| LIBRARY "NTDLL.dll" | |
| EXPORTS | |
| ; This file is a comprehensive documentation for 32-bit x86 ntdll.dll symbols. | |
| ; It covers all 3 platforms Win32s, Win9x and WinNT and contains information | |
| ; from native ntdll.dll libraries on 32-bit Windows systems and also from | |
| ; 32-bit WoW64 ntdll.dll libraries on 64-bit Windows systems. Symbols in this | |
| ; file are ordered by increasing Windows version in which they were introduced. | |
| ; First are Win32s versions, then followed by Win9x versions and then WinNT | |
| ; because logically Win32s symbols are subset of Win9x symbols which is subset | |
| ; of WinNT symbols. Comments contains additional information with exceptions. | |
| ; This is list of symbols available in all Windows versions (Win32s since Win32s 1.1; Win9x since Windows 95; WinNT since Windows NT 3.1) | |
| DbgBreakPoint@0 | |
| DbgPrint ; cdecl | |
| DbgPrompt@12 | |
| NtCurrentTeb@0 | |
| NtQueryEaFile@36 | |
| NtQueryPerformanceCounter@8 | |
| NtSetEaFile@16 | |
| RtlCreateHeap@24 | |
| RtlEnlargedIntegerMultiply@8 | |
| RtlExtendedIntegerMultiply@12 | |
| RtlExtendedLargeIntegerDivide@16 | |
| RtlImageDirectoryEntryToData@16 | |
| RtlImageNtHeader@4 | |
| RtlLargeIntegerSubtract@16 | |
| RtlUnwind@16 | |
| RtlValidateHeap@12 ; Win32s, Win9x and Windows NT 3.1 has ABI "RtlValidateHeap@4", Windows NT 3.5 and new has ABI "RtlValidateHeap@12" | |
| ; This is list of symbols available only in Win32s (not available in Win9x and WinNT) | |
| ; RtlProcessHeap@0 | |
| ; This is list of symbols available in Win32s and Win9x but not in WinNT | |
| ; RtlExFreeHeap@12 | |
| ; RtlExReAllocateHeap@16 | |
| ; RtlExSizeHeap@12 | |
| ; This is list of symbols added in Win32s 1.15 and available in all Win9x and WinNT versions | |
| ; Note that Win32s 1.15 and all later versions merged advapi32.dll, gdi32.dll, | |
| ; kernel32.dll, ntdll.dll, user32.dll (and Win32s 1.25a and later also mpr.dll) | |
| ; libraries into one big w32scomb.dll library and made those libraries as alias | |
| ; to w32scomb.dll, which effectively means that every symbol from every library | |
| ; is available also from ntdll.dll (aliased to w32scomb.dll). Below are only | |
| ; those Win32s symbols which are available in some Win9x or WinNT version of | |
| ; ntdll.dll or logically belongs to ntdll.dll. | |
| RtlAnsiStringToUnicodeString@12 | |
| RtlDestroyHeap@4 | |
| ; This is list of symbols added in Win32s 1.15 and available only in Win32s (not available in Win9x and WinNT) | |
| ; _RtlCopyMemory@12 | |
| ; _RtlMultiByteToUnicodeN@20 ; WinNT has this symbol without leading underline | |
| ; _RtlUnicodeToMultiByteN@20 ; WinNT has this symbol without leading underline | |
| ; This is list of symbols added in Win32s 1.15 and available in all Win9x version, but not in WinNT | |
| ; RtlExAllocateHeap@12 | |
| ; This is list of symbols added in Win32s 1.15 and available in all WinNT version, but not in Win9x | |
| NtCreateSection@28 | |
| NtMapViewOfSection@40 | |
| NtOpenDirectoryObject@12 | |
| NtUnmapViewOfSection@8 | |
| RtlInitAnsiString@8 | |
| RtlInitUnicodeString@8 | |
| RtlMoveMemory@12 | |
| RtlZeroMemory@8 | |
| ; This is list of symbols added in Win32s 1.15a and available in all Win9x and WinNT versions | |
| RtlUnicodeStringToAnsiString@12 | |
| ; This is list of symbols added in Win32s 1.15a and available in all WinNT version, but not in Win9x | |
| RtlAnsiStringToUnicodeSize@4 | |
| RtlInitString@8 | |
| RtlIntegerToUnicodeString@12 | |
| RtlUnicodeStringToAnsiSize@4 | |
| RtlUnicodeStringToInteger@12 | |
| ; This is list of symbols added in Win32s 1.20 and available in all WinNT version, but not in Win9x | |
| NtClose@4 | |
| NtCreateSemaphore@20 ; Win32s has ABI "NtCreateSemaphore@36", WinNT has ABI "NtCreateSemaphore@20" | |
| NtReleaseSemaphore@12 | |
| NtWaitForSingleObject@12 | |
| RtlCreateSecurityDescriptor@8 | |
| RtlFillMemory@12 | |
| RtlSetDaclSecurityDescriptor@16 | |
| ;; This is end of Win32s symbols ;; | |
| ; This is list of symbols available in all Win9x and WinNT versions, but not available in Win32s | |
| RtlAllocateHeap@12 ; Win9x has ABI "RtlAllocateHeap@8", WinNT has ABI "RtlAllocateHeap@12" | |
| RtlConvertLongToLargeInteger@4 | |
| RtlConvertUlongToLargeInteger@4 | |
| RtlEnlargedUnsignedDivide@16 ; removed in Windows 8 | |
| RtlEnlargedUnsignedMultiply@8 | |
| RtlExtendedMagicDivide@20 | |
| RtlFreeHeap@12 ; Win9x has ABI "RtlFreeHeap@8", WinNT has ABI "RtlFreeHeap@12" | |
| RtlLargeIntegerAdd@16 | |
| RtlLargeIntegerArithmeticShift@12 | |
| RtlLargeIntegerDivide@20 | |
| RtlLargeIntegerNegate@8 | |
| RtlLargeIntegerShiftLeft@12 | |
| RtlLargeIntegerShiftRight@12 | |
| RtlMultiByteToUnicodeN@20 ; Win9x has ABI "RtlMultiByteToUnicodeN@16", WinNT has ABI "RtlMultiByteToUnicodeN@20" | |
| RtlReAllocateHeap@16 ; Win9x has ABI "RtlReAllocateHeap@12", WinNT has ABI "RtlReAllocateHeap@16" | |
| RtlSizeHeap@12 ; Win9x has ABI "RtlSizeHeap@8", WinNT has ABI "RtlSizeHeap@12" | |
| RtlUnicodeToMultiByteN@20 ; Win9x has ABI "RtlUnicodeToMultiByteN@16", WinNT has ABI "RtlUnicodeToMultiByteN@20" | |
| ; This is list of symbols available in all Win9x versions, in Windows NT 3.1, but not available in Win32s, Windows NT 3.5 and new | |
| ; RtlGetHandleValueHeap@8 ; Win9x ABI | |
| ; RtlGetHandleValueHeap@12 ; Windows NT 3.1 ABI | |
| ; RtlSetHandleValueHeap@12 ; Win9x ABI | |
| ; RtlSetHandleValueHeap@16 ; Windows NT 3.1 ABI | |
| ; This is list of symbols available in all Win9x versions, but not available in Win32s and WinNT | |
| ; RtlGrowHeap@8 | |
| ; This is list of symbols added in Windows 98, available also in all WinNT versions, but not available in Win32s | |
| NtCreateFile@44 | |
| RtlNtStatusToDosError@4 | |
| ; This is list of symbols added in Windows 98, but not available in Win32s and WinNT | |
| ; IoUnregisterDeviceInterface@4 | |
| ; NtGetDevnodeFromFileHandle@8 | |
| ; This is list of symbols added in Windows 98 and also since Windows NT 3.51, but not available in Win32s | |
| NtSetSystemPowerState@12 | |
| ; This is list of symbols added in Windows 98 and also since Windows 2000, but not available in Win32s | |
| NtInitiatePowerAction@16 | |
| NtPowerInformation@20 | |
| NtRequestWakeupLatency@4 ; removed in Windows 7 | |
| ;; This is end of Win9x symbols ;; | |
| ; This is list of symbols available since Windows NT 3.1 | |
| CsrAllocateCaptureBuffer@8 ; Windows NT 3.1-4.0 has ABI "CsrAllocateCaptureBuffer@12", Windows 2000 and new has ABI "CsrAllocateCaptureBuffer@8" | |
| ; CsrAllocateCapturePointer@12 ; removed in Windows 2000 | |
| CsrAllocateMessagePointer@12 | |
| CsrCaptureMessageBuffer@16 | |
| CsrCaptureMessageString@20 | |
| CsrCaptureTimeout@8 | |
| CsrClientCallServer@16 | |
| CsrClientConnectToServer@20 ; Windows NT 3.1-2000 has ABI "CsrClientConnectToServer@24", Windows XP and new has ABI "CsrClientConnectToServer@20" | |
| ; CsrClientMaxMessage@0 ; removed in Windows NT 4.0 | |
| ; CsrClientSendMessage@0 ; removed in Windows NT 4.0 | |
| ; CsrClientThreadConnect@0 ; removed in Windows NT 4.0 | |
| ; CsrDumpProfile@0 ; removed in Windows NT 3.5 | |
| CsrFreeCaptureBuffer@4 | |
| CsrIdentifyAlertableThread@0 | |
| CsrNewThread@0 ; removed in Windows Vista SP1 | |
| CsrProbeForRead@12 ; removed in Windows Vista | |
| CsrProbeForWrite@12 ; removed in Windows Vista | |
| CsrSetPriorityClass@8 | |
| ; CsrStartProfile@0 ; removed in Windows NT 3.5 | |
| ; CsrStopDumpProfile@0 ; removed in Windows NT 3.5 | |
| ; CsrStopProfile@0 ; removed in Windows NT 3.5 | |
| ; CsrpProcessCallbackRequest@4 ; removed in Windows NT 4.0 | |
| DbgSsHandleKmApiMsg@8 ; removed in Windows XP | |
| DbgSsInitialize@16 ; removed in Windows XP | |
| DbgUiConnectToDbg@0 | |
| DbgUiContinue@8 | |
| DbgUiWaitStateChange@8 | |
| DbgUserBreakPoint@0 | |
| KiUserApcDispatcher@20 ; really stdcall @20, gendef detects it incorrectly | |
| KiUserExceptionDispatcher@8 | |
| LdrAccessResource@16 | |
| LdrFindEntryForAddress@8 | |
| LdrFindResourceDirectory_U@16 | |
| LdrFindResource_U@16 | |
| LdrGetDllHandle@16 | |
| LdrGetProcedureAddress@16 | |
| LdrInitializeThunk@16 ; really stdcall @16, gendef detects it incorrectly | |
| LdrLoadDll@16 | |
| LdrProcessRelocationBlock@16 | |
| LdrQueryImageFileExecutionOptions@24 | |
| LdrQueryProcessModuleInformation@12 | |
| LdrShutdownProcess@0 | |
| LdrShutdownThread@0 | |
| LdrUnloadDll@4 | |
| LdrVerifyImageMatchesChecksum@16 ; Windows NT 3.1-3.51 has ABI "LdrVerifyImageMatchesChecksum@4", Windows NT 4.0 and new has ABI "LdrVerifyImageMatchesChecksum@16" | |
| NtAcceptConnectPort@24 | |
| NtAccessCheck@32 | |
| NtAccessCheckAndAuditAlarm@44 | |
| NtAdjustGroupsToken@24 | |
| NtAdjustPrivilegesToken@24 | |
| NtAlertResumeThread@8 | |
| NtAlertThread@4 | |
| NtAllocateLocallyUniqueId@4 | |
| NtAllocateVirtualMemory@24 | |
| NtCancelIoFile@8 | |
| NtCancelTimer@8 | |
| NtCloseObjectAuditAlarm@12 | |
| NtCompleteConnectPort@4 | |
| NtConnectPort@32 | |
| NtContinue@8 | |
| NtCreateDirectoryObject@12 | |
| NtCreateEvent@20 | |
| NtCreateEventPair@12 | |
| NtCreateKey@28 | |
| NtCreateMailslotFile@32 | |
| NtCreateMutant@16 | |
| NtCreateNamedPipeFile@56 | |
| NtCreatePagingFile@16 | |
| NtCreatePort@20 | |
| NtCreateProcess@32 | |
| NtCreateProfile@36 ; Windows NT 3.1-3.5 has ABI "NtCreateProfile@28", Windows NT 3.51 and new has ABI "NtCreateProfile@36" | |
| NtCreateSymbolicLinkObject@16 | |
| NtCreateThread@32 | |
| NtCreateTimer@16 ; Windows NT 3.1-3.51 has ABI "NtCreateTimer@12", Windows NT 4.0 and new has ABI "NtCreateTimer@16" | |
| NtCreateToken@52 | |
| NtDelayExecution@8 | |
| NtDeleteKey@4 | |
| NtDeleteValueKey@8 | |
| NtDeviceIoControlFile@40 | |
| NtDisplayString@4 | |
| NtDuplicateObject@28 | |
| NtDuplicateToken@24 | |
| NtEnumerateKey@24 | |
| NtEnumerateValueKey@24 | |
| NtExtendSection@8 | |
| NtFlushBuffersFile@8 | |
| NtFlushInstructionCache@12 | |
| NtFlushKey@4 | |
| NtFlushVirtualMemory@16 | |
| NtFlushWriteBuffer@0 | |
| NtFreeVirtualMemory@16 | |
| NtFsControlFile@40 | |
| NtGetContextThread@8 | |
| ; NtGetTickCount@0 ; removed in Windows XP | |
| NtImpersonateClientOfPort@8 | |
| NtImpersonateThread@12 | |
| NtInitializeRegistry@4 | |
| ; NtInitializeVDM@0 ; removed in Windows NT 3.5 | |
| NtListenPort@8 | |
| NtLoadDriver@4 | |
| NtLoadKey@8 | |
| NtLockFile@40 | |
| NtLockVirtualMemory@16 | |
| NtMakeTemporaryObject@4 | |
| NtNotifyChangeDirectoryFile@36 | |
| NtNotifyChangeKey@40 | |
| NtOpenEvent@12 | |
| NtOpenEventPair@12 | |
| NtOpenFile@24 | |
| NtOpenKey@12 | |
| NtOpenMutant@12 | |
| NtOpenObjectAuditAlarm@48 | |
| NtOpenProcess@16 | |
| NtOpenProcessToken@12 | |
| NtOpenSection@12 | |
| NtOpenSemaphore@12 | |
| NtOpenSymbolicLinkObject@12 | |
| NtOpenThread@16 | |
| NtOpenThreadToken@16 | |
| NtOpenTimer@12 | |
| NtPrivilegeCheck@12 | |
| NtPrivilegeObjectAuditAlarm@24 | |
| NtPrivilegedServiceAuditAlarm@20 | |
| NtProtectVirtualMemory@20 | |
| NtPulseEvent@8 | |
| NtQueryDefaultLocale@8 | |
| NtQueryDirectoryFile@44 | |
| NtQueryDirectoryObject@28 | |
| NtQueryEvent@20 | |
| NtQueryInformationFile@20 | |
| NtQueryInformationPort@20 | |
| NtQueryInformationProcess@20 | |
| NtQueryInformationThread@20 | |
| NtQueryInformationToken@20 | |
| NtQueryIntervalProfile@8 ; Windows NT 3.1-3.5 has ABI "NtQueryIntervalProfile@4", Windows NT 3.51 and new has ABI "NtQueryIntervalProfile@8" | |
| NtQueryKey@20 | |
| NtQueryMutant@20 | |
| NtQueryObject@20 | |
| NtQuerySection@20 | |
| NtQuerySecurityObject@20 | |
| NtQuerySemaphore@20 | |
| NtQuerySymbolicLinkObject@12 | |
| NtQuerySystemEnvironmentValue@16 | |
| NtQuerySystemInformation@16 | |
| NtQuerySystemTime@4 | |
| NtQueryTimer@20 | |
| NtQueryValueKey@24 | |
| NtQueryVirtualMemory@24 | |
| NtQueryVolumeInformationFile@20 | |
| NtRaiseException@12 | |
| NtRaiseHardError@24 | |
| NtReadFile@36 | |
| NtReadRequestData@24 | |
| NtReadVirtualMemory@20 | |
| NtRegisterThreadTerminatePort@4 | |
| NtReleaseMutant@8 | |
| ; NtReleaseProcessMutant@0 ; removed in Windows NT 4.0 | |
| ; NtRenameValueKey@16 ; removed in Windows NT 3.5 | |
| NtReplaceKey@12 | |
| NtReplyPort@8 | |
| NtReplyWaitReceivePort@16 | |
| NtReplyWaitReplyPort@8 | |
| NtRequestPort@8 | |
| NtRequestWaitReplyPort@12 | |
| NtResetEvent@8 | |
| NtRestoreKey@12 | |
| NtResumeThread@8 | |
| NtSaveKey@8 | |
| NtSetContextThread@8 | |
| NtSetDefaultHardErrorPort@4 | |
| NtSetDefaultLocale@8 | |
| NtSetEvent@8 | |
| NtSetHighEventPair@4 | |
| NtSetHighWaitLowEventPair@4 | |
| ; NtSetHighWaitLowThread@0 ; removed in Windows 2000 | |
| NtSetInformationFile@20 | |
| NtSetInformationKey@16 | |
| NtSetInformationProcess@16 | |
| NtSetInformationThread@16 | |
| NtSetInformationToken@16 | |
| NtSetIntervalProfile@8 ; Windows NT 3.1-3.5 has ABI "NtSetIntervalProfile@4", Windows NT 3.51 and new has ABI "NtSetIntervalProfile@8" | |
| NtSetLdtEntries@24 | |
| NtSetLowEventPair@4 | |
| NtSetLowWaitHighEventPair@4 | |
| ; NtSetLowWaitHighThread@0 ; removed in Windows 2000 | |
| NtSetSecurityObject@12 | |
| NtSetSystemEnvironmentValue@8 | |
| NtSetSystemTime@8 | |
| NtSetTimer@28 ; Windows NT 3.1-3.5 has ABI "NtSetTimer@20", Windows NT 3.51 has ABI "NtSetTimer@24", Windows NT 4.0 and new has ABI NtSetTimer@28 | |
| NtSetValueKey@24 | |
| NtSetVolumeInformationFile@20 | |
| NtShutdownSystem@4 | |
| NtStartProfile@4 | |
| NtStopProfile@4 | |
| NtSuspendThread@8 | |
| NtSystemDebugControl@24 | |
| NtTerminateProcess@8 | |
| NtTerminateThread@8 | |
| NtTestAlert@0 | |
| NtUnloadDriver@4 | |
| NtUnloadKey@4 | |
| NtUnlockFile@20 | |
| NtUnlockVirtualMemory@16 | |
| NtVdmControl@8 ; Windows NT 3.1 has ABI "NtVdmControl@16", Windows NT 3.5 and new has ABI "NtVdmControl@8" | |
| ; NtVdmStartExecution@0 ; removed in Windows NT 3.5 | |
| NtWaitForMultipleObjects@20 | |
| ; NtWaitForProcessMutant@0 ; removed in Windows NT 4.0 | |
| NtWaitHighEventPair@4 | |
| NtWaitLowEventPair@4 | |
| NtWriteFile@36 | |
| NtWriteRequestData@24 | |
| NtWriteVirtualMemory@20 | |
| PfxFindPrefix@8 | |
| PfxInitialize@4 | |
| PfxInsertPrefix@12 | |
| PfxRemovePrefix@8 | |
| RtlAbortRXact@4 | |
| RtlAbsoluteToSelfRelativeSD@12 | |
| RtlAcquirePebLock@0 | |
| RtlAcquireResourceExclusive@8 | |
| RtlAcquireResourceShared@8 | |
