| LIBRARY "NTDLL.dll" |
| EXPORTS |
| |
| ; This file is a comprehensive documentation for 32-bit x86 ntdll.dll symbols. |
| ; It covers all 3 platforms Win32s, Win9x and WinNT and contains information |
| ; from native ntdll.dll libraries on 32-bit Windows systems and also from |
| ; 32-bit WoW64 ntdll.dll libraries on 64-bit Windows systems. Symbols in this |
| ; file are ordered by increasing Windows version in which they were introduced. |
| ; First are Win32s versions, then followed by Win9x versions and then WinNT |
| ; because logically Win32s symbols are subset of Win9x symbols which is subset |
| ; of WinNT symbols. Comments contains additional information with exceptions. |
| |
| ; This is list of symbols available in all Windows versions (Win32s since Win32s 1.1; Win9x since Windows 95; WinNT since Windows NT 3.1) |
| DbgBreakPoint@0 |
| DbgPrint ; cdecl |
| DbgPrompt@12 |
| NtCurrentTeb@0 |
| NtQueryEaFile@36 |
| NtQueryPerformanceCounter@8 |
| NtSetEaFile@16 |
| RtlCreateHeap@24 |
| RtlEnlargedIntegerMultiply@8 |
| RtlExtendedIntegerMultiply@12 |
| RtlExtendedLargeIntegerDivide@16 |
| RtlImageDirectoryEntryToData@16 |
| RtlImageNtHeader@4 |
| RtlLargeIntegerSubtract@16 |
| RtlUnwind@16 |
| RtlValidateHeap@12 ; Win32s, Win9x and Windows NT 3.1 has ABI "RtlValidateHeap@4", Windows NT 3.5 and new has ABI "RtlValidateHeap@12" |
| |
| ; This is list of symbols available only in Win32s (not available in Win9x and WinNT) |
| ; RtlProcessHeap@0 |
| |
| ; This is list of symbols available in Win32s and Win9x but not in WinNT |
| ; RtlExFreeHeap@12 |
| ; RtlExReAllocateHeap@16 |
| ; RtlExSizeHeap@12 |
| |
| ; This is list of symbols added in Win32s 1.15 and available in all Win9x and WinNT versions |
| ; Note that Win32s 1.15 and all later versions merged advapi32.dll, gdi32.dll, |
| ; kernel32.dll, ntdll.dll, user32.dll (and Win32s 1.25a and later also mpr.dll) |
| ; libraries into one big w32scomb.dll library and made those libraries as alias |
| ; to w32scomb.dll, which effectively means that every symbol from every library |
| ; is available also from ntdll.dll (aliased to w32scomb.dll). Below are only |
| ; those Win32s symbols which are available in some Win9x or WinNT version of |
| ; ntdll.dll or logically belongs to ntdll.dll. |
| RtlAnsiStringToUnicodeString@12 |
| RtlDestroyHeap@4 |
| |
| ; This is list of symbols added in Win32s 1.15 and available only in Win32s (not available in Win9x and WinNT) |
| ; _RtlCopyMemory@12 |
| ; _RtlMultiByteToUnicodeN@20 ; WinNT has this symbol without leading underline |
| ; _RtlUnicodeToMultiByteN@20 ; WinNT has this symbol without leading underline |
| |
| ; This is list of symbols added in Win32s 1.15 and available in all Win9x version, but not in WinNT |
| ; RtlExAllocateHeap@12 |
| |
| ; This is list of symbols added in Win32s 1.15 and available in all WinNT version, but not in Win9x |
| NtCreateSection@28 |
| NtMapViewOfSection@40 |
| NtOpenDirectoryObject@12 |
| NtUnmapViewOfSection@8 |
| RtlInitAnsiString@8 |
| RtlInitUnicodeString@8 |
| RtlMoveMemory@12 |
| RtlZeroMemory@8 |
| |
| ; This is list of symbols added in Win32s 1.15a and available in all Win9x and WinNT versions |
| RtlUnicodeStringToAnsiString@12 |
| |
| ; This is list of symbols added in Win32s 1.15a and available in all WinNT version, but not in Win9x |
| RtlAnsiStringToUnicodeSize@4 |
| RtlInitString@8 |
| RtlIntegerToUnicodeString@12 |
| RtlUnicodeStringToAnsiSize@4 |
| RtlUnicodeStringToInteger@12 |
| |
| ; This is list of symbols added in Win32s 1.20 and available in all WinNT version, but not in Win9x |
| NtClose@4 |
| NtCreateSemaphore@20 ; Win32s has ABI "NtCreateSemaphore@36", WinNT has ABI "NtCreateSemaphore@20" |
| NtReleaseSemaphore@12 |
| NtWaitForSingleObject@12 |
| RtlCreateSecurityDescriptor@8 |
| RtlFillMemory@12 |
| RtlSetDaclSecurityDescriptor@16 |
| |
| ;; This is end of Win32s symbols ;; |
| |
| |
| ; This is list of symbols available in all Win9x and WinNT versions, but not available in Win32s |
| RtlAllocateHeap@12 ; Win9x has ABI "RtlAllocateHeap@8", WinNT has ABI "RtlAllocateHeap@12" |
| RtlConvertLongToLargeInteger@4 |
| RtlConvertUlongToLargeInteger@4 |
| RtlEnlargedUnsignedDivide@16 ; removed in Windows 8 |
| RtlEnlargedUnsignedMultiply@8 |
| RtlExtendedMagicDivide@20 |
| RtlFreeHeap@12 ; Win9x has ABI "RtlFreeHeap@8", WinNT has ABI "RtlFreeHeap@12" |
| RtlLargeIntegerAdd@16 |
| RtlLargeIntegerArithmeticShift@12 |
| RtlLargeIntegerDivide@20 |
| RtlLargeIntegerNegate@8 |
| RtlLargeIntegerShiftLeft@12 |
| RtlLargeIntegerShiftRight@12 |
| RtlMultiByteToUnicodeN@20 ; Win9x has ABI "RtlMultiByteToUnicodeN@16", WinNT has ABI "RtlMultiByteToUnicodeN@20" |
| RtlReAllocateHeap@16 ; Win9x has ABI "RtlReAllocateHeap@12", WinNT has ABI "RtlReAllocateHeap@16" |
| RtlSizeHeap@12 ; Win9x has ABI "RtlSizeHeap@8", WinNT has ABI "RtlSizeHeap@12" |
| RtlUnicodeToMultiByteN@20 ; Win9x has ABI "RtlUnicodeToMultiByteN@16", WinNT has ABI "RtlUnicodeToMultiByteN@20" |
| |
| ; This is list of symbols available in all Win9x versions, in Windows NT 3.1, but not available in Win32s, Windows NT 3.5 and new |
| ; RtlGetHandleValueHeap@8 ; Win9x ABI |
| ; RtlGetHandleValueHeap@12 ; Windows NT 3.1 ABI |
| ; RtlSetHandleValueHeap@12 ; Win9x ABI |
| ; RtlSetHandleValueHeap@16 ; Windows NT 3.1 ABI |
| |
| ; This is list of symbols available in all Win9x versions, but not available in Win32s and WinNT |
| ; RtlGrowHeap@8 |
| |
| ; This is list of symbols added in Windows 98, available also in all WinNT versions, but not available in Win32s |
| NtCreateFile@44 |
| RtlNtStatusToDosError@4 |
| |
| ; This is list of symbols added in Windows 98, but not available in Win32s and WinNT |
| ; IoUnregisterDeviceInterface@4 |
| ; NtGetDevnodeFromFileHandle@8 |
| |
| ; This is list of symbols added in Windows 98 and also since Windows NT 3.51, but not available in Win32s |
| NtSetSystemPowerState@12 |
| |
| ; This is list of symbols added in Windows 98 and also since Windows 2000, but not available in Win32s |
| NtInitiatePowerAction@16 |
| NtPowerInformation@20 |
| NtRequestWakeupLatency@4 ; removed in Windows 7 |
| |
| ;; This is end of Win9x symbols ;; |
| |
| |
| ; This is list of symbols available since Windows NT 3.1 |
| CsrAllocateCaptureBuffer@8 ; Windows NT 3.1-4.0 has ABI "CsrAllocateCaptureBuffer@12", Windows 2000 and new has ABI "CsrAllocateCaptureBuffer@8" |
| ; CsrAllocateCapturePointer@12 ; removed in Windows 2000 |
| CsrAllocateMessagePointer@12 |
| CsrCaptureMessageBuffer@16 |
| CsrCaptureMessageString@20 |
| CsrCaptureTimeout@8 |
| CsrClientCallServer@16 |
| CsrClientConnectToServer@20 ; Windows NT 3.1-2000 has ABI "CsrClientConnectToServer@24", Windows XP and new has ABI "CsrClientConnectToServer@20" |
| ; CsrClientMaxMessage@0 ; removed in Windows NT 4.0 |
| ; CsrClientSendMessage@0 ; removed in Windows NT 4.0 |
| ; CsrClientThreadConnect@0 ; removed in Windows NT 4.0 |
| ; CsrDumpProfile@0 ; removed in Windows NT 3.5 |
| CsrFreeCaptureBuffer@4 |
| CsrIdentifyAlertableThread@0 |
| CsrNewThread@0 ; removed in Windows Vista SP1 |
| CsrProbeForRead@12 ; removed in Windows Vista |
| CsrProbeForWrite@12 ; removed in Windows Vista |
| CsrSetPriorityClass@8 |
| ; CsrStartProfile@0 ; removed in Windows NT 3.5 |
| ; CsrStopDumpProfile@0 ; removed in Windows NT 3.5 |
| ; CsrStopProfile@0 ; removed in Windows NT 3.5 |
| ; CsrpProcessCallbackRequest@4 ; removed in Windows NT 4.0 |
| DbgSsHandleKmApiMsg@8 ; removed in Windows XP |
| DbgSsInitialize@16 ; removed in Windows XP |
| DbgUiConnectToDbg@0 |
| DbgUiContinue@8 |
| DbgUiWaitStateChange@8 |
| DbgUserBreakPoint@0 |
| KiUserApcDispatcher@20 ; really stdcall @20, gendef detects it incorrectly |
| KiUserExceptionDispatcher@8 |
| LdrAccessResource@16 |
| LdrFindEntryForAddress@8 |
| LdrFindResourceDirectory_U@16 |
| LdrFindResource_U@16 |
| LdrGetDllHandle@16 |
| LdrGetProcedureAddress@16 |
| LdrInitializeThunk@16 ; really stdcall @16, gendef detects it incorrectly |
| LdrLoadDll@16 |
| LdrProcessRelocationBlock@16 |
| LdrQueryImageFileExecutionOptions@24 |
| LdrQueryProcessModuleInformation@12 |
| LdrShutdownProcess@0 |
| LdrShutdownThread@0 |
| LdrUnloadDll@4 |
| LdrVerifyImageMatchesChecksum@16 ; Windows NT 3.1-3.51 has ABI "LdrVerifyImageMatchesChecksum@4", Windows NT 4.0 and new has ABI "LdrVerifyImageMatchesChecksum@16" |
| NtAcceptConnectPort@24 |
| NtAccessCheck@32 |
| NtAccessCheckAndAuditAlarm@44 |
| NtAdjustGroupsToken@24 |
| NtAdjustPrivilegesToken@24 |
| NtAlertResumeThread@8 |
| NtAlertThread@4 |
| NtAllocateLocallyUniqueId@4 |
| NtAllocateVirtualMemory@24 |
| NtCancelIoFile@8 |
| NtCancelTimer@8 |
| NtCloseObjectAuditAlarm@12 |
| NtCompleteConnectPort@4 |
| NtConnectPort@32 |
| NtContinue@8 |
| NtCreateDirectoryObject@12 |
| NtCreateEvent@20 |
| NtCreateEventPair@12 |
| NtCreateKey@28 |
| NtCreateMailslotFile@32 |
| NtCreateMutant@16 |
| NtCreateNamedPipeFile@56 |
| NtCreatePagingFile@16 |
| NtCreatePort@20 |
| NtCreateProcess@32 |
| NtCreateProfile@36 ; Windows NT 3.1-3.5 has ABI "NtCreateProfile@28", Windows NT 3.51 and new has ABI "NtCreateProfile@36" |
| NtCreateSymbolicLinkObject@16 |
| NtCreateThread@32 |
| NtCreateTimer@16 ; Windows NT 3.1-3.51 has ABI "NtCreateTimer@12", Windows NT 4.0 and new has ABI "NtCreateTimer@16" |
| NtCreateToken@52 |
| NtDelayExecution@8 |
| NtDeleteKey@4 |
| NtDeleteValueKey@8 |
| NtDeviceIoControlFile@40 |
| NtDisplayString@4 |
| NtDuplicateObject@28 |
| NtDuplicateToken@24 |
| NtEnumerateKey@24 |
| NtEnumerateValueKey@24 |
| NtExtendSection@8 |
| NtFlushBuffersFile@8 |
| NtFlushInstructionCache@12 |
| NtFlushKey@4 |
| NtFlushVirtualMemory@16 |
| NtFlushWriteBuffer@0 |
| NtFreeVirtualMemory@16 |
| NtFsControlFile@40 |
| NtGetContextThread@8 |
| ; NtGetTickCount@0 ; removed in Windows XP |
| NtImpersonateClientOfPort@8 |
| NtImpersonateThread@12 |
| NtInitializeRegistry@4 |
| ; NtInitializeVDM@0 ; removed in Windows NT 3.5 |
| NtListenPort@8 |
| NtLoadDriver@4 |
| NtLoadKey@8 |
| NtLockFile@40 |
| NtLockVirtualMemory@16 |
| NtMakeTemporaryObject@4 |
| NtNotifyChangeDirectoryFile@36 |
| NtNotifyChangeKey@40 |
| NtOpenEvent@12 |
| NtOpenEventPair@12 |
| NtOpenFile@24 |
| NtOpenKey@12 |
| NtOpenMutant@12 |
| NtOpenObjectAuditAlarm@48 |
| NtOpenProcess@16 |
| NtOpenProcessToken@12 |
| NtOpenSection@12 |
| NtOpenSemaphore@12 |
| NtOpenSymbolicLinkObject@12 |
| NtOpenThread@16 |
| NtOpenThreadToken@16 |
| NtOpenTimer@12 |
| NtPrivilegeCheck@12 |
| NtPrivilegeObjectAuditAlarm@24 |
| NtPrivilegedServiceAuditAlarm@20 |
| NtProtectVirtualMemory@20 |
| NtPulseEvent@8 |
| NtQueryDefaultLocale@8 |
| NtQueryDirectoryFile@44 |
| NtQueryDirectoryObject@28 |
| NtQueryEvent@20 |
| NtQueryInformationFile@20 |
| NtQueryInformationPort@20 |
| NtQueryInformationProcess@20 |
| NtQueryInformationThread@20 |
| NtQueryInformationToken@20 |
| NtQueryIntervalProfile@8 ; Windows NT 3.1-3.5 has ABI "NtQueryIntervalProfile@4", Windows NT 3.51 and new has ABI "NtQueryIntervalProfile@8" |
| NtQueryKey@20 |
| NtQueryMutant@20 |
| NtQueryObject@20 |
| NtQuerySection@20 |
| NtQuerySecurityObject@20 |
| NtQuerySemaphore@20 |
| NtQuerySymbolicLinkObject@12 |
| NtQuerySystemEnvironmentValue@16 |
| NtQuerySystemInformation@16 |
| NtQuerySystemTime@4 |
| NtQueryTimer@20 |
| NtQueryValueKey@24 |
| NtQueryVirtualMemory@24 |
| NtQueryVolumeInformationFile@20 |
| NtRaiseException@12 |
| NtRaiseHardError@24 |
| NtReadFile@36 |
| NtReadRequestData@24 |
| NtReadVirtualMemory@20 |
| NtRegisterThreadTerminatePort@4 |
| NtReleaseMutant@8 |
| ; NtReleaseProcessMutant@0 ; removed in Windows NT 4.0 |
| ; NtRenameValueKey@16 ; removed in Windows NT 3.5 |
| NtReplaceKey@12 |
| NtReplyPort@8 |
| NtReplyWaitReceivePort@16 |
| NtReplyWaitReplyPort@8 |
| NtRequestPort@8 |
| NtRequestWaitReplyPort@12 |
| NtResetEvent@8 |
| NtRestoreKey@12 |
| NtResumeThread@8 |
| NtSaveKey@8 |
| NtSetContextThread@8 |
| NtSetDefaultHardErrorPort@4 |
| NtSetDefaultLocale@8 |
| NtSetEvent@8 |
| NtSetHighEventPair@4 |
| NtSetHighWaitLowEventPair@4 |
| ; NtSetHighWaitLowThread@0 ; removed in Windows 2000 |
| NtSetInformationFile@20 |
| NtSetInformationKey@16 |
| NtSetInformationProcess@16 |
| NtSetInformationThread@16 |
| NtSetInformationToken@16 |
| NtSetIntervalProfile@8 ; Windows NT 3.1-3.5 has ABI "NtSetIntervalProfile@4", Windows NT 3.51 and new has ABI "NtSetIntervalProfile@8" |
| NtSetLdtEntries@24 |
| NtSetLowEventPair@4 |
| NtSetLowWaitHighEventPair@4 |
| ; NtSetLowWaitHighThread@0 ; removed in Windows 2000 |
| NtSetSecurityObject@12 |
| NtSetSystemEnvironmentValue@8 |
| NtSetSystemTime@8 |
| NtSetTimer@28 ; Windows NT 3.1-3.5 has ABI "NtSetTimer@20", Windows NT 3.51 has ABI "NtSetTimer@24", Windows NT 4.0 and new has ABI NtSetTimer@28 |
| NtSetValueKey@24 |
| NtSetVolumeInformationFile@20 |
| NtShutdownSystem@4 |
| NtStartProfile@4 |
| NtStopProfile@4 |
| NtSuspendThread@8 |
| NtSystemDebugControl@24 |
| NtTerminateProcess@8 |
| NtTerminateThread@8 |
| NtTestAlert@0 |
| NtUnloadDriver@4 |
| NtUnloadKey@4 |
| NtUnlockFile@20 |
| NtUnlockVirtualMemory@16 |
| NtVdmControl@8 ; Windows NT 3.1 has ABI "NtVdmControl@16", Windows NT 3.5 and new has ABI "NtVdmControl@8" |
| ; NtVdmStartExecution@0 ; removed in Windows NT 3.5 |
| NtWaitForMultipleObjects@20 |
| ; NtWaitForProcessMutant@0 ; removed in Windows NT 4.0 |
| NtWaitHighEventPair@4 |
| NtWaitLowEventPair@4 |
| NtWriteFile@36 |
| NtWriteRequestData@24 |
| NtWriteVirtualMemory@20 |
| PfxFindPrefix@8 |
| PfxInitialize@4 |
| PfxInsertPrefix@12 |
| PfxRemovePrefix@8 |
| RtlAbortRXact@4 |
