0

Though ZwQueryDirectoryFile is documented in the Windows 2000 IFS Kit, it comes with a warning in red that “This is preliminary documentation and subject to change” and the NTIFS.H from the same kit does not declare the function. Presumably, the documentation was settled in time for the Windows XP IFS Kit and Microsoft has ever since meant that Windows XP is when the function became documented for use. A declaration was perhaps also settled on as early as the Windows XP IFS Kit. Certainly, a declaration is presented in the WDK for Windoiws Vista, but with a conditional-compilation block that doesn’t agree with the documentation.

Function Export History
_abnormal_termination x86 only
_global_unwind2 x86 only
_purecall  
_snprintf  
_snwprintf  
_strlwr  
_strupr  
_wcsicmp  
atoi  
atol  
isdigit  
islower  
isprint  
isspace  
isupper  
isxdigit  
mbstowcs  
memchr  
memcpy  
memmove  
memset  
qsort  
rand  
srand  
strchr  
strncmp  
strrchr  
swprintf  
tolower  
toupper  
vsprintf  
wcscat  
wcscmp  
wcsncmp  
wcsncpy  
wcsrchr  

Discontinued

If only for cross-referencing, note that a dozen of the kernel’s original exports do not survive to version 3.50:

None had yet been documented. Four were sooner (version 3.50) or later (5.0) documented as obsolete, one as reserved. For who knows what reason, this pruning temporarily removed ProbeForRead—but not its close companion, ProbeForWrite—from use by external callers such as drivers who surely would have valued it for validating parameters received from user-mode callers. It doesn’t return to the interface until version 5.0, but at least then it got documented.