| RtlAddAccessAllowedAce@16 | |
| RtlAddAccessDeniedAce@16 | |
| RtlAddAce@20 | |
| RtlAddActionToRXact@24 | |
| RtlAddAttributeActionToRXact@32 | |
| RtlAddAuditAccessAce@24 | |
| RtlAdjustPrivilege@16 | |
| RtlAllocateAndInitializeSid@44 | |
| ; RtlAnalyzeProfile@0 ; removed in Windows NT 3.5 | |
| RtlAnsiCharToUnicodeChar@4 | |
| RtlAppendAsciizToString@8 | |
| RtlAppendStringToString@8 | |
| RtlAppendUnicodeStringToString@8 | |
| RtlAppendUnicodeToString@8 | |
| RtlApplyRXact@4 | |
| RtlApplyRXactNoFlush@4 | |
| RtlAreAllAccessesGranted@8 | |
| RtlAreAnyAccessesGranted@8 | |
| RtlAreBitsClear@12 | |
| RtlAreBitsSet@12 | |
| RtlAssert@16 | |
| RtlCaptureStackBackTrace@16 | |
| RtlCharToInteger@12 | |
| RtlCheckRegistryKey@8 | |
| RtlClearAllBits@4 | |
| RtlClearBits@12 | |
| RtlCompactHeap@8 | |
| RtlCompareMemory@12 | |
| RtlCompareMemoryUlong@12 | |
| RtlCompareString@12 | |
| RtlCompareUnicodeString@12 | |
| RtlConsoleMultiByteToUnicodeN@24 | |
| RtlConvertExclusiveToShared@4 | |
| RtlConvertSharedToExclusive@4 | |
| RtlConvertSidToUnicodeString@12 | |
| RtlConvertUiListToApiList@12 ; removed in Windows 8.1 | |
| RtlCopyLuid@8 | |
| RtlCopyLuidAndAttributesArray@12 | |
| RtlCopySecurityDescriptor@8 | |
| RtlCopySid@12 | |
| RtlCopySidAndAttributesArray@28 | |
| RtlCopyString@8 | |
| RtlCopyUnicodeString@8 | |
| RtlCreateAcl@12 | |
| RtlCreateAndSetSD@20 | |
| RtlCreateEnvironment@8 | |
| RtlCreateProcessParameters@40 | |
| RtlCreateRegistryKey@8 | |
| RtlCreateUnicodeString@8 | |
| RtlCreateUnicodeStringFromAsciiz@8 | |
| RtlCreateUserProcess@40 | |
| RtlCreateUserSecurityObject@28 | |
| RtlCreateUserThread@40 | |
| RtlCustomCPToUnicodeN@24 | |
| RtlDeNormalizeProcessParams@4 | |
| RtlDelete@4 | |
| RtlDeleteAce@8 | |
| RtlDeleteCriticalSection@4 | |
| RtlDeleteElementGenericTable@8 | |
| RtlDeleteRegistryValue@12 | |
| RtlDeleteResource@4 | |
| RtlDeleteSecurityObject@4 | |
| RtlDestroyEnvironment@4 | |
| RtlDestroyProcessParameters@4 | |
| RtlDetermineDosPathNameType_U@4 | |
| RtlDoesFileExists_U@4 | |
| RtlDosPathNameToNtPathName_U@16 | |
| RtlDosSearchPath_U@24 | |
| RtlDumpResource@4 | |
| RtlEnterCriticalSection@4 | |
| RtlEnumerateGenericTable@8 | |
| RtlEnumerateGenericTableWithoutSplaying@8 | |
| RtlEqualComputerName@8 | |
| RtlEqualDomainName@8 | |
| RtlEqualLuid@8 | |
| RtlEqualPrefixSid@8 | |
| RtlEqualSid@8 | |
| RtlEqualString@12 | |
| RtlEqualUnicodeString@12 | |
| RtlEraseUnicodeString@4 | |
| ; RtlExpandEnvironmentStrings@16 ; removed in Windows NT 3.5 | |
| RtlExpandEnvironmentStrings_U@16 | |
| RtlFillMemoryUlong@12 | |
| RtlFindClearBits@12 | |
| RtlFindClearBitsAndSet@12 | |
| RtlFindLongestRunClear@8 | |
| RtlFindLongestRunSet@8 ; removed in Windows 2000 | |
| RtlFindMessage@20 | |
| RtlFindSetBits@12 | |
| RtlFindSetBitsAndClear@12 | |
| RtlFirstFreeAce@8 | |
| RtlFormatMessage@36 | |
| RtlFreeAnsiString@4 | |
| RtlFreeOemString@4 | |
| RtlFreeSid@4 | |
| RtlFreeUnicodeString@4 | |
| RtlGenerate8dot3Name@16 ; Windows NT 3.1 has ABI "RtlGenerate8dot3Name@12", Windows NT 3.5 and new has ABI "RtlGenerate8dot3Name@16" | |
| RtlGetAce@12 | |
| RtlGetCallersAddress@8 | |
| RtlGetControlSecurityDescriptor@12 | |
| RtlGetCurrentDirectory_U@8 | |
| RtlGetDaclSecurityDescriptor@16 | |
| RtlGetElementGenericTable@8 | |
| RtlGetFullPathName_U@16 | |
| RtlGetGroupSecurityDescriptor@12 | |
| ; RtlGetHeapUserValue@4 ; removed in Windows NT 3.5 | |
| RtlGetNtGlobalFlags@0 | |
| RtlGetNtProductType@4 | |
| RtlGetOwnerSecurityDescriptor@12 | |
| RtlGetSaclSecurityDescriptor@16 | |
| RtlIdentifierAuthoritySid@4 | |
| RtlImpersonateSelf@4 | |
| RtlInitCodePageTable@8 | |
| RtlInitNlsTables@16 | |
| RtlInitializeBitMap@12 | |
| RtlInitializeContext@20 | |
| RtlInitializeCriticalSection@4 | |
| RtlInitializeGenericTable@20 | |
| ; RtlInitializeProfile@4 ; removed in Windows NT 3.5 | |
| RtlInitializeRXact@12 | |
| RtlInitializeResource@4 | |
| RtlInitializeSid@12 | |
| ; RtlInitializeStackTraceDataBase@12 ; removed in Windows NT 3.51, added back in Windows XP SP2 and removed again in Windows Server 2003 | |
| RtlInsertElementGenericTable@16 | |
| RtlIntegerToChar@16 | |
| RtlIsDosDeviceName_U@4 | |
| RtlIsGenericTableEmpty@4 | |
| RtlLargeIntegerToChar@16 | |
| RtlLeaveCriticalSection@4 | |
| RtlLengthRequiredSid@4 | |
| RtlLengthSecurityDescriptor@4 | |
| RtlLengthSid@4 | |
| RtlLocalTimeToSystemTime@8 | |
| RtlLockHeap@4 | |
| ; RtlLogStackBackTrace@0 ; removed in Windows NT 3.51 | |
| RtlLookupElementGenericTable@8 | |
| ; RtlLookupSymbolByAddress@24 ; removed in Windows NT 3.51 | |
| ; RtlLookupSymbolByName@16 ; removed in Windows NT 3.51 | |
| RtlMakeSelfRelativeSD@12 | |
| RtlMapGenericMask@8 | |
| RtlMultiByteToUnicodeSize@12 | |
| RtlNewInstanceSecurityObject@40 | |
| RtlNewSecurityGrantedAccess@24 | |
| RtlNewSecurityObject@24 | |
| RtlNormalizeProcessParams@4 | |
| RtlNumberGenericTableElements@4 | |
| RtlNumberOfClearBits@4 | |
| RtlNumberOfSetBits@4 | |
| RtlOemStringToUnicodeSize@4 | |
| RtlOemStringToUnicodeString@12 | |
| RtlOemToUnicodeN@20 | |
| RtlOpenCurrentUser@8 | |
| RtlPcToFileHeader@8 | |
| RtlPrefixString@12 | |
| RtlPrefixUnicodeString@12 | |
| ; RtlQueryEnvironmentVariable@0 ; removed in Windows NT 3.5 | |
| RtlQueryEnvironmentVariable_U@12 | |
| RtlQueryInformationAcl@16 | |
| ; RtlQueryModuleInformation@24 ; removed in Windows NT 3.51 | |
| RtlQueryProcessBackTraceInformation@4 ; Windows NT 3.1-3.5 has ABI "RtlQueryProcessBackTraceInformation@12", Windows NT 3.51 and new has ABI "RtlQueryProcessBackTraceInformation@4" | |
| RtlQueryProcessHeapInformation@4 ; Windows NT 3.1-3.5 has ABI "RtlQueryProcessHeapInformation@12", Windows NT 3.51 and new has ABI "RtlQueryProcessHeapInformation@4" | |
| RtlQueryProcessLockInformation@4 ; Windows NT 3.1-3.5 has ABI "RtlQueryProcessLockInformation@12", Windows NT 3.51 and new has ABI "RtlQueryProcessLockInformation@4" | |
| RtlQueryRegistryValues@20 | |
| RtlQuerySecurityObject@20 | |
| RtlQueryTimeZoneInformation@4 | |
| RtlRaiseException@4 | |
| RtlRaiseStatus@4 | |
| RtlRandom@4 | |
| RtlRealPredecessor@4 | |
| RtlRealSuccessor@4 | |
| RtlReleasePebLock@0 | |
| RtlReleaseResource@4 | |
| RtlRemoteCall@28 | |
| RtlResetRtlTranslations@4 | |
| RtlRunDecodeUnicodeString@8 | |
| RtlRunEncodeUnicodeString@8 | |
| RtlSecondsSince1970ToTime@8 | |
| RtlSecondsSince1980ToTime@8 | |
| RtlSelfRelativeToAbsoluteSD@44 | |
| RtlSetAllBits@4 | |
| RtlSetBits@12 | |
| RtlSetCurrentDirectory_U@4 | |
| RtlSetCurrentEnvironment@8 | |
| RtlSetEnvironmentVariable@12 | |
| RtlSetGroupSecurityDescriptor@12 | |
| ; RtlSetHeapUserValue@8 ; removed in Windows NT 3.5 | |
| RtlSetInformationAcl@16 | |
| RtlSetOwnerSecurityDescriptor@12 | |
| RtlSetSaclSecurityDescriptor@16 | |
| RtlSetSecurityObject@20 | |
| RtlSetTimeZoneInformation@4 | |
| ; RtlSnapShotHeap@16 ; removed in Windows NT 3.51 | |
| RtlSplay@4 | |
| ; RtlStartProfile@0 ; removed in Windows NT 3.5 | |
| RtlStartRXact@4 | |
| ; RtlStopProfile@0 ; removed in Windows NT 3.5 | |
| RtlSubAuthorityCountSid@4 | |
| RtlSubAuthoritySid@8 | |
| RtlSubtreePredecessor@4 | |
| RtlSubtreeSuccessor@4 | |
| RtlSystemTimeToLocalTime@8 | |
| RtlTimeFieldsToTime@8 | |
| RtlTimeToElapsedTimeFields@8 | |
| RtlTimeToSecondsSince1970@8 | |
| RtlTimeToSecondsSince1980@8 | |
| RtlTimeToTimeFields@8 | |
| RtlUnicodeStringToCountedOemString@12 | |
| RtlUnicodeStringToOemSize@4 | |
| RtlUnicodeStringToOemString@12 | |
| RtlUnicodeToCustomCPN@24 | |
| RtlUnicodeToMultiByteSize@12 | |
| RtlUnicodeToOemN@20 | |
| RtlUniform@4 | |
| RtlUnlockHeap@4 | |
| RtlUpcaseUnicodeChar@4 | |
| RtlUpcaseUnicodeString@12 | |
| RtlUpcaseUnicodeStringToAnsiString@12 | |
| RtlUpcaseUnicodeStringToCountedOemString@12 | |
| RtlUpcaseUnicodeStringToOemString@12 | |
| RtlUpcaseUnicodeToCustomCPN@24 | |
| RtlUpcaseUnicodeToMultiByteN@20 | |
| RtlUpcaseUnicodeToOemN@20 | |
| RtlUpperChar@4 | |
| RtlUpperString@8 | |
| RtlValidAcl@4 | |
| RtlValidSecurityDescriptor@4 | |
| RtlValidSid@4 | |
| RtlWriteRegistryValue@24 | |
| ; RtlpInitializeRtl@12 ; removed in Windows NT 4.0 | |
| RtlpNtCreateKey@24 | |
| RtlpNtEnumerateSubKey@16 | |
| RtlpNtMakeTemporaryKey@4 | |
| RtlpNtOpenKey@16 | |
| RtlpNtQueryValueKey@20 | |
| RtlpNtSetValueKey@16 | |
| RtlpUnWaitCriticalSection@4 | |
| RtlpWaitForCriticalSection@4 | |
| ZwAcceptConnectPort@24 | |
| ZwAccessCheck@32 | |
| ZwAccessCheckAndAuditAlarm@44 | |
| ZwAdjustGroupsToken@24 | |
| ZwAdjustPrivilegesToken@24 | |
| ZwAlertResumeThread@8 | |
| ZwAlertThread@4 | |
| ZwAllocateLocallyUniqueId@4 | |
| ZwAllocateVirtualMemory@24 | |
| ZwCancelIoFile@8 | |
| ZwCancelTimer@8 | |
| ZwClose@4 | |
| ZwCloseObjectAuditAlarm@12 | |
| ZwCompleteConnectPort@4 | |
| ZwConnectPort@32 | |
| ZwContinue@8 | |
| ZwCreateDirectoryObject@12 | |
| ZwCreateEvent@20 | |
| ZwCreateEventPair@12 | |
| ZwCreateFile@44 | |
| ZwCreateKey@28 | |
| ZwCreateMailslotFile@32 | |
| ZwCreateMutant@16 | |
| ZwCreateNamedPipeFile@56 | |
| ZwCreatePagingFile@16 | |
| ZwCreatePort@20 | |
| ZwCreateProcess@32 | |
| ZwCreateProfile@36 ; Windows NT 3.1-3.5 has ABI "ZwCreateProfile@28", Windows NT 3.51 and new has ABI "ZwCreateProfile@36" | |
| ZwCreateSection@28 | |
| ZwCreateSemaphore@20 | |
| ZwCreateSymbolicLinkObject@16 | |
| ZwCreateThread@32 | |
| ZwCreateTimer@16 ; Windows NT 3.1-3.51 has ABI "ZwCreateTimer@12", Windows NT 4.0 and new has ABI "ZwCreateTimer@16" | |
| ZwCreateToken@52 | |
| ZwDelayExecution@8 | |
| ZwDeleteKey@4 | |
| ZwDeleteValueKey@8 | |
| ZwDeviceIoControlFile@40 | |
| ZwDisplayString@4 | |
| ZwDuplicateObject@28 | |
| ZwDuplicateToken@24 | |
| ZwEnumerateKey@24 | |
| ZwEnumerateValueKey@24 | |
| ZwExtendSection@8 | |
| ZwFlushBuffersFile@8 | |
| ZwFlushInstructionCache@12 | |
| ZwFlushKey@4 | |
| ZwFlushVirtualMemory@16 | |
| ZwFlushWriteBuffer@0 | |
| ZwFreeVirtualMemory@16 | |
| ZwFsControlFile@40 | |
| ZwGetContextThread@8 | |
| ZwGetTickCount@0 ; removed in Windows XP | |
| ZwImpersonateClientOfPort@8 | |
| ZwImpersonateThread@12 | |
| ZwInitializeRegistry@4 | |
| ; ZwInitializeVDM@0 ; removed in Windows NT 3.5 | |
| ZwListenPort@8 | |
| ZwLoadDriver@4 | |
| ZwLoadKey@8 | |
| ZwLockFile@40 | |
| ZwLockVirtualMemory@16 | |
| ZwMakeTemporaryObject@4 | |
| ZwMapViewOfSection@40 | |
| ZwNotifyChangeDirectoryFile@36 | |
| ZwNotifyChangeKey@40 | |
| ZwOpenDirectoryObject@12 | |
| ZwOpenEvent@12 | |
| ZwOpenEventPair@12 | |
| ZwOpenFile@24 | |
| ZwOpenKey@12 | |
| ZwOpenMutant@12 | |
| ZwOpenObjectAuditAlarm@48 | |
| ZwOpenProcess@16 | |
| ZwOpenProcessToken@12 | |
| ZwOpenSection@12 | |
| ZwOpenSemaphore@12 | |
| ZwOpenSymbolicLinkObject@12 | |
| ZwOpenThread@16 | |
| ZwOpenThreadToken@16 | |
| ZwOpenTimer@12 | |
| ZwPrivilegeCheck@12 | |
| ZwPrivilegeObjectAuditAlarm@24 | |
| ZwPrivilegedServiceAuditAlarm@20 | |
| ZwProtectVirtualMemory@20 | |
| ZwPulseEvent@8 | |
| ZwQueryDefaultLocale@8 | |
| ZwQueryDirectoryFile@44 | |
| ZwQueryDirectoryObject@28 | |
| ZwQueryEaFile@36 | |
| ZwQueryEvent@20 | |
| ZwQueryInformationFile@20 | |
| ZwQueryInformationPort@20 | |
| ZwQueryInformationProcess@20 | |
| ZwQueryInformationThread@20 | |
| ZwQueryInformationToken@20 | |
| ZwQueryIntervalProfile@8 ; Windows NT 3.1-3.51 has ABI "ZwQueryIntervalProfile@4", Windows NT 4.0 and new has ABI "ZwQueryIntervalProfile@8" | |
| ZwQueryKey@20 | |
| ZwQueryMutant@20 | |
| ZwQueryObject@20 | |
| ZwQueryPerformanceCounter@8 | |
| ZwQuerySection@20 | |
| ZwQuerySecurityObject@20 | |
| ZwQuerySemaphore@20 | |
| ZwQuerySymbolicLinkObject@12 | |
| ZwQuerySystemEnvironmentValue@16 | |
| ZwQuerySystemInformation@16 | |
| ZwQuerySystemTime@4 | |
| ZwQueryTimer@20 | |
| ZwQueryValueKey@24 | |
| ZwQueryVirtualMemory@24 | |
| ZwQueryVolumeInformationFile@20 | |
| ZwRaiseException@12 | |
| ZwRaiseHardError@24 | |
| ZwReadFile@36 | |
| ZwReadRequestData@24 | |
| ZwReadVirtualMemory@20 | |
| ZwRegisterThreadTerminatePort@4 | |
| ZwReleaseMutant@8 | |
| ; ZwReleaseProcessMutant@0 ; removed in Windows NT 4.0 | |
| ZwReleaseSemaphore@12 | |
| ; ZwRenameValueKey@16 ; removed in Windows NT 3.5 | |
| ZwReplaceKey@12 | |
| ZwReplyPort@8 | |
| ZwReplyWaitReceivePort@16 | |
| ZwReplyWaitReplyPort@8 | |
| ZwRequestPort@8 | |
| ZwRequestWaitReplyPort@12 | |
| ZwResetEvent@8 | |
| ZwRestoreKey@12 | |
| ZwResumeThread@8 | |
| ZwSaveKey@8 | |
| ZwSetContextThread@8 | |
| ZwSetDefaultHardErrorPort@4 | |
| ZwSetDefaultLocale@8 | |
| ZwSetEaFile@16 | |
| ZwSetEvent@8 | |
| ZwSetHighEventPair@4 | |
| ZwSetHighWaitLowEventPair@4 | |
| ; ZwSetHighWaitLowThread@0 ; removed in Windows 2000 | |
| ZwSetInformationFile@20 | |
| ZwSetInformationKey@16 | |
| ZwSetInformationProcess@16 | |
| ZwSetInformationThread@16 | |
| ZwSetInformationToken@16 | |
| ZwSetIntervalProfile@8 ; Windows NT 3.1-3.5 has ABI "ZwSetIntervalProfile@4", Windows NT 3.51 and new has ABI "ZwSetIntervalProfile@8" | |
| ZwSetLdtEntries@24 | |
| ZwSetLowEventPair@4 | |
| ZwSetLowWaitHighEventPair@4 | |
| ; ZwSetLowWaitHighThread@0 ; removed in Windows 2000 | |
| ZwSetSecurityObject@12 | |
| ZwSetSystemEnvironmentValue@8 | |
| ZwSetSystemTime@8 | |
| ZwSetTimer@28 ; Windows NT 3.1-3.5 has ABI "ZwSetTimer@20", Windows NT 3.51 has ABI "ZwSetTimer@24", Windows NT 4.0 and new has ABI "ZwSetTimer@28" | |
| ZwSetValueKey@24 | |
| ZwSetVolumeInformationFile@20 | |
| ZwShutdownSystem@4 | |
| ZwStartProfile@4 | |
| ZwStopProfile@4 | |
| ZwSuspendThread@8 | |
| ZwSystemDebugControl@24 | |
| ZwTerminateProcess@8 | |
| ZwTerminateThread@8 | |
| ZwTestAlert@0 | |
| ZwUnloadDriver@4 | |
| ZwUnloadKey@4 | |
| ZwUnlockFile@20 | |
| ZwUnlockVirtualMemory@16 | |
| ZwUnmapViewOfSection@8 | |
| ZwVdmControl@8 ; Windows NT 3.1 has ABI "ZwVdmControl@16", Windows NT 3.5 and new has ABI "ZwVdmControl@8" | |
| ; ZwVdmStartExecution@0 ; removed in Windows NT 3.5 | |
| ZwWaitForMultipleObjects@20 | |
| ; ZwWaitForProcessMutant@0 ; removed in Windows NT 4.0 | |
| ZwWaitForSingleObject@12 | |
| ZwWaitHighEventPair@4 | |
| ZwWaitLowEventPair@4 | |
| ZwWriteFile@36 | |
| ZwWriteRequestData@24 | |
| ZwWriteVirtualMemory@20 | |
| ; xRtlDosPathNameToNtPathName@16 ; removed in Windows NT 3.5 | |
| ; This is list of non-stdcall FPU emulator symbols, available since Windows NT 3.1 and removed in Windows XP SP2 and Windows Server 2003 SP1 | |