| RtlAbsoluteToSelfRelativeSD@12 |
| RtlAcquirePebLock@0 |
| RtlAcquireResourceExclusive@8 |
| RtlAcquireResourceShared@8 |
| RtlAddAccessAllowedAce@16 |
| RtlAddAccessDeniedAce@16 |
| RtlAddAce@20 |
| RtlAddActionToRXact@24 |
| RtlAddAttributeActionToRXact@32 |
| RtlAddAuditAccessAce@24 |
| RtlAdjustPrivilege@16 |
| RtlAllocateAndInitializeSid@44 |
| ; RtlAnalyzeProfile@0 ; removed in Windows NT 3.5 |
| RtlAnsiCharToUnicodeChar@4 |
| RtlAppendAsciizToString@8 |
| RtlAppendStringToString@8 |
| RtlAppendUnicodeStringToString@8 |
| RtlAppendUnicodeToString@8 |
| RtlApplyRXact@4 |
| RtlApplyRXactNoFlush@4 |
| RtlAreAllAccessesGranted@8 |
| RtlAreAnyAccessesGranted@8 |
| RtlAreBitsClear@12 |
| RtlAreBitsSet@12 |
| RtlAssert@16 |
| RtlCaptureStackBackTrace@16 |
| RtlCharToInteger@12 |
| RtlCheckRegistryKey@8 |
| RtlClearAllBits@4 |
| RtlClearBits@12 |
| RtlCompactHeap@8 |
| RtlCompareMemory@12 |
| RtlCompareMemoryUlong@12 |
| RtlCompareString@12 |
| RtlCompareUnicodeString@12 |
| RtlConsoleMultiByteToUnicodeN@24 |
| RtlConvertExclusiveToShared@4 |
| RtlConvertSharedToExclusive@4 |
| RtlConvertSidToUnicodeString@12 |
| RtlConvertUiListToApiList@12 ; removed in Windows 8.1 |
| RtlCopyLuid@8 |
| RtlCopyLuidAndAttributesArray@12 |
| RtlCopySecurityDescriptor@8 |
| RtlCopySid@12 |
| RtlCopySidAndAttributesArray@28 |
| RtlCopyString@8 |
| RtlCopyUnicodeString@8 |
| RtlCreateAcl@12 |
| RtlCreateAndSetSD@20 |
| RtlCreateEnvironment@8 |
| RtlCreateProcessParameters@40 |
| RtlCreateRegistryKey@8 |
| RtlCreateUnicodeString@8 |
| RtlCreateUnicodeStringFromAsciiz@8 |
| RtlCreateUserProcess@40 |
| RtlCreateUserSecurityObject@28 |
| RtlCreateUserThread@40 |
| RtlCustomCPToUnicodeN@24 |
| RtlDeNormalizeProcessParams@4 |
| RtlDelete@4 |
| RtlDeleteAce@8 |
| RtlDeleteCriticalSection@4 |
| RtlDeleteElementGenericTable@8 |
| RtlDeleteRegistryValue@12 |
| RtlDeleteResource@4 |
| RtlDeleteSecurityObject@4 |
| RtlDestroyEnvironment@4 |
| RtlDestroyProcessParameters@4 |
| RtlDetermineDosPathNameType_U@4 |
| RtlDoesFileExists_U@4 |
| RtlDosPathNameToNtPathName_U@16 |
| RtlDosSearchPath_U@24 |
| RtlDumpResource@4 |
| RtlEnterCriticalSection@4 |
| RtlEnumerateGenericTable@8 |
| RtlEnumerateGenericTableWithoutSplaying@8 |
| RtlEqualComputerName@8 |
| RtlEqualDomainName@8 |
| RtlEqualLuid@8 |
| RtlEqualPrefixSid@8 |
| RtlEqualSid@8 |
| RtlEqualString@12 |
| RtlEqualUnicodeString@12 |
| RtlEraseUnicodeString@4 |
| ; RtlExpandEnvironmentStrings@16 ; removed in Windows NT 3.5 |
| RtlExpandEnvironmentStrings_U@16 |
| RtlFillMemoryUlong@12 |
| RtlFindClearBits@12 |
| RtlFindClearBitsAndSet@12 |
| RtlFindLongestRunClear@8 |
| RtlFindLongestRunSet@8 ; removed in Windows 2000 |
| RtlFindMessage@20 |
| RtlFindSetBits@12 |
| RtlFindSetBitsAndClear@12 |
| RtlFirstFreeAce@8 |
| RtlFormatMessage@36 |
| RtlFreeAnsiString@4 |
| RtlFreeOemString@4 |
| RtlFreeSid@4 |
| RtlFreeUnicodeString@4 |
| RtlGenerate8dot3Name@16 ; Windows NT 3.1 has ABI "RtlGenerate8dot3Name@12", Windows NT 3.5 and new has ABI "RtlGenerate8dot3Name@16" |
| RtlGetAce@12 |
| RtlGetCallersAddress@8 |
| RtlGetControlSecurityDescriptor@12 |
| RtlGetCurrentDirectory_U@8 |
| RtlGetDaclSecurityDescriptor@16 |
| RtlGetElementGenericTable@8 |
| RtlGetFullPathName_U@16 |
| RtlGetGroupSecurityDescriptor@12 |
| ; RtlGetHeapUserValue@4 ; removed in Windows NT 3.5 |
| RtlGetNtGlobalFlags@0 |
| RtlGetNtProductType@4 |
| RtlGetOwnerSecurityDescriptor@12 |
| RtlGetSaclSecurityDescriptor@16 |
| RtlIdentifierAuthoritySid@4 |
| RtlImpersonateSelf@4 |
| RtlInitCodePageTable@8 |
| RtlInitNlsTables@16 |
| RtlInitializeBitMap@12 |
| RtlInitializeContext@20 |
| RtlInitializeCriticalSection@4 |
| RtlInitializeGenericTable@20 |
| ; RtlInitializeProfile@4 ; removed in Windows NT 3.5 |
| RtlInitializeRXact@12 |
| RtlInitializeResource@4 |
| RtlInitializeSid@12 |
| ; RtlInitializeStackTraceDataBase@12 ; removed in Windows NT 3.51, added back in Windows XP SP2 and removed again in Windows Server 2003 |
| RtlInsertElementGenericTable@16 |
| RtlIntegerToChar@16 |
| RtlIsDosDeviceName_U@4 |
| RtlIsGenericTableEmpty@4 |
| RtlLargeIntegerToChar@16 |
| RtlLeaveCriticalSection@4 |
| RtlLengthRequiredSid@4 |
| RtlLengthSecurityDescriptor@4 |
| RtlLengthSid@4 |
| RtlLocalTimeToSystemTime@8 |
| RtlLockHeap@4 |
| ; RtlLogStackBackTrace@0 ; removed in Windows NT 3.51 |
| RtlLookupElementGenericTable@8 |
| ; RtlLookupSymbolByAddress@24 ; removed in Windows NT 3.51 |
| ; RtlLookupSymbolByName@16 ; removed in Windows NT 3.51 |
| RtlMakeSelfRelativeSD@12 |
| RtlMapGenericMask@8 |
| RtlMultiByteToUnicodeSize@12 |
| RtlNewInstanceSecurityObject@40 |
| RtlNewSecurityGrantedAccess@24 |
| RtlNewSecurityObject@24 |
| RtlNormalizeProcessParams@4 |
| RtlNumberGenericTableElements@4 |
| RtlNumberOfClearBits@4 |
| RtlNumberOfSetBits@4 |
| RtlOemStringToUnicodeSize@4 |
| RtlOemStringToUnicodeString@12 |
| RtlOemToUnicodeN@20 |
| RtlOpenCurrentUser@8 |
| RtlPcToFileHeader@8 |
| RtlPrefixString@12 |
| RtlPrefixUnicodeString@12 |
| ; RtlQueryEnvironmentVariable@0 ; removed in Windows NT 3.5 |
| RtlQueryEnvironmentVariable_U@12 |
| RtlQueryInformationAcl@16 |
| ; RtlQueryModuleInformation@24 ; removed in Windows NT 3.51 |
| RtlQueryProcessBackTraceInformation@4 ; Windows NT 3.1-3.5 has ABI "RtlQueryProcessBackTraceInformation@12", Windows NT 3.51 and new has ABI "RtlQueryProcessBackTraceInformation@4" |
| RtlQueryProcessHeapInformation@4 ; Windows NT 3.1-3.5 has ABI "RtlQueryProcessHeapInformation@12", Windows NT 3.51 and new has ABI "RtlQueryProcessHeapInformation@4" |
| RtlQueryProcessLockInformation@4 ; Windows NT 3.1-3.5 has ABI "RtlQueryProcessLockInformation@12", Windows NT 3.51 and new has ABI "RtlQueryProcessLockInformation@4" |
| RtlQueryRegistryValues@20 |
| RtlQuerySecurityObject@20 |
| RtlQueryTimeZoneInformation@4 |
| RtlRaiseException@4 |
| RtlRaiseStatus@4 |
| RtlRandom@4 |
| RtlRealPredecessor@4 |
| RtlRealSuccessor@4 |
| RtlReleasePebLock@0 |
| RtlReleaseResource@4 |
| RtlRemoteCall@28 |
| RtlResetRtlTranslations@4 |
| RtlRunDecodeUnicodeString@8 |
| RtlRunEncodeUnicodeString@8 |
| RtlSecondsSince1970ToTime@8 |
| RtlSecondsSince1980ToTime@8 |
| RtlSelfRelativeToAbsoluteSD@44 |
| RtlSetAllBits@4 |
| RtlSetBits@12 |
| RtlSetCurrentDirectory_U@4 |
| RtlSetCurrentEnvironment@8 |
| RtlSetEnvironmentVariable@12 |
| RtlSetGroupSecurityDescriptor@12 |
| ; RtlSetHeapUserValue@8 ; removed in Windows NT 3.5 |
| RtlSetInformationAcl@16 |
| RtlSetOwnerSecurityDescriptor@12 |
| RtlSetSaclSecurityDescriptor@16 |
| RtlSetSecurityObject@20 |
| RtlSetTimeZoneInformation@4 |
| ; RtlSnapShotHeap@16 ; removed in Windows NT 3.51 |
| RtlSplay@4 |
| ; RtlStartProfile@0 ; removed in Windows NT 3.5 |
| RtlStartRXact@4 |
| ; RtlStopProfile@0 ; removed in Windows NT 3.5 |
| RtlSubAuthorityCountSid@4 |
| RtlSubAuthoritySid@8 |
| RtlSubtreePredecessor@4 |
| RtlSubtreeSuccessor@4 |
| RtlSystemTimeToLocalTime@8 |
| RtlTimeFieldsToTime@8 |
| RtlTimeToElapsedTimeFields@8 |
| RtlTimeToSecondsSince1970@8 |
| RtlTimeToSecondsSince1980@8 |
| RtlTimeToTimeFields@8 |
| RtlUnicodeStringToCountedOemString@12 |
| RtlUnicodeStringToOemSize@4 |
| RtlUnicodeStringToOemString@12 |
| RtlUnicodeToCustomCPN@24 |
| RtlUnicodeToMultiByteSize@12 |
| RtlUnicodeToOemN@20 |
| RtlUniform@4 |
| RtlUnlockHeap@4 |
| RtlUpcaseUnicodeChar@4 |
| RtlUpcaseUnicodeString@12 |
| RtlUpcaseUnicodeStringToAnsiString@12 |
| RtlUpcaseUnicodeStringToCountedOemString@12 |
| RtlUpcaseUnicodeStringToOemString@12 |
| RtlUpcaseUnicodeToCustomCPN@24 |
| RtlUpcaseUnicodeToMultiByteN@20 |
| RtlUpcaseUnicodeToOemN@20 |
| RtlUpperChar@4 |
| RtlUpperString@8 |
| RtlValidAcl@4 |
| RtlValidSecurityDescriptor@4 |
| RtlValidSid@4 |
| RtlWriteRegistryValue@24 |
| ; RtlpInitializeRtl@12 ; removed in Windows NT 4.0 |
| RtlpNtCreateKey@24 |
| RtlpNtEnumerateSubKey@16 |
| RtlpNtMakeTemporaryKey@4 |
| RtlpNtOpenKey@16 |
| RtlpNtQueryValueKey@20 |
| RtlpNtSetValueKey@16 |
| RtlpUnWaitCriticalSection@4 |
| RtlpWaitForCriticalSection@4 |
| ZwAcceptConnectPort@24 |
| ZwAccessCheck@32 |
| ZwAccessCheckAndAuditAlarm@44 |
| ZwAdjustGroupsToken@24 |
| ZwAdjustPrivilegesToken@24 |
| ZwAlertResumeThread@8 |
| ZwAlertThread@4 |
| ZwAllocateLocallyUniqueId@4 |
| ZwAllocateVirtualMemory@24 |
| ZwCancelIoFile@8 |
| ZwCancelTimer@8 |
| ZwClose@4 |
| ZwCloseObjectAuditAlarm@12 |
| ZwCompleteConnectPort@4 |
| ZwConnectPort@32 |
| ZwContinue@8 |
| ZwCreateDirectoryObject@12 |
| ZwCreateEvent@20 |
| ZwCreateEventPair@12 |
| ZwCreateFile@44 |
| ZwCreateKey@28 |
| ZwCreateMailslotFile@32 |
| ZwCreateMutant@16 |
| ZwCreateNamedPipeFile@56 |
| ZwCreatePagingFile@16 |
| ZwCreatePort@20 |
| ZwCreateProcess@32 |
| ZwCreateProfile@36 ; Windows NT 3.1-3.5 has ABI "ZwCreateProfile@28", Windows NT 3.51 and new has ABI "ZwCreateProfile@36" |
| ZwCreateSection@28 |
| ZwCreateSemaphore@20 |
| ZwCreateSymbolicLinkObject@16 |
| ZwCreateThread@32 |
| ZwCreateTimer@16 ; Windows NT 3.1-3.51 has ABI "ZwCreateTimer@12", Windows NT 4.0 and new has ABI "ZwCreateTimer@16" |
| ZwCreateToken@52 |
| ZwDelayExecution@8 |
| ZwDeleteKey@4 |
| ZwDeleteValueKey@8 |
| ZwDeviceIoControlFile@40 |
| ZwDisplayString@4 |
| ZwDuplicateObject@28 |
| ZwDuplicateToken@24 |
| ZwEnumerateKey@24 |
| ZwEnumerateValueKey@24 |
| ZwExtendSection@8 |
| ZwFlushBuffersFile@8 |
| ZwFlushInstructionCache@12 |
| ZwFlushKey@4 |
| ZwFlushVirtualMemory@16 |
| ZwFlushWriteBuffer@0 |
| ZwFreeVirtualMemory@16 |
| ZwFsControlFile@40 |
| ZwGetContextThread@8 |
| ZwGetTickCount@0 ; removed in Windows XP |
| ZwImpersonateClientOfPort@8 |
| ZwImpersonateThread@12 |
| ZwInitializeRegistry@4 |
| ; ZwInitializeVDM@0 ; removed in Windows NT 3.5 |
| ZwListenPort@8 |
| ZwLoadDriver@4 |
| ZwLoadKey@8 |
| ZwLockFile@40 |
| ZwLockVirtualMemory@16 |
| ZwMakeTemporaryObject@4 |
| ZwMapViewOfSection@40 |
| ZwNotifyChangeDirectoryFile@36 |
| ZwNotifyChangeKey@40 |
| ZwOpenDirectoryObject@12 |
| ZwOpenEvent@12 |
| ZwOpenEventPair@12 |
| ZwOpenFile@24 |
| ZwOpenKey@12 |
| ZwOpenMutant@12 |
| ZwOpenObjectAuditAlarm@48 |
| ZwOpenProcess@16 |
| ZwOpenProcessToken@12 |
| ZwOpenSection@12 |
| ZwOpenSemaphore@12 |
| ZwOpenSymbolicLinkObject@12 |
| ZwOpenThread@16 |
| ZwOpenThreadToken@16 |
| ZwOpenTimer@12 |
| ZwPrivilegeCheck@12 |
| ZwPrivilegeObjectAuditAlarm@24 |
| ZwPrivilegedServiceAuditAlarm@20 |
| ZwProtectVirtualMemory@20 |
| ZwPulseEvent@8 |
| ZwQueryDefaultLocale@8 |
| ZwQueryDirectoryFile@44 |
| ZwQueryDirectoryObject@28 |
| ZwQueryEaFile@36 |
| ZwQueryEvent@20 |
| ZwQueryInformationFile@20 |
| ZwQueryInformationPort@20 |
| ZwQueryInformationProcess@20 |
| ZwQueryInformationThread@20 |
| ZwQueryInformationToken@20 |
| ZwQueryIntervalProfile@8 ; Windows NT 3.1-3.51 has ABI "ZwQueryIntervalProfile@4", Windows NT 4.0 and new has ABI "ZwQueryIntervalProfile@8" |
| ZwQueryKey@20 |
| ZwQueryMutant@20 |
| ZwQueryObject@20 |
| ZwQueryPerformanceCounter@8 |
| ZwQuerySection@20 |
| ZwQuerySecurityObject@20 |
| ZwQuerySemaphore@20 |
| ZwQuerySymbolicLinkObject@12 |
| ZwQuerySystemEnvironmentValue@16 |
| ZwQuerySystemInformation@16 |
| ZwQuerySystemTime@4 |
| ZwQueryTimer@20 |
| ZwQueryValueKey@24 |
| ZwQueryVirtualMemory@24 |
| ZwQueryVolumeInformationFile@20 |
| ZwRaiseException@12 |
| ZwRaiseHardError@24 |
| ZwReadFile@36 |
| ZwReadRequestData@24 |
| ZwReadVirtualMemory@20 |
| ZwRegisterThreadTerminatePort@4 |
| ZwReleaseMutant@8 |
| ; ZwReleaseProcessMutant@0 ; removed in Windows NT 4.0 |
| ZwReleaseSemaphore@12 |
| ; ZwRenameValueKey@16 ; removed in Windows NT 3.5 |
| ZwReplaceKey@12 |
| ZwReplyPort@8 |
| ZwReplyWaitReceivePort@16 |
| ZwReplyWaitReplyPort@8 |
| ZwRequestPort@8 |
| ZwRequestWaitReplyPort@12 |
| ZwResetEvent@8 |
| ZwRestoreKey@12 |
| ZwResumeThread@8 |
| ZwSaveKey@8 |
| ZwSetContextThread@8 |
| ZwSetDefaultHardErrorPort@4 |
| ZwSetDefaultLocale@8 |
| ZwSetEaFile@16 |
| ZwSetEvent@8 |
| ZwSetHighEventPair@4 |
| ZwSetHighWaitLowEventPair@4 |
| ; ZwSetHighWaitLowThread@0 ; removed in Windows 2000 |
| ZwSetInformationFile@20 |
| ZwSetInformationKey@16 |
| ZwSetInformationProcess@16 |
| ZwSetInformationThread@16 |
| ZwSetInformationToken@16 |
| ZwSetIntervalProfile@8 ; Windows NT 3.1-3.5 has ABI "ZwSetIntervalProfile@4", Windows NT 3.51 and new has ABI "ZwSetIntervalProfile@8" |
| ZwSetLdtEntries@24 |
| ZwSetLowEventPair@4 |
| ZwSetLowWaitHighEventPair@4 |
| ; ZwSetLowWaitHighThread@0 ; removed in Windows 2000 |
| ZwSetSecurityObject@12 |
| ZwSetSystemEnvironmentValue@8 |
| ZwSetSystemTime@8 |
| ZwSetTimer@28 ; Windows NT 3.1-3.5 has ABI "ZwSetTimer@20", Windows NT 3.51 has ABI "ZwSetTimer@24", Windows NT 4.0 and new has ABI "ZwSetTimer@28" |
| ZwSetValueKey@24 |
| ZwSetVolumeInformationFile@20 |
| ZwShutdownSystem@4 |
| ZwStartProfile@4 |
| ZwStopProfile@4 |
| ZwSuspendThread@8 |
| ZwSystemDebugControl@24 |
| ZwTerminateProcess@8 |
| ZwTerminateThread@8 |
| ZwTestAlert@0 |
| ZwUnloadDriver@4 |
| ZwUnloadKey@4 |
| ZwUnlockFile@20 |
| ZwUnlockVirtualMemory@16 |
| ZwUnmapViewOfSection@8 |
| ZwVdmControl@8 ; Windows NT 3.1 has ABI "ZwVdmControl@16", Windows NT 3.5 and new has ABI "ZwVdmControl@8" |
| ; ZwVdmStartExecution@0 ; removed in Windows NT 3.5 |
| ZwWaitForMultipleObjects@20 |
| ; ZwWaitForProcessMutant@0 ; removed in Windows NT 4.0 |
| ZwWaitForSingleObject@12 |
| ZwWaitHighEventPair@4 |
| ZwWaitLowEventPair@4 |
| ZwWriteFile@36 |
| ZwWriteRequestData@24 |
| ZwWriteVirtualMemory@20 |
| ; xRtlDosPathNameToNtPathName@16 ; removed in Windows NT 3.5 |
| |
| ; This is list of non-stdcall FPU emulator symbols, available since Windows NT 3.1 and removed in Windows XP SP2 and Windows Server 2003 SP1 |
