Geoff Chappell, Software Analyst
The large table on this page lists the functions and variables that are newly exported by name from the Windows kernel in its first release for version 6.2, i.e., for the original Windows 8. Several do not survive to the next version.
Few of the new functions for version 6.2 seem to be documented by Microsoft as far as shows up in a search online today (29th February 2016). The apparently undocumented functions are highlighted yellow below. Many are declared in one or another header file from the Windows Driver Kit—but collating those is left for another day.
| Function | Remarks |
|---|---|
| BgkDisplayCharacter | |
| BgkGetConsoleState | |
| BgkGetCursorState | |
| BgkSetCursor | |
| CcAddDirtyPagesToExternalCache | |
| CcCopyReadEx | |
| CcCopyWriteEx | |
| CcDeductDirtyPagesFromExternalCache | |
| CcFlushCacheToLsn | |
| CcIsThereDirtyLoggedPages | |
| CcRegisterExternalCache | |
| CcScheduleReadAheadEx | |
| CcSetAdditionalCacheAttributesEx | |
| CcSetLogHandleForFileEx | |
| CcSetLoggedDataThreshold | |
| CcSetReadAheadGranularityEx | |
| CcUnmapFileOffsetFromSystemCache | |
| CcUnregisterExternalCache | |
| CcZeroDataOnDisk | |
| CmCallbackGetKeyObjectIDEx | |
| CmCallbackReleaseKeyObjectIDEx | |
| ExAcquireFastMutex | |
| ExBlockOnAddressPushLock | |
| ExBlockPushLock | |
| ExCompositionSurfaceObjectType (data) | discontinued in 6.3 |
| ExGetFirmwareEnvironmentVariable | |
| ExNotifyBootDeviceRemoval | |
| ExQueryFastCacheAppOrigin | |
| ExQueryFastCacheDevLicense | |
| ExQueryTimerResolution | |
| ExQueryWnfStateData | |
| ExRealTimeIsUniversal | |
| ExRegisterBootDevice | |
| ExReleaseFastMutex | |
| ExSetFirmwareEnvironmentVariable | |
| ExSubscribeWnfStateChange | |
| ExTimedWaitForUnblockPushLock | |
| ExTryQueueWorkItem | |
| ExTryToAcquireFastMutex | |
| ExUnsubscribeWnfStateChange | |
| ExWaitForUnblockPushLock | |
| FsRtlAcquireEofLock | |
| FsRtlAcquireHeaderMutex | |
| FsRtlAreThereWaitingFileLocks | |
| FsRtlCheckLockForOplockRequest | |
| FsRtlDismountComplete | |
| FsRtlGetFilenameInformation | |
| FsRtlGetIoAtEof | |
| FsRtlGetSectorSizeInformation | |
| FsRtlGetSupportedFeatures | |
| FsRtlInitializeEofLock | |
| FsRtlIsSystemPagingFile | |
| FsRtlIssueDeviceIoControl | |
| FsRtlKernelFsControlFile | |
| FsRtlMdlReadEx | |
| FsRtlPrepareMdlWriteEx | |
| FsRtlPrepareToReuseEcp | |
| FsRtlQueryCachedVdl | |
| FsRtlQueryKernelEaFile | |
| FsRtlReleaseEofLock | |
| FsRtlReleaseFileNameInformation | |
| FsRtlReleaseHeaderMutex | |
| FsRtlSetKernelEaFile | |
| FsRtlTryToAcquireHeaderMutex | |
| FsRtlUpdateDiskCounters | |
| HvlGetLpIndexFromApicId | |
| HvlPerformEndOfInterrupt | x64 only |
| HvlQueryActiveHypervisorProcessorCount | |
| HvlQueryActiveProcessors | |
| HvlQueryHypervisorProcessorNodeNumber | |
| HvlQueryProcessorTopology | |
| HvlQueryProcessorTopologyCount | |
| HvlQueryProcessorTopologyHighestId | |
| HvlRegisterInterruptCallback | |
| HvlRegisterWheaErrorNotification | |
| HvlunregisterInterruptCallback | |
| HvlUnregisterWheaErrorNotification | |
| InbvNotifyDisplayOwnershipChange | |
| IoBoostThreadIo | |
| IoClearActivityIdThread | |
| IoClearReservedDependency | discontinued in 6.3 |