| ; NPXEMULATORTABLE DATA ; removed in Windows XP | |
| ; RestoreEm87Context | |
| ; SaveEm87Context | |
| ; __eCommonExceptions | |
| ; __eEmulatorInit | |
| ; __eF2XM1 | |
| ; __eFABS | |
| ; __eFADD32 | |
| ; __eFADD64 | |
| ; __eFADDPreg | |
| ; __eFADDreg | |
| ; __eFADDtop | |
| ; __eFCHS | |
| ; __eFCOM32 | |
| ; __eFCOM64 | |
| ; __eFCOM | |
| ; __eFCOMP32 | |
| ; __eFCOMP64 | |
| ; __eFCOMP | |
| ; __eFCOMPP | |
| ; __eFCOS | |
| ; __eFDECSTP | |
| ; __eFDIV32 | |
| ; __eFDIV64 | |
| ; __eFDIVPreg | |
| ; __eFDIVR32 | |
| ; __eFDIVR64 | |
| ; __eFDIVRPreg | |
| ; __eFDIVRreg | |
| ; __eFDIVRtop | |
| ; __eFDIVreg | |
| ; __eFDIVtop | |
| ; __eFFREE | |
| ; __eFIADD16 | |
| ; __eFIADD32 | |
| ; __eFICOM16 | |
| ; __eFICOM32 | |
| ; __eFICOMP16 | |
| ; __eFICOMP32 | |
| ; __eFIDIV16 | |
| ; __eFIDIV32 | |
| ; __eFIDIVR16 | |
| ; __eFIDIVR32 | |
| ; __eFILD16 | |
| ; __eFILD32 | |
| ; __eFILD64 | |
| ; __eFIMUL16 | |
| ; __eFIMUL32 | |
| ; __eFINCSTP | |
| ; __eFINIT | |
| ; __eFIST16 | |
| ; __eFIST32 | |
| ; __eFISTP16 | |
| ; __eFISTP32 | |
| ; __eFISTP64 | |
| ; __eFISUB16 | |
| ; __eFISUB32 | |
| ; __eFISUBR16 | |
| ; __eFISUBR32 | |
| ; __eFLD1 | |
| ; __eFLD32 | |
| ; __eFLD64 | |
| ; __eFLD80 | |
| ; __eFLDCW | |
| ; __eFLDENV | |
| ; __eFLDL2E | |
| ; __eFLDLN2 | |
| ; __eFLDPI | |
| ; __eFLDZ | |
| ; __eFMUL32 | |
| ; __eFMUL64 | |
| ; __eFMULPreg | |
| ; __eFMULreg | |
| ; __eFMULtop | |
| ; __eFPATAN | |
| ; __eFPREM | |
| ; __eFPREM1 | |
| ; __eFPTAN | |
| ; __eFRNDINT | |
| ; __eFRSTOR | |
| ; __eFSAVE | |
| ; __eFSCALE | |
| ; __eFSIN | |
| ; __eFSQRT | |
| ; __eFST32 | |
| ; __eFST64 | |
| ; __eFST | |
| ; __eFSTCW | |
| ; __eFSTENV | |
| ; __eFSTP32 | |
| ; __eFSTP64 | |
| ; __eFSTP80 | |
| ; __eFSTP | |
| ; __eFSTSW | |
| ; __eFSUB32 | |
| ; __eFSUB64 | |
| ; __eFSUBPreg | |
| ; __eFSUBR32 | |
| ; __eFSUBR64 | |
| ; __eFSUBRPreg | |
| ; __eFSUBRreg | |
| ; __eFSUBRtop | |
| ; __eFSUBreg | |
| ; __eFSUBtop | |
| ; __eFTST | |
| ; __eFUCOM | |
| ; __eFUCOMP | |
| ; __eFUCOMPP | |
| ; __eFXAM | |
| ; __eFXCH | |
| ; __eFXTRACT | |
| ; __eFYL2X | |
| ; __eFYL2XP1 | |
| ; __eGetStatusWord | |
| ; This is list of symbols added in Windows NT 3.5 | |
| LdrDisableThreadCalloutsForDll@4 | |
| NlsMbCodePageTag DATA | |
| NlsMbOemCodePageTag DATA | |
| NtClearEvent@4 | |
| NtCreateIoCompletion@16 | |
| NtDeleteFile@4 | |
| NtOpenIoCompletion@12 | |
| NtQueryAttributesFile@8 | |
| NtQueryIoCompletion@20 | |
| NtQueryTimerResolution@12 | |
| NtRemoveIoCompletion@20 | |
| NtSetInformationObject@16 | |
| NtSetSystemInformation@12 | |
| NtSetTimerResolution@12 | |
| RtlCompressBuffer@32 | |
| RtlCutoverTimeToSystemTime@16 | |
| RtlDecompressBuffer@24 | |
| RtlDecompressFragment@32 | |
| RtlFormatCurrentUserKeyPath@4 | |
| RtlGetCompressionWorkSpaceSize@12 | |
| RtlGetLongestNtPathLength@0 | |
| ; RtlGetUserFlagsHeap@16 ; removed in Windows NT 3.51 | |
| ; RtlGetUserValueHeap@16 ; removed in Windows NT 3.51 | |
| RtlIsTextUnicode@12 | |
| RtlSetUserFlagsHeap@20 | |
| RtlSetUserValueHeap@16 | |
| RtlWalkHeap@8 | |
| RtlZeroHeap@8 | |
| RtlxAnsiStringToUnicodeSize@4 | |
| RtlxOemStringToUnicodeSize@4 | |
| RtlxUnicodeStringToAnsiSize@4 | |
| RtlxUnicodeStringToOemSize@4 | |
| ZwClearEvent@4 | |
| ZwCreateIoCompletion@16 | |
| ZwDeleteFile@4 | |
| ZwOpenIoCompletion@12 | |
| ZwQueryAttributesFile@8 | |
| ZwQueryIoCompletion@20 | |
| ZwQueryTimerResolution@12 | |
| ZwRemoveIoCompletion@20 | |
| ZwSetInformationObject@16 | |
| ZwSetSystemInformation@12 | |
| ZwSetTimerResolution@12 | |
| ; This is list of symbols added in Windows NT 3.51 | |
| KiUserCallbackDispatcher@12 ; really stdcall @12, gendef detects it incorrectly | |
| LdrEnumResources@20 | |
| NtAllocateUuids@16 ; Windows NT 3.51-4.0 has ABI "NtAllocateUuids@12", Windows 2000 and new has ABI "NtAllocateUuids@16" | |
| NtCallbackReturn@12 | |
| ; NtEnumerateBus@8 ; removed in Windows NT 4.0 | |
| NtGetPlugPlayEvent@16 ; removed in Windows 8 | |
| NtPlugPlayControl@12 ; Windows NT 3.51-4.0 has ABI "NtPlugPlayControl@16", Windows 2000 and new has ABI "NtPlugPlayControl@12" | |
| ; NtRegisterNewDevice@8 ; removed in Windows NT 4.0 | |
| NtSetIoCompletion@20 | |
| ; NtW32Call@20 ; removed in Windows NT 4.0 SP4 | |
| RtlCreateQueryDebugBuffer@8 | |
| RtlCreateTagHeap@16 | |
| RtlDestroyQueryDebugBuffer@4 | |
| RtlEnumProcessHeaps@8 | |
| RtlExtendHeap@16 ; removed in Windows Vista | |
| RtlGetProcessHeaps@8 | |
| RtlGetUserInfoHeap@20 | |
| RtlIsNameLegalDOS8Dot3@12 | |
| RtlProtectHeap@8 | |
| RtlQueryProcessDebugInformation@12 | |
| RtlQueryTagHeap@20 | |
| RtlUsageHeap@12 ; removed in Windows Vista | |
| RtlValidateProcessHeaps@0 | |
| ZwAllocateUuids@16 ; Windows NT 3.51-4.0 has ABI "ZwAllocateUuids@12", Windows 2000 and new has ABI "ZwAllocateUuids@16" | |
| ZwCallbackReturn@12 | |
| ; ZwEnumerateBus@8 ; remvoed in Windows NT 4.0 | |
| ZwGetPlugPlayEvent@16 ; removed in Windows 8 | |
| ZwPlugPlayControl@12 ; Windows NT 3.51-4.0 has ABI "ZwPlugPlayControl@16", Windows 2000 and new has ABI "ZwPlugPlayControl@12" | |
| ; ZwRegisterNewDevice@8 ; removed in Windows NT 4.0 | |
| ZwSetIoCompletion@20 | |
| ZwSetSystemPowerState@12 | |
| ; ZwW32Call@20 ; removed in Windows NT 4.0 SP4 | |
| ; This is list of symbols added in Windows NT 4.0 | |
| ; public: virtual void *__thiscall CBufferAllocator::Allocate(unsigned long) | |
| ; ?Allocate@CBufferAllocator@@UAEPAXK@Z ; has WINAPI (@4) ; removed in Windows 2000 | |
| KiRaiseUserExceptionDispatcher@0 | |
| NlsAnsiCodePage DATA | |
| NtAddAtom@12 ; Windows NT 4.0 has ABI "NtAddAtom@8", Windows 2000 and new has ABI "NtAddAtom@12" | |
| ; NtCreateChannel@8 ; removed in Windows XP | |
| NtDeleteAtom@4 | |
| NtDeleteObjectAuditAlarm@12 | |
| NtFindAtom@12 ; Windows NT 4.0 has ABI "NtFindAtom@8", Windows 2000 and new has ABI "NtFindAtom@12" | |
| ; NtListenChannel@8 ; removed in Windows XP | |
| NtLoadKey2@12 | |
| ; NtOpenChannel@8 ; removed in Windows XP | |
| NtQueryFullAttributesFile@8 | |
| NtQueryInformationAtom@20 | |
| NtQueryMultipleValueKey@24 | |
| ; NtQueryOleDirectoryFile@44 ; removed in Windows 2000 | |
| NtQueueApcThread@20 | |
| ; NtReplyWaitSendChannel@12 ; removed in Windows XP | |
| ; NtSendWaitReplyChannel@16 ; removed in Windows XP | |
| ; NtSetContextChannel@4 ; removed in Windows XP | |
| NtSignalAndWaitForSingleObject@16 | |
| NtYieldExecution@0 | |
| ; PropertyLengthAsVariant@16 ; removed in Windows Vista | |
| RtlAddAtomToAtomTable@12 | |
| RtlAddCompoundAce@24 | |
| RtlAllocateHandle@8 | |
| ; RtlClosePropertySet@4 ; removed in Windows 2000 | |
| ; RtlCompareVariants@12 ; removed in Windows 2000 | |
| ; RtlConvertPropertyToVariant@16 ; removed in Windows Vista | |
| ; RtlConvertVariantToProperty@28 ; removed in Windows Vista | |
| RtlCreateAtomTable@8 | |
| ; RtlCreatePropertySet@36 ; removed in Windows 2000 | |
| RtlDeleteAtomFromAtomTable@8 | |
| RtlDeleteNoSplay@8 | |
| RtlDestroyAtomTable@4 | |
| RtlDestroyHandleTable@4 | |
| RtlDowncaseUnicodeString@12 | |
| RtlEmptyAtomTable@8 | |
| ; RtlEnumerateProperties@24 ; removed in Windows 2000 | |
| ; RtlFlushPropertySet@4 ; removed in Windows 2000 | |
| RtlFreeHandle@8 | |
| RtlFreeUserThreadStack@8 ; removed in Windows Vista | |
| ; RtlGuidToPropertySetName@8 ; removed in Windows 2000 | |
| RtlImageRvaToSection@12 | |
| RtlImageRvaToVa@16 | |
| RtlInitializeAtomPackage@4 | |
| RtlInitializeHandleTable@12 | |
| RtlIsValidHandle@8 | |
| RtlIsValidIndexHandle@12 | |
| RtlLookupAtomInAtomTable@12 | |
| RtlPinAtomInAtomTable@8 | |
| ; RtlPropertySetNameToGuid@12 ; removed in Windows 2000 | |
| RtlQueryAtomInAtomTable@24 | |
| ; RtlQueryProperties@28 ; removed in Windows 2000 | |
| ; RtlQueryPropertyNames@16 ; removed in Windows 2000 | |
| ; RtlQueryPropertySet@8 ; removed in Windows 2000 | |
| RtlSetAttributesSecurityDescriptor@12 | |
| ; RtlSetProperties@28 ; removed in Windows 2000 | |
| ; RtlSetPropertyNames@16 ; removed in Windows 2000 | |
| ; RtlSetPropertySetClassId@8 ; removed in Windows 2000 | |
| ; RtlSetUnicodeCallouts@4 ; removed in Windows Vista | |
| RtlTryEnterCriticalSection@4 | |
| ZwAddAtom@12 ; Windows NT 4.0 has ABI "ZwAddAtom@8", Windows 2000 and new has ABI "ZwAddAtom@12" | |
| ; ZwCreateChannel@8 ; removed in Windows XP | |
| ZwDeleteAtom@4 | |
| ZwDeleteObjectAuditAlarm@12 | |
| ZwFindAtom@12 ; Windows NT 4.0 has ABI "ZwFindAtom@8", Windows 2000 and new has ABI "ZwFindAtom@12" | |
| ; ZwListenChannel@8 ; removed in Windows XP | |
| ZwLoadKey2@12 | |
| ; ZwOpenChannel@8 ; removed in Windows XP | |
| ZwQueryFullAttributesFile@8 | |
| ZwQueryInformationAtom@20 | |
| ZwQueryMultipleValueKey@24 | |
| ; ZwQueryOleDirectoryFile@44 ; removed in Windows 2000 | |
| ZwQueueApcThread@20 | |
| ; ZwReplyWaitSendChannel@12 ; removed in Windows XP | |
| ; ZwSendWaitReplyChannel@16 ; removed in Windows XP | |
| ; ZwSetContextChannel@4 ; removed in Windows XP | |
| ZwSignalAndWaitForSingleObject@16 | |
| ZwYieldExecution@0 | |
| ; In Windows NT 4.0 SP1 was not added any new symbol | |
| ; This is list of symbols added in Windows NT 4.0 SP2 | |
| NtReadFileScatter@36 | |
| NtWriteFileGather@36 | |
| ; RtlOnMappedStreamEvent@12 ; removed in Windows 2000 | |
| ZwReadFileScatter@36 | |
| ZwWriteFileGather@36 | |
| ; This is list of symbols added in Windows NT 4.0 SP3 | |
| RtlInitializeCriticalSectionAndSpinCount@8 | |
| RtlSetCriticalSectionSpinCount@8 | |
| ; In Windows NT 4.0 SP4 was not added any new symbol but some were removed | |
| ; In Windows NT 4.0 SP5 was not added any new symbol | |
| ; In Windows NT 4.0 SP6 was not added any new symbol | |
| ; In Windows NT 4.0 SP6a was not added any new symbol | |
| ; This is list of symbols added in Windows 2000 | |
| DbgPrintReturnControlC ; cdecl | |
| LdrAlternateResourcesEnabled@0 ; removed in Windows Vista | |
| LdrFlushAlternateResourceModules@0 | |
| LdrLoadAlternateResourceModule@16 ; Windows 2000-2003 has ABI "LdrLoadAlternateResourceModule@8", Windows Vista and new has ABI "LdrLoadAlternateResourceModule@16" | |
| LdrUnloadAlternateResourceModule@4 | |
| NtAccessCheckByType@44 | |
| NtAccessCheckByTypeAndAuditAlarm@64 | |
| NtAccessCheckByTypeResultList@44 | |
| NtAccessCheckByTypeResultListAndAuditAlarm@64 | |
| NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68 | |
| NtAllocateUserPhysicalPages@12 | |
| NtAreMappedFilesTheSame@8 | |
| NtAssignProcessToJobObject@8 | |
| NtCancelDeviceWakeupRequest@4 ; removed in Windows 7 | |
| NtCreateJobObject@12 | |
| NtCreateWaitablePort@20 | |
| NtFilterToken@24 | |
| NtFreeUserPhysicalPages@12 | |
| NtGetDevicePowerState@8 | |
| NtGetWriteWatch@28 | |
| NtImpersonateAnonymousToken@4 | |
| NtIsSystemResumeAutomatic@0 | |
| NtMapUserPhysicalPages@12 | |
| NtMapUserPhysicalPagesScatter@12 | |
| NtNotifyChangeMultipleKeys@48 | |
| NtOpenJobObject@12 | |
| NtQueryDefaultUILanguage@4 | |
| NtQueryInformationJobObject@20 | |
| NtQueryInstallUILanguage@4 | |
| NtQueryOpenSubKeys@8 | |
| NtQueryQuotaInformationFile@36 | |
| NtReplyWaitReceivePortEx@20 | |
| NtRequestDeviceWakeup@4 ; removed in Windows 7 | |
| NtResetWriteWatch@12 | |
| NtSaveMergedKeys@12 | |
| NtSecureConnectPort@36 | |
| NtSetDefaultUILanguage@4 | |
| NtSetInformationJobObject@16 | |
| NtSetQuotaInformationFile@16 | |
| NtSetThreadExecutionState@8 | |
| NtSetUuidSeed@4 | |
| NtTerminateJobObject@8 | |
| RtlAddAccessAllowedAceEx@20 | |
| RtlAddAccessAllowedObjectAce@28 | |
| RtlAddAccessDeniedAceEx@20 | |
| RtlAddAccessDeniedObjectAce@28 | |
| RtlAddAuditAccessAceEx@28 | |
| RtlAddAuditAccessObjectAce@36 | |
| RtlAddRange@36 ; removed in Windows Server 2003 | |
| RtlCallbackLpcClient@12 ; removed in Windows XP | |
| RtlCancelTimer@8 | |
| RtlCheckForOrphanedCriticalSections@4 | |
| RtlConvertToAutoInheritSecurityObject@24 | |
| RtlCopyRangeList@8 ; removed in Windows Server 2003 | |
| RtlCreateLpcServer@24 ; removed in Windows XP | |
| RtlCreateTimer@28 | |
| RtlCreateTimerQueue@4 | |
| RtlDebugPrintTimes@0 | |
| RtlDefaultNpAcl@4 | |
| RtlDeleteOwnersRanges@8 ; removed in Windows Server 2003 | |
| RtlDeleteRange@24 ; removed in Windows Server 2003 | |
| RtlDeleteTimer@12 | |
| RtlDeleteTimerQueue@4 | |
| RtlDeleteTimerQueueEx@8 | |
| RtlDeregisterWait@4 | |
| RtlDeregisterWaitEx@8 | |
| RtlDnsHostNameToComputerName@12 | |
| RtlEnableEarlyCriticalSectionEventCreation@0 | |
| RtlFindLastBackwardRunClear@12 | |
| RtlFindLeastSignificantBit@8 | |
| RtlFindMostSignificantBit@8 | |
| RtlFindNextForwardRunClear@12 | |
| RtlFindRange@48 ; removed in Windows Server 2003 | |
| ; RtlFreeRangeList@4 ; removed in Windows Server 2003 | |
| RtlGUIDFromString@8 | |
| RtlGetFirstRange@12 ; removed in Windows Server 2003 | |
| RtlGetNextRange@12 ; removed in Windows Server 2003 | |
| RtlGetSecurityDescriptorRMControl@8 | |
| RtlGetVersion@4 | |
| RtlImpersonateLpcClient@8 ; removed in Windows XP | |
| ; RtlInitializeRangeList@4 ; removed in Windows Server 2003 | |
| RtlInt64ToUnicodeString@16 | |
| RtlInvertRangeList@8 ; removed in Windows Server 2003 | |
| RtlIsRangeAvailable@40 ; removed in Windows Server 2003 | |
| RtlMergeRangeLists@16 ; removed in Windows Server 2003 | |
| RtlNewSecurityObjectEx@32 | |
| RtlQueueWorkItem@12 | |
| RtlRegisterWait@24 | |
| RtlSelfRelativeToAbsoluteSD2@8 | |
| RtlSetControlSecurityDescriptor@12 | |
| RtlSetIoCompletionCallback@12 | |
| RtlSetSecurityDescriptorRMControl@8 | |
| RtlSetSecurityObjectEx@24 | |
| RtlSetThreadPoolStartFunc@8 | |
| RtlSetTimer@28 | |
| RtlShutdownLpcServer@4 ; removed in Windows XP | |
| RtlStringFromGUID@8 | |
| @RtlUlongByteSwap@4 ; fastcall | |
| @RtlUlonglongByteSwap@8 ; fastcall | |
| RtlUpdateTimer@16 | |
| @RtlUshortByteSwap@4 ; fastcall | |
| RtlValidRelativeSecurityDescriptor@12 | |
| RtlVerifyVersionInfo@16 | |
| RtlWalkFrameChain@12 | |
| VerSetConditionMask@16 | |
| ZwAccessCheckByType@44 | |
| ZwAccessCheckByTypeAndAuditAlarm@64 | |
| ZwAccessCheckByTypeResultList@44 | |
| ZwAccessCheckByTypeResultListAndAuditAlarm@64 | |
| ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68 | |
| ZwAllocateUserPhysicalPages@12 | |
| ZwAreMappedFilesTheSame@8 | |
| ZwAssignProcessToJobObject@8 | |
| ZwCancelDeviceWakeupRequest@4 ; removed in Windows 7 | |