| ; NPXEMULATORTABLE DATA ; removed in Windows XP |
| ; RestoreEm87Context |
| ; SaveEm87Context |
| ; __eCommonExceptions |
| ; __eEmulatorInit |
| ; __eF2XM1 |
| ; __eFABS |
| ; __eFADD32 |
| ; __eFADD64 |
| ; __eFADDPreg |
| ; __eFADDreg |
| ; __eFADDtop |
| ; __eFCHS |
| ; __eFCOM32 |
| ; __eFCOM64 |
| ; __eFCOM |
| ; __eFCOMP32 |
| ; __eFCOMP64 |
| ; __eFCOMP |
| ; __eFCOMPP |
| ; __eFCOS |
| ; __eFDECSTP |
| ; __eFDIV32 |
| ; __eFDIV64 |
| ; __eFDIVPreg |
| ; __eFDIVR32 |
| ; __eFDIVR64 |
| ; __eFDIVRPreg |
| ; __eFDIVRreg |
| ; __eFDIVRtop |
| ; __eFDIVreg |
| ; __eFDIVtop |
| ; __eFFREE |
| ; __eFIADD16 |
| ; __eFIADD32 |
| ; __eFICOM16 |
| ; __eFICOM32 |
| ; __eFICOMP16 |
| ; __eFICOMP32 |
| ; __eFIDIV16 |
| ; __eFIDIV32 |
| ; __eFIDIVR16 |
| ; __eFIDIVR32 |
| ; __eFILD16 |
| ; __eFILD32 |
| ; __eFILD64 |
| ; __eFIMUL16 |
| ; __eFIMUL32 |
| ; __eFINCSTP |
| ; __eFINIT |
| ; __eFIST16 |
| ; __eFIST32 |
| ; __eFISTP16 |
| ; __eFISTP32 |
| ; __eFISTP64 |
| ; __eFISUB16 |
| ; __eFISUB32 |
| ; __eFISUBR16 |
| ; __eFISUBR32 |
| ; __eFLD1 |
| ; __eFLD32 |
| ; __eFLD64 |
| ; __eFLD80 |
| ; __eFLDCW |
| ; __eFLDENV |
| ; __eFLDL2E |
| ; __eFLDLN2 |
| ; __eFLDPI |
| ; __eFLDZ |
| ; __eFMUL32 |
| ; __eFMUL64 |
| ; __eFMULPreg |
| ; __eFMULreg |
| ; __eFMULtop |
| ; __eFPATAN |
| ; __eFPREM |
| ; __eFPREM1 |
| ; __eFPTAN |
| ; __eFRNDINT |
| ; __eFRSTOR |
| ; __eFSAVE |
| ; __eFSCALE |
| ; __eFSIN |
| ; __eFSQRT |
| ; __eFST32 |
| ; __eFST64 |
| ; __eFST |
| ; __eFSTCW |
| ; __eFSTENV |
| ; __eFSTP32 |
| ; __eFSTP64 |
| ; __eFSTP80 |
| ; __eFSTP |
| ; __eFSTSW |
| ; __eFSUB32 |
| ; __eFSUB64 |
| ; __eFSUBPreg |
| ; __eFSUBR32 |
| ; __eFSUBR64 |
| ; __eFSUBRPreg |
| ; __eFSUBRreg |
| ; __eFSUBRtop |
| ; __eFSUBreg |
| ; __eFSUBtop |
| ; __eFTST |
| ; __eFUCOM |
| ; __eFUCOMP |
| ; __eFUCOMPP |
| ; __eFXAM |
| ; __eFXCH |
| ; __eFXTRACT |
| ; __eFYL2X |
| ; __eFYL2XP1 |
| ; __eGetStatusWord |
| |
| ; This is list of symbols added in Windows NT 3.5 |
| LdrDisableThreadCalloutsForDll@4 |
| NlsMbCodePageTag DATA |
| NlsMbOemCodePageTag DATA |
| NtClearEvent@4 |
| NtCreateIoCompletion@16 |
| NtDeleteFile@4 |
| NtOpenIoCompletion@12 |
| NtQueryAttributesFile@8 |
| NtQueryIoCompletion@20 |
| NtQueryTimerResolution@12 |
| NtRemoveIoCompletion@20 |
| NtSetInformationObject@16 |
| NtSetSystemInformation@12 |
| NtSetTimerResolution@12 |
| RtlCompressBuffer@32 |
| RtlCutoverTimeToSystemTime@16 |
| RtlDecompressBuffer@24 |
| RtlDecompressFragment@32 |
| RtlFormatCurrentUserKeyPath@4 |
| RtlGetCompressionWorkSpaceSize@12 |
| RtlGetLongestNtPathLength@0 |
| ; RtlGetUserFlagsHeap@16 ; removed in Windows NT 3.51 |
| ; RtlGetUserValueHeap@16 ; removed in Windows NT 3.51 |
| RtlIsTextUnicode@12 |
| RtlSetUserFlagsHeap@20 |
| RtlSetUserValueHeap@16 |
| RtlWalkHeap@8 |
| RtlZeroHeap@8 |
| RtlxAnsiStringToUnicodeSize@4 |
| RtlxOemStringToUnicodeSize@4 |
| RtlxUnicodeStringToAnsiSize@4 |
| RtlxUnicodeStringToOemSize@4 |
| ZwClearEvent@4 |
| ZwCreateIoCompletion@16 |
| ZwDeleteFile@4 |
| ZwOpenIoCompletion@12 |
| ZwQueryAttributesFile@8 |
| ZwQueryIoCompletion@20 |
| ZwQueryTimerResolution@12 |
| ZwRemoveIoCompletion@20 |
| ZwSetInformationObject@16 |
| ZwSetSystemInformation@12 |
| ZwSetTimerResolution@12 |
| |
| ; This is list of symbols added in Windows NT 3.51 |
| KiUserCallbackDispatcher@12 ; really stdcall @12, gendef detects it incorrectly |
| LdrEnumResources@20 |
| NtAllocateUuids@16 ; Windows NT 3.51-4.0 has ABI "NtAllocateUuids@12", Windows 2000 and new has ABI "NtAllocateUuids@16" |
| NtCallbackReturn@12 |
| ; NtEnumerateBus@8 ; removed in Windows NT 4.0 |
| NtGetPlugPlayEvent@16 ; removed in Windows 8 |
| NtPlugPlayControl@12 ; Windows NT 3.51-4.0 has ABI "NtPlugPlayControl@16", Windows 2000 and new has ABI "NtPlugPlayControl@12" |
| ; NtRegisterNewDevice@8 ; removed in Windows NT 4.0 |
| NtSetIoCompletion@20 |
| ; NtW32Call@20 ; removed in Windows NT 4.0 SP4 |
| RtlCreateQueryDebugBuffer@8 |
| RtlCreateTagHeap@16 |
| RtlDestroyQueryDebugBuffer@4 |
| RtlEnumProcessHeaps@8 |
| RtlExtendHeap@16 ; removed in Windows Vista |
| RtlGetProcessHeaps@8 |
| RtlGetUserInfoHeap@20 |
| RtlIsNameLegalDOS8Dot3@12 |
| RtlProtectHeap@8 |
| RtlQueryProcessDebugInformation@12 |
| RtlQueryTagHeap@20 |
| RtlUsageHeap@12 ; removed in Windows Vista |
| RtlValidateProcessHeaps@0 |
| ZwAllocateUuids@16 ; Windows NT 3.51-4.0 has ABI "ZwAllocateUuids@12", Windows 2000 and new has ABI "ZwAllocateUuids@16" |
| ZwCallbackReturn@12 |
| ; ZwEnumerateBus@8 ; remvoed in Windows NT 4.0 |
| ZwGetPlugPlayEvent@16 ; removed in Windows 8 |
| ZwPlugPlayControl@12 ; Windows NT 3.51-4.0 has ABI "ZwPlugPlayControl@16", Windows 2000 and new has ABI "ZwPlugPlayControl@12" |
| ; ZwRegisterNewDevice@8 ; removed in Windows NT 4.0 |
| ZwSetIoCompletion@20 |
| ZwSetSystemPowerState@12 |
| ; ZwW32Call@20 ; removed in Windows NT 4.0 SP4 |
| |
| ; This is list of symbols added in Windows NT 4.0 |
| ; public: virtual void *__thiscall CBufferAllocator::Allocate(unsigned long) |
| ; ?Allocate@CBufferAllocator@@UAEPAXK@Z ; has WINAPI (@4) ; removed in Windows 2000 |
| KiRaiseUserExceptionDispatcher@0 |
| NlsAnsiCodePage DATA |
| NtAddAtom@12 ; Windows NT 4.0 has ABI "NtAddAtom@8", Windows 2000 and new has ABI "NtAddAtom@12" |
| ; NtCreateChannel@8 ; removed in Windows XP |
| NtDeleteAtom@4 |
| NtDeleteObjectAuditAlarm@12 |
| NtFindAtom@12 ; Windows NT 4.0 has ABI "NtFindAtom@8", Windows 2000 and new has ABI "NtFindAtom@12" |
| ; NtListenChannel@8 ; removed in Windows XP |
| NtLoadKey2@12 |
| ; NtOpenChannel@8 ; removed in Windows XP |
| NtQueryFullAttributesFile@8 |
| NtQueryInformationAtom@20 |
| NtQueryMultipleValueKey@24 |
| ; NtQueryOleDirectoryFile@44 ; removed in Windows 2000 |
| NtQueueApcThread@20 |
| ; NtReplyWaitSendChannel@12 ; removed in Windows XP |
| ; NtSendWaitReplyChannel@16 ; removed in Windows XP |
| ; NtSetContextChannel@4 ; removed in Windows XP |
| NtSignalAndWaitForSingleObject@16 |
| NtYieldExecution@0 |
| ; PropertyLengthAsVariant@16 ; removed in Windows Vista |
| RtlAddAtomToAtomTable@12 |
| RtlAddCompoundAce@24 |
| RtlAllocateHandle@8 |
| ; RtlClosePropertySet@4 ; removed in Windows 2000 |
| ; RtlCompareVariants@12 ; removed in Windows 2000 |
| ; RtlConvertPropertyToVariant@16 ; removed in Windows Vista |
| ; RtlConvertVariantToProperty@28 ; removed in Windows Vista |
| RtlCreateAtomTable@8 |
| ; RtlCreatePropertySet@36 ; removed in Windows 2000 |
| RtlDeleteAtomFromAtomTable@8 |
| RtlDeleteNoSplay@8 |
| RtlDestroyAtomTable@4 |
| RtlDestroyHandleTable@4 |
| RtlDowncaseUnicodeString@12 |
| RtlEmptyAtomTable@8 |
| ; RtlEnumerateProperties@24 ; removed in Windows 2000 |
| ; RtlFlushPropertySet@4 ; removed in Windows 2000 |
| RtlFreeHandle@8 |
| RtlFreeUserThreadStack@8 ; removed in Windows Vista |
| ; RtlGuidToPropertySetName@8 ; removed in Windows 2000 |
| RtlImageRvaToSection@12 |
| RtlImageRvaToVa@16 |
| RtlInitializeAtomPackage@4 |
| RtlInitializeHandleTable@12 |
| RtlIsValidHandle@8 |
| RtlIsValidIndexHandle@12 |
| RtlLookupAtomInAtomTable@12 |
| RtlPinAtomInAtomTable@8 |
| ; RtlPropertySetNameToGuid@12 ; removed in Windows 2000 |
| RtlQueryAtomInAtomTable@24 |
| ; RtlQueryProperties@28 ; removed in Windows 2000 |
| ; RtlQueryPropertyNames@16 ; removed in Windows 2000 |
| ; RtlQueryPropertySet@8 ; removed in Windows 2000 |
| RtlSetAttributesSecurityDescriptor@12 |
| ; RtlSetProperties@28 ; removed in Windows 2000 |
| ; RtlSetPropertyNames@16 ; removed in Windows 2000 |
| ; RtlSetPropertySetClassId@8 ; removed in Windows 2000 |
| ; RtlSetUnicodeCallouts@4 ; removed in Windows Vista |
| RtlTryEnterCriticalSection@4 |
| ZwAddAtom@12 ; Windows NT 4.0 has ABI "ZwAddAtom@8", Windows 2000 and new has ABI "ZwAddAtom@12" |
| ; ZwCreateChannel@8 ; removed in Windows XP |
| ZwDeleteAtom@4 |
| ZwDeleteObjectAuditAlarm@12 |
| ZwFindAtom@12 ; Windows NT 4.0 has ABI "ZwFindAtom@8", Windows 2000 and new has ABI "ZwFindAtom@12" |
| ; ZwListenChannel@8 ; removed in Windows XP |
| ZwLoadKey2@12 |
| ; ZwOpenChannel@8 ; removed in Windows XP |
| ZwQueryFullAttributesFile@8 |
| ZwQueryInformationAtom@20 |
| ZwQueryMultipleValueKey@24 |
| ; ZwQueryOleDirectoryFile@44 ; removed in Windows 2000 |
| ZwQueueApcThread@20 |
| ; ZwReplyWaitSendChannel@12 ; removed in Windows XP |
| ; ZwSendWaitReplyChannel@16 ; removed in Windows XP |
| ; ZwSetContextChannel@4 ; removed in Windows XP |
| ZwSignalAndWaitForSingleObject@16 |
| ZwYieldExecution@0 |
| |
| ; In Windows NT 4.0 SP1 was not added any new symbol |
| |
| ; This is list of symbols added in Windows NT 4.0 SP2 |
| NtReadFileScatter@36 |
| NtWriteFileGather@36 |
| ; RtlOnMappedStreamEvent@12 ; removed in Windows 2000 |
| ZwReadFileScatter@36 |
| ZwWriteFileGather@36 |
| |
| ; This is list of symbols added in Windows NT 4.0 SP3 |
| RtlInitializeCriticalSectionAndSpinCount@8 |
| RtlSetCriticalSectionSpinCount@8 |
| |
| ; In Windows NT 4.0 SP4 was not added any new symbol but some were removed |
| |
| ; In Windows NT 4.0 SP5 was not added any new symbol |
| |
| ; In Windows NT 4.0 SP6 was not added any new symbol |
| |
| ; In Windows NT 4.0 SP6a was not added any new symbol |
| |
| ; This is list of symbols added in Windows 2000 |
| DbgPrintReturnControlC ; cdecl |
| LdrAlternateResourcesEnabled@0 ; removed in Windows Vista |
| LdrFlushAlternateResourceModules@0 |
| LdrLoadAlternateResourceModule@16 ; Windows 2000-2003 has ABI "LdrLoadAlternateResourceModule@8", Windows Vista and new has ABI "LdrLoadAlternateResourceModule@16" |
| LdrUnloadAlternateResourceModule@4 |
| NtAccessCheckByType@44 |
| NtAccessCheckByTypeAndAuditAlarm@64 |
| NtAccessCheckByTypeResultList@44 |
| NtAccessCheckByTypeResultListAndAuditAlarm@64 |
| NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68 |
| NtAllocateUserPhysicalPages@12 |
| NtAreMappedFilesTheSame@8 |
| NtAssignProcessToJobObject@8 |
| NtCancelDeviceWakeupRequest@4 ; removed in Windows 7 |
| NtCreateJobObject@12 |
| NtCreateWaitablePort@20 |
| NtFilterToken@24 |
| NtFreeUserPhysicalPages@12 |
| NtGetDevicePowerState@8 |
| NtGetWriteWatch@28 |
| NtImpersonateAnonymousToken@4 |
| NtIsSystemResumeAutomatic@0 |
| NtMapUserPhysicalPages@12 |
| NtMapUserPhysicalPagesScatter@12 |
| NtNotifyChangeMultipleKeys@48 |
| NtOpenJobObject@12 |
| NtQueryDefaultUILanguage@4 |
| NtQueryInformationJobObject@20 |
| NtQueryInstallUILanguage@4 |
| NtQueryOpenSubKeys@8 |
| NtQueryQuotaInformationFile@36 |
| NtReplyWaitReceivePortEx@20 |
| NtRequestDeviceWakeup@4 ; removed in Windows 7 |
| NtResetWriteWatch@12 |
| NtSaveMergedKeys@12 |
| NtSecureConnectPort@36 |
| NtSetDefaultUILanguage@4 |
| NtSetInformationJobObject@16 |
| NtSetQuotaInformationFile@16 |
| NtSetThreadExecutionState@8 |
| NtSetUuidSeed@4 |
| NtTerminateJobObject@8 |
| RtlAddAccessAllowedAceEx@20 |
| RtlAddAccessAllowedObjectAce@28 |
| RtlAddAccessDeniedAceEx@20 |
| RtlAddAccessDeniedObjectAce@28 |
| RtlAddAuditAccessAceEx@28 |
| RtlAddAuditAccessObjectAce@36 |
| RtlAddRange@36 ; removed in Windows Server 2003 |
| RtlCallbackLpcClient@12 ; removed in Windows XP |
| RtlCancelTimer@8 |
| RtlCheckForOrphanedCriticalSections@4 |
| RtlConvertToAutoInheritSecurityObject@24 |
| RtlCopyRangeList@8 ; removed in Windows Server 2003 |
| RtlCreateLpcServer@24 ; removed in Windows XP |
| RtlCreateTimer@28 |
| RtlCreateTimerQueue@4 |
| RtlDebugPrintTimes@0 |
| RtlDefaultNpAcl@4 |
| RtlDeleteOwnersRanges@8 ; removed in Windows Server 2003 |
| RtlDeleteRange@24 ; removed in Windows Server 2003 |
| RtlDeleteTimer@12 |
| RtlDeleteTimerQueue@4 |
| RtlDeleteTimerQueueEx@8 |
| RtlDeregisterWait@4 |
| RtlDeregisterWaitEx@8 |
| RtlDnsHostNameToComputerName@12 |
| RtlEnableEarlyCriticalSectionEventCreation@0 |
| RtlFindLastBackwardRunClear@12 |
| RtlFindLeastSignificantBit@8 |
| RtlFindMostSignificantBit@8 |
| RtlFindNextForwardRunClear@12 |
| RtlFindRange@48 ; removed in Windows Server 2003 |
| ; RtlFreeRangeList@4 ; removed in Windows Server 2003 |
| RtlGUIDFromString@8 |
| RtlGetFirstRange@12 ; removed in Windows Server 2003 |
| RtlGetNextRange@12 ; removed in Windows Server 2003 |
| RtlGetSecurityDescriptorRMControl@8 |
| RtlGetVersion@4 |
| RtlImpersonateLpcClient@8 ; removed in Windows XP |
| ; RtlInitializeRangeList@4 ; removed in Windows Server 2003 |
| RtlInt64ToUnicodeString@16 |
| RtlInvertRangeList@8 ; removed in Windows Server 2003 |
| RtlIsRangeAvailable@40 ; removed in Windows Server 2003 |
| RtlMergeRangeLists@16 ; removed in Windows Server 2003 |
| RtlNewSecurityObjectEx@32 |
| RtlQueueWorkItem@12 |
| RtlRegisterWait@24 |
| RtlSelfRelativeToAbsoluteSD2@8 |
| RtlSetControlSecurityDescriptor@12 |
| RtlSetIoCompletionCallback@12 |
| RtlSetSecurityDescriptorRMControl@8 |
| RtlSetSecurityObjectEx@24 |
| RtlSetThreadPoolStartFunc@8 |
| RtlSetTimer@28 |
| RtlShutdownLpcServer@4 ; removed in Windows XP |
| RtlStringFromGUID@8 |
| @RtlUlongByteSwap@4 ; fastcall |
| @RtlUlonglongByteSwap@8 ; fastcall |
| RtlUpdateTimer@16 |
| @RtlUshortByteSwap@4 ; fastcall |
| RtlValidRelativeSecurityDescriptor@12 |
| RtlVerifyVersionInfo@16 |
| RtlWalkFrameChain@12 |
| VerSetConditionMask@16 |
| ZwAccessCheckByType@44 |
| ZwAccessCheckByTypeAndAuditAlarm@64 |
| ZwAccessCheckByTypeResultList@44 |
| ZwAccessCheckByTypeResultListAndAuditAlarm@64 |
| ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68 |
| ZwAllocateUserPhysicalPages@12 |
| ZwAreMappedFilesTheSame@8 |
| ZwAssignProcessToJobObject@8 |
| ZwCancelDeviceWakeupRequest@4 ; removed in Windows 7 |
| ZwCreateJobObject@12 |
| ZwCreateWaitablePort@20 |
| ZwFilterToken@24 |
| ZwFreeUserPhysicalPages@12 |