| IoCompletionObjectType (data) | |
| IoCopyDeviceObjectHint | |
| IoCreateStreamFileObjectEx2 | |
| IoCreateSystemThread | |
| IoDecrementKeepAliveCount | |
| IoDeleteAllDependencyRelations | |
| IoGetActivityIdIrp | |
| IoGetActivityIdThread | |
| IoGetDeviceInterfacePropertyData | |
| IoGetInitiatorProcess | |
| IoGetOplockKeyContextEx | |
| IoIncrementKeepAliveCount | |
| IoInitializeMiniCompletionPacket | |
| IoIsActivityTracingEnabled | |
| IoIsInitiator32bitProcess | |
| IoIsValidIrpStatus | |
| IoPropagateActivityIdToThread | |
| IoQueueWorkItemToNode | |
| IoRegisterBootDriverCallback | |
| IoRegisterIoTracking | |
| IoReportInterruptActive | |
| IoReportInterruptInactive | |
| IoReserveDependency | |
| IoResolveDependency | |
| IoSetActivityIdIrp | |
| IoSetActivityIdThread | |
| IoSetDeviceInterfacePropertyData | |
| IoSetMasterIrpStatus | |
| IoSynchronousCallDriver | |
| IoTransferActivityId | |
| IoTryQueueWorkItem | |
| IoUnregisterBootDriverCallback | |
| IoUnregisterIoTracking | |
| IoVolumeDeviceToGuid | |
| IoVolumeDeviceToGuidPath | |
| KdLogDbgPrint | |
| KeAcquireSpinLock | x86 only |
| KeDispatchSecondaryInterrupt | |
| KeForceEnableNx | |
| KeGetNextTimerExpirationDueTime | discontinued in 6.3 |
| KeHwPolicyLocateResource | |
| KeInitializeSecondaryInterruptServices | |
| KeLoadMTRR | |
| KeQueryEffectivePriorityThread | |
| KeQueryInterruptTimePrecise | |
| KeQuerySystemTimePrecise | |
| KeQueryTotalCycleTimeThread | |
| KeReleaseInStackQueuedSpinLock | |
| KeStallWhileFrozen | |
| KeSweepLocalCaches | |
| KeUpdateTime | discontinued in 6.3 |
| KeUpdateTimeAssist | discontinued in 6.3 |
| KeWriteProtectPAT | |
| KfAcquireSpinLock | x86 only |
| KfReleaseSpinLock | x86 only |
| KiEndThreadAccountingPeriod | x86 only |
| KiEntropyQueueDpc | x86 only |
| KseQueryDeviceData | |
| KseQueryDeviceDataList | |
| KseQueryDeviceFlags | |
| KseRegisterShim | |
| KseRegisterShimEx | |
| KseSetDeviceFlags | |
| KseUnregisterShim | |
| MmAllocateContiguousNodeMemory | |
| MmAllocateMdlForIoSpace | |
| MmAllocateNodePagesForMdlEx | |
| MmAreMdlPagesCached | |
| MmGetMaximumFileSectionSize | |
| MmIsDriverSuspectForVerifier | |
| MmMapViewInSystemSpaceEx | |
| MmMapViewInSessionSpaceEx | |
| MmMdlPageContentsState | |
| MmPrefetchVirtualAddresses | |
| NtSetCachedSigningLevel | |
| NtSetInformationVirtualMemory | |
| ObDuplicateObject | |
| ObReferenceObjectSafe | |
| ObReferenceObjectSafeWithTag | |
| ObWaitForMultipleObjects | |
| ObWaitForSingleObject | |
| PoAllProcessorsDeepIdle | discontinued in 6.3 |
| PoFxCompleteDevicePowerNotRequired | |
| PoFxCompleteIdleCondition | |
| PoFxCompleteIdleState | |
| PoFxIdleComponent | |
| PoFxNotifySurprisePowerOn | |
| PoFxPowerControl | |
| PoFxProcessorNotification | |
| PoFxRegisterCoreDevice | |
| PoFxRegisterDevice | |
| PoFxRegisterPlugin | |
| PoFxRegisterPluginEx | |
| PoFxRegisterPrimaryDevice | |
| PoFxReportDevicePoweredOn | |
| PoFxSetComponentLatency | |
| PoFxSetComponentResidency | |
| PoFxSetComponentWake | |
| PoFxSetDeviceIdleTimeout | |
| PoFxStartDevicePowerManagement | |
| PoFxUnregisterDevice | |
| PoGetProcessorIdleAccounting | |
