Techwiki:Ntoskrnl export list
Revision as of 22:13, 8 November 2009 by RideBMX (talk | contribs) (Techwiki/ntoskrnl export list part 1 moved to Techwiki:Ntoskrnl export list part 1)
This is the first half of the list of exports from ntoskrnl,you can find the second part here.Taken from Windows XP SP2 Build 2600.
Name | # win xp |
CcCopyRead | 61 |
CcDeferWrite | 63 |
CcFastCopyWrite | 65 |
CcFastReadNotPossible | 67 |
CcFlushCache | 69 |
CcGetFileObjectFromBcb | 71 |
CcGetFlushedValidData | 73 |
CcInitializeCacheMap | 75 |
CcMapData | 77 |
CcMdlReadComplete | 79 |
CcMdlWriteComplete | 81 |
CcPinRead | 83 |
CcPreparePinWrite | 85 |
CcRemapBcb | 87 |
CcScheduleReadAhead | 89 |
CcSetBcbOwnerPointer | 91 |
CcSetDirtyPinnedData | 93 |
CcSetLogHandleForFile | 95 |
CcUninitializeCacheMap | 97 |
CcUnpinDataForThread | 99 |
CcWaitForCurrentLazyWriterActivity | 101 |
CmRegisterCallback | 103 |
DbgBreakPoint | 105 |
DbgLoadImageSymbols | 107 |
DbgPrintEx | 109 |
DbgPrompt | 111 |
DbgSetDebugFilterState | 113 |
ExAcquireResourceExclusiveLite | 114 |
ExAcquireRundownProtection | 2 |
ExAcquireSharedStarveExclusive | 116 |
ExAllocateFromPagedLookasideList | 118 |
ExAllocatePoolWithQuota | 120 |
ExAllocatePoolWithTag | 122 |
ExConvertExclusiveToSharedLite | 124 |
ExDeleteNPagedLookasideList | 126 |
ExDeleteResourceLite | 128 |
ExDisableResourceBoostLite | 130 |
ExEventObjectType | 132 |
ExFreePool | 134 |
ExFreeToPagedLookasideList | 136 |
ExGetCurrentProcessorCpuUsage | 138 |
ExGetPreviousMode | 140 |
ExInitializeNPagedLookasideList | 142 |
ExInitializeResourceLite | 144 |
ExInitializeZone | 145 |
ExInterlockedAddLargeStatistic | 5 |
ExInterlockedCompareExchange64 | 6 |
ExInterlockedExchangeUlong | 149 |
ExInterlockedFlushSList | 7 |
ExInterlockedInsertHeadList | 152 |
ExInterlockedPopEntryList | 154 |
ExInterlockedPushEntryList | 155 |
ExInterlockedRemoveHeadList | 156 |
ExIsResourceAcquiredExclusiveLite | 158 |
ExLocalTimeToSystemTime | 160 |
ExQueryPoolBlockSize | 162 |
ExRaiseAccessViolation | 164 |
ExRaiseException | 166 |
ExRaiseStatus | 168 |
ExRegisterCallback | 169 |
ExReleaseFastMutexUnsafe | 11 |
ExReleaseResourceLite | 12 |
ExReleaseRundownProtectionEx | 14 |
ExSemaphoreObjectType | 172 |
ExSetTimerResolution | 174 |
ExSystemTimeToLocalTime | 176 |
ExUuidCreate | 178 |
ExWaitForRundownProtectionRelease | 16 |
ExfAcquirePushLockExclusive | 17 |
ExfInterlockedAddUlong | 19 |
ExfInterlockedInsertHeadList | 21 |
ExfInterlockedPopEntryList | 23 |
ExfInterlockedRemoveHeadList | 25 |
Exfi386InterlockedDecrementLong | 27 |
Exfi386InterlockedIncrementLong | 29 |
Exi386InterlockedExchangeUlong | 182 |
FsRtlAcquireFileExclusive | 184 |
FsRtlAddMcbEntry | 186 |
FsRtlAllocateFileLock | 188 |
FsRtlAllocatePoolWithQuota | 190 |
FsRtlAllocatePoolWithTag | 192 |
FsRtlAreNamesEqual | 194 |