| ZwGetDevicePowerState@8 |
| ZwGetWriteWatch@28 |
| ZwImpersonateAnonymousToken@4 |
| ZwInitiatePowerAction@16 |
| ZwIsSystemResumeAutomatic@0 |
| ZwMapUserPhysicalPages@12 |
| ZwMapUserPhysicalPagesScatter@12 |
| ZwNotifyChangeMultipleKeys@48 |
| ZwOpenJobObject@12 |
| ZwPowerInformation@20 |
| ZwQueryDefaultUILanguage@4 |
| ZwQueryInformationJobObject@20 |
| ZwQueryInstallUILanguage@4 |
| ZwQueryOpenSubKeys@8 |
| ZwQueryQuotaInformationFile@36 |
| ZwReplyWaitReceivePortEx@20 |
| ZwRequestDeviceWakeup@4 ; removed in Windows 7 |
| ZwRequestWakeupLatency@4 ; removed in Windows 7 |
| ZwResetWriteWatch@12 |
| ZwSaveMergedKeys@12 |
| ZwSecureConnectPort@36 |
| ZwSetDefaultUILanguage@4 |
| ZwSetInformationJobObject@16 |
| ZwSetQuotaInformationFile@16 |
| ZwSetThreadExecutionState@8 |
| ZwSetUuidSeed@4 |
| ZwTerminateJobObject@8 |
| |
| ; This is list of symbols added in Windows 2000 SP1 |
| RtlTraceDatabaseAdd@16 |
| RtlTraceDatabaseCreate@20 |
| RtlTraceDatabaseDestroy@4 |
| RtlTraceDatabaseEnumerate@12 |
| RtlTraceDatabaseFind@16 |
| RtlTraceDatabaseLock@4 |
| RtlTraceDatabaseUnlock@4 |
| RtlTraceDatabaseValidate@4 |
| |
| ; In Windows 2000 SP2 was not added any new symbol |
| |
| ; In Windows 2000 SP3 was not added any new symbol |
| |
| ; In Windows 2000 SP4 was not added any new symbol |
| |
| ; This is list of symbols added in Windows XP |
| CsrCaptureMessageMultiUnicodeStringsInPlace@12 |
| CsrGetProcessId@0 |
| DbgPrintEx ; cdecl |
| DbgQueryDebugFilterState@8 |
| DbgSetDebugFilterState@12 |
| DbgUiConvertStateChangeStructure@8 |
| DbgUiDebugActiveProcess@4 |
| DbgUiGetThreadDebugObject@0 |
| DbgUiIssueRemoteBreakin@4 |
| DbgUiRemoteBreakin@4 |
| DbgUiSetThreadDebugObject@4 |
| DbgUiStopDebugging@4 |
| ; LdrAccessOutOfProcessResource@20 ; removed in Windows Vista |
| LdrAddRefDll@8 |
| ; LdrCreateOutOfProcessImage@20 ; Windows XP has ABI "LdrCreateOutOfProcessImage@16", Windows Server 2003 has ABI "LdrCreateOutOfProcessImage@20", removed in Windows Vista |
| ; LdrDestroyOutOfProcessImage@4 ; removed in Windows Vista |
| ; LdrFindCreateProcessManifest@20 ; removed in Windows Vista |
| LdrFindResourceEx_U@20 |
| LdrGetDllHandleEx@20 |
| LdrInitShimEngineDynamic@4 ; Windows XP-7 has ABI "LdrInitShimEngineDynamic@4", Windows 8 an new has ABI "LdrInitShimEngineDynamic@8" |
| LdrLockLoaderLock@12 |
| LdrSetAppCompatDllRedirectionCallback@12 |
| LdrSetDllManifestProber@4 ; Windows XP-Vista has ABI "LdrSetDllManifestProber@4", Windows 7 an new has ABI "LdrSetDllManifestProber@12" |
| LdrUnlockLoaderLock@8 |
| NtAddBootEntry@8 |
| NtCompactKeys@8 |
| NtCompareTokens@12 |
| NtCompressKey@4 |
| NtCreateDebugObject@16 |
| NtCreateJobSet@12 |
| NtCreateKeyedEvent@16 |
| NtCreateProcessEx@36 |
| NtDebugActiveProcess@8 |
| NtDebugContinue@12 |
| NtDeleteBootEntry@4 |
| NtEnumerateBootEntries@8 |
| NtEnumerateSystemEnvironmentValuesEx@12 |
| NtIsProcessInJob@8 |
| NtLockProductActivationKeys@8 |
| NtLockRegistryKey@4 |
| NtMakePermanentObject@4 |
| NtModifyBootEntry@4 |
| NtOpenKeyedEvent@12 |
| NtOpenProcessTokenEx@16 |
| NtOpenThreadTokenEx@20 |
| NtQueryBootEntryOrder@8 |
| NtQueryBootOptions@8 |
| NtQueryDebugFilterState@8 |
| NtQueryPortInformationProcess@0 |
| NtQuerySystemEnvironmentValueEx@20 |
| NtReleaseKeyedEvent@16 |
| NtRemoveProcessDebug@8 |
| NtRenameKey@8 |
| NtResumeProcess@4 |
| NtSaveKeyEx@12 |
| NtSetBootEntryOrder@8 |
| NtSetBootOptions@8 |
| NtSetDebugFilterState@12 |
| NtSetEventBoostPriority@4 |
| NtSetInformationDebugObject@20 |
| NtSetSystemEnvironmentValueEx@20 |
| NtSuspendProcess@4 |
| NtTraceEvent@16 |
| NtTranslateFilePath@16 |
| NtUnloadKeyEx@8 |
| NtWaitForDebugEvent@16 |
| NtWaitForKeyedEvent@16 |
| RtlActivateActivationContext@12 |
| RtlActivateActivationContextEx@16 |
| @RtlActivateActivationContextUnsafeFast@8 ; fastcall |
| RtlAddRefActivationContext@4 |
| RtlAddRefMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlAddVectoredExceptionHandler@8 |
| RtlAddressInSectionTable@12 |
| RtlAppendPathElement@12 |
| RtlApplicationVerifierStop@40 |
| ; RtlAssert2@20 ; removed in Windows Server 2003 |
| RtlCaptureContext@4 |
| RtlCaptureStackContext@12 |
| ; RtlCheckProcessParameters@16 ; removed in Windows Vista |
| RtlCloneMemoryStream@8 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlCommitMemoryStream@8 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlComputeCrc32@12 |
| RtlComputeImportTableHash@12 |
| RtlComputePrivatizedDllName_U@12 |
| RtlCopyMemoryStreamTo@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlCopyOutOfProcessMemoryStreamTo@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlCreateActivationContext@24 |
| RtlCreateBootStatusDataFile@4 ; Windows XP-2003 has ABI "RtlCreateBootStatusDataFile@0", Windows Vista and new has ABI "RtlCreateBootStatusDataFile@4" |
| RtlCreateSystemVolumeInformationFolder@4 |
| RtlDeactivateActivationContext@8 |
| @RtlDeactivateActivationContextUnsafeFast@4 ; fastcall |
| RtlDeleteElementGenericTableAvl@8 |
| RtlDllShutdownInProgress@0 |
| RtlDosApplyFileIsolationRedirection_Ustr@36 |
| RtlDosSearchPath_Ustr@36 |
| RtlDowncaseUnicodeChar@4 |
| RtlDuplicateUnicodeString@12 |
| RtlEnumerateGenericTableAvl@8 |
| RtlEnumerateGenericTableLikeADirectory@28 |
| RtlEnumerateGenericTableWithoutSplayingAvl@8 |
| RtlExitUserThread@4 |
| RtlFinalReleaseOutOfProcessMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlFindActivationContextSectionGuid@20 |
| RtlFindActivationContextSectionString@20 |
| RtlFindCharInUnicodeString@16 |
| RtlFindClearRuns@16 |
| RtlFirstEntrySList@4 |
| RtlFlushSecureMemoryCache@8 |
| RtlFreeThreadActivationContextStack@0 |
| RtlGetActiveActivationContext@4 |
| RtlGetCurrentPeb@0 |
| RtlGetElementGenericTableAvl@8 |
| RtlGetFrame@0 |
| RtlGetLastNtStatus@0 |
| RtlGetLastWin32Error@0 |
| RtlGetLengthWithoutLastFullDosOrNtPathElement@12 |
| RtlGetLengthWithoutTrailingPathSeperators@12 |
| RtlGetNativeSystemInformation@16 |
| RtlGetNtVersionNumbers@12 |
| RtlGetSetBootStatusData@24 |
| RtlHashUnicodeString@16 |
| RtlInitMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlInitOutOfProcessMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlInitUnicodeStringEx@8 |
| RtlInitializeGenericTableAvl@20 |
| RtlInitializeSListHead@4 |
| RtlInsertElementGenericTableAvl@16 |
| RtlInterlockedFlushSList@4 |
| RtlInterlockedPopEntrySList@4 |
| RtlInterlockedPushEntrySList@8 |
| @RtlInterlockedPushListSList@16 ; fastcall |
| RtlIpv4AddressToStringA@8 |
| RtlIpv4AddressToStringW@8 |
| RtlIpv4StringToAddressA@16 |
| RtlIpv4StringToAddressW@16 |
| RtlIpv6AddressToStringA@8 |
| RtlIpv6AddressToStringW@8 |
| RtlIpv6StringToAddressA@12 |
| RtlIpv6StringToAddressW@12 |
| RtlIsActivationContextActive@4 |
| RtlIsGenericTableEmptyAvl@4 |
| RtlLockBootStatusData@4 |
| RtlLockMemoryStreamRegion@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlLogStackBackTrace@0 |
| RtlLookupElementGenericTableAvl@8 |
| RtlMapSecurityErrorToNtStatus@4 |
| RtlMultiAppendUnicodeStringBuffer@12 |
| RtlNewSecurityObjectWithMultipleInheritance@36 |
| RtlNtPathNameToDosPathName@16 |
| RtlNtStatusToDosErrorNoTeb@4 |
| RtlNumberGenericTableElementsAvl@4 |
| RtlPopFrame@4 |
| RtlPushFrame@4 |
| RtlQueryDepthSList@4 |
| RtlQueryHeapInformation@20 |
| RtlQueryInformationActivationContext@28 |
| RtlQueryInformationActiveActivationContext@16 |
| RtlQueryInterfaceMemoryStream@12 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlQueueApcWow64Thread@20 |
| RtlRandomEx@4 |
| RtlReadMemoryStream@16 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlReadOutOfProcessMemoryStream@16 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlRegisterSecureMemoryCacheCallback@4 |
| RtlReleaseActivationContext@4 |
| RtlReleaseMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlRemoveVectoredExceptionHandler@4 |
| RtlRestoreLastWin32Error@4 |
| RtlRevertMemoryStream@4 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlSeekMemoryStream@20 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlSetHeapInformation@16 |
| RtlSetLastWin32Error@4 |
| RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4 |
| RtlSetMemoryStreamSize@12 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlSetProcessIsCritical ; cdecl |
| RtlSetThreadIsCritical ; cdecl |
| RtlStatMemoryStream@12 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlUnhandledExceptionFilter2@8 |
| RtlUnhandledExceptionFilter@4 |
| RtlUnlockBootStatusData@4 |
| RtlUnlockMemoryStreamRegion@24 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlValidateUnicodeString@8 |
| RtlWriteMemoryStream@16 ; not available in Windows XP x64 WoW64 version, but available in Windows Vista and new WoW64 version |
| RtlZombifyActivationContext@4 |
| RtlpApplyLengthFunction@16 |
| RtlpEnsureBufferSize@12 |
| RtlpNotOwnerCriticalSection@4 |
| ZwAddBootEntry@8 |
| ZwCompactKeys@8 |
| ZwCompareTokens@12 |
| ZwCompressKey@4 |
| ZwCreateDebugObject@16 |
| ZwCreateJobSet@12 |
| ZwCreateKeyedEvent@16 |
| ZwCreateProcessEx@36 |
| ZwDebugActiveProcess@8 |
| ZwDebugContinue@12 |
| ZwDeleteBootEntry@4 |
| ZwEnumerateBootEntries@8 |
| ZwEnumerateSystemEnvironmentValuesEx@12 |
| ZwIsProcessInJob@8 |
| ZwLockProductActivationKeys@8 |
| ZwLockRegistryKey@4 |
| ZwMakePermanentObject@4 |
| ZwModifyBootEntry@4 |
| ZwOpenKeyedEvent@12 |
| ZwOpenProcessTokenEx@16 |
| ZwOpenThreadTokenEx@20 |
| ZwQueryBootEntryOrder@8 |
| ZwQueryBootOptions@8 |
| ZwQueryDebugFilterState@8 |
| ZwQueryPortInformationProcess@0 |
| ZwQuerySystemEnvironmentValueEx@20 |
| ZwReleaseKeyedEvent@16 |
| ZwRemoveProcessDebug@8 |
| ZwRenameKey@8 |
| ZwResumeProcess@4 |
| ZwSaveKeyEx@12 |
| ZwSetBootEntryOrder@8 |
| ZwSetBootOptions@8 |
| ZwSetDebugFilterState@12 |
| ZwSetEventBoostPriority@4 |
| ZwSetInformationDebugObject@20 |
| ZwSetSystemEnvironmentValueEx@20 |
| ZwSuspendProcess@4 |
| ZwTraceEvent@16 |
| ZwTranslateFilePath@16 |
| ZwUnloadKeyEx@8 |
| ZwWaitForDebugEvent@16 |
| ZwWaitForKeyedEvent@16 |
| vDbgPrintEx@16 |
| vDbgPrintExWithPrefix@20 |
| |
| ; This is list of symbols added in Windows XP SP1 |
| LdrEnumerateLoadedModules@12 |
| RtlIsThreadWithinLoaderCallout@0 |
| |
| ; This is list of symbols added in Windows XP SP2 |
| LdrHotPatchRoutine@0 ; removed in Windows 8.1 |
| RtlGetUnloadEventTrace@0 |
| RtlIpv4AddressToStringExA@16 |
| RtlIpv4AddressToStringExW@16 |
| RtlIpv4StringToAddressExA@16 |
| RtlIpv4StringToAddressExW@16 |
| RtlIpv6AddressToStringExA@20 |
| RtlIpv6AddressToStringExW@20 |
| RtlIpv6StringToAddressExA@16 |
| RtlIpv6StringToAddressExW@16 |
| |
| ; This is list of symbols added in Windows XP SP2 and in Windows Server 2003 SP1 (not available in 2003 without SP1) |
| KiFastSystemCall@0 |
| KiFastSystemCallRet@0 |
| KiIntSystemCall@0 |
| RtlDecodePointer@4 |
| RtlDecodeSystemPointer@4 |
| RtlEncodePointer@4 |
| RtlEncodeSystemPointer@4 |
| |
| ; In Windows XP SP3 was not added any new symbol |
| |
| ; This is list of symbols added in Windows Server 2003 |
| ; EtwControlTraceA@20 ; removed in Windows Vista |
| ; EtwControlTraceW@20 ; removed in Windows Vista |
| EtwCreateTraceInstanceId@8 |
| ; EtwEnableTrace@24 ; removed in Windows Vista |
| ; EtwEnumerateTraceGuids@12 ; removed in Windows Vista |
| ; EtwFlushTraceA@16 ; removed in Windows Vista |
| ; EtwFlushTraceW@16 ; removed in Windows Vista |
| EtwGetTraceEnableFlags@8 |
| EtwGetTraceEnableLevel@8 |
| EtwGetTraceLoggerHandle@4 |
| ; EtwNotificationRegistrationA@20 ; removed in Windows Vista |
| ; EtwNotificationRegistrationW@20 ; removed in Windows Vista |
| ; EtwQueryAllTracesA@12 ; removed in Windows Vista |
| ; EtwQueryAllTracesW@12 ; removed in Windows Vista |
| ; EtwQueryTraceA@16 ; removed in Windows Vista |
| ; EtwQueryTraceW@16 ; removed in Windows Vista |
| ; EtwReceiveNotificationsA@16 ; removed in Windows Vista |
| ; EtwReceiveNotificationsW@16 ; removed in Windows Vista |
| EtwRegisterTraceGuidsA@32 |
| EtwRegisterTraceGuidsW@32 |
| ; EtwStartTraceA@12 ; removed in Windows Vista |
| ; EtwStartTraceW@12 ; removed in Windows Vista |
| ; EtwStopTraceA@16 ; removed in Windows Vista |
| ; EtwStopTraceW@16 ; removed in Windows Vista |
| ; EtwTraceEvent@12 ; removed in Windows Vista |
| EtwTraceEventInstance@20 |
| EtwTraceMessage ; cdecl |
| EtwTraceMessageVa@24 |
| EtwUnregisterTraceGuids@8 |
| ; EtwUpdateTraceA@16 ; removed in Windows Vista |
| ; EtwUpdateTraceW@16 ; removed in Windows Vista |
| ; EtwpGetTraceBuffer@16 ; removed in Windows Vista |
| ; EtwpSetHWConfigFunction@8 ; removed in Windows Vista |
| LdrQueryImageFileExecutionOptionsEx@28 |
| NtAddDriverEntry@8 |
| NtApphelpCacheControl@8 |
| NtDeleteDriverEntry@4 |
| NtEnumerateDriverEntries@8 |
| NtGetCurrentProcessorNumber@0 |
| NtGetTickCount@0 |
| NtLoadKeyEx@32 ; Windows Server 2003 has ABI "NtLoadKeyEx@16", Windows Vista and new has ABI "NtLoadKeyEx@32" |
| NtModifyDriverEntry@4 |
| NtQueryDriverEntryOrder@8 |
| NtQueryOpenSubKeysEx@16 |
| NtSetDriverEntryOrder@8 |
| NtUnloadKey2@8 |
| RtlCopyMappedMemory@12 |
| RtlDosPathNameToRelativeNtPathName_U@16 |
| RtlGetFullPathName_UstrEx@32 |
| RtlGetThreadErrorMode@0 |
| RtlImageNtHeaderEx@20 |
| RtlInitAnsiStringEx@8 |
| RtlInsertElementGenericTableFull@24 |
| RtlInsertElementGenericTableFullAvl@24 |
| RtlInterlockedCompareExchange64@20 |
| RtlLookupElementGenericTableFull@16 |
| RtlLookupElementGenericTableFullAvl@16 |
| RtlMultipleAllocateHeap@20 |
| RtlMultipleFreeHeap@16 |
| RtlReleaseRelativeName@4 |
| RtlSetEnvironmentStrings@8 |
| RtlSetThreadErrorMode@8 |
| RtlWow64EnableFsRedirection@4 |
| ZwAddDriverEntry@8 |
| ZwApphelpCacheControl@8 |