| ZwCreateJobObject@12 | |
| ZwCreateWaitablePort@20 | |
| ZwFilterToken@24 | |
| ZwFreeUserPhysicalPages@12 | |
| ZwGetDevicePowerState@8 | |
| ZwGetWriteWatch@28 | |
| ZwImpersonateAnonymousToken@4 | |
| ZwInitiatePowerAction@16 | |
| ZwIsSystemResumeAutomatic@0 | |
| ZwMapUserPhysicalPages@12 | |
| ZwMapUserPhysicalPagesScatter@12 | |
| ZwNotifyChangeMultipleKeys@48 | |
| ZwOpenJobObject@12 | |
| ZwPowerInformation@20 | |
| ZwQueryDefaultUILanguage@4 | |
| ZwQueryInformationJobObject@20 | |
| ZwQueryInstallUILanguage@4 | |
| ZwQueryOpenSubKeys@8 | |
| ZwQueryQuotaInformationFile@36 | |
| ZwReplyWaitReceivePortEx@20 | |
| ZwRequestDeviceWakeup@4 ; removed in Windows 7 | |
| ZwRequestWakeupLatency@4 ; removed in Windows 7 | |
| ZwResetWriteWatch@12 | |
| ZwSaveMergedKeys@12 | |
| ZwSecureConnectPort@36 | |
| ZwSetDefaultUILanguage@4 | |
| ZwSetInformationJobObject@16 | |
| ZwSetQuotaInformationFile@16 | |
| ZwSetThreadExecutionState@8 | |
| ZwSetUuidSeed@4 | |
| ZwTerminateJobObject@8 | |
| ; This is list of symbols added in Windows 2000 SP1 | |
| RtlTraceDatabaseAdd@16 | |
| RtlTraceDatabaseCreate@20 | |
| RtlTraceDatabaseDestroy@4 | |
| RtlTraceDatabaseEnumerate@12 | |
| RtlTraceDatabaseFind@16 | |
| RtlTraceDatabaseLock@4 | |
| RtlTraceDatabaseUnlock@4 | |
| RtlTraceDatabaseValidate@4 | |
| ; In Windows 2000 SP2 was not added any new symbol | |
| ; In Windows 2000 SP3 was not added any new symbol | |
| ; In Windows 2000 SP4 was not added any new symbol | |
| ; This is list of symbols added in Windows XP | |
| CsrCaptureMessageMultiUnicodeStringsInPlace@12 | |
| CsrGetProcessId@0 | |
| DbgPrintEx ; cdecl | |
| DbgQueryDebugFilterState@8 | |
| DbgSetDebugFilterState@12 | |
| DbgUiConvertStateChangeStructure@8 | |
| DbgUiDebugActiveProcess@4 | |
| DbgUiGetThreadDebugObject@0 | |
| DbgUiIssueRemoteBreakin@4 | |
| DbgUiRemoteBreakin@4 | |
| DbgUiSetThreadDebugObject@4 | |
| DbgUiStopDebugging@4 | |
| ; LdrAccessOutOfProcessResource@20 ; removed in Windows Vista | |
| LdrAddRefDll@8 | |
| ; LdrCreateOutOfProcessImage@20 ; Windows XP has ABI "LdrCreateOutOfProcessImage@16", Windows Server 2003 has ABI "LdrCreateOutOfProcessImage@20", removed in Windows Vista | |
| ; LdrDestroyOutOfProcessImage@4 ; removed in Windows Vista | |
| ; LdrFindCreateProcessManifest@20 ; removed in Windows Vista | |
| LdrFindResourceEx_U@20 | |
| LdrGetDllHandleEx@20 | |
| LdrInitShimEngineDynamic@4 ; Windows XP-7 has ABI "LdrInitShimEngineDynamic@4", Windows 8 an new has ABI "LdrInitShimEngineDynamic@8" | |
| LdrLockLoaderLock@12 | |
| LdrSetAppCompatDllRedirectionCallback@12 | |
| LdrSetDllManifestProber@4 ; Windows XP-Vista has ABI "LdrSetDllManifestProber@4", Windows 7 an new has ABI "LdrSetDllManifestProber@12" | |
| LdrUnlockLoaderLock@8 | |
| NtAddBootEntry@8 | |
| NtCompactKeys@8 | |
| NtCompareTokens@12 | |
| NtCompressKey@4 | |
| NtCreateDebugObject@16 | |
| NtCreateJobSet@12 | |
| NtCreateKeyedEvent@16 | |
| NtCreateProcessEx@36 | |
| NtDebugActiveProcess@8 | |
| NtDebugContinue@12 | |
| NtDeleteBootEntry@4 | |
| NtEnumerateBootEntries@8 | |
| NtEnumerateSystemEnvironmentValuesEx@12 | |
| NtIsProcessInJob@8 | |
| NtLockProductActivationKeys@8 | |
| NtLockRegistryKey@4 | |
| NtMakePermanentObject@4 | |
| NtModifyBootEntry@4 | |
| NtOpenKeyedEvent@12 | |
| NtOpenProcessTokenEx@16 | |
| NtOpenThreadTokenEx@20 | |
| NtQueryBootEntryOrder@8 | |
| NtQueryBootOptions@8 | |
| NtQueryDebugFilterState@8 | |
| NtQueryPortInformationProcess@0 | |
| NtQuerySystemEnvironmentValueEx@20 | |
| NtReleaseKeyedEvent@16 | |
| NtRemoveProcessDebug@8 | |
| NtRenameKey@8 | |
| NtResumeProcess@4 | |
| NtSaveKeyEx@12 | |
| NtSetBootEntryOrder@8 | |
| NtSetBootOptions@8 | |
| NtSetDebugFilterState@12 | |
| NtSetEventBoostPriority@4 | |
| NtSetInformationDebugObject@20 | |
| NtSetSystemEnvironmentValueEx@20 | |
| NtSuspendProcess@4 | |
| NtTraceEvent@16 | |
| NtTranslateFilePath@16 | |
| NtUnloadKeyEx@8 | |
| NtWaitForDebugEvent@16 | |
| NtWaitForKeyedEvent@16 | |
| RtlActivateActivationContext@12 | |
| RtlActivateActivationContextEx@16 | |
| @RtlActivateActivationContextUnsafeFast@8 ; fastcall | |
| RtlAddRefActivationContext@4 | |
| RtlAddRefMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlAddVectoredExceptionHandler@8 | |
| RtlAddressInSectionTable@12 | |
| RtlAppendPathElement@12 | |
| RtlApplicationVerifierStop@40 | |
| ; RtlAssert2@20 ; removed in Windows Server 2003 | |
| RtlCaptureContext@4 | |
| RtlCaptureStackContext@12 | |
| ; RtlCheckProcessParameters@16 ; removed in Windows Vista | |
| RtlCloneMemoryStream@8 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlCommitMemoryStream@8 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlComputeCrc32@12 | |
| RtlComputeImportTableHash@12 | |
| RtlComputePrivatizedDllName_U@12 | |
| RtlCopyMemoryStreamTo@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlCopyOutOfProcessMemoryStreamTo@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlCreateActivationContext@24 | |
| RtlCreateBootStatusDataFile@4 ; Windows XP-2003 has ABI "RtlCreateBootStatusDataFile@0", Windows Vista and new has ABI "RtlCreateBootStatusDataFile@4" | |
| RtlCreateSystemVolumeInformationFolder@4 | |
| RtlDeactivateActivationContext@8 | |
| @RtlDeactivateActivationContextUnsafeFast@4 ; fastcall | |
| RtlDeleteElementGenericTableAvl@8 | |
| RtlDllShutdownInProgress@0 | |
| RtlDosApplyFileIsolationRedirection_Ustr@36 | |
| RtlDosSearchPath_Ustr@36 | |
| RtlDowncaseUnicodeChar@4 | |
| RtlDuplicateUnicodeString@12 | |
| RtlEnumerateGenericTableAvl@8 | |
| RtlEnumerateGenericTableLikeADirectory@28 | |
| RtlEnumerateGenericTableWithoutSplayingAvl@8 | |
| RtlExitUserThread@4 | |
| RtlFinalReleaseOutOfProcessMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlFindActivationContextSectionGuid@20 | |
| RtlFindActivationContextSectionString@20 | |
| RtlFindCharInUnicodeString@16 | |
| RtlFindClearRuns@16 | |
| RtlFirstEntrySList@4 | |
| RtlFlushSecureMemoryCache@8 | |
| RtlFreeThreadActivationContextStack@0 | |
| RtlGetActiveActivationContext@4 | |
| RtlGetCurrentPeb@0 | |
| RtlGetElementGenericTableAvl@8 | |
| RtlGetFrame@0 | |
| RtlGetLastNtStatus@0 | |
| RtlGetLastWin32Error@0 | |
| RtlGetLengthWithoutLastFullDosOrNtPathElement@12 | |
| RtlGetLengthWithoutTrailingPathSeperators@12 | |
| RtlGetNativeSystemInformation@16 | |
| RtlGetNtVersionNumbers@12 | |
| RtlGetSetBootStatusData@24 | |
| RtlHashUnicodeString@16 | |
| RtlInitMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlInitOutOfProcessMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlInitUnicodeStringEx@8 | |
| RtlInitializeGenericTableAvl@20 | |
| RtlInitializeSListHead@4 | |
| RtlInsertElementGenericTableAvl@16 | |
| RtlInterlockedFlushSList@4 | |
| RtlInterlockedPopEntrySList@4 | |
| RtlInterlockedPushEntrySList@8 | |
| @RtlInterlockedPushListSList@16 ; fastcall | |
| RtlIpv4AddressToStringA@8 | |
| RtlIpv4AddressToStringW@8 | |
| RtlIpv4StringToAddressA@16 | |
| RtlIpv4StringToAddressW@16 | |
| RtlIpv6AddressToStringA@8 | |
| RtlIpv6AddressToStringW@8 | |
| RtlIpv6StringToAddressA@12 | |
| RtlIpv6StringToAddressW@12 | |
| RtlIsActivationContextActive@4 | |
| RtlIsGenericTableEmptyAvl@4 | |
| RtlLockBootStatusData@4 | |
| RtlLockMemoryStreamRegion@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlLogStackBackTrace@0 | |
| RtlLookupElementGenericTableAvl@8 | |
| RtlMapSecurityErrorToNtStatus@4 | |
| RtlMultiAppendUnicodeStringBuffer@12 | |
| RtlNewSecurityObjectWithMultipleInheritance@36 | |
| RtlNtPathNameToDosPathName@16 | |
| RtlNtStatusToDosErrorNoTeb@4 | |
| RtlNumberGenericTableElementsAvl@4 | |
| RtlPopFrame@4 | |
| RtlPushFrame@4 | |
| RtlQueryDepthSList@4 | |
| RtlQueryHeapInformation@20 | |
| RtlQueryInformationActivationContext@28 | |
| RtlQueryInformationActiveActivationContext@16 | |
| RtlQueryInterfaceMemoryStream@12 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlQueueApcWow64Thread@20 | |
| RtlRandomEx@4 | |
| RtlReadMemoryStream@16 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlReadOutOfProcessMemoryStream@16 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlRegisterSecureMemoryCacheCallback@4 | |
| RtlReleaseActivationContext@4 | |
| RtlReleaseMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlRemoveVectoredExceptionHandler@4 | |
| RtlRestoreLastWin32Error@4 | |
| RtlRevertMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlSeekMemoryStream@20 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlSetHeapInformation@16 | |
| RtlSetLastWin32Error@4 | |
| RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4 | |
| RtlSetMemoryStreamSize@12 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlSetProcessIsCritical ; cdecl | |
| RtlSetThreadIsCritical ; cdecl | |
| RtlStatMemoryStream@12 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlUnhandledExceptionFilter2@8 | |
| RtlUnhandledExceptionFilter@4 | |
| RtlUnlockBootStatusData@4 | |
| RtlUnlockMemoryStreamRegion@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlValidateUnicodeString@8 | |
| RtlWriteMemoryStream@16 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version | |
| RtlZombifyActivationContext@4 | |
| RtlpApplyLengthFunction@16 | |
| RtlpEnsureBufferSize@12 | |
| RtlpNotOwnerCriticalSection@4 | |
| ZwAddBootEntry@8 | |
| ZwCompactKeys@8 | |
| ZwCompareTokens@12 | |
| ZwCompressKey@4 | |
| ZwCreateDebugObject@16 | |
| ZwCreateJobSet@12 | |
| ZwCreateKeyedEvent@16 | |
| ZwCreateProcessEx@36 | |
| ZwDebugActiveProcess@8 | |
| ZwDebugContinue@12 | |
| ZwDeleteBootEntry@4 | |
| ZwEnumerateBootEntries@8 | |
| ZwEnumerateSystemEnvironmentValuesEx@12 | |
| ZwIsProcessInJob@8 | |
| ZwLockProductActivationKeys@8 | |
| ZwLockRegistryKey@4 | |
| ZwMakePermanentObject@4 | |
| ZwModifyBootEntry@4 | |
| ZwOpenKeyedEvent@12 | |
| ZwOpenProcessTokenEx@16 | |
| ZwOpenThreadTokenEx@20 | |
| ZwQueryBootEntryOrder@8 | |
| ZwQueryBootOptions@8 | |
| ZwQueryDebugFilterState@8 | |
| ZwQueryPortInformationProcess@0 | |
| ZwQuerySystemEnvironmentValueEx@20 | |
| ZwReleaseKeyedEvent@16 | |
| ZwRemoveProcessDebug@8 | |
| ZwRenameKey@8 | |
| ZwResumeProcess@4 | |
| ZwSaveKeyEx@12 | |
| ZwSetBootEntryOrder@8 | |
| ZwSetBootOptions@8 | |
| ZwSetDebugFilterState@12 | |
| ZwSetEventBoostPriority@4 | |
| ZwSetInformationDebugObject@20 | |
| ZwSetSystemEnvironmentValueEx@20 | |
| ZwSuspendProcess@4 | |
| ZwTraceEvent@16 | |
| ZwTranslateFilePath@16 | |
| ZwUnloadKeyEx@8 | |
| ZwWaitForDebugEvent@16 | |
| ZwWaitForKeyedEvent@16 | |
| vDbgPrintEx@16 | |
| vDbgPrintExWithPrefix@20 | |
| ; This is list of symbols added in Windows XP SP1 | |
| LdrEnumerateLoadedModules@12 | |
| RtlIsThreadWithinLoaderCallout@0 | |
| ; This is list of symbols added in Windows XP SP2 | |
| LdrHotPatchRoutine@0 ; removed in Windows 8.1 | |
| RtlGetUnloadEventTrace@0 | |
| RtlIpv4AddressToStringExA@16 | |
| RtlIpv4AddressToStringExW@16 | |
| RtlIpv4StringToAddressExA@16 | |
| RtlIpv4StringToAddressExW@16 | |
| RtlIpv6AddressToStringExA@20 | |
| RtlIpv6AddressToStringExW@20 | |
| RtlIpv6StringToAddressExA@16 | |
| RtlIpv6StringToAddressExW@16 | |
| ; This is list of symbols added in Windows XP SP2 and in Windows Server 2003 SP1 (not available in 2003 without SP1) | |
| KiFastSystemCall@0 | |
| KiFastSystemCallRet@0 | |
| KiIntSystemCall@0 | |
| RtlDecodePointer@4 | |
| RtlDecodeSystemPointer@4 | |
| RtlEncodePointer@4 | |
| RtlEncodeSystemPointer@4 | |
| ; In Windows XP SP3 was not added any new symbol | |
| ; This is list of symbols added in Windows Server 2003 | |
| ; EtwControlTraceA@20 ; removed in Windows Vista | |
| ; EtwControlTraceW@20 ; removed in Windows Vista | |
| EtwCreateTraceInstanceId@8 | |
| ; EtwEnableTrace@24 ; removed in Windows Vista | |
| ; EtwEnumerateTraceGuids@12 ; removed in Windows Vista | |
| ; EtwFlushTraceA@16 ; removed in Windows Vista | |
| ; EtwFlushTraceW@16 ; removed in Windows Vista | |
| EtwGetTraceEnableFlags@8 | |
| EtwGetTraceEnableLevel@8 | |
| EtwGetTraceLoggerHandle@4 | |
| ; EtwNotificationRegistrationA@20 ; removed in Windows Vista | |
| ; EtwNotificationRegistrationW@20 ; removed in Windows Vista | |
| ; EtwQueryAllTracesA@12 ; removed in Windows Vista | |
| ; EtwQueryAllTracesW@12 ; removed in Windows Vista | |
| ; EtwQueryTraceA@16 ; removed in Windows Vista | |
| ; EtwQueryTraceW@16 ; removed in Windows Vista | |
| ; EtwReceiveNotificationsA@16 ; removed in Windows Vista | |
| ; EtwReceiveNotificationsW@16 ; removed in Windows Vista | |
| EtwRegisterTraceGuidsA@32 | |
| EtwRegisterTraceGuidsW@32 | |
| ; EtwStartTraceA@12 ; removed in Windows Vista | |
| ; EtwStartTraceW@12 ; removed in Windows Vista | |
| ; EtwStopTraceA@16 ; removed in Windows Vista | |
| ; EtwStopTraceW@16 ; removed in Windows Vista | |
| ; EtwTraceEvent@12 ; removed in Windows Vista | |
| EtwTraceEventInstance@20 | |
| EtwTraceMessage ; cdecl | |
| EtwTraceMessageVa@24 | |
| EtwUnregisterTraceGuids@8 | |
| ; EtwUpdateTraceA@16 ; removed in Windows Vista | |
| ; EtwUpdateTraceW@16 ; removed in Windows Vista | |
| ; EtwpGetTraceBuffer@16 ; removed in Windows Vista | |
| ; EtwpSetHWConfigFunction@8 ; removed in Windows Vista | |
| LdrQueryImageFileExecutionOptionsEx@28 | |
| NtAddDriverEntry@8 | |
| NtApphelpCacheControl@8 | |
| NtDeleteDriverEntry@4 | |
| NtEnumerateDriverEntries@8 | |
| NtGetCurrentProcessorNumber@0 | |
| NtGetTickCount@0 | |
| NtLoadKeyEx@32 ; Windows Server 2003 has ABI "NtLoadKeyEx@16", Windows Vista and new has ABI "NtLoadKeyEx@32" | |
| NtModifyDriverEntry@4 | |
| NtQueryDriverEntryOrder@8 | |
| NtQueryOpenSubKeysEx@16 | |
| NtSetDriverEntryOrder@8 | |
| NtUnloadKey2@8 | |
| RtlCopyMappedMemory@12 | |
| RtlDosPathNameToRelativeNtPathName_U@16 | |
| RtlGetFullPathName_UstrEx@32 | |
| RtlGetThreadErrorMode@0 | |
| RtlImageNtHeaderEx@20 | |
| RtlInitAnsiStringEx@8 | |
| RtlInsertElementGenericTableFull@24 | |
| RtlInsertElementGenericTableFullAvl@24 | |
| RtlInterlockedCompareExchange64@20 | |
| RtlLookupElementGenericTableFull@16 | |
| RtlLookupElementGenericTableFullAvl@16 | |
| RtlMultipleAllocateHeap@20 | |
| RtlMultipleFreeHeap@16 | |
| RtlReleaseRelativeName@4 | |
| RtlSetEnvironmentStrings@8 | |
| RtlSetThreadErrorMode@8 | |
| RtlWow64EnableFsRedirection@4 | |
| ZwAddDriverEntry@8 | |