FsRtlCheckLockForReadAccess | 196 |
FsRtlCheckOplock | 198 |
FsRtlCopyWrite | 200 |
FsRtlDeleteKeyFromTunnelCache | 202 |
FsRtlDeregisterUncProvider | 204 |
FsRtlDissectName | 206 |
FsRtlDoesNameContainWildCards | 208 |
FsRtlFastCheckLockForWrite | 210 |
FsRtlFastUnlockAllByKey | 212 |
FsRtlFindInTunnelCache | 214 |
FsRtlGetFileSize | 216 |
FsRtlGetNextLargeMcbEntry | 218 |
FsRtlIncrementCcFastReadNoWait | 220 |
FsRtlIncrementCcFastReadResourceMiss | 222 |
FsRtlInitializeFileLock | 224 |
FsRtlInitializeMcb | 226 |
FsRtlInitializeTunnelCache | 228 |
FsRtlInsertPerStreamContext | 230 |
FsRtlIsFatDbcsLegal | 232 |
FsRtlIsNameInExpression | 234 |
FsRtlIsPagingFile | 236 |
FsRtlLegalAnsiCharacterArray | 238 |
FsRtlLookupLastLargeMcbEntry | 240 |
FsRtlLookupLastMcbEntry | 242 |
FsRtlLookupPerFileObjectContext | 244 |
FsRtlMdlRead | 246 |
FsRtlMdlReadCompleteDev | 248 |
FsRtlMdlWriteComplete | 250 |
FsRtlNormalizeNtstatus | 252 |
FsRtlNotifyCleanup | 254 |
FsRtlNotifyFilterReportChange | 256 |
FsRtlNotifyFullReportChange | 258 |
FsRtlNotifyReportChange | 260 |
FsRtlNotifyVolumeEvent | 262 |
FsRtlNumberOfRunsInMcb | 264 |
FsRtlOplockIsFastIoPossible | 266 |
FsRtlPostStackOverflow | 268 |
FsRtlPrepareMdlWriteDev | 270 |
FsRtlProcessFileLock | 272 |
FsRtlRegisterUncProvider | 274 |
FsRtlRemoveLargeMcbEntry | 276 |
FsRtlRemovePerFileObjectContext | 278 |
FsRtlResetLargeMcb | 280 |
FsRtlSyncVolumes | 282 |
FsRtlTruncateLargeMcb | 284 |
FsRtlUninitializeFileLock | 286 |
FsRtlUninitializeMcb | 288 |
HalDispatchTable | 290 |
HalPrivateDispatchTable | 291 |
InbvAcquireDisplayOwnership | 293 |
InbvDisplayString | 295 |
InbvEnableDisplayString | 297 |
InbvIsBootDriverInstalled | 299 |
InbvResetDisplay | 301 |
InbvSetTextColor | 303 |
InitSafeBootMode | 305 |
InterlockedDecrement | 32 |
InterlockedExchangeAdd | 34 |
InterlockedPopEntrySList | 36 |
IoAcquireCancelSpinLock | 306 |
IoAcquireVpbSpinLock | 308 |
IoAllocateAdapterChannel | 310 |
IoAllocateDriverObjectExtension | 312 |
IoAllocateIrp | 314 |
IoAllocateWorkItem | 316 |
IoAssignResources | 317 |
IoAttachDeviceByPointer | 319 |
IoAttachDeviceToDeviceStackSafe | 321 |
IoBuildDeviceIoControlRequest | 323 |
IoBuildSynchronousFsdRequest | 325 |
IoCancelFileOpen | 327 |
IoCheckDesiredAccess | 329 |
IoCheckFunctionAccess | 331 |
IoCheckQuerySetVolumeInformation | 333 |
IoCheckShareAccess | 335 |
IoConnectInterrupt | 337 |
IoCreateDevice | 339 |
IoCreateDriver | 341 |
IoCreateFileSpecifyDeviceObjectHint | 343 |
IoCreateStreamFileObject | 345 |
IoCreateStreamFileObjectLite | 347 |
IoCreateSynchronizationEvent | 349 |
IoCsqInitialize | 351 |
IoCsqRemoveIrp | 353 |
IoDeleteController | 355 |
IoDeleteDriver | 357 |
IoDetachDevice | 359 |
IoDeviceHandlerObjectType | 361 |
IoDisconnectInterrupt | 363 |
IoEnqueueIrp | 365 |