| ZwDeleteDriverEntry@4 |
| ZwEnumerateDriverEntries@8 |
| ZwGetCurrentProcessorNumber@0 |
| ZwLoadKeyEx@32 ; Windows Server 2003 has ABI "ZwLoadKeyEx@16", Windows Vista and new has ABI "ZwLoadKeyEx@32" |
| ZwModifyDriverEntry@4 |
| ZwQueryDriverEntryOrder@8 |
| ZwQueryOpenSubKeysEx@16 |
| ZwSetDriverEntryOrder@8 |
| ZwUnloadKey2@8 |
| |
| ; This is list of symbols added in Windows Server 2003 SP1 and Windows XP x64 SP1 (WoW64 version) |
| ExpInterlockedPopEntrySListEnd@0 ; removed in Windows 10 November Update (Threshold 2 / 1511) WoW64 version, but available in non-WoW64 version |
| ExpInterlockedPopEntrySListFault@0 ; removed in Windows 10 November Update (Threshold 2 / 1511) WoW64 version, but available in non-WoW64 version |
| ExpInterlockedPopEntrySListResume@0 ; removed in Windows 10 November Update (Threshold 2 / 1511) WoW64 version, but available in non-WoW64 version |
| LdrOpenImageFileOptionsKey@12 |
| LdrQueryImageFileKeyOption@24 |
| NtWaitForMultipleObjects32@20 |
| NtWow64CsrAllocateCaptureBuffer@8 ; available only in 32-bit WoW64 version on 64-bit system |
| NtWow64CsrAllocateMessagePointer@12 ; available only in 32-bit WoW64 version on 64-bit system |
| NtWow64CsrCaptureMessageBuffer@16 ; available only in 32-bit WoW64 version on 64-bit system |
| NtWow64CsrCaptureMessageString@20 ; available only in 32-bit WoW64 version on 64-bit system |
| NtWow64CsrClientCallServer@16 ; available only in 32-bit WoW64 version on 64-bit system |
| NtWow64CsrClientConnectToServer@20 ; available only in 32-bit WoW64 version on 64-bit system |
| NtWow64CsrFreeCaptureBuffer@4 ; available only in 32-bit WoW64 version on 64-bit system |
| NtWow64CsrGetProcessId@0 ; available only in 32-bit WoW64 version on 64-bit system |
| NtWow64CsrIdentifyAlertableThread@0 ; available only in 32-bit WoW64 version on 64-bit system |
| ; NtWow64CsrNewThread@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7 |
| ; NtWow64CsrSetPriorityClass@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7 |
| NtWow64DebuggerCall@20 ; available only in 32-bit WoW64 version on 64-bit system |
| NtWow64GetNativeSystemInformation@16 ; available only in 32-bit WoW64 version on 64-bit system |
| NtWow64QueryInformationProcess64@20 ; available only in 32-bit WoW64 version on 64-bit system |
| NtWow64QueryVirtualMemory64@32 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 (Threshold / 1507) |
| NtWow64ReadVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system |
| RtlAcquirePrivilege@16 |
| RtlAddVectoredContinueHandler@8 |
| RtlAllocateActivationContextStack@4 |
| RtlDosPathNameToNtPathName_U_WithStatus@16 |
| RtlDosPathNameToRelativeNtPathName_U_WithStatus@16 |
| RtlFormatMessageEx@40 |
| RtlFreeActivationContextStack@4 |
| RtlGetCriticalSectionRecursionCount@4 |
| RtlGetCurrentProcessorNumber@0 |
| RtlIsCriticalSectionLocked@4 |
| RtlIsCriticalSectionLockedByThread@4 |
| RtlReleasePrivilege@4 |
| RtlRemoveVectoredContinueHandler@4 |
| RtlSetUnhandledExceptionFilter@4 |
| RtlWow64EnableFsRedirectionEx@8 |
| ZwWaitForMultipleObjects32@20 |
| ZwWow64CsrAllocateCaptureBuffer@8 ; available only in 32-bit WoW64 version on 64-bit system |
| ZwWow64CsrAllocateMessagePointer@12 ; available only in 32-bit WoW64 version on 64-bit system |
| ZwWow64CsrCaptureMessageBuffer@16 ; available only in 32-bit WoW64 version on 64-bit system |
| ZwWow64CsrCaptureMessageString@20 ; available only in 32-bit WoW64 version on 64-bit system |
| ZwWow64CsrClientCallServer@16 ; available only in 32-bit WoW64 version on 64-bit system |
| ZwWow64CsrClientConnectToServer@20 ; available only in 32-bit WoW64 version on 64-bit system |
| ZwWow64CsrFreeCaptureBuffer@4 ; available only in 32-bit WoW64 version on 64-bit system |
| ZwWow64CsrGetProcessId@0 ; available only in 32-bit WoW64 version on 64-bit system |
| ZwWow64CsrIdentifyAlertableThread@0 ; available only in 32-bit WoW64 version on 64-bit system |
| ; ZwWow64CsrNewThread@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7 |
| ; ZwWow64CsrSetPriorityClass@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7 |
| ZwWow64DebuggerCall@20 ; available only in 32-bit WoW64 version on 64-bit system |
| ZwWow64GetNativeSystemInformation@16 ; available only in 32-bit WoW64 version on 64-bit system |
| ZwWow64QueryInformationProcess64@20 ; available only in 32-bit WoW64 version on 64-bit system |
| ZwWow64QueryVirtualMemory64@32 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 (Threshold / 1507) |
| ZwWow64ReadVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system |
| |
| ; In Windows Server 2003 SP2 and Windows XP x64 SP2 (WoW64 version) was not added any new symbol |
| |
| ; This is list of symbols added in Windows Vista |
| A_SHAFinal@8 |
| A_SHAInit@4 |
| A_SHAUpdate@12 |
| AlpcAdjustCompletionListConcurrencyCount@8 |
| AlpcFreeCompletionListMessage@8 |
| AlpcGetCompletionListLastMessageInformation@12 |
| AlpcGetCompletionListMessageAttributes@8 |
| AlpcGetHeaderSize@4 |
| AlpcGetMessageAttribute@8 |
| AlpcGetMessageFromCompletionList@8 |
| AlpcGetOutstandingCompletionListMessageCount@4 |
| AlpcInitializeMessageAttribute@16 |
| AlpcMaxAllowedMessageLength@0 |
| AlpcRegisterCompletionList@20 |
| AlpcRegisterCompletionListWorkerThread@4 |
| AlpcUnregisterCompletionList@4 |
| AlpcUnregisterCompletionListWorkerThread@4 |
| CsrVerifyRegion@8 |
| EtwDeliverDataBlock@4 |
| EtwEnumerateProcessRegGuids@12 |
| EtwEventActivityIdControl@8 |
| EtwEventEnabled@12 |
| EtwEventProviderEnabled@20 |
| EtwEventRegister@16 |
| EtwEventUnregister@8 |
| EtwEventWrite@20 |
| EtwEventWriteEndScenario@20 |
| EtwEventWriteFull@32 |
| EtwEventWriteStartScenario@20 |
| EtwEventWriteString@24 |
| EtwEventWriteTransfer@28 |
| EtwLogTraceEvent@12 |
| EtwNotificationRegister@20 |
| EtwNotificationUnregister@12 |
| EtwProcessPrivateLoggerRequest@4 |
| EtwRegisterSecurityProvider@0 |
| EtwReplyNotification@4 |
| EtwSendNotification@20 |
| EtwSetMark@16 |
| EtwWriteUMSecurityEvent@16 |
| EtwpCreateEtwThread@8 |
| EtwpGetCpuSpeed@8 ; Windows Vista-8 has ABI "EtwpGetCpuSpeed@8", Windows 8.1 and new has ABI "EtwpGetCpuSpeed@4" |
| ; EtwpNotificationThread@0 ; removed in Windows 8.1 |
| LdrAddLoadAsDataTable@16 ; Windows Vista has ABI "LdrAddLoadAsDataTable@16", Windows 7 and new has ABI "LdrAddLoadAsDataTable@20" |
| LdrGetFailureData@0 |
| LdrGetFileNameFromLoadAsDataTable@8 |
| LdrGetProcedureAddressEx@20 |
| LdrLoadAlternateResourceModuleEx@20 |
| LdrQueryModuleServiceTags@12 |
| LdrRegisterDllNotification@16 |
| LdrRemoveLoadAsDataTable@16 |
| LdrResFindResource@36 |
| LdrResFindResourceDirectory@28 |
| LdrResRelease@12 |
| LdrResSearchResource@32 |
| LdrSetMUICacheType@4 |
| LdrUnloadAlternateResourceModuleEx@8 |
| LdrUnregisterDllNotification@4 |
| LdrVerifyImageMatchesChecksumEx@8 |
| MD4Final@4 |
| MD4Init@4 |
| MD4Update@12 |
| MD5Final@4 |
| MD5Init@4 |
| MD5Update@12 |
| NtAcquireCMFViewOwnership@12 ; removed in Windows 7 |
| NtAlpcAcceptConnectPort@36 |
| NtAlpcCancelMessage@12 |
| NtAlpcConnectPort@44 |
| NtAlpcCreatePort@12 |
| NtAlpcCreatePortSection@24 |
| NtAlpcCreateResourceReserve@16 |
| NtAlpcCreateSectionView@12 |
| NtAlpcCreateSecurityContext@12 |
| NtAlpcDeletePortSection@12 |
| NtAlpcDeleteResourceReserve@12 |
| NtAlpcDeleteSectionView@12 |
| NtAlpcDeleteSecurityContext@12 |
| NtAlpcDisconnectPort@8 |
| NtAlpcImpersonateClientOfPort@12 |
| NtAlpcOpenSenderProcess@24 |
| NtAlpcOpenSenderThread@24 |
| NtAlpcQueryInformation@20 |
| NtAlpcQueryInformationMessage@24 |
| NtAlpcRevokeSecurityContext@12 |
| NtAlpcSendWaitReceivePort@32 |
| NtAlpcSetInformation@16 |
| NtCancelIoFileEx@12 |
| NtCancelSynchronousIoFile@12 |
| ; NtClearAllSavepointsTransaction@4 ; removed in Windows Vista SP1 |
| ; NtClearSavepointTransaction@8 ; removed in Windows Vista SP1 |
| NtCommitComplete@8 |
| NtCommitEnlistment@8 |
| NtCommitTransaction@8 |
| NtCreateEnlistment@32 |
| NtCreateKeyTransacted@32 |
| NtCreatePrivateNamespace@16 |
| NtCreateResourceManager@28 |
| NtCreateThreadEx@44 |
| NtCreateTransaction@40 |
| NtCreateTransactionManager@24 |
| NtCreateUserProcess@44 |
| NtCreateWorkerFactory@40 |
| NtDeletePrivateNamespace@4 |
| NtEnumerateTransactionObject@20 |
| NtFlushInstallUILanguage@8 |
| NtFlushProcessWriteBuffers@0 |
| NtFreezeRegistry@4 |
| NtFreezeTransactions@8 |
| NtGetMUIRegistryInfo@12 |
| NtGetNextProcess@20 |
| NtGetNextThread@24 |
| NtGetNlsSectionPtr@20 |
| NtGetNotificationResourceManager@28 |
| NtInitializeNlsFiles@16 ; Windows Vista has ABI "NtInitializeNlsFiles@12", Windows Vista SP1 and SP2 has ABI "NtInitializeNlsFiles@16", Windows 7 and new has again ABI "NtInitializeNlsFiles@12" |
| NtIsUILanguageComitted@0 |
| ; NtListTransactions@12 ; removed in Windows Vista SP1 |
| NtMapCMFModule@24 |
| ; NtMarshallTransaction@24 ; removed in Windows Vista SP1 |
| NtOpenEnlistment@20 |
| NtOpenKeyTransacted@16 |
| NtOpenPrivateNamespace@16 |
| NtOpenResourceManager@20 |
| NtOpenSession@12 |
| NtOpenTransaction@20 |
| NtOpenTransactionManager@24 |
| NtPrePrepareComplete@8 |
| NtPrePrepareEnlistment@8 |
| NtPrepareComplete@8 |
| NtPrepareEnlistment@8 |
| NtPropagationComplete@16 |
| NtPropagationFailed@12 |
| ; NtPullTransaction@28 ; removed in Windows Vista SP1 |
| NtQueryInformationEnlistment@20 |
| NtQueryInformationResourceManager@20 |
| NtQueryInformationTransaction@20 |
| NtQueryInformationTransactionManager@20 |
| NtQueryInformationWorkerFactory@20 |
| NtQueryLicenseValue@20 |
| NtReadOnlyEnlistment@8 |
| NtRecoverEnlistment@8 |
| NtRecoverResourceManager@4 |
| NtRecoverTransactionManager@4 |
| NtRegisterProtocolAddressInformation@20 |
| NtReleaseCMFViewOwnership@0 ; removed in Windows 7 |
| NtReleaseWorkerFactoryWorker@4 |
| NtRemoveIoCompletionEx@24 |
| NtRollbackComplete@8 |
| NtRollbackEnlistment@8 |
| ; NtRollbackSavepointTransaction@8 ; removed in Windows Vista SP1 |
| NtRollbackTransaction@8 |
| NtRollforwardTransactionManager@8 |
| ; NtSavepointComplete@8 ; removed in Windows Vista SP1 |
| ; NtSavepointTransaction@12 ; removed in Windows Vista SP1 |
| NtSetInformationEnlistment@16 |
| NtSetInformationResourceManager@16 |
| NtSetInformationTransaction@16 |
| NtSetInformationTransactionManager@16 |
| NtSetInformationWorkerFactory@16 |
| NtShutdownWorkerFactory@8 |
| NtSinglePhaseReject@8 |
| ; NtStartTm@0 ; removed in Windows Vista SP1 |
| NtThawRegistry@0 |
| NtThawTransactions@0 |
| NtTraceControl@24 |
| NtWaitForWorkViaWorkerFactory@8 ; Windows Vista-7 has ABI "NtWaitForWorkViaWorkerFactory@8", Windows 8 has ABI "NtWaitForWorkViaWorkerFactory@16", Windows 8.1 and new has ABI "NtWaitForWorkViaWorkerFactory@20" |
| NtWorkerFactoryWorkerReady@4 |
| NtWow64CallFunction64@28 ; available only in 32-bit WoW64 version on 64-bit system |
| NtWow64CsrVerifyRegion@8 ; available only in 32-bit WoW64 version on 64-bit system |
| NtWow64WriteVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system |
| ; ResCCloseRuntimeView@4 ; removed in Windows Vista SP1 |
| ; ResCCompareCacheIDs@8 ; removed in Windows Vista SP1 |
| ; ResCCreateCultureMap@12 ; removed in Windows Vista SP1 |
| ; ResCCreateDefaultCultureMap@4 ; removed in Windows Vista SP1 |
| ; ResCCreateRuntimeView@16 ; removed in Windows Vista SP1 |
| ; ResCDirectoryCreateAndPopulate@12 ; removed in Windows Vista SP1 |
| ; ResCDirectoryCreateMapping@16 ; removed in Windows Vista SP1 |
| ; ResCDirectoryFree@4 ; removed in Windows Vista SP1 |
| ; ResCDirectoryGetBaseFolder@4 ; removed in Windows Vista SP1 |
| ; ResCDirectoryGetEntry@24 ; removed in Windows Vista SP1 |
| ; ResCDirectoryGetEntryCopy@28 ; removed in Windows Vista SP1 |
| ; ResCDirectoryGetEntryEx@32 ; removed in Windows Vista SP1 |
| ; ResCDirectoryGetEntryExCopy@36 ; removed in Windows Vista SP1 |
| ; ResCDirectoryGetEntryIndex@24 ; removed in Windows Vista SP1 |
| ; ResCDirectoryGetEntryIndexEx@32 ; removed in Windows Vista SP1 |
| ; ResCDirectoryGetFirstEntry@20 ; removed in Windows Vista SP1 |
| ; ResCDirectoryGetFirstEntryIndex@20 ; removed in Windows Vista SP1 |
| ; ResCDirectoryGetSegmentIndex@8 ; removed in Windows Vista SP1 |
| ; ResCDirectoryGetSegmentName@8 ; removed in Windows Vista SP1 |
| ; ResCDirectoryLoadFixedSize@4 ; removed in Windows Vista SP1 |
| ; ResCDirectoryOpenMapping@8 ; removed in Windows Vista SP1 |
| ; ResCFreeCultureMap@4 ; removed in Windows Vista SP1 |
| ; ResCGetCacheIndices@16 ; removed in Windows Vista SP1 |
| ; ResCGetCultureID@8 ; removed in Windows Vista SP1 |
| ; ResCGetCultureIndex@8 ; removed in Windows Vista SP1 |
| ; ResCGetCultureName@16 ; removed in Windows Vista SP1 |
| ; ResCGetHighestCacheIndex@4 ; removed in Windows Vista SP1 |
| ; ResCGetHighestConsecutiveCacheIndex@12 ; removed in Windows Vista SP1 |
| ; ResCGetIndexedName@20 ; removed in Windows Vista SP1 |
| ; ResCGetName@16 ; removed in Windows Vista SP1 |
| ; ResCGetRegistryBaseFolder@16 ; removed in Windows Vista SP1 |
| ; ResCGetRegistryConfig@8 ; removed in Windows Vista SP1 |
| ; ResCGetRegistryLatestIndex@8 ; removed in Windows Vista SP1 |
| ; ResCGetRegistryMappingPrefix@16 ; removed in Windows Vista SP1 |
| ; ResCGetRegistryStatus@8 ; removed in Windows Vista SP1 |
| ; ResCGetSubIndexedName@24 ; removed in Windows Vista SP1 |
| ; ResCInitRuntimeView@8 ; removed in Windows Vista SP1 |
| ; ResCInitRuntimeViewEx@12 ; removed in Windows Vista SP1 |
| ; ResCKeDirectoryOpenMapping@20 ; removed in Windows Vista SP1 |
| ; ResCKeGetBaseFolder@8 ; removed in Windows Vista SP1 |
| ; ResCKeGetCacheIndices@8 ; removed in Windows Vista SP1 |
| ; ResCKeInitRuntimeViewEx@4 ; removed in Windows Vista SP1 |
