Exports Added For NTDLL 4.0

The table below lists the 115 exports that are new to NTDLL in version 4.0. Something to note is that a high proportion of these additions were soon rejected, many as soon as version 5.0 and most by version 5.1.

Documentation status is conveyed by colour coding. If you browse with scripting enabled, hovering over any text that has a background colour should produce a tooltip that explains the formatting. NTDLL exports that have all along had their own non-trivial documentation as exports from NTDLL are shown with no background colour. So too are the NTDLL implementations of documented functions and variables from the C Run-Time Library. If the whole of the documentation is just that the function is reserved or obsolete, without even giving a prototype, then the function is highlighted red or highlighted pink, respectively. Functions that look to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented immediately, especially in the contemporaneous Software Development Kit (SDK), then it is shaded yellow to retain some of its previous status as undocumented. If the delayed documentation came specifically from the function’s listing among the Settlement Program Interfaces in late 2002, then the shading is less yellow since Microsoft at least acknowledged that the documentation was late. An undocumented function is highlighted orange, as semi-documented, if it is at least declared in one or another header file from an SDK or, exceptionally, a Windows Driver Kit (WDK). NTDLL is low-level enough that some functions are documented in the Windows Driver Kit (WDK), typically as exports from the NT kernel for use by ring 0 software such as device drivers, but sometimes with non-specific talk of being callable from user mode. Such functions are shaded blue if they seem always to have had such documentation, but a brighter blue if the WDK documentation was not immediate. A function is shaded grey if it seems not to be documented but is known to be the entire low-level implementation of some function in a higher-level DLL such as KERNEL32 or ADVAPI32. Identifying these is a work in progress.

Function Remarks
?Allocate@CBufferAllocator@@UAEPAXK@Z discontinued in 5.0
NtCreateChannel discontinued in 5.1
NtDeleteObjectAuditAlarm declaration requires Windows XP and higher
NtListenChannel discontinued in 5.1
NtOpenChannel discontinued in 5.1
NtQueryFullAttributesFile undocumented until 2008-2009;
documentation requires Windows 2000 and higher;
not declared
NtQueryMultipleValueKey declared in Windows 10 SDK
NtQueryOleDirectoryFile discontinued in 5.0
NtReadFileScatter begins from Windows NT 4.0 SP3
NtReplyWaitSendChannel discontinued in 5.1
NtSendWaitReplyChannel discontinued in 5.1
NtSetContextChannel discontinued in 5.1
NtWriteFileGather begins from Windows NT 4.0 SP3
PropertyLengthAsVariant discontinued in 6.0
RtlClosePropertySet discontinued in 5.0
RtlCompareVariants discontinued in 5.0
RtlConvertPropertyToVariant discontinued in 6.0
RtlConvertVariantToProperty discontinued in 6.0
RtlCreatePropertySet discontinued in 5.0
RtlDeleteNoSplay undocumented until 2000;
declaration requires Windows 2000 and higher
RtlDowncaseUnicodeString undocumented until 2000;
declaration requires Windows 2000 and higher
RtlEnumerateProperties discontinued in 5.0
RtlFlushPropertySet discontinued in 5.0
RtlFreeUserThreadStack discontinued in 6.0
RtlGuidToPropertySetName discontinued in 5.0
RtlInitializeCriticalSectionAndSpinCount begins from Windows NT 4.0 SP3
RtlOnMappedStreamEvent begins from Windows NT 4.0 SP3
RtlPropertySetNameToGuid discontinued in 5.0
RtlQueryProperties discontinued in 5.0
RtlQueryPropertyNames discontinued in 5.0
RtlQueryPropertySet discontinued in 5.0
RtlSetCriticalSectionSpinCount begins from Windows NT 4.0 SP3;
forwarded from KERNEL32 function SetCriticalSectionSpinCount in corresponding 4.0, and higher;
forwarded from KERNELBASE function SetCriticalSectionSpinCount in 6.1 and higher
RtlSetProperties discontinued in 5.0
RtlSetPropertyNames discontinued in 5.0
RtlSetPropertySetClassId discontinued in 5.0
RtlSetUnicodeCallouts discontinued in 6.0
RtlTryEnterCriticalSection forwarded from KERNEL32 function TryEnterCriticalSection in 4.0 and higher;
forwarded from KERNELBASE function TryEnterCriticalSection in 6.1 and higher
ZwAddAtom declared in Windows 10 WDK
ZwCreateChannel discontinued in 5.1
ZwDeleteAtom declared in Windows 10 WDK
ZwDeleteObjectAuditAlarm declared in Windows 10 WDK
ZwFindAtom declared in Windows 10 WDK
ZwListenChannel discontinued in 5.1
ZwLoadKey2 declared in Windows 10 WDK
ZwOpenChannel discontinued in 5.1
ZwQueryFullAttributesFile undocumented until 2008-2009;
documentation requires Windows XP and higher;
declaration requires Windows 2000 and higher
ZwQueryInformationAtom declared in Windows 10 WDK
ZwQueryMultipleValueKey declaration requires Windows 7 and higher
ZwQueryOleDirectoryFile discontinued in 5.0
ZwQueueApcThread declared in Windows 10 WDK
ZwReadFileScatter begins from Windows NT 4.0 SP3;
declared in Windows 10 WDK
ZwReplyWaitSendChannel discontinued in 5.1
ZwSendWaitReplyChannel discontinued in 5.1
ZwSetContextChannel discontinued in 5.1
ZwSignalAndWaitForSingleObject declared in Windows 10 WDK
ZwWriteFileGather begins from Windows NT 4.0 SP3;
declared in Windows 10 WDK
ZwYieldExecution declared in Windows 10 WDK
_alldiv x86 only;
undocumented until 2001-2002
_allmul x86 only
_allrem x86 only
_allshl x86 only
_allshr x86 only
_aulldiv x86 only
_aullrem x86 only
_aullshr x86 only
_tolower discontinued in 6.0
_toupper discontinued in 6.0


Some of the original API does not survive even to version 4.0:

Additionally, NtW32Call and ZwW32Call were dropped at SP4.