| ZwApphelpCacheControl@8 | |
| ZwDeleteDriverEntry@4 | |
| ZwEnumerateDriverEntries@8 | |
| ZwGetCurrentProcessorNumber@0 | |
| ZwLoadKeyEx@32 ; Windows Server 2003 has ABI "ZwLoadKeyEx@16", Windows Vista and new has ABI "ZwLoadKeyEx@32" | |
| ZwModifyDriverEntry@4 | |
| ZwQueryDriverEntryOrder@8 | |
| ZwQueryOpenSubKeysEx@16 | |
| ZwSetDriverEntryOrder@8 | |
| ZwUnloadKey2@8 | |
| ; This is list of symbols added in Windows Server 2003 SP1 and Windows XP x64 SP1 (WoW64 version) | |
| ExpInterlockedPopEntrySListEnd@0 ; removed in Windows 10 November Update (Threshold 2 / 1511) WoW64 version, but available in non-WoW64 version | |
| ExpInterlockedPopEntrySListFault@0 ; removed in Windows 10 November Update (Threshold 2 / 1511) WoW64 version, but available in non-WoW64 version | |
| ExpInterlockedPopEntrySListResume@0 ; removed in Windows 10 November Update (Threshold 2 / 1511) WoW64 version, but available in non-WoW64 version | |
| LdrOpenImageFileOptionsKey@12 | |
| LdrQueryImageFileKeyOption@24 | |
| NtWaitForMultipleObjects32@20 | |
| NtWow64CsrAllocateCaptureBuffer@8 ; available only in 32-bit WoW64 version on 64-bit system | |
| NtWow64CsrAllocateMessagePointer@12 ; available only in 32-bit WoW64 version on 64-bit system | |
| NtWow64CsrCaptureMessageBuffer@16 ; available only in 32-bit WoW64 version on 64-bit system | |
| NtWow64CsrCaptureMessageString@20 ; available only in 32-bit WoW64 version on 64-bit system | |
| NtWow64CsrClientCallServer@16 ; available only in 32-bit WoW64 version on 64-bit system | |
| NtWow64CsrClientConnectToServer@20 ; available only in 32-bit WoW64 version on 64-bit system | |
| NtWow64CsrFreeCaptureBuffer@4 ; available only in 32-bit WoW64 version on 64-bit system | |
| NtWow64CsrGetProcessId@0 ; available only in 32-bit WoW64 version on 64-bit system | |
| NtWow64CsrIdentifyAlertableThread@0 ; available only in 32-bit WoW64 version on 64-bit system | |
| ; NtWow64CsrNewThread@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7 | |
| ; NtWow64CsrSetPriorityClass@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7 | |
| NtWow64DebuggerCall@20 ; available only in 32-bit WoW64 version on 64-bit system | |
| NtWow64GetNativeSystemInformation@16 ; available only in 32-bit WoW64 version on 64-bit system | |
| NtWow64QueryInformationProcess64@20 ; available only in 32-bit WoW64 version on 64-bit system | |
| NtWow64QueryVirtualMemory64@32 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 (Threshold / 1507) | |
| NtWow64ReadVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system | |
| RtlAcquirePrivilege@16 | |
| RtlAddVectoredContinueHandler@8 | |
| RtlAllocateActivationContextStack@4 | |
| RtlDosPathNameToNtPathName_U_WithStatus@16 | |
| RtlDosPathNameToRelativeNtPathName_U_WithStatus@16 | |
| RtlFormatMessageEx@40 | |
| RtlFreeActivationContextStack@4 | |
| RtlGetCriticalSectionRecursionCount@4 | |
| RtlGetCurrentProcessorNumber@0 | |
| RtlIsCriticalSectionLocked@4 | |
| RtlIsCriticalSectionLockedByThread@4 | |
| RtlReleasePrivilege@4 | |
| RtlRemoveVectoredContinueHandler@4 | |
| RtlSetUnhandledExceptionFilter@4 | |
| RtlWow64EnableFsRedirectionEx@8 | |
| ZwWaitForMultipleObjects32@20 | |
| ZwWow64CsrAllocateCaptureBuffer@8 ; available only in 32-bit WoW64 version on 64-bit system | |
| ZwWow64CsrAllocateMessagePointer@12 ; available only in 32-bit WoW64 version on 64-bit system | |
| ZwWow64CsrCaptureMessageBuffer@16 ; available only in 32-bit WoW64 version on 64-bit system | |
| ZwWow64CsrCaptureMessageString@20 ; available only in 32-bit WoW64 version on 64-bit system | |
| ZwWow64CsrClientCallServer@16 ; available only in 32-bit WoW64 version on 64-bit system | |
| ZwWow64CsrClientConnectToServer@20 ; available only in 32-bit WoW64 version on 64-bit system | |
| ZwWow64CsrFreeCaptureBuffer@4 ; available only in 32-bit WoW64 version on 64-bit system | |
| ZwWow64CsrGetProcessId@0 ; available only in 32-bit WoW64 version on 64-bit system | |
| ZwWow64CsrIdentifyAlertableThread@0 ; available only in 32-bit WoW64 version on 64-bit system | |
| ; ZwWow64CsrNewThread@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7 | |
| ; ZwWow64CsrSetPriorityClass@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7 | |
| ZwWow64DebuggerCall@20 ; available only in 32-bit WoW64 version on 64-bit system | |
| ZwWow64GetNativeSystemInformation@16 ; available only in 32-bit WoW64 version on 64-bit system | |
| ZwWow64QueryInformationProcess64@20 ; available only in 32-bit WoW64 version on 64-bit system | |
| ZwWow64QueryVirtualMemory64@32 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 (Threshold / 1507) | |
| ZwWow64ReadVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system | |
| ; In Windows Server 2003 SP2 and Windows XP x64 SP2 (WoW64 version) was not added any new symbol | |
| ; This is list of symbols added in Windows Vista | |
| A_SHAFinal@8 | |
| A_SHAInit@4 | |
| A_SHAUpdate@12 | |
| AlpcAdjustCompletionListConcurrencyCount@8 | |
| AlpcFreeCompletionListMessage@8 | |
| AlpcGetCompletionListLastMessageInformation@12 | |
| AlpcGetCompletionListMessageAttributes@8 | |
| AlpcGetHeaderSize@4 | |
| AlpcGetMessageAttribute@8 | |
| AlpcGetMessageFromCompletionList@8 | |
| AlpcGetOutstandingCompletionListMessageCount@4 | |
| AlpcInitializeMessageAttribute@16 | |
| AlpcMaxAllowedMessageLength@0 | |
| AlpcRegisterCompletionList@20 | |
| AlpcRegisterCompletionListWorkerThread@4 | |
| AlpcUnregisterCompletionList@4 | |
| AlpcUnregisterCompletionListWorkerThread@4 | |
| CsrVerifyRegion@8 | |
| EtwDeliverDataBlock@4 | |
| EtwEnumerateProcessRegGuids@12 | |
| EtwEventActivityIdControl@8 | |
| EtwEventEnabled@12 | |
| EtwEventProviderEnabled@20 | |
| EtwEventRegister@16 | |
| EtwEventUnregister@8 | |
| EtwEventWrite@20 | |
| EtwEventWriteEndScenario@20 | |
| EtwEventWriteFull@32 | |
| EtwEventWriteStartScenario@20 | |
| EtwEventWriteString@24 | |
| EtwEventWriteTransfer@28 | |
| EtwLogTraceEvent@12 | |
| EtwNotificationRegister@20 | |
| EtwNotificationUnregister@12 | |
| EtwProcessPrivateLoggerRequest@4 | |
| EtwRegisterSecurityProvider@0 | |
| EtwReplyNotification@4 | |
| EtwSendNotification@20 | |
| EtwSetMark@16 | |
| EtwWriteUMSecurityEvent@16 | |
| EtwpCreateEtwThread@8 | |
| EtwpGetCpuSpeed@8 ; Windows Vista-8 has ABI "EtwpGetCpuSpeed@8", Windows 8.1 and new has ABI "EtwpGetCpuSpeed@4" | |
| ; EtwpNotificationThread@0 ; removed in Windows 8.1 | |
| LdrAddLoadAsDataTable@16 ; Windows Vista has ABI "LdrAddLoadAsDataTable@16", Windows 7 and new has ABI "LdrAddLoadAsDataTable@20" | |
| LdrGetFailureData@0 | |
| LdrGetFileNameFromLoadAsDataTable@8 | |
| LdrGetProcedureAddressEx@20 | |
| LdrLoadAlternateResourceModuleEx@20 | |
| LdrQueryModuleServiceTags@12 | |
| LdrRegisterDllNotification@16 | |
| LdrRemoveLoadAsDataTable@16 | |
| LdrResFindResource@36 | |
| LdrResFindResourceDirectory@28 | |
| LdrResRelease@12 | |
| LdrResSearchResource@32 | |
| LdrSetMUICacheType@4 | |
| LdrUnloadAlternateResourceModuleEx@8 | |
| LdrUnregisterDllNotification@4 | |
| LdrVerifyImageMatchesChecksumEx@8 | |
| MD4Final@4 | |
| MD4Init@4 | |
| MD4Update@12 | |
| MD5Final@4 | |
| MD5Init@4 | |
| MD5Update@12 | |
| NtAcquireCMFViewOwnership@12 ; removed in Windows 7 | |
| NtAlpcAcceptConnectPort@36 | |
| NtAlpcCancelMessage@12 | |
| NtAlpcConnectPort@44 | |
| NtAlpcCreatePort@12 | |
| NtAlpcCreatePortSection@24 | |
| NtAlpcCreateResourceReserve@16 | |
| NtAlpcCreateSectionView@12 | |
| NtAlpcCreateSecurityContext@12 | |
| NtAlpcDeletePortSection@12 | |
| NtAlpcDeleteResourceReserve@12 | |
| NtAlpcDeleteSectionView@12 | |
| NtAlpcDeleteSecurityContext@12 | |
| NtAlpcDisconnectPort@8 | |
| NtAlpcImpersonateClientOfPort@12 | |
| NtAlpcOpenSenderProcess@24 | |
| NtAlpcOpenSenderThread@24 | |
| NtAlpcQueryInformation@20 | |
| NtAlpcQueryInformationMessage@24 | |
| NtAlpcRevokeSecurityContext@12 | |
| NtAlpcSendWaitReceivePort@32 | |
| NtAlpcSetInformation@16 | |
| NtCancelIoFileEx@12 | |
| NtCancelSynchronousIoFile@12 | |
| ; NtClearAllSavepointsTransaction@4 ; removed in Windows Vista SP1 | |
| ; NtClearSavepointTransaction@8 ; removed in Windows Vista SP1 | |
| NtCommitComplete@8 | |
| NtCommitEnlistment@8 | |
| NtCommitTransaction@8 | |
| NtCreateEnlistment@32 | |
| NtCreateKeyTransacted@32 | |
| NtCreatePrivateNamespace@16 | |
| NtCreateResourceManager@28 | |
| NtCreateThreadEx@44 | |
| NtCreateTransaction@40 | |
| NtCreateTransactionManager@24 | |
| NtCreateUserProcess@44 | |
| NtCreateWorkerFactory@40 | |
| NtDeletePrivateNamespace@4 | |
| NtEnumerateTransactionObject@20 | |
| NtFlushInstallUILanguage@8 | |
| NtFlushProcessWriteBuffers@0 | |
| NtFreezeRegistry@4 | |
| NtFreezeTransactions@8 | |
| NtGetMUIRegistryInfo@12 | |
| NtGetNextProcess@20 | |
| NtGetNextThread@24 | |
| NtGetNlsSectionPtr@20 | |
| NtGetNotificationResourceManager@28 | |
| NtInitializeNlsFiles@16 ; Windows Vista has ABI "NtInitializeNlsFiles@12", Windows Vista SP1 and SP2 has ABI "NtInitializeNlsFiles@16", Windows 7 and new has again ABI "NtInitializeNlsFiles@12" | |
| NtIsUILanguageComitted@0 | |
| ; NtListTransactions@12 ; removed in Windows Vista SP1 | |
| NtMapCMFModule@24 | |
| ; NtMarshallTransaction@24 ; removed in Windows Vista SP1 | |
| NtOpenEnlistment@20 | |
| NtOpenKeyTransacted@16 | |
| NtOpenPrivateNamespace@16 | |
| NtOpenResourceManager@20 | |
| NtOpenSession@12 | |
| NtOpenTransaction@20 | |
| NtOpenTransactionManager@24 | |
| NtPrePrepareComplete@8 | |
| NtPrePrepareEnlistment@8 | |
| NtPrepareComplete@8 | |
| NtPrepareEnlistment@8 | |
| NtPropagationComplete@16 | |
| NtPropagationFailed@12 | |
| ; NtPullTransaction@28 ; removed in Windows Vista SP1 | |
| NtQueryInformationEnlistment@20 | |
| NtQueryInformationResourceManager@20 | |
| NtQueryInformationTransaction@20 | |
| NtQueryInformationTransactionManager@20 | |
| NtQueryInformationWorkerFactory@20 | |
| NtQueryLicenseValue@20 | |
| NtReadOnlyEnlistment@8 | |
| NtRecoverEnlistment@8 | |
| NtRecoverResourceManager@4 | |
| NtRecoverTransactionManager@4 | |
| NtRegisterProtocolAddressInformation@20 | |
| NtReleaseCMFViewOwnership@0 ; removed in Windows 7 | |
| NtReleaseWorkerFactoryWorker@4 | |
| NtRemoveIoCompletionEx@24 | |
| NtRollbackComplete@8 | |
| NtRollbackEnlistment@8 | |
| ; NtRollbackSavepointTransaction@8 ; removed in Windows Vista SP1 | |
| NtRollbackTransaction@8 | |
| NtRollforwardTransactionManager@8 | |
| ; NtSavepointComplete@8 ; removed in Windows Vista SP1 | |
| ; NtSavepointTransaction@12 ; removed in Windows Vista SP1 | |
| NtSetInformationEnlistment@16 | |
| NtSetInformationResourceManager@16 | |
| NtSetInformationTransaction@16 | |
| NtSetInformationTransactionManager@16 | |
| NtSetInformationWorkerFactory@16 | |
| NtShutdownWorkerFactory@8 | |
| NtSinglePhaseReject@8 | |
| ; NtStartTm@0 ; removed in Windows Vista SP1 | |
| NtThawRegistry@0 | |
| NtThawTransactions@0 | |
| NtTraceControl@24 | |
| NtWaitForWorkViaWorkerFactory@8 ; Windows Vista-7 has ABI "NtWaitForWorkViaWorkerFactory@8", Windows 8 has ABI "NtWaitForWorkViaWorkerFactory@16", Windows 8.1 and new has ABI "NtWaitForWorkViaWorkerFactory@20" | |
| NtWorkerFactoryWorkerReady@4 | |
| NtWow64CallFunction64@28 ; available only in 32-bit WoW64 version on 64-bit system | |
| NtWow64CsrVerifyRegion@8 ; available only in 32-bit WoW64 version on 64-bit system | |
| NtWow64WriteVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system | |
| ; ResCCloseRuntimeView@4 ; removed in Windows Vista SP1 | |
| ; ResCCompareCacheIDs@8 ; removed in Windows Vista SP1 | |
| ; ResCCreateCultureMap@12 ; removed in Windows Vista SP1 | |
| ; ResCCreateDefaultCultureMap@4 ; removed in Windows Vista SP1 | |
| ; ResCCreateRuntimeView@16 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryCreateAndPopulate@12 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryCreateMapping@16 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryFree@4 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryGetBaseFolder@4 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryGetEntry@24 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryGetEntryCopy@28 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryGetEntryEx@32 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryGetEntryExCopy@36 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryGetEntryIndex@24 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryGetEntryIndexEx@32 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryGetFirstEntry@20 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryGetFirstEntryIndex@20 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryGetSegmentIndex@8 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryGetSegmentName@8 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryLoadFixedSize@4 ; removed in Windows Vista SP1 | |
| ; ResCDirectoryOpenMapping@8 ; removed in Windows Vista SP1 | |
| ; ResCFreeCultureMap@4 ; removed in Windows Vista SP1 | |
| ; ResCGetCacheIndices@16 ; removed in Windows Vista SP1 | |
| ; ResCGetCultureID@8 ; removed in Windows Vista SP1 | |
| ; ResCGetCultureIndex@8 ; removed in Windows Vista SP1 | |
| ; ResCGetCultureName@16 ; removed in Windows Vista SP1 | |
| ; ResCGetHighestCacheIndex@4 ; removed in Windows Vista SP1 | |
| ; ResCGetHighestConsecutiveCacheIndex@12 ; removed in Windows Vista SP1 | |
| ; ResCGetIndexedName@20 ; removed in Windows Vista SP1 | |
| ; ResCGetName@16 ; removed in Windows Vista SP1 | |
| ; ResCGetRegistryBaseFolder@16 ; removed in Windows Vista SP1 | |
| ; ResCGetRegistryConfig@8 ; removed in Windows Vista SP1 | |
| ; ResCGetRegistryLatestIndex@8 ; removed in Windows Vista SP1 | |
| ; ResCGetRegistryMappingPrefix@16 ; removed in Windows Vista SP1 | |
| ; ResCGetRegistryStatus@8 ; removed in Windows Vista SP1 | |
| ; ResCGetSubIndexedName@24 ; removed in Windows Vista SP1 | |
| ; ResCInitRuntimeView@8 ; removed in Windows Vista SP1 | |
| ; ResCInitRuntimeViewEx@12 ; removed in Windows Vista SP1 | |
| ; ResCKeDirectoryOpenMapping@20 ; removed in Windows Vista SP1 | |
| ; ResCKeGetBaseFolder@8 ; removed in Windows Vista SP1 | |
| ; ResCKeGetCacheIndices@8 ; removed in Windows Vista SP1 | |
| ; ResCKeInitRuntimeViewEx@4 ; removed in Windows Vista SP1 | |
| ; ResCKeSegmentOpenMapping@8 ; removed in Windows Vista SP1 | |