| ; ResCKeSegmentOpenMapping@8 ; removed in Windows Vista SP1 |
| ; ResCLoadCultureMap@4 ; removed in Windows Vista SP1 |
| ; ResCOpenRegistryKey@24 ; removed in Windows Vista SP1 |
| ; ResCOpenRuntimeView@8 ; removed in Windows Vista SP1 |
| ; ResCReleaseInitMutex@4 ; removed in Windows Vista SP1 |
| ; ResCReloadCultureMap@4 ; removed in Windows Vista SP1 |
| ; ResCRequestInitMutex@8 ; removed in Windows Vista SP1 |
| ; ResCRuntimeGetAnySegmentData@20 ; removed in Windows Vista SP1 |
| ; ResCRuntimeGetCultureID@8 ; removed in Windows Vista SP1 |
| ; ResCRuntimeGetEntryData@8 ; removed in Windows Vista SP1 |
| ; ResCRuntimeGetEntryDataEx@12 ; removed in Windows Vista SP1 |
| ; ResCRuntimeGetResourceData@32 ; removed in Windows Vista SP1 |
| ; ResCRuntimeGetResourceDataEx@36 ; removed in Windows Vista SP1 |
| ; ResCRuntimeGetResourceDataForCulture@32 ; removed in Windows Vista SP1 |
| ; ResCRuntimeGetSegmentData@16 ; removed in Windows Vista SP1 |
| ; ResCRuntimeGetSegmentDataEx@20 ; removed in Windows Vista SP1 |
| ; ResCRuntimeViewLoadCultureMap@4 ; removed in Windows Vista SP1 |
| ; ResCSaveRegistryBaseFolder@8 ; removed in Windows Vista SP1 |
| ; ResCSaveRegistryConfig@8 ; removed in Windows Vista SP1 |
| ; ResCSaveRegistryLatestIndex@8 ; removed in Windows Vista SP1 |
| ; ResCSaveRegistryStatus@8 ; removed in Windows Vista SP1 |
| ; ResCSegmentCreateAndPopulate@12 ; removed in Windows Vista SP1 |
| ; ResCSegmentCreateMapping@20 ; removed in Windows Vista SP1 |
| ; ResCSegmentFree@4 ; removed in Windows Vista SP1 |
| ; ResCSegmentGetData@8 ; removed in Windows Vista SP1 |
| ; ResCSegmentLoadFixedSize@4 ; removed in Windows Vista SP1 |
| ; ResCSegmentOpenMapping@8 ; removed in Windows Vista SP1 |
| ; ResCSegmentReserveMapping@16 ; removed in Windows Vista SP1 |
| ; ResCSetCacheSecurityType@4 ; removed in Windows Vista SP1 |
| RtlAcquireSRWLockExclusive@4 |
| RtlAcquireSRWLockShared@4 |
| RtlAddMandatoryAce@24 |
| RtlAddSIDToBoundaryDescriptor@8 |
| RtlAllocateMemoryBlockLookaside@12 |
| RtlAllocateMemoryZone@12 |
| RtlBarrier@8 |
| RtlBarrierForDelete@8 |
| RtlCleanUpTEBLangLists@0 |
| RtlCloneUserProcess@20 |
| RtlCmDecodeMemIoResource@8 |
| RtlCmEncodeMemIoResource@24 |
| RtlCommitDebugInfo@8 |
| RtlCompareAltitudes@8 |
| RtlCompareUnicodeStrings@20 |
| RtlConnectToSm@16 |
| RtlConvertLCIDToString@20 |
| RtlCreateBoundaryDescriptor@8 |
| RtlCreateEnvironmentEx@12 |
| RtlCreateMemoryBlockLookaside@20 |
| RtlCreateMemoryZone@12 |
| RtlCreateProcessParametersEx@44 |
| RtlCreateServiceSid@12 |
| RtlCreateUserStack@24 |
| RtlCultureNameToLCID@8 |
| RtlDeCommitDebugInfo@12 |
| RtlDeleteBarrier@4 |
| RtlDeleteBoundaryDescriptor@4 |
| RtlDestroyMemoryBlockLookaside@4 |
| RtlDestroyMemoryZone@4 |
| RtlExitUserProcess@4 |
| RtlExpandEnvironmentStrings@24 |
| RtlExtendMemoryBlockLookaside@8 |
| RtlExtendMemoryZone@8 |
| RtlFindAceByType@12 |
| RtlFindClosestEncodableLength@12 |
| RtlFlsAlloc@8 |
| RtlFlsFree@4 |
| RtlFreeMemoryBlockLookaside@8 |
| RtlFreeUserStack@4 |
| RtlGetCurrentTransaction@0 |
| RtlGetFileMUIPath@28 |
| RtlGetIntegerAtom@8 |
| RtlGetParentLocaleName@16 |
| RtlGetProductInfo@20 |
| RtlGetSystemPreferredUILanguages@20 |
| RtlGetThreadLangIdByIndex@16 |
| RtlGetThreadPreferredUILanguages@16 |
| RtlGetUILanguageInfo@20 |
| RtlGetUnloadEventTraceEx@12 |
| RtlGetUserPreferredUILanguages@20 |
| RtlHeapTrkInitialize@4 |
| RtlIdnToAscii@20 |
| RtlIdnToNameprepUnicode@20 |
| RtlIdnToUnicode@20 |
| RtlImpersonateSelfEx@12 |
| RtlInitBarrier@12 |
| RtlInitializeConditionVariable@4 |
| RtlInitializeCriticalSectionEx@12 |
| RtlInitializeNtUserPfn@24 |
| RtlInitializeSRWLock@4 |
| RtlIoDecodeMemIoResource@16 |
| RtlIoEncodeMemIoResource@40 |
| RtlIsCurrentThreadAttachExempt@0 |
| RtlIsNormalizedString@16 |
| RtlIsValidLocaleName@8 |
| RtlLCIDToCultureName@8 |
| RtlLcidToLocaleName@16 |
| RtlLocaleNameToLcid@12 |
| RtlLockCurrentThread@0 |
| RtlLockMemoryBlockLookaside@4 |
| RtlLockMemoryZone@4 |
| RtlLockModuleSection@4 |
| RtlNormalizeString@20 |
| RtlOwnerAcesPresent@4 |
| RtlProcessFlsData@4 ; Windows Vista-10 has ABI "RtlProcessFlsData@4", Windows 10 May 2019 Update (19H1 / 1903) and new has ABI "RtlProcessFlsData@8" |
| RtlQueryActivationContextApplicationSettings@28 |
| RtlQueryCriticalSectionOwner@4 ; Windows Vista-8.1 has ABI "RtlQueryCriticalSectionOwner@4", Windows 10 and new has ABI "RtlQueryCriticalSectionOwner@8" |
| RtlQueryDynamicTimeZoneInformation@4 |
| RtlQueryElevationFlags@4 |
| RtlQueryEnvironmentVariable@24 |
| RtlQueryModuleInformation@12 |
| RtlRegisterThreadWithCsrss@0 |
| RtlReleaseSRWLockExclusive@4 |
| RtlReleaseSRWLockShared@4 |
| RtlRemovePrivileges@12 |
| RtlReportException@12 |
| RtlResetMemoryBlockLookaside@4 |
| RtlResetMemoryZone@4 |
| RtlRetrieveNtUserPfn@12 |
| RtlRunOnceBeginInitialize@12 |
| RtlRunOnceComplete@12 |
| RtlRunOnceExecuteOnce@16 |
| RtlRunOnceInitialize@4 |
| RtlSendMsgToSm@8 |
| RtlSetCurrentTransaction@4 |
| RtlSetDynamicTimeZoneInformation@4 |
| RtlSetEnvironmentVar@20 |
| RtlSetProcessDebugInformation@12 |
| RtlSetThreadPreferredUILanguages@12 |
| RtlSidDominates@12 |
| RtlSidEqualLevel@12 |
| RtlSidHashInitialize@12 |
| RtlSidHashLookup@8 |
| RtlSidIsHigherLevel@12 |
| RtlSleepConditionVariableCS@12 |
| RtlSleepConditionVariableSRW@16 |
| RtlTestBit@8 |
| RtlTryAcquirePebLock@0 |
| RtlUnlockCurrentThread@0 |
| RtlUnlockMemoryBlockLookaside@4 |
| RtlUnlockMemoryZone@4 |
| RtlUnlockModuleSection@4 |
| RtlUpdateClonedCriticalSection@4 |
| RtlUpdateClonedSRWLock@8 |
| RtlUserThreadStart@8 |
| RtlWakeAllConditionVariable@4 |
| RtlWakeConditionVariable@4 |
| RtlWerpReportException@16 ; Windows Vista-8 has ABI "RtlWerpReportException@16", Windows 8.1 and new has ABI "RtlWerpReportException@24" |
| RtlWow64CallFunction64@28 |
| RtlWow64LogMessageInEventLogger@12 ; available only in 32-bit WoW64 version on 64-bit system |
| RtlpCleanupRegistryKeys@0 |
| RtlpConvertCultureNamesToLCIDs@8 |
| RtlpConvertLCIDsToCultureNames@8 |
| RtlpCreateProcessRegistryInfo@4 |
| RtlpGetLCIDFromLangInfoNode@12 |
| RtlpGetNameFromLangInfoNode@12 |
| RtlpGetSystemDefaultUILanguage@4 ; Windows Vista has ABI "RtlpGetSystemDefaultUILanguage@4", Windows 7 and new has ABI "RtlpGetSystemDefaultUILanguage@8" |
| RtlpGetUserOrMachineUILanguage4NLS@12 |
| RtlpInitializeLangRegistryInfo@4 |
| RtlpIsQualifiedLanguage@12 |
| RtlpLoadMachineUIByPolicy@12 |
| RtlpLoadUserUIByPolicy@12 |
| RtlpMuiFreeLangRegistryInfo@4 |
| RtlpMuiRegCreateRegistryInfo@0 |
| RtlpMuiRegFreeRegistryInfo@8 |
| RtlpMuiRegLoadRegistryInfo@8 |
| RtlpQueryDefaultUILanguage@8 |
| RtlpQueryProcessDebugInformationRemote@4 ; available only in 32-bit WoW64 version on 64-bit system, since Windows 10 Creators Update (Redstone 2 / 1703) available also in non-WoW64 version |
| RtlpRefreshCachedUILanguage@8 |
| RtlpSetInstallLanguage@8 |
| RtlpSetPreferredUILanguages@12 |
| RtlpSetUserPreferredUILanguages@12 |
| RtlpVerifyAndCommitUILanguageSettings@4 |
| ShipAssert@8 |
| ShipAssertGetBufferInfo@8 |
| ShipAssertMsgA@12 |
| ShipAssertMsgW@12 |
| TpAllocAlpcCompletion@20 |
| TpAllocCleanupGroup@4 |
| TpAllocIoCompletion@20 |
| TpAllocPool@8 |
| TpAllocTimer@16 |
| TpAllocWait@16 |
| TpAllocWork@16 |
| TpCallbackLeaveCriticalSectionOnCompletion@8 |
| TpCallbackMayRunLong@4 |
| TpCallbackReleaseMutexOnCompletion@8 |
| TpCallbackReleaseSemaphoreOnCompletion@12 |
| TpCallbackSetEventOnCompletion@8 |
| TpCallbackUnloadDllOnCompletion@8 |
| TpCancelAsyncIoOperation@4 |
| TpCaptureCaller@4 |
| TpCheckTerminateWorker@4 |
| TpDbgDumpHeapUsage@12 |
| TpDbgSetLogRoutine@4 |
| TpDisassociateCallback@4 |
| TpIsTimerSet@4 |
| TpPostWork@4 |
| TpReleaseAlpcCompletion@4 |
| TpReleaseCleanupGroup@4 |
| TpReleaseCleanupGroupMembers@12 |
| TpReleaseIoCompletion@4 |
| TpReleasePool@4 |
| TpReleaseTimer@4 |
| TpReleaseWait@4 |
| TpReleaseWork@4 |
| TpSetPoolMaxThreads@8 |
| TpSetPoolMinThreads@8 |
| TpSetTimer@16 |
| TpSetWait@12 |
| TpSimpleTryPost@12 |
| TpStartAsyncIoOperation@4 |
| TpWaitForAlpcCompletion@4 |
| TpWaitForIoCompletion@8 |
| TpWaitForTimer@8 |
| TpWaitForWait@8 |
| TpWaitForWork@8 |
| WerCheckEventEscalation@8 ; removed in Windows 7 |
| WerReportSQMEvent@16 ; Windows Vista has ABI "WerReportSQMEvent@12", Windows 7 and new has ABI "WerReportSQMEvent@16" |
| WerReportWatsonEvent@16 ; removed in Windows 7 |
| WinSqmAddToStream@16 |
| WinSqmEndSession@4 |
| WinSqmEventEnabled@8 |
| WinSqmEventWrite@12 |
| WinSqmIsOptedIn@0 |
| WinSqmSetString@12 |
| WinSqmStartSession@12 |
| ZwAcquireCMFViewOwnership@12 ; removed in Windows 7 |
| ZwAlpcAcceptConnectPort@36 |
| ZwAlpcCancelMessage@12 |
| ZwAlpcConnectPort@44 |
| ZwAlpcCreatePort@12 |
| ZwAlpcCreatePortSection@24 |
| ZwAlpcCreateResourceReserve@16 |
| ZwAlpcCreateSectionView@12 |
| ZwAlpcCreateSecurityContext@12 |
| ZwAlpcDeletePortSection@12 |
| ZwAlpcDeleteResourceReserve@12 |
| ZwAlpcDeleteSectionView@12 |
| ZwAlpcDeleteSecurityContext@12 |
| ZwAlpcDisconnectPort@8 |
| ZwAlpcImpersonateClientOfPort@12 |
| ZwAlpcOpenSenderProcess@24 |
| ZwAlpcOpenSenderThread@24 |
| ZwAlpcQueryInformation@20 |
| ZwAlpcQueryInformationMessage@24 |
| ZwAlpcRevokeSecurityContext@12 |
| ZwAlpcSendWaitReceivePort@32 |
| ZwAlpcSetInformation@16 |
| ZwCancelIoFileEx@12 |
| ZwCancelSynchronousIoFile@12 |
| ; ZwClearAllSavepointsTransaction@4 ; removed in Windows Vista SP1 |
| ; ZwClearSavepointTransaction@8 ; removed in Windows Vista SP1 |
| ZwCommitComplete@8 |
| ZwCommitEnlistment@8 |
| ZwCommitTransaction@8 |
| ZwCreateEnlistment@32 |
| ZwCreateKeyTransacted@32 |
| ZwCreatePrivateNamespace@16 |
| ZwCreateResourceManager@28 |
| ZwCreateThreadEx@44 |
| ZwCreateTransaction@40 |
| ZwCreateTransactionManager@24 |
| ZwCreateUserProcess@44 |
| ZwCreateWorkerFactory@40 |
| ZwDeletePrivateNamespace@4 |
| ZwEnumerateTransactionObject@20 |
| ZwFlushInstallUILanguage@8 |
| ZwFlushProcessWriteBuffers@0 |
| ZwFreezeRegistry@4 |
| ZwFreezeTransactions@8 |
| ZwGetMUIRegistryInfo@12 |
| ZwGetNextProcess@20 |
| ZwGetNextThread@24 |
| ZwGetNlsSectionPtr@20 |
| ZwGetNotificationResourceManager@28 |
| ZwInitializeNlsFiles@16 ; Windows Vista has ABI "ZwInitializeNlsFiles@12", Windows Vista SP1 and SP2 has ABI "ZwInitializeNlsFiles@16", Windows 7 and new has again ABI "ZwInitializeNlsFiles@12" |
| ZwIsUILanguageComitted@0 |
| ; ZwListTransactions@12 ; removed in Windows Vista SP1 |
| ZwMapCMFModule@24 |
| ; ZwMarshallTransaction@24 ; removed in Windows Vista SP1 |
| ZwOpenEnlistment@20 |
| ZwOpenKeyTransacted@16 |
| ZwOpenPrivateNamespace@16 |
| ZwOpenResourceManager@20 |
| ZwOpenSession@12 |
| ZwOpenTransaction@20 |
| ZwOpenTransactionManager@24 |
| ZwPrePrepareComplete@8 |
| ZwPrePrepareEnlistment@8 |
| ZwPrepareComplete@8 |
| ZwPrepareEnlistment@8 |
| ZwPropagationComplete@16 |
| ZwPropagationFailed@12 |
| ; ZwPullTransaction@28 ; removed in Windows Vista SP1 |
| ZwQueryInformationEnlistment@20 |
| ZwQueryInformationResourceManager@20 |
| ZwQueryInformationTransaction@20 |
| ZwQueryInformationTransactionManager@20 |
| ZwQueryInformationWorkerFactory@20 |
| ZwQueryLicenseValue@20 |
| ZwReadOnlyEnlistment@8 |
| ZwRecoverEnlistment@8 |
| ZwRecoverResourceManager@4 |
| ZwRecoverTransactionManager@4 |
| ZwRegisterProtocolAddressInformation@20 |
| ZwReleaseCMFViewOwnership@0 ; removed in Windows 7 |
| ZwReleaseWorkerFactoryWorker@4 |
| ZwRemoveIoCompletionEx@24 |
| ZwRollbackComplete@8 |
| ZwRollbackEnlistment@8 |
| ; ZwRollbackSavepointTransaction@8 ; removed in Windows Vista SP1 |
| ZwRollbackTransaction@8 |
| ZwRollforwardTransactionManager@8 |
| ; ZwSavepointComplete@8 ; removed in Windows Vista SP1 |
| ; ZwSavepointTransaction@12 ; removed in Windows Vista SP1 |
| ZwSetInformationEnlistment@16 |
| ZwSetInformationResourceManager@16 |
| ZwSetInformationTransaction@16 |
| ZwSetInformationTransactionManager@16 |
| ZwSetInformationWorkerFactory@16 |
| ZwShutdownWorkerFactory@8 |
| ZwSinglePhaseReject@8 |
| ; ZwStartTm@0 ; removed in Windows Vista SP1 |
| ZwThawRegistry@0 |
| ZwThawTransactions@0 |
| ZwTraceControl@24 |
| ZwWaitForWorkViaWorkerFactory@8 ; Windows Vista-7 has ABI "ZwWaitForWorkViaWorkerFactory@8", Windows 8 has ABI "ZwWaitForWorkViaWorkerFactory@16", Windows 8.1 and new has ABI "ZwWaitForWorkViaWorkerFactory@20" |
| ZwWorkerFactoryWorkerReady@4 |
| ZwWow64CallFunction64@28 ; available only in 32-bit WoW64 version on 64-bit system |
| ZwWow64CsrVerifyRegion@8 ; available only in 32-bit WoW64 version on 64-bit system |
| ZwWow64WriteVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system |
| ; _ResCGetRegistryFlags@16 ; removed in Windows Vista SP1 |
| ; _ResCMatchFlags@12 ; removed in Windows Vista SP1 |
| ; _ResCSaveRegistryFlags@16 ; removed in Windows Vista SP1 |
| |
| ; This is list of symbols added in Windows Vista SP1 |
| LdrpResGetMappingSize@16 |
| LdrpResGetRCConfig@20 ; removed in Windows 7 |
| LdrpResGetResourceDirectory@20 |
| NtRenameTransactionManager@8 |
| NtReplacePartitionUnit@12 |
| NtdllDefWindowProc_A@16 ; same as user32.DefWindowProcA |
| NtdllDefWindowProc_W@16 ; same as user32.DefWindowProcW |
| NtdllDialogWndProc_A@16 ; same as user32.DefDlgProcA |
| NtdllDialogWndProc_W@16 ; same as user32.DefDlgProcW |
| RtlDeregisterSecureMemoryCacheCallback@4 |
| RtlInitializeExceptionChain@4 |
| RtlNumberOfSetBitsUlongPtr@4 |
| RtlpCheckDynamicTimeZoneInformation@8 |
| ZwRenameTransactionManager@8 |
| ZwReplacePartitionUnit@12 |
| |
| ; This is list of symbols added in Windows Vista SP2 |
| RtlpInterlockedPopEntrySeqSListEnd@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7 |