IoFastQueryNetworkAttributes | 367 |
IoForwardAndCatchIrp | 369 |
IoFreeController | 371 |
IoFreeIrp | 373 |
IoFreeWorkItem | 375 |
IoGetAttachedDeviceReference | 377 |
IoGetBootDiskInformation | 379 |
IoGetCurrentProcess | 381 |
IoGetDeviceInterfaceAlias | 383 |
IoGetDeviceObjectPointer | 385 |
IoGetDeviceToVerify | 387 |
IoGetDmaAdapter | 389 |
IoGetFileObjectGenericMapping | 391 |
IoGetLowerDeviceObject | 393 |
IoGetRequestorProcess | 395 |
IoGetRequestorSessionId | 397 |
IoGetTopLevelIrp | 399 |
IoInitializeRemoveLockEx | 401 |
IoInvalidateDeviceRelations | 403 |
IoIsFileOriginRemote | 405 |
IoIsSystemThread | 407 |
IoIsWdmVersionAvailable | 409 |
IoOpenDeviceInterfaceRegistryKey | 411 |
IoPageRead | 413 |
IoQueryDeviceDescription | 415 |
IoQueryFileInformation | 417 |
IoQueueThreadIrp | 419 |
IoRaiseHardError | 421 |
IoReadDiskSignature | 423 |
IoReadPartitionTable | 39 |
IoReadTransferCount | 426 |
IoRegisterDeviceInterface | 428 |
IoRegisterFileSystem | 430 |
IoRegisterLastChanceShutdownNotification | 432 |
IoRegisterShutdownNotification | 434 |
IoReleaseRemoveLockAndWaitEx | 436 |
IoReleaseVpbSpinLock | 438 |
IoReportDetectedDevice | 440 |
IoReportResourceForDetection | 442 |
IoReportTargetDeviceChange | 444 |
IoRequestDeviceEject | 446 |
IoSetCompletionRoutineEx | 448 |
IoSetDeviceToVerify | 450 |
IoSetHardErrorOrVerifyDevice | 452 |
IoSetIoCompletion | 454 |
IoSetPartitionInformationEx | 455 |
IoSetStartIoAttributes | 457 |
IoSetThreadHardErrorMode | 459 |
IoStartNextPacket | 461 |
IoStartPacket | 463 |
IoStatisticsLock | 465 |
IoSynchronousInvalidateDeviceRelations | 467 |
IoThreadToProcess | 469 |
IoUnregisterFsRegistrationChange | 471 |
IoUnregisterShutdownNotification | 473 |
IoValidateDeviceIoControlAccess | 475 |
IoVerifyVolume | 477 |
IoWMIAllocateInstanceIds | 479 |
IoWMIExecuteMethod | 481 |
IoWMIOpenBlock | 483 |
IoWMIQueryAllDataMultiple | 485 |
IoWMIQuerySingleInstanceMultiple | 487 |
IoWMISetNotificationCallback | 489 |
IoWMISetSingleItem | 491 |
IoWMIWriteEvent | 493 |
IoWriteOperationCount | 495 |
IoWritePartitionTableEx | 496 |
IofCallDriver | 42 |
KdDebuggerEnabled | 498 |
KdDisableDebugger | 500 |
KdEnteredDebugger | 502 |
KdPowerTransition | 504 |
Ke386IoSetAccessProcess | 506 |
Ke386SetIoAccessMap | 508 |
KeAcquireInterruptSpinLock | 509 |
KeAddSystemServiceTable | 511 |
KeAttachProcess | 513 |
KeBugCheckEx | 515 |
KeCapturePersistentThreadState | 517 |
KeConnectInterrupt | 519 |
KeDelayExecutionThread | 521 |
KeDeregisterBugCheckReasonCallback | 523 |
KeDisconnectInterrupt | 525 |
KeEnterKernelDebugger | 527 |
KeFindConfigurationNextEntry | 529 |
KeFlushQueuedDpcs | 531 |
KeGetPreviousMode | 533 |
KeI386AbiosCall | 535 |
KeI386Call16BitCStyleFunction | 537 |
KeI386FlatToGdtSelector | 539 |
KeI386MachineType | 541 |
KeI386ReleaseLid | 543 |