| ; ResCLoadCultureMap@4 ; removed in Windows Vista SP1 | |
| ; ResCOpenRegistryKey@24 ; removed in Windows Vista SP1 | |
| ; ResCOpenRuntimeView@8 ; removed in Windows Vista SP1 | |
| ; ResCReleaseInitMutex@4 ; removed in Windows Vista SP1 | |
| ; ResCReloadCultureMap@4 ; removed in Windows Vista SP1 | |
| ; ResCRequestInitMutex@8 ; removed in Windows Vista SP1 | |
| ; ResCRuntimeGetAnySegmentData@20 ; removed in Windows Vista SP1 | |
| ; ResCRuntimeGetCultureID@8 ; removed in Windows Vista SP1 | |
| ; ResCRuntimeGetEntryData@8 ; removed in Windows Vista SP1 | |
| ; ResCRuntimeGetEntryDataEx@12 ; removed in Windows Vista SP1 | |
| ; ResCRuntimeGetResourceData@32 ; removed in Windows Vista SP1 | |
| ; ResCRuntimeGetResourceDataEx@36 ; removed in Windows Vista SP1 | |
| ; ResCRuntimeGetResourceDataForCulture@32 ; removed in Windows Vista SP1 | |
| ; ResCRuntimeGetSegmentData@16 ; removed in Windows Vista SP1 | |
| ; ResCRuntimeGetSegmentDataEx@20 ; removed in Windows Vista SP1 | |
| ; ResCRuntimeViewLoadCultureMap@4 ; removed in Windows Vista SP1 | |
| ; ResCSaveRegistryBaseFolder@8 ; removed in Windows Vista SP1 | |
| ; ResCSaveRegistryConfig@8 ; removed in Windows Vista SP1 | |
| ; ResCSaveRegistryLatestIndex@8 ; removed in Windows Vista SP1 | |
| ; ResCSaveRegistryStatus@8 ; removed in Windows Vista SP1 | |
| ; ResCSegmentCreateAndPopulate@12 ; removed in Windows Vista SP1 | |
| ; ResCSegmentCreateMapping@20 ; removed in Windows Vista SP1 | |
| ; ResCSegmentFree@4 ; removed in Windows Vista SP1 | |
| ; ResCSegmentGetData@8 ; removed in Windows Vista SP1 | |
| ; ResCSegmentLoadFixedSize@4 ; removed in Windows Vista SP1 | |
| ; ResCSegmentOpenMapping@8 ; removed in Windows Vista SP1 | |
| ; ResCSegmentReserveMapping@16 ; removed in Windows Vista SP1 | |
| ; ResCSetCacheSecurityType@4 ; removed in Windows Vista SP1 | |
| RtlAcquireSRWLockExclusive@4 | |
| RtlAcquireSRWLockShared@4 | |
| RtlAddMandatoryAce@24 | |
| RtlAddSIDToBoundaryDescriptor@8 | |
| RtlAllocateMemoryBlockLookaside@12 | |
| RtlAllocateMemoryZone@12 | |
| RtlBarrier@8 | |
| RtlBarrierForDelete@8 | |
| RtlCleanUpTEBLangLists@0 | |
| RtlCloneUserProcess@20 | |
| RtlCmDecodeMemIoResource@8 | |
| RtlCmEncodeMemIoResource@24 | |
| RtlCommitDebugInfo@8 | |
| RtlCompareAltitudes@8 | |
| RtlCompareUnicodeStrings@20 | |
| RtlConnectToSm@16 | |
| RtlConvertLCIDToString@20 | |
| RtlCreateBoundaryDescriptor@8 | |
| RtlCreateEnvironmentEx@12 | |
| RtlCreateMemoryBlockLookaside@20 | |
| RtlCreateMemoryZone@12 | |
| RtlCreateProcessParametersEx@44 | |
| RtlCreateServiceSid@12 | |
| RtlCreateUserStack@24 | |
| RtlCultureNameToLCID@8 | |
| RtlDeCommitDebugInfo@12 | |
| RtlDeleteBarrier@4 | |
| RtlDeleteBoundaryDescriptor@4 | |
| RtlDestroyMemoryBlockLookaside@4 | |
| RtlDestroyMemoryZone@4 | |
| RtlExitUserProcess@4 | |
| RtlExpandEnvironmentStrings@24 | |
| RtlExtendMemoryBlockLookaside@8 | |
| RtlExtendMemoryZone@8 | |
| RtlFindAceByType@12 | |
| RtlFindClosestEncodableLength@12 | |
| RtlFlsAlloc@8 | |
| RtlFlsFree@4 | |
| RtlFreeMemoryBlockLookaside@8 | |
| RtlFreeUserStack@4 | |
| RtlGetCurrentTransaction@0 | |
| RtlGetFileMUIPath@28 | |
| RtlGetIntegerAtom@8 | |
| RtlGetParentLocaleName@16 | |
| RtlGetProductInfo@20 | |
| RtlGetSystemPreferredUILanguages@20 | |
| RtlGetThreadLangIdByIndex@16 | |
| RtlGetThreadPreferredUILanguages@16 | |
| RtlGetUILanguageInfo@20 | |
| RtlGetUnloadEventTraceEx@12 | |
| RtlGetUserPreferredUILanguages@20 | |
| RtlHeapTrkInitialize@4 | |
| RtlIdnToAscii@20 | |
| RtlIdnToNameprepUnicode@20 | |
| RtlIdnToUnicode@20 | |
| RtlImpersonateSelfEx@12 | |
| RtlInitBarrier@12 | |
| RtlInitializeConditionVariable@4 | |
| RtlInitializeCriticalSectionEx@12 | |
| RtlInitializeNtUserPfn@24 | |
| RtlInitializeSRWLock@4 | |
| RtlIoDecodeMemIoResource@16 | |
| RtlIoEncodeMemIoResource@40 | |
| RtlIsCurrentThreadAttachExempt@0 | |
| RtlIsNormalizedString@16 | |
| RtlIsValidLocaleName@8 | |
| RtlLCIDToCultureName@8 | |
| RtlLcidToLocaleName@16 | |
| RtlLocaleNameToLcid@12 | |
| RtlLockCurrentThread@0 | |
| RtlLockMemoryBlockLookaside@4 | |
| RtlLockMemoryZone@4 | |
| RtlLockModuleSection@4 | |
| RtlNormalizeString@20 | |
| RtlOwnerAcesPresent@4 | |
| RtlProcessFlsData@4 ; Windows Vista-10 has ABI "RtlProcessFlsData@4", Windows 10 May 2019 Update (19H1 / 1903) and new has ABI "RtlProcessFlsData@8" | |
| RtlQueryActivationContextApplicationSettings@28 | |
| RtlQueryCriticalSectionOwner@4 ; Windows Vista-8.1 has ABI "RtlQueryCriticalSectionOwner@4", Windows 10 and new has ABI "RtlQueryCriticalSectionOwner@8" | |
| RtlQueryDynamicTimeZoneInformation@4 | |
| RtlQueryElevationFlags@4 | |
| RtlQueryEnvironmentVariable@24 | |
| RtlQueryModuleInformation@12 | |
| RtlRegisterThreadWithCsrss@0 | |
| RtlReleaseSRWLockExclusive@4 | |
| RtlReleaseSRWLockShared@4 | |
| RtlRemovePrivileges@12 | |
| RtlReportException@12 | |
| RtlResetMemoryBlockLookaside@4 | |
| RtlResetMemoryZone@4 | |
| RtlRetrieveNtUserPfn@12 | |
| RtlRunOnceBeginInitialize@12 | |
| RtlRunOnceComplete@12 | |
| RtlRunOnceExecuteOnce@16 | |
| RtlRunOnceInitialize@4 | |
| RtlSendMsgToSm@8 | |
| RtlSetCurrentTransaction@4 | |
| RtlSetDynamicTimeZoneInformation@4 | |
| RtlSetEnvironmentVar@20 | |
| RtlSetProcessDebugInformation@12 | |
| RtlSetThreadPreferredUILanguages@12 | |
| RtlSidDominates@12 | |
| RtlSidEqualLevel@12 | |
| RtlSidHashInitialize@12 | |
| RtlSidHashLookup@8 | |
| RtlSidIsHigherLevel@12 | |
| RtlSleepConditionVariableCS@12 | |
| RtlSleepConditionVariableSRW@16 | |
| RtlTestBit@8 | |
| RtlTryAcquirePebLock@0 | |
| RtlUnlockCurrentThread@0 | |
| RtlUnlockMemoryBlockLookaside@4 | |
| RtlUnlockMemoryZone@4 | |
| RtlUnlockModuleSection@4 | |
| RtlUpdateClonedCriticalSection@4 | |
| RtlUpdateClonedSRWLock@8 | |
| RtlUserThreadStart@8 | |
| RtlWakeAllConditionVariable@4 | |
| RtlWakeConditionVariable@4 | |
| RtlWerpReportException@16 ; Windows Vista-8 has ABI "RtlWerpReportException@16", Windows 8.1 and new has ABI "RtlWerpReportException@24" | |
| RtlWow64CallFunction64@28 | |
| RtlWow64LogMessageInEventLogger@12 ; available only in 32-bit WoW64 version on 64-bit system | |
| RtlpCleanupRegistryKeys@0 | |
| RtlpConvertCultureNamesToLCIDs@8 | |
| RtlpConvertLCIDsToCultureNames@8 | |
| RtlpCreateProcessRegistryInfo@4 | |
| RtlpGetLCIDFromLangInfoNode@12 | |
| RtlpGetNameFromLangInfoNode@12 | |
| RtlpGetSystemDefaultUILanguage@4 ; Windows Vista has ABI "RtlpGetSystemDefaultUILanguage@4", Windows 7 and new has ABI "RtlpGetSystemDefaultUILanguage@8" | |
| RtlpGetUserOrMachineUILanguage4NLS@12 | |
| RtlpInitializeLangRegistryInfo@4 | |
| RtlpIsQualifiedLanguage@12 | |
| RtlpLoadMachineUIByPolicy@12 | |
| RtlpLoadUserUIByPolicy@12 | |
| RtlpMuiFreeLangRegistryInfo@4 | |
| RtlpMuiRegCreateRegistryInfo@0 | |
| RtlpMuiRegFreeRegistryInfo@8 | |
| RtlpMuiRegLoadRegistryInfo@8 | |
| RtlpQueryDefaultUILanguage@8 | |
| RtlpQueryProcessDebugInformationRemote@4 ; available only in 32-bit WoW64 version on 64-bit system, since Windows 10 Creators Update (Redstone 2 / 1703) available also in non-WoW64 version | |
| RtlpRefreshCachedUILanguage@8 | |
| RtlpSetInstallLanguage@8 | |
| RtlpSetPreferredUILanguages@12 | |
| RtlpSetUserPreferredUILanguages@12 | |
| RtlpVerifyAndCommitUILanguageSettings@4 | |
| ShipAssert@8 | |
| ShipAssertGetBufferInfo@8 | |
| ShipAssertMsgA@12 | |
| ShipAssertMsgW@12 | |
| TpAllocAlpcCompletion@20 | |
| TpAllocCleanupGroup@4 | |
| TpAllocIoCompletion@20 | |
| TpAllocPool@8 | |
| TpAllocTimer@16 | |
| TpAllocWait@16 | |
| TpAllocWork@16 | |
| TpCallbackLeaveCriticalSectionOnCompletion@8 | |
| TpCallbackMayRunLong@4 | |
| TpCallbackReleaseMutexOnCompletion@8 | |
| TpCallbackReleaseSemaphoreOnCompletion@12 | |
| TpCallbackSetEventOnCompletion@8 | |
| TpCallbackUnloadDllOnCompletion@8 | |
| TpCancelAsyncIoOperation@4 | |
| TpCaptureCaller@4 | |
| TpCheckTerminateWorker@4 | |
| TpDbgDumpHeapUsage@12 | |
| TpDbgSetLogRoutine@4 | |
| TpDisassociateCallback@4 | |
| TpIsTimerSet@4 | |
| TpPostWork@4 | |
| TpReleaseAlpcCompletion@4 | |
| TpReleaseCleanupGroup@4 | |
| TpReleaseCleanupGroupMembers@12 | |
| TpReleaseIoCompletion@4 | |
| TpReleasePool@4 | |
| TpReleaseTimer@4 | |
| TpReleaseWait@4 | |
| TpReleaseWork@4 | |
| TpSetPoolMaxThreads@8 | |
| TpSetPoolMinThreads@8 | |
| TpSetTimer@16 | |
| TpSetWait@12 | |
| TpSimpleTryPost@12 | |
| TpStartAsyncIoOperation@4 | |
| TpWaitForAlpcCompletion@4 | |
| TpWaitForIoCompletion@8 | |
| TpWaitForTimer@8 | |
| TpWaitForWait@8 | |
| TpWaitForWork@8 | |
| WerCheckEventEscalation@8 ; removed in Windows 7 | |
| WerReportSQMEvent@16 ; Windows Vista has ABI "WerReportSQMEvent@12", Windows 7 and new has ABI "WerReportSQMEvent@16" | |
| WerReportWatsonEvent@16 ; removed in Windows 7 | |
| WinSqmAddToStream@16 | |
| WinSqmEndSession@4 | |
| WinSqmEventEnabled@8 | |
| WinSqmEventWrite@12 | |
| WinSqmIsOptedIn@0 | |
| WinSqmSetString@12 | |
| WinSqmStartSession@12 | |
| ZwAcquireCMFViewOwnership@12 ; removed in Windows 7 | |
| ZwAlpcAcceptConnectPort@36 | |
| ZwAlpcCancelMessage@12 | |
| ZwAlpcConnectPort@44 | |
| ZwAlpcCreatePort@12 | |
| ZwAlpcCreatePortSection@24 | |
| ZwAlpcCreateResourceReserve@16 | |
| ZwAlpcCreateSectionView@12 | |
| ZwAlpcCreateSecurityContext@12 | |
| ZwAlpcDeletePortSection@12 | |
| ZwAlpcDeleteResourceReserve@12 | |
| ZwAlpcDeleteSectionView@12 | |
| ZwAlpcDeleteSecurityContext@12 | |
| ZwAlpcDisconnectPort@8 | |
| ZwAlpcImpersonateClientOfPort@12 | |
| ZwAlpcOpenSenderProcess@24 | |
| ZwAlpcOpenSenderThread@24 | |
| ZwAlpcQueryInformation@20 | |
| ZwAlpcQueryInformationMessage@24 | |
| ZwAlpcRevokeSecurityContext@12 | |
| ZwAlpcSendWaitReceivePort@32 | |
| ZwAlpcSetInformation@16 | |
| ZwCancelIoFileEx@12 | |
| ZwCancelSynchronousIoFile@12 | |
| ; ZwClearAllSavepointsTransaction@4 ; removed in Windows Vista SP1 | |
| ; ZwClearSavepointTransaction@8 ; removed in Windows Vista SP1 | |
| ZwCommitComplete@8 | |
| ZwCommitEnlistment@8 | |
| ZwCommitTransaction@8 | |
| ZwCreateEnlistment@32 | |
| ZwCreateKeyTransacted@32 | |
| ZwCreatePrivateNamespace@16 | |
| ZwCreateResourceManager@28 | |
| ZwCreateThreadEx@44 | |
| ZwCreateTransaction@40 | |
| ZwCreateTransactionManager@24 | |
| ZwCreateUserProcess@44 | |
| ZwCreateWorkerFactory@40 | |
| ZwDeletePrivateNamespace@4 | |
| ZwEnumerateTransactionObject@20 | |
| ZwFlushInstallUILanguage@8 | |
| ZwFlushProcessWriteBuffers@0 | |
| ZwFreezeRegistry@4 | |
| ZwFreezeTransactions@8 | |
| ZwGetMUIRegistryInfo@12 | |
| ZwGetNextProcess@20 | |
| ZwGetNextThread@24 | |
| ZwGetNlsSectionPtr@20 | |
| ZwGetNotificationResourceManager@28 | |
| ZwInitializeNlsFiles@16 ; Windows Vista has ABI "ZwInitializeNlsFiles@12", Windows Vista SP1 and SP2 has ABI "ZwInitializeNlsFiles@16", Windows 7 and new has again ABI "ZwInitializeNlsFiles@12" | |
| ZwIsUILanguageComitted@0 | |
| ; ZwListTransactions@12 ; removed in Windows Vista SP1 | |
| ZwMapCMFModule@24 | |
| ; ZwMarshallTransaction@24 ; removed in Windows Vista SP1 | |
| ZwOpenEnlistment@20 | |
| ZwOpenKeyTransacted@16 | |
| ZwOpenPrivateNamespace@16 | |
| ZwOpenResourceManager@20 | |
| ZwOpenSession@12 | |
| ZwOpenTransaction@20 | |
| ZwOpenTransactionManager@24 | |
| ZwPrePrepareComplete@8 | |
| ZwPrePrepareEnlistment@8 | |
| ZwPrepareComplete@8 | |
| ZwPrepareEnlistment@8 | |
| ZwPropagationComplete@16 | |
| ZwPropagationFailed@12 | |
| ; ZwPullTransaction@28 ; removed in Windows Vista SP1 | |
| ZwQueryInformationEnlistment@20 | |
| ZwQueryInformationResourceManager@20 | |
| ZwQueryInformationTransaction@20 | |
| ZwQueryInformationTransactionManager@20 | |
| ZwQueryInformationWorkerFactory@20 | |
| ZwQueryLicenseValue@20 | |
| ZwReadOnlyEnlistment@8 | |
| ZwRecoverEnlistment@8 | |
| ZwRecoverResourceManager@4 | |
| ZwRecoverTransactionManager@4 | |
| ZwRegisterProtocolAddressInformation@20 | |
| ZwReleaseCMFViewOwnership@0 ; removed in Windows 7 | |
| ZwReleaseWorkerFactoryWorker@4 | |
| ZwRemoveIoCompletionEx@24 | |
| ZwRollbackComplete@8 | |
| ZwRollbackEnlistment@8 | |
| ; ZwRollbackSavepointTransaction@8 ; removed in Windows Vista SP1 | |
| ZwRollbackTransaction@8 | |
| ZwRollforwardTransactionManager@8 | |
| ; ZwSavepointComplete@8 ; removed in Windows Vista SP1 | |
| ; ZwSavepointTransaction@12 ; removed in Windows Vista SP1 | |
| ZwSetInformationEnlistment@16 | |
| ZwSetInformationResourceManager@16 | |
| ZwSetInformationTransaction@16 | |
| ZwSetInformationTransactionManager@16 | |
| ZwSetInformationWorkerFactory@16 | |
| ZwShutdownWorkerFactory@8 | |
| ZwSinglePhaseReject@8 | |
| ; ZwStartTm@0 ; removed in Windows Vista SP1 | |
| ZwThawRegistry@0 | |
| ZwThawTransactions@0 | |
| ZwTraceControl@24 | |
| ZwWaitForWorkViaWorkerFactory@8 ; Windows Vista-7 has ABI "ZwWaitForWorkViaWorkerFactory@8", Windows 8 has ABI "ZwWaitForWorkViaWorkerFactory@16", Windows 8.1 and new has ABI "ZwWaitForWorkViaWorkerFactory@20" | |
| ZwWorkerFactoryWorkerReady@4 | |
| ZwWow64CallFunction64@28 ; available only in 32-bit WoW64 version on 64-bit system | |
| ZwWow64CsrVerifyRegion@8 ; available only in 32-bit WoW64 version on 64-bit system | |
| ZwWow64WriteVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system | |
| ; _ResCGetRegistryFlags@16 ; removed in Windows Vista SP1 | |
| ; _ResCMatchFlags@12 ; removed in Windows Vista SP1 | |
| ; _ResCSaveRegistryFlags@16 ; removed in Windows Vista SP1 | |
| ; This is list of symbols added in Windows Vista SP1 | |
| LdrpResGetMappingSize@16 | |
| LdrpResGetRCConfig@20 ; removed in Windows 7 | |
| LdrpResGetResourceDirectory@20 | |
| NtRenameTransactionManager@8 | |
| NtReplacePartitionUnit@12 | |
| NtdllDefWindowProc_A@16 ; same as user32.DefWindowProcA | |
| NtdllDefWindowProc_W@16 ; same as user32.DefWindowProcW | |
| NtdllDialogWndProc_A@16 ; same as user32.DefDlgProcA | |
| NtdllDialogWndProc_W@16 ; same as user32.DefDlgProcW | |
| RtlDeregisterSecureMemoryCacheCallback@4 | |
| RtlInitializeExceptionChain@4 | |
| RtlNumberOfSetBitsUlongPtr@4 | |
| RtlpCheckDynamicTimeZoneInformation@8 | |
| ZwRenameTransactionManager@8 | |
| ZwReplacePartitionUnit@12 | |
| ; This is list of symbols added in Windows Vista SP2 | |
| RtlpInterlockedPopEntrySeqSListEnd@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7 | |