| RtlpInterlockedPopEntrySeqSListFault@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7 |
| RtlpInterlockedPopEntrySeqSListResume@0 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 7 |
| |
| ; This is list of symbols added in Windows 7 |
| AlpcRundownCompletionList@4 |
| EtwEventWriteEx@40 |
| EtwEventWriteNoRegistration@16 |
| EvtIntReportAuthzEventAndSourceAsync@44 |
| EvtIntReportEventAndSourceAsync@44 |
| LdrGetDllHandleByMapping@8 |
| LdrGetDllHandleByName@12 |
| LdrResGetRCConfig@20 |
| LdrRscIsTypeExist@16 |
| LdrWx86FormatVirtualImage@12 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| NtAllocateReserveObject@12 |
| NtCreateProfileEx@40 |
| NtDisableLastKnownGood@0 |
| NtDrawText@4 |
| NtEnableLastKnownGood@0 |
| NtNotifyChangeSession@32 |
| NtOpenKeyEx@16 |
| NtOpenKeyTransactedEx@20 |
| NtQuerySecurityAttributesToken@24 |
| NtQuerySystemInformationEx@24 |
| NtQueueApcThreadEx@24 |
| NtSerializeBoot@0 |
| NtSetIoCompletionEx@24 |
| NtSetTimerEx@16 |
| NtUmsThreadYield@4 |
| NtWow64GetCurrentProcessorNumberEx@4 ; available only in 32-bit WoW64 version on 64-bit system |
| NtWow64InterlockedPopEntrySList@4 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 8 |
| RtlAcquireReleaseSRWLockExclusive@4 |
| RtlAddIntegrityLabelToBoundaryDescriptor@8 |
| RtlContractHashTable@4 |
| RtlCopyExtendedContext@12 |
| RtlCreateHashTable@12 |
| RtlCreateProcessReflection@24 |
| RtlCreateVirtualAccountSid@16 |
| RtlDeleteHashTable@4 |
| RtlDetectHeapLeaks@0 |
| RtlDisableThreadProfiling@4 |
| RtlEnableThreadProfiling@20 |
| RtlEndEnumerationHashTable@8 |
| RtlEndWeakEnumerationHashTable@8 |
| RtlEnumerateEntryHashTable@8 |
| RtlEthernetAddressToStringA@8 |
| RtlEthernetAddressToStringW@8 |
| RtlEthernetStringToAddressA@12 |
| RtlEthernetStringToAddressW@12 |
| RtlExpandHashTable@4 |
| RtlFillMemoryUlonglong@16 |
| RtlGetCurrentProcessorNumberEx@4 |
| RtlGetEnabledExtendedFeatures@8 |
| RtlGetExtendedContextLength@8 |
| RtlGetExtendedFeaturesMask@4 |
| RtlGetFullPathName_UEx@20 |
| RtlGetLocaleFileMappingAddress@12 |
| RtlGetNextEntryHashTable@8 |
| RtlGetProcessPreferredUILanguages@16 |
| RtlInitEnumerationHashTable@8 |
| RtlInitWeakEnumerationHashTable@8 |
| RtlInitializeExtendedContext@12 |
| RtlInsertEntryHashTable@16 |
| RtlInterlockedClearBitRun@12 |
| RtlInterlockedSetBitRun@12 |
| RtlIsNameInExpression@16 |
| RtlKnownExceptionFilter@4 |
| RtlLoadString@32 |
| RtlLocateExtendedFeature@12 |
| RtlLocateLegacyContext@8 |
| RtlLookupEntryHashTable@12 |
| RtlQueryPerformanceCounter@4 |
| RtlQueryPerformanceFrequency@4 |
| RtlQueryThreadProfiling@8 |
| RtlReadThreadProfilingData@12 |
| RtlRemoveEntryHashTable@12 |
| RtlReplaceSidInSd@16 |
| RtlReportSilentProcessExit@8 |
| RtlReportSqmEscalation@24 |
| RtlSetExtendedFeaturesMask@12 |
| RtlSetProcessPreferredUILanguages@12 |
| RtlSetUserCallbackExceptionFilter@4 ; available only in 32-bit WoW64 version on 64-bit system |
| RtlTryAcquireSRWLockExclusive@4 |
| RtlTryAcquireSRWLockShared@4 |
| RtlUTF8ToUnicodeN@20 |
| RtlUnicodeToUTF8N@20 |
| RtlWeaklyEnumerateEntryHashTable@8 |
| SbExecuteProcedure@20 |
| SbSelectProcedure@16 |
| TpAllocAlpcCompletionEx@20 |
| TpAlpcRegisterCompletionList@4 |
| TpAlpcUnregisterCompletionList@4 |
| TpCallbackIndependent@4 |
| TpDbgGetFreeInfo@8 ; removed in Windows 8 |
| TpDisablePoolCallbackChecks@4 |
| TpPoolFreeUnusedNodes@4 ; removed in Windows 8 |
| TpQueryPoolStackInformation@8 |
| TpSetDefaultPoolMaxThreads@4 |
| TpSetDefaultPoolStackInformation@4 |
| TpSetPoolStackInformation@8 |
| WinSqmAddToAverageDWORD@12 |
| WinSqmAddToStreamEx@20 |
| WinSqmCheckEscalationAddToStreamEx@20 |
| WinSqmCheckEscalationSetDWORD64@20 |
| WinSqmCheckEscalationSetDWORD@16 |
| WinSqmCheckEscalationSetString@16 |
| WinSqmCommonDatapointDelete@4 |
| WinSqmCommonDatapointSetDWORD64@16 |
| WinSqmCommonDatapointSetDWORD@12 |
| WinSqmCommonDatapointSetStreamEx@20 |
| WinSqmCommonDatapointSetString@12 |
| WinSqmGetEscalationRuleStatus@8 |
| WinSqmGetInstrumentationProperty@16 |
| WinSqmIncrementDWORD@12 |
| WinSqmIsOptedInEx@4 |
| WinSqmSetDWORD64@16 |
| WinSqmSetDWORD@12 |
| WinSqmSetEscalationInfo@16 |
| WinSqmSetIfMaxDWORD@12 |
| WinSqmSetIfMinDWORD@12 |
| ZwAllocateReserveObject@12 |
| ZwCreateProfileEx@40 |
| ZwDisableLastKnownGood@0 |
| ZwDrawText@4 |
| ZwEnableLastKnownGood@0 |
| ZwNotifyChangeSession@32 |
| ZwOpenKeyEx@16 |
| ZwOpenKeyTransactedEx@20 |
| ZwQuerySecurityAttributesToken@24 |
| ZwQuerySystemInformationEx@24 |
| ZwQueueApcThreadEx@24 |
| ZwSerializeBoot@0 |
| ZwSetIoCompletionEx@24 |
| ZwSetTimerEx@16 |
| ZwUmsThreadYield@4 |
| ZwWow64GetCurrentProcessorNumberEx@4 ; available only in 32-bit WoW64 version on 64-bit system |
| ZwWow64InterlockedPopEntrySList@4 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 (Threshold / 1507) |
| |
| ; This is list of ordinal-only symbols added in Windows 7 |
| ; Symbol names are taken from: |
| ; https://www.geoffchappell.com/studies/windows/win32/ntdll/history/ords61.htm |
| ; AitLogFeatureUsageByApp@4 @1 NONAME ; removed in Windows 10 (Threshold / 1507) |
| ; AitFireParentUsageEvent@16 @2 NONAME ; removed in Windows 10 (Threshold / 1507) |
| ; SbtLogSystemUsageByParent@32 @3 NONAME ; removed in Windows 10 (Threshold / 1507) |
| ; SbtLogSystemUsageByStack@28 @4 NONAME ; FIXME: Windows 7 has ABI @28, Windows 8 and 8.1 has ABI @20, removed in Windows 10 (Threshold / 1507) |
| ; SbtDisableForCurrentProcess@0 @5 NONAME ; removed in Windows 10 (Threshold / 1507) |
| ; SbtLogDllMapping@8 @6 NONAME ; FIXME: Windows 7 has ABI @8, Windows 8 and 8.1 has ABI @0, removed in Windows 10 (Threshold / 1507) |
| ; SbtLogExeInitializing@0 @7 NONAME ; removed in Windows 10 (Threshold / 1507) |
| ; RtlDispatchAPC@12 @8 NONAME ; since Windows 10 Creators Update (Redstone 2 / 1703) available as normal symbol |
| |
| ; This is list of symbols added in Windows 7 SP1 |
| RtlCopyContext@12 |
| |
| ; This is list of symbols added in Windows 8 |
| ApiSetQueryApiSetPresence@8 |
| EtwEventSetInformation@20 |
| LdrAddDllDirectory@8 |
| LdrAppxHandleIntegrityFailure@4 |
| LdrGetDllDirectory@4 |
| LdrGetDllFullName@8 |
| LdrGetDllPath@16 |
| LdrGetProcedureAddressForCaller@24 |
| LdrProcessRelocationBlockEx@20 |
| LdrQueryOptionalDelayLoadedAPI@16 |
| LdrRemoveDllDirectory@4 |
| LdrResolveDelayLoadedAPI@24 |
| LdrResolveDelayLoadsFromDll@12 |
| LdrSetDefaultDllDirectories@4 |
| LdrSetDllDirectory@4 |
| LdrStandardizeSystemPath@4 |
| LdrSystemDllInitBlock DATA |
| NtAddAtomEx@16 |
| NtAdjustTokenClaimsAndDeviceGroups@64 |
| NtAlertThreadByThreadId@4 |
| NtAlpcConnectPortEx@44 |
| NtAssociateWaitCompletionPacket@32 |
| NtCancelWaitCompletionPacket@8 |
| NtCreateDirectoryObjectEx@20 |
| NtCreateIRTimer@12 ; Windows 8-10 has ABI "NtCreateIRTimer@8", Windows 10 Creators Update (Redstone 2 / 1703) and new has ABI "NtCreateIRTimer@12" |
| NtCreateLowBoxToken@36 |
| NtCreateTokenEx@68 |
| NtCreateWaitCompletionPacket@12 |
| NtCreateWnfStateName@28 |
| NtDeleteWnfStateData@8 |
| NtDeleteWnfStateName@4 |
| NtFilterBootOption@20 |
| NtFilterTokenEx@56 |
| NtFlushBuffersFileEx@20 |
| NtGetCachedSigningLevel@24 |
| NtQueryWnfStateData@24 |
| NtQueryWnfStateNameInformation@20 |
| NtSetCachedSigningLevel@20 |
| NtSetIRTimer@8 |
| NtSetInformationVirtualMemory@24 |
| NtSubscribeWnfStateChange@16 |
| NtUnmapViewOfSectionEx@12 |
| NtUnsubscribeWnfStateChange@4 |
| NtUpdateWnfStateData@28 |
| NtWaitForAlertByThreadId@8 |
| ; NtWaitForWnfNotifications@8 ; removed in Windows 8.1 |
| ; NtWow64AllocateVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system |
| RtlAddResourceAttributeAce@28 |
| RtlAddScopedPolicyIDAce@20 |
| RtlAllocateWnfSerializationGroup@0 |
| RtlAppxIsFileOwnedByTrustedInstaller@8 |
| RtlAvlInsertNodeEx@16 |
| RtlAvlRemoveNode@8 |
| RtlCanonicalizeDomainName@12 |
| RtlCheckPortableOperatingSystem@4 |
| RtlCheckTokenCapability@12 |
| RtlCheckTokenMembership@12 |
| RtlCheckTokenMembershipEx@16 |
| RtlClearBit@8 |
| RtlCopyBitMap@12 |
| RtlCrc32@12 |
| RtlCrc64@16 |
| RtlCreateHashTableEx@16 |
| RtlDecompressBufferEx@28 |
| RtlDeleteElementGenericTableAvlEx@8 |
| RtlEqualWnfChangeStamps@8 |
| RtlExtractBitMap@16 |
| RtlFlushHeaps@0 |
| RtlGetAppContainerNamedObjectPath@16 |
| RtlGetExePath@8 |
| RtlGetSearchPath@4 |
| RtlGetSystemTimePrecise@0 |
| RtlInterlockedPushListSListEx@16 |
| RtlIsCapabilitySid@4 |
| RtlIsPackageSid@4 |
| RtlIsUntrustedObject@12 |
| RtlLengthSidAsUnicodeString@8 |
| RtlNumberOfClearBitsInRange@12 |
| RtlNumberOfSetBitsInRange@12 |
| RtlPublishWnfStateData@24 |
| RtlQueryPackageIdentity@24 |
| RtlQueryRegistryValuesEx@20 |
| RtlQueryUnbiasedInterruptTime@4 |
| RtlQueryValidationRunlevel@4 |
| RtlQueryWnfMetaNotification@20 |
| RtlQueryWnfStateData@24 |
| RtlQueryWnfStateDataWithExplicitScope@28 |
| RtlRbInsertNodeEx@16 |
| RtlRbRemoveNode@8 |
| RtlRegisterForWnfMetaNotification@24 |
| RtlReleasePath@4 |
| RtlResetNtUserPfn@0 |
| RtlSetBit@8 |
| RtlSetPortableOperatingSystem@4 |
| RtlSetSearchPathMode@4 |
| RtlSubscribeWnfStateChangeNotification@36 |
| RtlTestAndPublishWnfStateData@28 |
| RtlTryConvertSRWLockSharedToExclusiveOrRelease@4 |
| RtlUnsubscribeWnfNotificationWaitForCompletion@4 |
| RtlUnsubscribeWnfNotificationWithCompletionCallback@12 |
| RtlUnsubscribeWnfStateChangeNotification@4 |
| RtlWaitForWnfMetaNotification@24 |
| RtlWaitOnAddress@16 |
| RtlWakeAddressAll@4 |
| RtlWakeAddressAllNoFence@4 |
| RtlWakeAddressSingle@4 |
| RtlWakeAddressSingleNoFence@4 |
| RtlWnfCompareChangeStamp@8 ; removed in Windows 11 2024 Update (Hudson Valley / 24H2) |
| RtlWnfDllUnloadCallback@4 |
| RtlpConvertAbsoluteToRelativeSecurityAttribute@12 |
| RtlpConvertRelativeToAbsoluteSecurityAttribute@16 |
| RtlpFreezeTimeBias DATA |
| RtlpMergeSecurityAttributeInformation@16 |
| ; RtlpWnfNotificationThread@16 ; removed in Windows 8.1 |
| TpAllocJobNotification@20 |
| TpCallbackDetectedUnrecoverableError@4 |
| TpReleaseJobNotification@4 |
| TpSetPoolThreadBasePriority@8 |
| TpSetTimerEx@16 |
| TpSetWaitEx@16 |
| TpTimerOutstandingCallbackCount@4 |
| TpWaitForJobNotification@4 |
| WinSqmIsSessionDisabled@4 |
| ZwAddAtomEx@16 |
| ZwAdjustTokenClaimsAndDeviceGroups@64 |
| ZwAlertThreadByThreadId@4 |
| ZwAlpcConnectPortEx@44 |
| ZwAssociateWaitCompletionPacket@32 |
| ZwCancelWaitCompletionPacket@8 |
| ZwCreateDirectoryObjectEx@20 |
| ZwCreateIRTimer@12 ; Windows 8-10 has ABI "ZwCreateIRTimer@8", Windows 10 Creators Update (Redstone 2 / 1703) and new has ABI "ZwCreateIRTimer@12" |
| ZwCreateLowBoxToken@36 |
| ZwCreateTokenEx@68 |
| ZwCreateWaitCompletionPacket@12 |
| ZwCreateWnfStateName@28 |
| ZwDeleteWnfStateData@8 |
| ZwDeleteWnfStateName@4 |
| ZwFilterBootOption@20 |
| ZwFilterTokenEx@56 |
| ZwFlushBuffersFileEx@20 |
| ZwGetCachedSigningLevel@24 |
| ZwQueryWnfStateData@24 |
| ZwQueryWnfStateNameInformation@20 |
| ZwSetCachedSigningLevel@20 |
| ZwSetIRTimer@8 |
| ZwSetInformationVirtualMemory@24 |
| ZwSubscribeWnfStateChange@16 |
| ZwUnmapViewOfSectionEx@12 |
| ZwUnsubscribeWnfStateChange@4 |
| ZwUpdateWnfStateData@28 |
| ZwWaitForAlertByThreadId@8 |
| ; ZwWaitForWnfNotifications@8 ; removed in Windows 8.1 |
| ; ZwWow64AllocateVirtualMemory64@28 ; available only in 32-bit WoW64 version on 64-bit system |
| |
| ; This is list of symbols added in Windows 8.1 |
| LdrSetImplicitPathOptions@8 |
| NtCancelTimer2@8 |
| NtCreateTimer2@20 |
| NtGetCompleteWnfStateSubscription@24 |
| NtSetTimer2@16 |
| NtSetWnfProcessNotificationEvent@4 |
| PssNtCaptureSnapshot@16 |
| PssNtDuplicateSnapshot@20 |
| PssNtFreeRemoteSnapshot@8 |
| PssNtFreeSnapshot@4 |
| PssNtFreeWalkMarker@4 |
| PssNtQuerySnapshot@16 |
| PssNtValidateDescriptor@8 |
| PssNtWalkSnapshot@20 |
| RtlAddProcessTrustLabelAce@24 |
| RtlAllocateAndInitializeSidEx@16 |
| RtlGetAppContainerParent@8 |
| RtlGetAppContainerSidType@8 |
| RtlIsParentOfChildAppContainer@8 |
| RtlIsValidProcessTrustLabelSid@4 |
| RtlQueryPackageIdentityEx@28 |
| RtlSidDominatesForTrust@12 |
| RtlStringFromGUIDEx@12 |
| RtlTestProtectedAccess@8 |
| RtlValidProcessProtection@4 |
| TpCallbackSendAlpcMessageOnCompletion@16 |
| TpCallbackSendPendingAlpcMessage@4 |
| WinSqmStartSessionForPartner@16 |
| ZwCancelTimer2@8 |
| ZwCreateTimer2@20 |
| ZwGetCompleteWnfStateSubscription@24 |
| ZwSetTimer2@16 |
| ZwSetWnfProcessNotificationEvent@4 |
| |
| ; This is list of symbols added in Windows 10 (Threshold / 1507) |
| DbgUiConvertStateChangeStructureEx@8 |
| LdrFastFailInLoaderCallout@0 |
| NtAlpcImpersonateClientContainerOfPort@12 |
| NtCompareObjects@8 |
| NtCreatePartition@16 ; Windows 10 has ABI "NtCreatePartition@20", Windows 10 November Update (Threshold 2 / 1511) and new has ABI "NtCreatePartition@16" |
| NtGetCurrentProcessorNumberEx@4 |
| NtManagePartition@20 |
| NtOpenPartition@12 |
| NtRevertContainerImpersonation@0 |
| NtSetInformationSymbolicLink@16 |
| ; NtWow64IsProcessorFeaturePresent@4 ; available only in 32-bit WoW64 version on 64-bit system |
| RtlCapabilityCheck@12 |
| RtlCheckSandboxedToken@8 |
| RtlConvertDeviceFamilyInfoToString@16 |
| RtlConvertSRWLockExclusiveToShared@4 |
| RtlDecodeRemotePointer@12 |
| RtlDeriveCapabilitySidsFromName@12 |
| RtlEncodeRemotePointer@12 |
| RtlEndStrongEnumerationHashTable@8 |
| RtlFindUnicodeSubstring@12 |
| RtlGetDeviceFamilyInfoEnum@12 |
| RtlGetInterruptTimePrecise@4 |
| RtlInitStringEx@8 |
| RtlInitStrongEnumerationHashTable@8 |
| RtlInitializeSidEx@0 |
| RtlIsMultiSessionSku@0 |
| RtlIsProcessorFeaturePresent@4 |
| RtlOsDeploymentState@4 |