| PoInitiateProcessorWake | |
| PoLatencySensitivityHint | |
| PoNotifyDisableDynamicTick | discontinued in 6.3 |
| PoNotifyVSyncChange | |
| PoRegisterCoalescingCallback | |
| PoSetUserPresent | |
| PoUnregisterCoalescingCallback | |
| PoUserShutdownCancelled | |
| PsChargeProcessWakeCounter | |
| PsCreateSystemThreadEx | |
| PsDereferenceKernelStack | |
| PsGetProcessCommonJob | |
| PsGetProcessSignatureLevel | |
| PsGetThreadExitStatus | |
| PsIsDiskCountersEnabled | |
| PsQueryProcessAttributesByToken | |
| PsQueryTotalCycleTimeProcess | |
| PsReferenceKernelStack | |
| PsReleaseProcessWakeCounter | |
| PsUpdateDiskCounters | |
| RtlAddAtomToAtomTableEx | |
| RtlAddResourceAttributeAce | |
| RtlCheckPortableOperatingSystem | |
| RtlCheckTokenCapability | |
| RtlCheckTokenMembership | |
| RtlCheckTokenMembershipEx | |
| RtlCopyBitMap | |
| RtlCrc32 | |
| RtlCrc64 | |
| RtlCreateAtomTableEx | |
| RtlCreateHashTableEx | |
| RtlCreateUserThread | |
| RtlCultureNameToLCID | |
| RtlDecompressBufferEx | |
| RtlDeleteElementGenericTableAvlEx | |
| RtlEqualWnfChangeStamps | |
| RtlExtractBitMap | |
| RtlGenerateClass5Guid | |
| RtlGetAppContainerNamedObjectPath | |
| RtlIsUntrustedObject | |
| RtlLCIDToCultureName | |
| RtlNumberOfClearBitsInRange | |
| RtlNumberOfSetBitsInRange | |
| RtlOpenCurrentUser | |
| RtlQueryInformationAcl | |
| RtlQueryPackageIdentity | |
| RtlQueryRegistryValuesEx | |
| RtlQueryValidationRunLevel | |
| RtlRbInsertNodeEx | |
| RtlRbRemoveNode | |
| RtlSetControlSecurityDescriptor | |
| RtlSetPortableOperatingSystem | |
| SeAccessCheckFromStateEx | |
| SeAuditingAnyFileEventsWithContextEx | |
| SeAuditingFileEventsWithContextEx | |
| SeCreateClientSecurityEx | |
| SeCreateClientSecurityFromSubjectContextEx | |
| SeGetLogonSessionToken | |
| SeQuerySecureBootPolicyValue | |
| SeSecurityAttributePresent | |
| SeSystemDefaultSd | |
| SeTokenFromAccessInformation | |
| TmInitializeTransactionManager | |
| TmIsKTMCommitCoordinator | |
| TmRenameTransactionManager | |
| TmSinglePhaseReject | |
| WheaRegisterInUsePageOfflineNotification | x64 only |
| WheaUnregisterInUsePageOfflineNotification | x64 only |
| ZwAlpcConnectPortEx | |
| ZwCreateWnfStateName | |
| ZwDeleteWnfStateData | |
| ZwDeleteWnfStateName | |
| ZwFlushBuffersFileEx | |
| ZwQuerySystemEnvironmentValueEx | |
| ZwQueryWnfStateData | |
| ZwQueryWnfStateNameInformation | |
| ZwSetCachedSigningLevel | |
| ZwSetInformationKey | |
| ZwSetInformationVirtualMemory | |
| ZwSetSystemEnvironmentValueEx | |
| ZwUnlockVirtualMemory | |
| ZwUpdateWnfStateData | |
| bsearch_s |
Several more functions that are exported from all earlier versions of x64 builds are now exported from x86 builds too. One, however, is discontinued as an export from both builds in the very next version.
| Function | Remarks |
|---|---|
| KeAcquireInStackQueuedSpinLock | |
| KeAcquireInStackQueuedSpinLockRaiseToSynch | |
| KeAcquireQueuedSpinLock | |
| KeAcquireQueuedSpinLockRaiseToSynch | |
| KeAcquireSpinLockRaiseToSynch | |
| KeReleaseQueuedSpinLock | |
| KeReleaseSpinLock | |
| KeTryToAcquireQueuedSpinLock | |
| KeTryToAcquireQueuedSpinLockRaiseToSynch | |
| KiCpuId | discontinued in 6.3 |
| memcmp |