| RtlpInterlockedPopEntrySeqSListFault@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7 | |
| RtlpInterlockedPopEntrySeqSListResume@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7 | |
| ; This is list of symbols added in Windows 7 | |
| AlpcRundownCompletionList@4 | |
| EtwEventWriteEx@40 | |
| EtwEventWriteNoRegistration@16 | |
| EvtIntReportAuthzEventAndSourceAsync@44 | |
| EvtIntReportEventAndSourceAsync@44 | |
| LdrGetDllHandleByMapping@8 | |
| LdrGetDllHandleByName@12 | |
| LdrResGetRCConfig@20 | |
| LdrRscIsTypeExist@16 | |
| LdrWx86FormatVirtualImage@12 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| NtAllocateReserveObject@12 | |
| NtCreateProfileEx@40 | |
| NtDisableLastKnownGood@0 | |
| NtDrawText@4 | |
| NtEnableLastKnownGood@0 | |
| NtNotifyChangeSession@32 | |
| NtOpenKeyEx@16 | |
| NtOpenKeyTransactedEx@20 | |
| NtQuerySecurityAttributesToken@24 | |
| NtQuerySystemInformationEx@24 | |
| NtQueueApcThreadEx@24 | |
| NtSerializeBoot@0 | |
| NtSetIoCompletionEx@24 | |
| NtSetTimerEx@16 | |
| NtUmsThreadYield@4 | |
| NtWow64GetCurrentProcessorNumberEx@4 ; available only in 32-bit WoW64 version on 64-bit system | |
| NtWow64InterlockedPopEntrySList@4 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 8 | |
| RtlAcquireReleaseSRWLockExclusive@4 | |
| RtlAddIntegrityLabelToBoundaryDescriptor@8 | |
| RtlContractHashTable@4 | |
| RtlCopyExtendedContext@12 | |
| RtlCreateHashTable@12 | |
| RtlCreateProcessReflection@24 | |
| RtlCreateVirtualAccountSid@16 | |
| RtlDeleteHashTable@4 | |
| RtlDetectHeapLeaks@0 | |
| RtlDisableThreadProfiling@4 | |
| RtlEnableThreadProfiling@20 | |
| RtlEndEnumerationHashTable@8 | |
| RtlEndWeakEnumerationHashTable@8 | |
| RtlEnumerateEntryHashTable@8 | |
| RtlEthernetAddressToStringA@8 | |
| RtlEthernetAddressToStringW@8 | |
| RtlEthernetStringToAddressA@12 | |
| RtlEthernetStringToAddressW@12 | |
| RtlExpandHashTable@4 | |
| RtlFillMemoryUlonglong@16 | |
| RtlGetCurrentProcessorNumberEx@4 | |
| RtlGetEnabledExtendedFeatures@8 | |
| RtlGetExtendedContextLength@8 | |
| RtlGetExtendedFeaturesMask@4 | |
| RtlGetFullPathName_UEx@20 | |
| RtlGetLocaleFileMappingAddress@12 | |
| RtlGetNextEntryHashTable@8 | |
| RtlGetProcessPreferredUILanguages@16 | |
| RtlInitEnumerationHashTable@8 | |
| RtlInitWeakEnumerationHashTable@8 | |
| RtlInitializeExtendedContext@12 | |
| RtlInsertEntryHashTable@16 | |
| RtlInterlockedClearBitRun@12 | |
| RtlInterlockedSetBitRun@12 | |
| RtlIsNameInExpression@16 | |
| RtlKnownExceptionFilter@4 | |
| RtlLoadString@32 | |
| RtlLocateExtendedFeature@12 | |
| RtlLocateLegacyContext@8 | |
| RtlLookupEntryHashTable@12 | |
| RtlQueryPerformanceCounter@4 | |
| RtlQueryPerformanceFrequency@4 | |
| RtlQueryThreadProfiling@8 | |
| RtlReadThreadProfilingData@12 | |
| RtlRemoveEntryHashTable@12 | |
| RtlReplaceSidInSd@16 | |
| RtlReportSilentProcessExit@8 | |
| RtlReportSqmEscalation@24 | |
| RtlSetExtendedFeaturesMask@12 | |
| RtlSetProcessPreferredUILanguages@12 | |
| RtlSetUserCallbackExceptionFilter@4 ; available only in 32-bit WoW64 version on 64-bit system | |
| RtlTryAcquireSRWLockExclusive@4 | |
| RtlTryAcquireSRWLockShared@4 | |
| RtlUTF8ToUnicodeN@20 | |
| RtlUnicodeToUTF8N@20 | |
| RtlWeaklyEnumerateEntryHashTable@8 | |
| SbExecuteProcedure@20 | |
| SbSelectProcedure@16 | |
| TpAllocAlpcCompletionEx@20 | |
| TpAlpcRegisterCompletionList@4 | |
| TpAlpcUnregisterCompletionList@4 | |
| TpCallbackIndependent@4 | |
| TpDbgGetFreeInfo@8 ; removed in Windows 8 | |
| TpDisablePoolCallbackChecks@4 | |
| TpPoolFreeUnusedNodes@4 ; removed in Windows 8 | |
| TpQueryPoolStackInformation@8 | |
| TpSetDefaultPoolMaxThreads@4 | |
| TpSetDefaultPoolStackInformation@4 | |
| TpSetPoolStackInformation@8 | |
| WinSqmAddToAverageDWORD@12 | |
| WinSqmAddToStreamEx@20 | |
| WinSqmCheckEscalationAddToStreamEx@20 | |
| WinSqmCheckEscalationSetDWORD64@20 | |
| WinSqmCheckEscalationSetDWORD@16 | |
| WinSqmCheckEscalationSetString@16 | |
| WinSqmCommonDatapointDelete@4 | |
| WinSqmCommonDatapointSetDWORD64@16 | |
| WinSqmCommonDatapointSetDWORD@12 | |
| WinSqmCommonDatapointSetStreamEx@20 | |
| WinSqmCommonDatapointSetString@12 | |
| WinSqmGetEscalationRuleStatus@8 | |
| WinSqmGetInstrumentationProperty@16 | |
| WinSqmIncrementDWORD@12 | |
| WinSqmIsOptedInEx@4 | |
| WinSqmSetDWORD64@16 | |
| WinSqmSetDWORD@12 | |
| WinSqmSetEscalationInfo@16 | |
| WinSqmSetIfMaxDWORD@12 | |
| WinSqmSetIfMinDWORD@12 | |
| ZwAllocateReserveObject@12 | |
| ZwCreateProfileEx@40 | |
| ZwDisableLastKnownGood@0 | |
| ZwDrawText@4 | |
| ZwEnableLastKnownGood@0 | |
| ZwNotifyChangeSession@32 | |
| ZwOpenKeyEx@16 | |
| ZwOpenKeyTransactedEx@20 | |
| ZwQuerySecurityAttributesToken@24 | |
| ZwQuerySystemInformationEx@24 | |
| ZwQueueApcThreadEx@24 | |
| ZwSerializeBoot@0 | |
| ZwSetIoCompletionEx@24 | |
| ZwSetTimerEx@16 | |
| ZwUmsThreadYield@4 | |
| ZwWow64GetCurrentProcessorNumberEx@4 ; available only in 32-bit WoW64 version on 64-bit system | |
| ZwWow64InterlockedPopEntrySList@4 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 (Threshold / 1507) | |
| ; This is list of ordinal-only symbols added in Windows 7 | |
| ; Symbol names are taken from: | |
| ; https://www.geoffchappell.com/studies/windows/win32/ntdll/history/ords61.htm | |
| ; AitLogFeatureUsageByApp@4 @1 NONAME ; removed in Windows 10 (Threshold / 1507) | |
| ; AitFireParentUsageEvent@16 @2 NONAME ; removed in Windows 10 (Threshold / 1507) | |
| ; SbtLogSystemUsageByParent@32 @3 NONAME ; removed in Windows 10 (Threshold / 1507) | |
| ; SbtLogSystemUsageByStack@28 @4 NONAME ; FIXME: Windows 7 has ABI @28, Windows 8 and 8.1 has ABI @20, removed in Windows 10 (Threshold / 1507) | |
| ; SbtDisableForCurrentProcess@0 @5 NONAME ; removed in Windows 10 (Threshold / 1507) | |
| ; SbtLogDllMapping@8 @6 NONAME ; FIXME: Windows 7 has ABI @8, Windows 8 and 8.1 has ABI @0, removed in Windows 10 (Threshold / 1507) | |
| ; SbtLogExeInitializing@0 @7 NONAME ; removed in Windows 10 (Threshold / 1507) | |
| ; RtlDispatchAPC@12 @8 NONAME ; since Windows 10 Creators Update (Redstone 2 / 1703) available as normal symbol | |
| ; This is list of symbols added in Windows 7 SP1 | |
| RtlCopyContext@12 | |
| ; This is list of symbols added in Windows 8 | |
| ApiSetQueryApiSetPresence@8 | |
| EtwEventSetInformation@20 | |
| LdrAddDllDirectory@8 | |
| LdrAppxHandleIntegrityFailure@4 | |
| LdrGetDllDirectory@4 | |
| LdrGetDllFullName@8 | |
| LdrGetDllPath@16 | |
| LdrGetProcedureAddressForCaller@24 | |
| LdrProcessRelocationBlockEx@20 | |
| LdrQueryOptionalDelayLoadedAPI@16 | |
| LdrRemoveDllDirectory@4 | |
| LdrResolveDelayLoadedAPI@24 | |
| LdrResolveDelayLoadsFromDll@12 | |
| LdrSetDefaultDllDirectories@4 | |
| LdrSetDllDirectory@4 | |
| LdrStandardizeSystemPath@4 | |
| LdrSystemDllInitBlock DATA | |
| NtAddAtomEx@16 | |
| NtAdjustTokenClaimsAndDeviceGroups@64 | |
| NtAlertThreadByThreadId@4 | |
| NtAlpcConnectPortEx@44 | |
| NtAssociateWaitCompletionPacket@32 | |
| NtCancelWaitCompletionPacket@8 | |
| NtCreateDirectoryObjectEx@20 | |
| NtCreateIRTimer@12 ; Windows 8-10 has ABI "NtCreateIRTimer@8", Windows 10 Creators Update (Redstone 2 / 1703) and new has ABI "NtCreateIRTimer@12" | |
| NtCreateLowBoxToken@36 | |
| NtCreateTokenEx@68 | |
| NtCreateWaitCompletionPacket@12 | |
| NtCreateWnfStateName@28 | |
| NtDeleteWnfStateData@8 | |
| NtDeleteWnfStateName@4 | |
| NtFilterBootOption@20 | |
| NtFilterTokenEx@56 | |
| NtFlushBuffersFileEx@20 | |
| NtGetCachedSigningLevel@24 | |
| NtQueryWnfStateData@24 | |
| NtQueryWnfStateNameInformation@20 | |
| NtSetCachedSigningLevel@20 | |
| NtSetIRTimer@8 | |
| NtSetInformationVirtualMemory@24 | |
| NtSubscribeWnfStateChange@16 | |
| NtUnmapViewOfSectionEx@12 | |
| NtUnsubscribeWnfStateChange@4 | |
| NtUpdateWnfStateData@28 | |
| NtWaitForAlertByThreadId@8 | |
| ; NtWaitForWnfNotifications@8 ; removed in Windows 8.1 | |
| ; NtWow64AllocateVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system | |
| RtlAddResourceAttributeAce@28 | |
| RtlAddScopedPolicyIDAce@20 | |
| RtlAllocateWnfSerializationGroup@0 | |
| RtlAppxIsFileOwnedByTrustedInstaller@8 | |
| RtlAvlInsertNodeEx@16 | |
| RtlAvlRemoveNode@8 | |
| RtlCanonicalizeDomainName@12 | |
| RtlCheckPortableOperatingSystem@4 | |
| RtlCheckTokenCapability@12 | |
| RtlCheckTokenMembership@12 | |
| RtlCheckTokenMembershipEx@16 | |
| RtlClearBit@8 | |
| RtlCopyBitMap@12 | |
| RtlCrc32@12 | |
| RtlCrc64@16 | |
| RtlCreateHashTableEx@16 | |
| RtlDecompressBufferEx@28 | |
| RtlDeleteElementGenericTableAvlEx@8 | |
| RtlEqualWnfChangeStamps@8 | |
| RtlExtractBitMap@16 | |
| RtlFlushHeaps@0 | |
| RtlGetAppContainerNamedObjectPath@16 | |
| RtlGetExePath@8 | |
| RtlGetSearchPath@4 | |
| RtlGetSystemTimePrecise@0 | |
| RtlInterlockedPushListSListEx@16 | |
| RtlIsCapabilitySid@4 | |
| RtlIsPackageSid@4 | |
| RtlIsUntrustedObject@12 | |
| RtlLengthSidAsUnicodeString@8 | |
| RtlNumberOfClearBitsInRange@12 | |
| RtlNumberOfSetBitsInRange@12 | |
| RtlPublishWnfStateData@24 | |
| RtlQueryPackageIdentity@24 | |
| RtlQueryRegistryValuesEx@20 | |
| RtlQueryUnbiasedInterruptTime@4 | |
| RtlQueryValidationRunlevel@4 | |
| RtlQueryWnfMetaNotification@20 | |
| RtlQueryWnfStateData@24 | |
| RtlQueryWnfStateDataWithExplicitScope@28 | |
| RtlRbInsertNodeEx@16 | |
| RtlRbRemoveNode@8 | |
| RtlRegisterForWnfMetaNotification@24 | |
| RtlReleasePath@4 | |
| RtlResetNtUserPfn@0 | |
| RtlSetBit@8 | |
| RtlSetPortableOperatingSystem@4 | |
| RtlSetSearchPathMode@4 | |
| RtlSubscribeWnfStateChangeNotification@36 | |
| RtlTestAndPublishWnfStateData@28 | |
| RtlTryConvertSRWLockSharedToExclusiveOrRelease@4 | |
| RtlUnsubscribeWnfNotificationWaitForCompletion@4 | |
| RtlUnsubscribeWnfNotificationWithCompletionCallback@12 | |
| RtlUnsubscribeWnfStateChangeNotification@4 | |
| RtlWaitForWnfMetaNotification@24 | |
| RtlWaitOnAddress@16 | |
| RtlWakeAddressAll@4 | |
| RtlWakeAddressAllNoFence@4 | |
| RtlWakeAddressSingle@4 | |
| RtlWakeAddressSingleNoFence@4 | |
| RtlWnfCompareChangeStamp@8 ; removed in Windows 11 2024 Update (Hudson Valley / 24H2) | |
| RtlWnfDllUnloadCallback@4 | |
| RtlpConvertAbsoluteToRelativeSecurityAttribute@12 | |
| RtlpConvertRelativeToAbsoluteSecurityAttribute@16 | |
| RtlpFreezeTimeBias DATA | |
| RtlpMergeSecurityAttributeInformation@16 | |
| ; RtlpWnfNotificationThread@16 ; removed in Windows 8.1 | |
| TpAllocJobNotification@20 | |
| TpCallbackDetectedUnrecoverableError@4 | |
| TpReleaseJobNotification@4 | |
| TpSetPoolThreadBasePriority@8 | |
| TpSetTimerEx@16 | |
| TpSetWaitEx@16 | |
| TpTimerOutstandingCallbackCount@4 | |
| TpWaitForJobNotification@4 | |
| WinSqmIsSessionDisabled@4 | |
| ZwAddAtomEx@16 | |
| ZwAdjustTokenClaimsAndDeviceGroups@64 | |
| ZwAlertThreadByThreadId@4 | |
| ZwAlpcConnectPortEx@44 | |
| ZwAssociateWaitCompletionPacket@32 | |
| ZwCancelWaitCompletionPacket@8 | |
| ZwCreateDirectoryObjectEx@20 | |
| ZwCreateIRTimer@12 ; Windows 8-10 has ABI "ZwCreateIRTimer@8", Windows 10 Creators Update (Redstone 2 / 1703) and new has ABI "ZwCreateIRTimer@12" | |
| ZwCreateLowBoxToken@36 | |
| ZwCreateTokenEx@68 | |
| ZwCreateWaitCompletionPacket@12 | |
| ZwCreateWnfStateName@28 | |
| ZwDeleteWnfStateData@8 | |
| ZwDeleteWnfStateName@4 | |
| ZwFilterBootOption@20 | |
| ZwFilterTokenEx@56 | |
| ZwFlushBuffersFileEx@20 | |
| ZwGetCachedSigningLevel@24 | |
| ZwQueryWnfStateData@24 | |
| ZwQueryWnfStateNameInformation@20 | |
| ZwSetCachedSigningLevel@20 | |
| ZwSetIRTimer@8 | |
| ZwSetInformationVirtualMemory@24 | |
| ZwSubscribeWnfStateChange@16 | |
| ZwUnmapViewOfSectionEx@12 | |
| ZwUnsubscribeWnfStateChange@4 | |
| ZwUpdateWnfStateData@28 | |
| ZwWaitForAlertByThreadId@8 | |
| ; ZwWaitForWnfNotifications@8 ; removed in Windows 8.1 | |
| ; ZwWow64AllocateVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system | |
| ; This is list of symbols added in Windows 8.1 | |
| LdrSetImplicitPathOptions@8 | |
| NtCancelTimer2@8 | |
| NtCreateTimer2@20 | |
| NtGetCompleteWnfStateSubscription@24 | |
| NtSetTimer2@16 | |
| NtSetWnfProcessNotificationEvent@4 | |
| PssNtCaptureSnapshot@16 | |
| PssNtDuplicateSnapshot@20 | |
| PssNtFreeRemoteSnapshot@8 | |
| PssNtFreeSnapshot@4 | |
| PssNtFreeWalkMarker@4 | |
| PssNtQuerySnapshot@16 | |
| PssNtValidateDescriptor@8 | |
| PssNtWalkSnapshot@20 | |
| RtlAddProcessTrustLabelAce@24 | |
| RtlAllocateAndInitializeSidEx@16 | |
| RtlGetAppContainerParent@8 | |
| RtlGetAppContainerSidType@8 | |
| RtlIsParentOfChildAppContainer@8 | |
| RtlIsValidProcessTrustLabelSid@4 | |
| RtlQueryPackageIdentityEx@28 | |
| RtlSidDominatesForTrust@12 | |
| RtlStringFromGUIDEx@12 | |
| RtlTestProtectedAccess@8 | |
| RtlValidProcessProtection@4 | |
| TpCallbackSendAlpcMessageOnCompletion@16 | |
| TpCallbackSendPendingAlpcMessage@4 | |
| WinSqmStartSessionForPartner@16 | |
| ZwCancelTimer2@8 | |
| ZwCreateTimer2@20 | |
| ZwGetCompleteWnfStateSubscription@24 | |
| ZwSetTimer2@16 | |
| ZwSetWnfProcessNotificationEvent@4 | |
| ; This is list of symbols added in Windows 10 (Threshold / 1507) | |
| DbgUiConvertStateChangeStructureEx@8 | |
| LdrFastFailInLoaderCallout@0 | |
| NtAlpcImpersonateClientContainerOfPort@12 | |
| NtCompareObjects@8 | |
| NtCreatePartition@16 ; Windows 10 has ABI "NtCreatePartition@20", Windows 10 November Update (Threshold 2 / 1511) and new has ABI "NtCreatePartition@16" | |
| NtGetCurrentProcessorNumberEx@4 | |
| NtManagePartition@20 | |
| NtOpenPartition@12 | |
| NtRevertContainerImpersonation@0 | |
| NtSetInformationSymbolicLink@16 | |
| ; NtWow64IsProcessorFeaturePresent@4 ; available only in 32-bit WoW64 version on 64-bit system | |
| RtlCapabilityCheck@12 | |
| RtlCheckSandboxedToken@8 | |
| RtlConvertDeviceFamilyInfoToString@16 | |
| RtlConvertSRWLockExclusiveToShared@4 | |
| RtlDecodeRemotePointer@12 | |
| RtlDeriveCapabilitySidsFromName@12 | |
| RtlEncodeRemotePointer@12 | |
| RtlEndStrongEnumerationHashTable@8 | |
| RtlFindUnicodeSubstring@12 | |
| RtlGetDeviceFamilyInfoEnum@12 | |
| RtlGetInterruptTimePrecise@4 | |
| RtlInitStringEx@8 | |
| RtlInitStrongEnumerationHashTable@8 | |
| RtlInitializeSidEx@0 | |
| RtlIsMultiSessionSku@0 | |
| RtlIsProcessorFeaturePresent@4 | |
| RtlOsDeploymentState@4 | |
| RtlQueryPackageClaims@32 ; Windows 10 has ABI "RtlQueryPackageClaims@28", Windows 10 Anniversary Update (Redstone / 1607) and new has ABI "RtlQueryPackageClaims@32" | |