| RtlQueryPackageClaims@32 ; Windows 10 has ABI "RtlQueryPackageClaims@28", Windows 10 Anniversary Update (Redstone / 1607) and new has ABI "RtlQueryPackageClaims@32" |
| RtlQueryProtectedPolicy@8 |
| RtlQueryResourcePolicy@16 |
| RtlSetProtectedPolicy@12 |
| RtlSetThreadSubProcessTag@4 |
| RtlStronglyEnumerateEntryHashTable@8 |
| RtlSwitchedVVI@16 |
| RtlpGetDeviceFamilyInfoEnum@12 |
| TpSetPoolMaxThreadsSoftLimit@8 |
| TpSetPoolWorkerThreadIdleTimeout@12 |
| TpTrimPools@0 |
| WinSqmStartSqmOptinListener@0 |
| ZwAlpcImpersonateClientContainerOfPort@12 |
| ZwCompareObjects@8 |
| ZwCreatePartition@16 ; Windows 10 has ABI "ZwCreatePartition@20", Windows 10 November Update (Threshold 2 / 1511) and new has ABI "ZwCreatePartition@16" |
| ZwGetCurrentProcessorNumberEx@4 |
| ZwManagePartition@20 |
| ZwOpenPartition@12 |
| ZwRevertContainerImpersonation@0 |
| ZwSetInformationSymbolicLink@16 |
| ; ZwWow64IsProcessorFeaturePresent@4 ; available only in 32-bit WoW64 version on 64-bit system |
| |
| ; This is list of symbols added in Windows 10 November Update (Threshold 2 / 1511) |
| NtCreateEnclave@36 |
| NtInitializeEnclave@20 |
| NtLoadEnclaveData@36 |
| RtlGetCurrentServiceSessionId@0 |
| RtlWow64GetCurrentMachine@0 |
| ZwCreateEnclave@36 |
| ZwInitializeEnclave@20 |
| ZwLoadEnclaveData@36 |
| |
| ; This is list of symbols added in Windows 10 Anniversary Update (Redstone / 1607) |
| NtCommitRegistryTransaction@8 |
| NtCreateRegistryTransaction@16 |
| NtOpenRegistryTransaction@12 |
| NtQuerySecurityPolicy@24 |
| NtRollbackRegistryTransaction@8 |
| NtSetCachedSigningLevel2@24 |
| RtlAreLongPathsEnabled@0 |
| RtlCheckBootStatusIntegrity@8 |
| RtlClearThreadWorkOnBehalfTicket@0 |
| RtlFindExportedRoutineByName@8 |
| RtlGetActiveConsoleId@0 |
| RtlGetConsoleSessionForegroundProcessId@0 |
| RtlGetSuiteMask@0 |
| RtlGetThreadWorkOnBehalfTicket@8 |
| RtlGuardCheckLongJumpTarget@12 |
| ; RtlIsLongPathAwareProcessByManifest@0 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| RtlIsMultiUsersInSessionSku@0 |
| RtlLocateExtendedFeature2@16 |
| RtlReplaceSystemDirectoryInPath@16 |
| RtlReportExceptionEx@20 |
| RtlRestoreBootStatusDefaults@4 |
| RtlSetThreadWorkOnBehalfTicket@4 |
| ; RtlSparseBitmapCtxAreAllClear@20 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxAreAllSet@20 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxCheckBit@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxCleanup@4 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxClearBits@24 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxClearBitsEx@32 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxCountBitsSet@4 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxFindNextBitSet@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxFindSetRuns@36 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxInitialize@4 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxMetadataForBit@16 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxOrBitmap@8 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxPrepareBits@20 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxSetBits@24 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxSetBitsEx@32 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxStart@8 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapCtxSubtractBitmap@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| ; RtlSparseBitmapEnumerateBitmap@12 ; removed in Windows 10 Creators Update (Redstone 2 / 1703) |
| RtlWow64GetProcessMachines@12 |
| RtlWow64IsWowGuestMachineSupported@8 |
| ; Wow64Transition DATA ; available only in 32-bit WoW64 version on 64-bit system |
| ZwCommitRegistryTransaction@8 |
| ZwCreateRegistryTransaction@16 |
| ZwOpenRegistryTransaction@12 |
| ZwQuerySecurityPolicy@24 |
| ZwRollbackRegistryTransaction@8 |
| ZwSetCachedSigningLevel2@24 |
| |
| ; This is list of symbols added in Windows 10 Creators Update (Redstone 2 / 1703) |
| LdrParentInterlockedPopEntrySList DATA |
| LdrParentRtlInitializeNtUserPfn DATA |
| LdrParentRtlResetNtUserPfn DATA |
| LdrParentRtlRetrieveNtUserPfn DATA |
| LdrUpdatePackageSearchPath@4 |
| LdrpChildNtdll DATA |
| NtAcquireProcessActivityReference@12 |
| NtCompareSigningLevels@8 |
| ; NtContinueCHPE@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709) |
| NtConvertBetweenAuxiliaryCounterAndPerformanceCounter@16 |
| ; NtLoadHotPatch@8 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809) |
| NtQueryAuxiliaryCounterFrequency@4 |
| NtQueryInformationByName@20 |
| RtlAddAccessFilterAce@32 |
| RtlCreateUserProcessEx@20 |
| RtlDispatchAPC@12 ; before Windows 10 Creators Update (Redstone 2 / 1703) available as ordinal-only symbol |
| RtlGetNtSystemRoot@0 |
| RtlGetSessionProperties@8 |
| RtlGetTokenNamedObjectPath@12 |
| RtlIsElevatedRid@4 |
| RtlIsNonEmptyDirectoryReparsePointAllowed@4 |
| ; RtlIsPlaceholderFileHandle@8 ; removed in Windows 10 Fall Creators Update (Redstone 3 / 1709) |
| ; RtlIsPlaceholderFileInfo@12 ; removed in Windows 10 Fall Creators Update (Redstone 3 / 1709) |
| RtlLookupFirstMatchingElementGenericTableAvl@12 |
| ; RtlLookupFunctionEntryCHPE@12 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709) |
| ; RtlUnwindEx@24 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709) |
| WerReportExceptionWorker@4 |
| ZwAcquireProcessActivityReference@12 |
| ZwCompareSigningLevels@8 |
| ; ZwContinueCHPE@8 ; available only in 32-bit WoW64 version on 64-bit system, removed in Windows 10 Fall Creators Update (Redstone 3 / 1709) |
| ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter@16 |
| ; ZwLoadHotPatch@8 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809) |
| ZwQueryAuxiliaryCounterFrequency@4 |
| ZwQueryInformationByName@20 |
| |
| ; This is list of symbols added in Windows 10 Fall Creators Update (Redstone 3 / 1709) |
| EtwCheckCoverage@4 |
| LdrCallEnclave@12 |
| LdrControlFlowGuardEnforced@0 |
| LdrCreateEnclave@36 |
| LdrDeleteEnclave@4 |
| LdrInitializeEnclave@20 |
| LdrLoadEnclaveModule@12 |
| NtCallEnclave@16 |
| NtNotifyChangeDirectoryFileEx@40 |
| NtQueryDirectoryFileEx@40 |
| NtTerminateEnclave@8 |
| RtlCapabilityCheckForSingleSessionSku@12 |
| RtlCheckSystemBootStatusIntegrity@4 |
| RtlDosLongPathNameToNtPathName_U_WithStatus@16 |
| RtlDosLongPathNameToRelativeNtPathName_U_WithStatus@16 |
| RtlExtendCorrelationVector@4 |
| RtlGetSystemBootStatus@16 |
| RtlGetSystemBootStatusEx@12 |
| RtlIncrementCorrelationVector@4 |
| RtlInitializeCorrelationVector@12 |
| RtlIsCloudFilesPlaceholder@8 |
| RtlIsCurrentProcess@4 |
| RtlIsCurrentThread@4 |
| RtlIsPartialPlaceholder@8 |
| RtlIsPartialPlaceholderFileHandle@8 |
| RtlIsPartialPlaceholderFileInfo@12 |
| RtlIsStateSeparationEnabled@0 |
| RtlQueryImageMitigationPolicy@20 |
| RtlQueryThreadPlaceholderCompatibilityMode@0 |
| RtlRestoreSystemBootStatusDefaults@0 |
| RtlSetImageMitigationPolicy@20 |
| RtlSetProxiedProcessId@4 |
| RtlSetSystemBootStatus@16 |
| RtlSetSystemBootStatusEx@12 |
| RtlSetThreadPlaceholderCompatibilityMode@4 |
| RtlValidateCorrelationVector@4 |
| RtlWow64GetEquivalentMachineCHPE@4 |
| RtlWow64GetSharedInfoProcess@12 |
| ; RtlWow64PopAllCrossProcessWork@4 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809) |
| ; RtlWow64PopCrossProcessWork@4 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809) |
| ; RtlWow64PushCrossProcessWork@8 ; removed in Windows 10 October 2018 Update (Redstone 5 / 1809) |
| ZwCallEnclave@16 |
| ZwNotifyChangeDirectoryFileEx@40 |
| ZwQueryDirectoryFileEx@40 |
| ZwTerminateEnclave@8 |
| |
| ; This is list of symbols added in Windows 10 April 2018 Update (Redstone 4 / 1803) |
| NtAllocateVirtualMemoryEx@28 |
| NtMapViewOfSectionEx@36 |
| RtlGetPersistedStateLocation@28 |
| RtlIsNameInUnUpcasedExpression@16 |
| RtlQueryProcessPlaceholderCompatibilityMode@0 |
| RtlQueryRegistryValueWithFallback@28 |
| RtlQueryTokenHostIdAsUlong64@8 |
| RtlRaiseCustomSystemEventTrigger@4 |
| RtlSetProcessPlaceholderCompatibilityMode@4 |
| ZwAllocateVirtualMemoryEx@28 |
| ZwMapViewOfSectionEx@36 |
| |
| ; This is list of symbols added in Windows 10 October 2018 Update (Redstone 5 / 1809) |
| ApiSetQueryApiSetPresenceEx@12 |
| LdrIsModuleSxsRedirected@4 |
| NtCreateSectionEx@36 |
| NtManageHotPatch@16 |
| RtlCreateProcessParametersWithTemplate@12 |
| RtlGetExtendedContextLength2@16 |
| RtlGetMultiTimePrecise@12 |
| RtlInitializeExtendedContext2@20 |
| ; RtlUserFiberStart@0 |
| RtlpTimeFieldsToTime@12 |
| RtlpTimeToTimeFields@12 |
| ZwCreateSectionEx@36 |
| ZwManageHotPatch@16 |
| |
| ; This is list of symbols added in Windows 10 May 2019 Update (19H1 / 1903) |
| NtCreateCrossVmEvent@24 |
| RtlConstructCrossVmEventPath@12 |
| RtlDoesNameContainWildCards@4 |
| RtlFlsGetValue@8 |
| RtlFlsSetValue@8 |
| RtlUdiv128@28 |
| TpSetPoolThreadCpuSets@12 |
| ZwCreateCrossVmEvent@24 |
| |
| ; In Windows 10 November 2019 Update (19H2 /1909) was not added any new symbol |
| |
| ; This is list of symbols added in Windows 10 May 2020 Update (20H1 / 2004) |
| NtAcquireCrossVmMutant@8 |
| NtAllocateUserPhysicalPagesEx@20 |
| NtContinueEx@8 |
| NtCreateCrossVmMutant@24 |
| NtDirectGraphicsCall@20 |
| NtLoadKey3@32 |
| NtPssCaptureVaSpaceBulk@20 |
| RtlConstructCrossVmMutexPath@12 |
| ; RtlDisownModuleHeapAllocation@8 |
| RtlFreeUTF8String@4 |
| RtlGetReturnAddressHijackTarget@0 |
| RtlInitUTF8String@8 |
| RtlInitUTF8StringEx@8 |
| RtlIsZeroMemory@8 |
| RtlNormalizeSecurityDescriptor@20 |
| RtlNotifyFeatureUsage@4 |
| RtlQueryAllFeatureConfigurations@16 |
| RtlQueryFeatureConfiguration@16 |
| RtlQueryFeatureConfigurationChangeStamp@0 |
| RtlQueryFeatureUsageNotificationSubscriptions@8 |
| RtlRegisterFeatureConfigurationChangeNotification@16 |
| RtlRestoreThreadPreferredUILanguages@4 |
| RtlSetFeatureConfigurations@16 |
| RtlSetThreadPreferredUILanguages2@16 |
| RtlSubscribeForFeatureUsageNotification@8 |
| RtlUTF8StringToUnicodeString@12 |
| RtlUnicodeStringToUTF8String@12 |
| RtlUnregisterFeatureConfigurationChangeNotification@4 |
| RtlUnsubscribeFromFeatureUsageNotifications@8 |
| ZwAcquireCrossVmMutant@8 |
| ZwAllocateUserPhysicalPagesEx@20 |
| ZwContinueEx@8 |
| ZwCreateCrossVmMutant@24 |
| ZwDirectGraphicsCall@20 |
| ZwLoadKey3@32 |
| ZwPssCaptureVaSpaceBulk@20 |
| |
| ; In Windows 10 October 2020 Update (20H2) was not added any new symbol |
| |
| ; In Windows 10 May 2021 Update (21H1) was not added any new symbol |
| |
| ; This is list of symbols added in Windows 10 November 2021 Update (21H2) |
| RtlGetSystemTimeAndBias@12 |
| |
| ; In Windows 10 2022 Update (22H2) was not added any new symbol |
| |
| ; This is list of symbols added in Windows 11 (Sun Valley / 21H2) (WoW64 version) |
| ; LdrHotPatchNotify@4 |
| ; MicrosoftTelemetryAssertTriggeredUM@4 |
| NtChangeProcessState@24 |
| NtChangeThreadState@24 |
| NtCreateIoRing@20 |
| NtCreateProcessStateChange@20 |
| NtCreateThreadStateChange@20 |
| NtQueryIoRingCapabilities@8 |
| NtQueueApcThreadEx2@28 |
| NtReadVirtualMemoryEx@24 |
| NtSetInformationIoRing@16 |
| NtSubmitIoRing@16 |
| RtlCompareExchangePointerMapping@16 |
| RtlCompareExchangePropertyStore@16 |
| ; RtlConvertHostPerfCounterToPerfCounter@20 |
| RtlDelayExecution@8 |
| RtlGetImageFileMachines@8 |
| RtlGetSystemGlobalData@12 |
| RtlIsApiSetImplemented@4 |
| RtlIsEnclaveFeaturePresent@4 |
| RtlQueryPointerMapping@8 |
| RtlQueryPropertyStore@8 |
| RtlRemovePointerMapping@8 |
| RtlRemovePropertyStore@8 |
| RtlRestoreContext ; cdecl |
| ZwChangeProcessState@24 |
| ZwChangeThreadState@24 |
| ZwCreateIoRing@20 |
| ZwCreateProcessStateChange@20 |
| ZwCreateThreadStateChange@20 |
| ZwQueryIoRingCapabilities@8 |
| ZwQueueApcThreadEx2@28 |
| ZwReadVirtualMemoryEx@24 |
| ZwSetInformationIoRing@16 |
| ZwSubmitIoRing@16 |
| |
| ; This is list of symbols added in Windows 11 2022 Update (Sun Valley 2 / 22H2) (WoW64 version) |
| ; NtCopyFileChunk@40 |
| ; NtCreateCpuPartition@20 ; Windows 10 has ABI "NtCreateCpuPartition@12", Windows 11 2024 Update (Hudson Valley / 24H2) and new has ABI "NtCreateCpuPartition@20" |
| ; NtOpenCpuPartition@12 |
| ; NtQueryInformationCpuPartition@20 |
| ; NtSetInformationCpuPartition@28 |
| ; RtlOverwriteFeatureConfigurationBuffer@16 |
| ; TpWorkOnBehalfClearTicket@4 |
| ; TpWorkOnBehalfSetTicket@8 |
| ; ZwCopyFileChunk@40 |
| ; ZwCreateCpuPartition@20 ; Windows 10 has ABI "ZwCreateCpuPartition@12", Windows 11 2024 Update (Hudson Valley / 24H2) and new has ABI "ZwCreateCpuPartition@20" |
| ; ZwOpenCpuPartition@12 |
| ; ZwQueryInformationCpuPartition@20 |
| ; ZwSetInformationCpuPartition@28 |
| |
| ; This is list of symbols added in Windows 11 2023 Update (Sun Valley 3 / 23H2) (WoW64 version) |
| ; RtlIsFeatureEnabledForEnterprise@4 |
| |
| ; This is list of symbols added in Windows 11 2024 Update (Hudson Valley / 24H2) (WoW64 version) |
| ; NtAlertMultipleThreadByThreadId@16 |
| ; NtAlertThreadByThreadIdEx@8 |
| ; NtSetEventEx@12 |
| ; NtWow64GetCurrentProcessorNumber@0 |
| ; RtlFlsAllocEx@12 |
| ; RtlFlsGetValue2@4 |
| ; RtlGetAcesBufferSize@8 |
| ; RtlGetCurrentThreadPrimaryGroup@0 |
| ; RtlGetFeatureToggleConfiguration@12 |
| ; RtlGetFeatureTogglesChangeToken@0 |
| ; RtlLogUnexpectedCodepath@4 |
| ; RtlNotifyFeatureToggleUsage@12 |
| ; RtlQueryAllInternalFeatureConfigurations@16 |
| ; RtlRcuAllocate@4 |
| ; RtlRcuFree@4 |
| ; RtlRcuReadLock@0 |
| ; RtlRcuReadUnlock@0 |
| ; RtlRcuSynchronize@4 |
| ; RtlTlsAlloc@4 |
| ; RtlTlsFree@4 |
| ; RtlTlsSetValue@8 |
| ; RtlValidateUserCallTarget@8 |
| ; RtlXRestore@12 |
| ; RtlXSave@12 |
| ; ZwAlertMultipleThreadByThreadId@16 |
| ; ZwAlertThreadByThreadIdEx@8 |
| ; ZwSetEventEx@12 |
| ; ZwWow64GetCurrentProcessorNumber@0 |