KeIcacheFlushCount | 545 |
KeInitializeDeviceQueue | 547 |
KeInitializeEvent | 549 |
KeInitializeMutant | 551 |
KeInitializeQueue | 553 |
KeInitializeSpinLock | 555 |
KeInitializeTimerEx | 557 |
KeInsertDeviceQueue | 559 |
KeInsertQueue | 561 |
KeInsertQueueDpc | 563 |
KeIsExecutingDpc | 565 |
KeLoaderBlock | 567 |
KeProfileInterrupt | 569 |
KePulseEvent | 571 |
KeQueryInterruptTime | 573 |
KeQueryRuntimeThread | 575 |
KeQueryTickCount | 577 |
KeRaiseUserException | 579 |
KeReadStateMutant | 581 |
KeReadStateQueue | 583 |
KeReadStateTimer | 585 |
KeRegisterBugCheckReasonCallback | 587 |
KeReleaseInterruptSpinLock | 588 |
KeReleaseMutex | 590 |
KeReleaseSpinLockFromDpcLevel | 592 |
KeRemoveByKeyDeviceQueueIfBusy | 594 |
KeRemoveEntryDeviceQueue | 596 |
KeRemoveQueueDpc | 598 |
KeResetEvent | 600 |
KeRevertToUserAffinityThread | 602 |
KeSaveFloatingPointState | 604 |
KeServiceDescriptorTable | 606 |
KeSetBasePriorityThread | 608 |
KeSetEvent | 610 |
KeSetIdealProcessorThread | 612 |
KeSetKernelStackSwapEnable | 614 |
KeSetProfileIrql | 616 |
KeSetTargetProcessorDpc | 618 |
KeSetTimeUpdateNotifyRoutine | 46 |
KeSetTimerEx | 621 |
KeSynchronizeExecution | 623 |
KeTickCount | 625 |
KeUpdateRunTime | 627 |
KeUserModeCallback | 629 |
KeWaitForMutexObject | 631 |
KefAcquireSpinLockAtDpcLevel | 47 |
Kei386EoiHelper | 58 |
KiBugCheckData | 633 |
KiDeliverApc | 635 |
KiEnableTimerWatchdog | 637 |
KiReleaseSpinLock | 50 |
Kii386SpinOnSpinLock | 59 |
LdrEnumResources | 641 |
LdrFindResource_U | 643 |
LpcRequestPort | 645 |
LsaCallAuthenticationPackage | 647 |
LsaFreeReturnBuffer | 649 |
LsaLookupAuthenticationPackage | 651 |
Mm64BitPhysicalAddress | 653 |
MmAddVerifierThunks | 655 |
MmAdvanceMdl | 657 |
MmAllocateContiguousMemorySpecifyCache | 659 |
MmAllocateNonCachedMemory | 661 |
MmBuildMdlForNonPagedPool | 663 |
MmCommitSessionMappedView | 665 |
MmCreateSection | 667 |
MmFlushImageSection | 669 |
MmFreeContiguousMemory | 671 |
MmFreeMappingAddress | 673 |
MmFreePagesFromMdl | 675 |
MmGetPhysicalMemoryRanges | 677 |
MmGetVirtualForPhysical | 679 |
MmHighestUserAddress | 681 |
MmIsDriverVerifying | 683 |
MmIsRecursiveIoFault | 685 |
MmIsVerifierEnabled | 687 |
MmLockPagableImageSection | 689 |
MmMapIoSpace | 691 |
MmMapLockedPagesSpecifyCache | 693 |
MmMapMemoryDumpMdl | 695 |
MmMapVideoDisplay | 697 |
MmMapViewInSystemSpace | 699 |
MmMarkPhysicalMemoryAsBad | 701 |
MmPageEntireDriver | 703 |
MmProbeAndLockPages | 705 |
MmProbeAndLockSelectedPages | 707 |
MmQuerySystemSize | 709 |
MmResetDriverPaging | 711 |
MmSecureVirtualMemory | 713 |
MmSetBankedSection | 715 |
MmSystemRangeStart | 717 |
MmUnlockPagableImageSection | 719 |
MmUnmapIoSpace | 721 |
MmUnmapReservedMapping | 723 |
MmUnmapViewInSessionSpace | 725 |
MmUnmapViewOfSection | 727 |
MmUserProbeAddress | 729 |