| RtlQueryProtectedPolicy@8 | |
| RtlQueryResourcePolicy@16 | |
| RtlSetProtectedPolicy@12 | |
| RtlSetThreadSubProcessTag@4 | |
| RtlStronglyEnumerateEntryHashTable@8 | |
| RtlSwitchedVVI@16 | |
| RtlpGetDeviceFamilyInfoEnum@12 | |
| TpSetPoolMaxThreadsSoftLimit@8 | |
| TpSetPoolWorkerThreadIdleTimeout@12 | |
| TpTrimPools@0 | |
| WinSqmStartSqmOptinListener@0 | |
| ZwAlpcImpersonateClientContainerOfPort@12 | |
| ZwCompareObjects@8 | |
| ZwCreatePartition@16 ; Windows 10 has ABI "ZwCreatePartition@20", Windows 10 November Update (Threshold 2 / 1511) and new has ABI "ZwCreatePartition@16" | |
| ZwGetCurrentProcessorNumberEx@4 | |
| ZwManagePartition@20 | |
| ZwOpenPartition@12 | |
| ZwRevertContainerImpersonation@0 | |
| ZwSetInformationSymbolicLink@16 | |
| ; ZwWow64IsProcessorFeaturePresent@4 ; available only in 32-bit WoW64 version on 64-bit system | |
| ; This is list of symbols added in Windows 10 November Update (Threshold 2 / 1511) | |
| NtCreateEnclave@36 | |
| NtInitializeEnclave@20 | |
| NtLoadEnclaveData@36 | |
| RtlGetCurrentServiceSessionId@0 | |
| RtlWow64GetCurrentMachine@0 | |
| ZwCreateEnclave@36 | |
| ZwInitializeEnclave@20 | |
| ZwLoadEnclaveData@36 | |
| ; This is list of symbols added in Windows 10 Anniversary Update (Redstone / 1607) | |
| NtCommitRegistryTransaction@8 | |
| NtCreateRegistryTransaction@16 | |
| NtOpenRegistryTransaction@12 | |
| NtQuerySecurityPolicy@24 | |
| NtRollbackRegistryTransaction@8 | |
| NtSetCachedSigningLevel2@24 | |
| RtlAreLongPathsEnabled@0 | |
| RtlCheckBootStatusIntegrity@8 | |
| RtlClearThreadWorkOnBehalfTicket@0 | |
| RtlFindExportedRoutineByName@8 | |
| RtlGetActiveConsoleId@0 | |
| RtlGetConsoleSessionForegroundProcessId@0 | |
| RtlGetSuiteMask@0 | |
| RtlGetThreadWorkOnBehalfTicket@8 | |
| RtlGuardCheckLongJumpTarget@12 | |
| ; RtlIsLongPathAwareProcessByManifest@0 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| RtlIsMultiUsersInSessionSku@0 | |
| RtlLocateExtendedFeature2@16 | |
| RtlReplaceSystemDirectoryInPath@16 | |
| RtlReportExceptionEx@20 | |
| RtlRestoreBootStatusDefaults@4 | |
| RtlSetThreadWorkOnBehalfTicket@4 | |
| ; RtlSparseBitmapCtxAreAllClear@20 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxAreAllSet@20 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxCheckBit@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxCleanup@4 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxClearBits@24 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxClearBitsEx@32 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxCountBitsSet@4 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxFindNextBitSet@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxFindSetRuns@36 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxInitialize@4 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxMetadataForBit@16 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxOrBitmap@8 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxPrepareBits@20 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxSetBits@24 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxSetBitsEx@32 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxStart@8 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapCtxSubtractBitmap@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| ; RtlSparseBitmapEnumerateBitmap@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) | |
| RtlWow64GetProcessMachines@12 | |
| RtlWow64IsWowGuestMachineSupported@8 | |
| ; Wow64Transition DATA ; available only in 32-bit WoW64 version on 64-bit system | |
| ZwCommitRegistryTransaction@8 | |
| ZwCreateRegistryTransaction@16 | |
| ZwOpenRegistryTransaction@12 | |
| ZwQuerySecurityPolicy@24 | |
| ZwRollbackRegistryTransaction@8 | |
| ZwSetCachedSigningLevel2@24 | |
| ; This is list of symbols added in Windows 10 Creators Update (Redstone 2 / 1703) | |
| LdrParentInterlockedPopEntrySList DATA | |
| LdrParentRtlInitializeNtUserPfn DATA | |
| LdrParentRtlResetNtUserPfn DATA | |
| LdrParentRtlRetrieveNtUserPfn DATA | |
| LdrUpdatePackageSearchPath@4 | |
| LdrpChildNtdll DATA | |
| NtAcquireProcessActivityReference@12 | |
| NtCompareSigningLevels@8 | |
| ; NtContinueCHPE@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709) | |
| NtConvertBetweenAuxiliaryCounterAndPerformanceCounter@16 | |
| ; NtLoadHotPatch@8 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809) | |
| NtQueryAuxiliaryCounterFrequency@4 | |
| NtQueryInformationByName@20 | |
| RtlAddAccessFilterAce@32 | |
| RtlCreateUserProcessEx@20 | |
| RtlDispatchAPC@12 ; before Windows 10 Creators Update (Redstone 2 / 1703) available as ordinal-only symbol | |
| RtlGetNtSystemRoot@0 | |
| RtlGetSessionProperties@8 | |
| RtlGetTokenNamedObjectPath@12 | |
| RtlIsElevatedRid@4 | |
| RtlIsNonEmptyDirectoryReparsePointAllowed@4 | |
| ; RtlIsPlaceholderFileHandle@8 ; removed in Windows 10 Fall Creators Update (Redstone 3 / 1709) | |
| ; RtlIsPlaceholderFileInfo@12 ; removed in Windows 10 Fall Creators Update (Redstone 3 / 1709) | |
| RtlLookupFirstMatchingElementGenericTableAvl@12 | |
| ; RtlLookupFunctionEntryCHPE@12 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709) | |
| ; RtlUnwindEx@24 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709) | |
| WerReportExceptionWorker@4 | |
| ZwAcquireProcessActivityReference@12 | |
| ZwCompareSigningLevels@8 | |
| ; ZwContinueCHPE@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709) | |
| ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter@16 | |
| ; ZwLoadHotPatch@8 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809) | |
| ZwQueryAuxiliaryCounterFrequency@4 | |
| ZwQueryInformationByName@20 | |
| ; This is list of symbols added in Windows 10 Fall Creators Update (Redstone 3 / 1709) | |
| EtwCheckCoverage@4 | |
| LdrCallEnclave@12 | |
| LdrControlFlowGuardEnforced@0 | |
| LdrCreateEnclave@36 | |
| LdrDeleteEnclave@4 | |
| LdrInitializeEnclave@20 | |
| LdrLoadEnclaveModule@12 | |
| NtCallEnclave@16 | |
| NtNotifyChangeDirectoryFileEx@40 | |
| NtQueryDirectoryFileEx@40 | |
| NtTerminateEnclave@8 | |
| RtlCapabilityCheckForSingleSessionSku@12 | |
| RtlCheckSystemBootStatusIntegrity@4 | |
| RtlDosLongPathNameToNtPathName_U_WithStatus@16 | |
| RtlDosLongPathNameToRelativeNtPathName_U_WithStatus@16 | |
| RtlExtendCorrelationVector@4 | |
| RtlGetSystemBootStatus@16 | |
| RtlGetSystemBootStatusEx@12 | |
| RtlIncrementCorrelationVector@4 | |
| RtlInitializeCorrelationVector@12 | |
| RtlIsCloudFilesPlaceholder@8 | |
| RtlIsCurrentProcess@4 | |
| RtlIsCurrentThread@4 | |
| RtlIsPartialPlaceholder@8 | |
| RtlIsPartialPlaceholderFileHandle@8 | |
| RtlIsPartialPlaceholderFileInfo@12 | |
| RtlIsStateSeparationEnabled@0 | |
| RtlQueryImageMitigationPolicy@20 | |
| RtlQueryThreadPlaceholderCompatibilityMode@0 | |
| RtlRestoreSystemBootStatusDefaults@0 | |
| RtlSetImageMitigationPolicy@20 | |
| RtlSetProxiedProcessId@4 | |
| RtlSetSystemBootStatus@16 | |
| RtlSetSystemBootStatusEx@12 | |
| RtlSetThreadPlaceholderCompatibilityMode@4 | |
| RtlValidateCorrelationVector@4 | |
| RtlWow64GetEquivalentMachineCHPE@4 | |
| RtlWow64GetSharedInfoProcess@12 | |
| ; RtlWow64PopAllCrossProcessWork@4 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809) | |
| ; RtlWow64PopCrossProcessWork@4 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809) | |
| ; RtlWow64PushCrossProcessWork@8 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809) | |
| ZwCallEnclave@16 | |
| ZwNotifyChangeDirectoryFileEx@40 | |
| ZwQueryDirectoryFileEx@40 | |
| ZwTerminateEnclave@8 | |
| ; This is list of symbols added in Windows 10 April 2018 Update (Redstone 4 / 1803) | |
| NtAllocateVirtualMemoryEx@28 | |
| NtMapViewOfSectionEx@36 | |
| RtlGetPersistedStateLocation@28 | |
| RtlIsNameInUnUpcasedExpression@16 | |
| RtlQueryProcessPlaceholderCompatibilityMode@0 | |
| RtlQueryRegistryValueWithFallback@28 | |
| RtlQueryTokenHostIdAsUlong64@8 | |
| RtlRaiseCustomSystemEventTrigger@4 | |
| RtlSetProcessPlaceholderCompatibilityMode@4 | |
| ZwAllocateVirtualMemoryEx@28 | |
| ZwMapViewOfSectionEx@36 | |
| ; This is list of symbols added in Windows 10 October 2018 Update (Redstone 5 / 1809) | |
| ApiSetQueryApiSetPresenceEx@12 | |
| LdrIsModuleSxsRedirected@4 | |
| NtCreateSectionEx@36 | |
| NtManageHotPatch@16 | |
| RtlCreateProcessParametersWithTemplate@12 | |
| RtlGetExtendedContextLength2@16 | |
| RtlGetMultiTimePrecise@12 | |
| RtlInitializeExtendedContext2@20 | |
| ; RtlUserFiberStart@0 | |
| RtlpTimeFieldsToTime@12 | |
| RtlpTimeToTimeFields@12 | |
| ZwCreateSectionEx@36 | |
| ZwManageHotPatch@16 | |
| ; This is list of symbols added in Windows 10 May 2019 Update (19H1 / 1903) | |
| NtCreateCrossVmEvent@24 | |
| RtlConstructCrossVmEventPath@12 | |
| RtlDoesNameContainWildCards@4 | |
| RtlFlsGetValue@8 | |
| RtlFlsSetValue@8 | |
| RtlUdiv128@28 | |
| TpSetPoolThreadCpuSets@12 | |
| ZwCreateCrossVmEvent@24 | |
| ; In Windows 10 November 2019 Update (19H2 /1909) was not added any new symbol | |
| ; This is list of symbols added in Windows 10 May 2020 Update (20H1 / 2004) | |
| NtAcquireCrossVmMutant@8 | |
| NtAllocateUserPhysicalPagesEx@20 | |
| NtContinueEx@8 | |
| NtCreateCrossVmMutant@24 | |
| NtDirectGraphicsCall@20 | |
| NtLoadKey3@32 | |
| NtPssCaptureVaSpaceBulk@20 | |
| RtlConstructCrossVmMutexPath@12 | |
| ; RtlDisownModuleHeapAllocation@8 | |
| RtlFreeUTF8String@4 | |
| RtlGetReturnAddressHijackTarget@0 | |
| RtlInitUTF8String@8 | |
| RtlInitUTF8StringEx@8 | |
| RtlIsZeroMemory@8 | |
| RtlNormalizeSecurityDescriptor@20 | |
| RtlNotifyFeatureUsage@4 | |
| RtlQueryAllFeatureConfigurations@16 | |
| RtlQueryFeatureConfiguration@16 | |
| RtlQueryFeatureConfigurationChangeStamp@0 | |
| RtlQueryFeatureUsageNotificationSubscriptions@8 | |
| RtlRegisterFeatureConfigurationChangeNotification@16 | |
| RtlRestoreThreadPreferredUILanguages@4 | |
| RtlSetFeatureConfigurations@16 | |
| RtlSetThreadPreferredUILanguages2@16 | |
| RtlSubscribeForFeatureUsageNotification@8 | |
| RtlUTF8StringToUnicodeString@12 | |
| RtlUnicodeStringToUTF8String@12 | |
| RtlUnregisterFeatureConfigurationChangeNotification@4 | |
| RtlUnsubscribeFromFeatureUsageNotifications@8 | |
| ZwAcquireCrossVmMutant@8 | |
| ZwAllocateUserPhysicalPagesEx@20 | |
| ZwContinueEx@8 | |
| ZwCreateCrossVmMutant@24 | |
| ZwDirectGraphicsCall@20 | |
| ZwLoadKey3@32 | |
| ZwPssCaptureVaSpaceBulk@20 | |
| ; In Windows 10 October 2020 Update (20H2) was not added any new symbol | |
| ; In Windows 10 May 2021 Update (21H1) was not added any new symbol | |
| ; This is list of symbols added in Windows 10 November 2021 Update (21H2) | |
| RtlGetSystemTimeAndBias@12 | |
| ; In Windows 10 2022 Update (22H2) was not added any new symbol | |
| ; This is list of symbols added in Windows 11 (Sun Valley / 21H2) (WoW64 version) | |
| ; LdrHotPatchNotify@4 | |
| ; MicrosoftTelemetryAssertTriggeredUM@4 | |
| NtChangeProcessState@24 | |
| NtChangeThreadState@24 | |
| NtCreateIoRing@20 | |
| NtCreateProcessStateChange@20 | |
| NtCreateThreadStateChange@20 | |
| NtQueryIoRingCapabilities@8 | |
| NtQueueApcThreadEx2@28 | |
| NtReadVirtualMemoryEx@24 | |
| NtSetInformationIoRing@16 | |
| NtSubmitIoRing@16 | |
| RtlCompareExchangePointerMapping@16 | |
| RtlCompareExchangePropertyStore@16 | |
| ; RtlConvertHostPerfCounterToPerfCounter@20 | |
| RtlDelayExecution@8 | |
| RtlGetImageFileMachines@8 | |
| RtlGetSystemGlobalData@12 | |
| RtlIsApiSetImplemented@4 | |
| RtlIsEnclaveFeaturePresent@4 | |
| RtlQueryPointerMapping@8 | |
| RtlQueryPropertyStore@8 | |
| RtlRemovePointerMapping@8 | |
| RtlRemovePropertyStore@8 | |
| RtlRestoreContext ; cdecl | |
| ZwChangeProcessState@24 | |
| ZwChangeThreadState@24 | |
| ZwCreateIoRing@20 | |
| ZwCreateProcessStateChange@20 | |
| ZwCreateThreadStateChange@20 | |
| ZwQueryIoRingCapabilities@8 | |
| ZwQueueApcThreadEx2@28 | |
| ZwReadVirtualMemoryEx@24 | |
| ZwSetInformationIoRing@16 | |
| ZwSubmitIoRing@16 | |
| ; This is list of symbols added in Windows 11 2022 Update (Sun Valley 2 / 22H2) (WoW64 version) | |
| ; NtCopyFileChunk@40 | |
| ; NtCreateCpuPartition@20 ; Windows 10 has ABI "NtCreateCpuPartition@12", Windows 11 2024 Update (Hudson Valley / 24H2) and new has ABI "NtCreateCpuPartition@20" | |
| ; NtOpenCpuPartition@12 | |
| ; NtQueryInformationCpuPartition@20 | |
| ; NtSetInformationCpuPartition@28 | |
| ; RtlOverwriteFeatureConfigurationBuffer@16 | |
| ; TpWorkOnBehalfClearTicket@4 | |
| ; TpWorkOnBehalfSetTicket@8 | |
| ; ZwCopyFileChunk@40 | |
| ; ZwCreateCpuPartition@20 ; Windows 10 has ABI "ZwCreateCpuPartition@12", Windows 11 2024 Update (Hudson Valley / 24H2) and new has ABI "ZwCreateCpuPartition@20" | |
| ; ZwOpenCpuPartition@12 | |
| ; ZwQueryInformationCpuPartition@20 | |
| ; ZwSetInformationCpuPartition@28 | |
| ; This is list of symbols added in Windows 11 2023 Update (Sun Valley 3 / 23H2) (WoW64 version) | |
| ; RtlIsFeatureEnabledForEnterprise@4 | |
| ; This is list of symbols added in Windows 11 2024 Update (Hudson Valley / 24H2) (WoW64 version) | |
| ; NtAlertMultipleThreadByThreadId@16 | |
| ; NtAlertThreadByThreadIdEx@8 | |
| ; NtSetEventEx@12 | |
| ; NtWow64GetCurrentProcessorNumber@0 | |
| ; RtlFlsAllocEx@12 | |
| ; RtlFlsGetValue2@4 | |
| ; RtlGetAcesBufferSize@8 | |
| ; RtlGetCurrentThreadPrimaryGroup@0 | |
| ; RtlGetFeatureToggleConfiguration@12 | |
| ; RtlGetFeatureTogglesChangeToken@0 | |
| ; RtlLogUnexpectedCodepath@4 | |
| ; RtlNotifyFeatureToggleUsage@12 | |
| ; RtlQueryAllInternalFeatureConfigurations@16 | |
| ; RtlRcuAllocate@4 | |
| ; RtlRcuFree@4 | |
| ; RtlRcuReadLock@0 | |
| ; RtlRcuReadUnlock@0 | |
| ; RtlRcuSynchronize@4 | |
| ; RtlTlsAlloc@4 | |
| ; RtlTlsFree@4 | |
| ; RtlTlsSetValue@8 | |
| ; RtlValidateUserCallTarget@8 | |
| ; RtlXRestore@12 | |
| ; RtlXSave@12 | |
| ; ZwAlertMultipleThreadByThreadId@16 | |
| ; ZwAlertThreadByThreadIdEx@8 | |
| ; ZwSetEventEx@12 | |
| ; ZwWow64GetCurrentProcessorNumber@0 | |
| ; This is list of symbols added in Windows 11 2025 Update (Hudson Valley 2 / 25H2) (WoW64 version) | |
| ; ApiSetGetImplementationHost@12 | |
| ; ApiSetQuerySchema@8 | |
| ; RtlQueryAllInternalRuntimeFeatureConfigurations@20 | |
| ; RtlQueryInternalFeatureConfiguration@16 |