Difference between revisions of "Kernel"

From xboxdevwiki
Jump to: navigation, search
(.text and .rdata distinction)
m (Mention that some keys are depending on running XBE (details need to be documented))
 
(11 intermediate revisions by 3 users not shown)
Line 25: Line 25:
 
=== .text ===
 
=== .text ===
  
−
The .text section contains all x86 subroutines to be executed by the processor.
+
The .text section contains the kernel exports.
−
 
 
−
=== .rdata ===
 
−
 
 
−
The .rdata section contains the kernel thunk table. The ordinals in the table are to be resolved to the kernel's actual calling routine, when loaded.
 
  
 
=== .data ===
 
=== .data ===
Line 47: Line 43:
  
 
This section is always the last one. It contains the entrypoint of the kernel.
 
This section is always the last one. It contains the entrypoint of the kernel.
−
Later kernels{{FIXME|reason=Which revision?}} will discard this section after initialization.
+
This does all the cold-boot kernel initialization as described [[Boot_Process#Initialization|here]].
 +
Later kernels{{FIXME|reason=Which revision? right now it appears that *ALL* kernels will discard this}} will discard this section after initialization.
 +
INIT also contains the [[Boot Animation]], so once the kernel has finished booting it can't do a full hardware re-initialization or play the boot animation anymore.
  
 
== Kernel exports ==
 
== Kernel exports ==
Line 55: Line 53:
 
!Name
 
!Name
 
!Ordinal
 
!Ordinal
 +
!x86 Calling Convention
 
!Notes
 
!Notes
 
|-
 
|-
 
|[[Kernel/AvGetSavedDataAddress]]
 
|[[Kernel/AvGetSavedDataAddress]]
 
|1
 
|1
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/AvSendTVEncoderOption]]
 
|[[Kernel/AvSendTVEncoderOption]]
 
|2
 
|2
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/AvSetDisplayMode]]
 
|[[Kernel/AvSetDisplayMode]]
 
|3
 
|3
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/AvSetSavedDataAddress]]
 
|[[Kernel/AvSetSavedDataAddress]]
 
|4
 
|4
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/DbgBreakPoint]]
 
|[[Kernel/DbgBreakPoint]]
 
|5
 
|5
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/DbgBreakPointWithStatus]]
 
|[[Kernel/DbgBreakPointWithStatus]]
 
|6
 
|6
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/DbgLoadImageSymbols]]
 
|[[Kernel/DbgLoadImageSymbols]]
 
|7
 
|7
 +
|stdcall
 
|Devkits only!
 
|Devkits only!
 
|-
 
|-
 
|[[Kernel/DbgPrint]]
 
|[[Kernel/DbgPrint]]
 
|8
 
|8
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/HalReadSMCTrayState]]
 
|[[Kernel/HalReadSMCTrayState]]
 
|9
 
|9
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/DbgPrompt]]
 
|[[Kernel/DbgPrompt]]
 
|10
 
|10
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/DbgUnLoadImageSymbols]]
 
|[[Kernel/DbgUnLoadImageSymbols]]
 
|11
 
|11
 +
|stdcall
 
|Devkits only!
 
|Devkits only!
 
|-
 
|-
 
|[[Kernel/ExAcquireReadWriteLockExclusive]]
 
|[[Kernel/ExAcquireReadWriteLockExclusive]]
 
|12
 
|12
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExAcquireReadWriteLockShared]]
 
|[[Kernel/ExAcquireReadWriteLockShared]]
 
|13
 
|13
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExAllocatePool]]
 
|[[Kernel/ExAllocatePool]]
 
|14
 
|14
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExAllocatePoolWithTag]]
 
|[[Kernel/ExAllocatePoolWithTag]]
 
|15
 
|15
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExEventObjectType]]
 
|[[Kernel/ExEventObjectType]]
 
|16
 
|16
−
|Variable?
+
|
 +
|Variable: OBJECT_TYPE
 
|-
 
|-
 
|[[Kernel/ExFreePool]]
 
|[[Kernel/ExFreePool]]
 
|17
 
|17
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExInitializeReadWriteLock]]
 
|[[Kernel/ExInitializeReadWriteLock]]
 
|18
 
|18
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExInterlockedAddLargeInteger]]
 
|[[Kernel/ExInterlockedAddLargeInteger]]
 
|19
 
|19
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExInterlockedAddLargeStatistic]]
 
|[[Kernel/ExInterlockedAddLargeStatistic]]
 
|20
 
|20
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExInterlockedCompareExchange64]]
 
|[[Kernel/ExInterlockedCompareExchange64]]
 
|21
 
|21
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExMutantObjectType]]
 
|[[Kernel/ExMutantObjectType]]
 
|22
 
|22
−
|Variable?
+
|
 +
|Variable: OBJECT_TYPE
 
|-
 
|-
 
|[[Kernel/ExQueryPoolBlockSize]]
 
|[[Kernel/ExQueryPoolBlockSize]]
 
|23
 
|23
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExQueryNonVolatileSetting]]
 
|[[Kernel/ExQueryNonVolatileSetting]]
 
|24
 
|24
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExReadWriteRefurbInfo]]
 
|[[Kernel/ExReadWriteRefurbInfo]]
 
|25
 
|25
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExRaiseException]]
 
|[[Kernel/ExRaiseException]]
 
|26
 
|26
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExRaiseStatus]]
 
|[[Kernel/ExRaiseStatus]]
 
|27
 
|27
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExReleaseReadWriteLock]]
 
|[[Kernel/ExReleaseReadWriteLock]]
 
|28
 
|28
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExSaveNonVolatileSetting]]
 
|[[Kernel/ExSaveNonVolatileSetting]]
 
|29
 
|29
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExSemaphoreObjectType]]
 
|[[Kernel/ExSemaphoreObjectType]]
 
|30
 
|30
−
|Variable?
+
|
 +
|Variable: OBJECT_TYPE
 
|-
 
|-
 
|[[Kernel/ExTimerObjectType]]
 
|[[Kernel/ExTimerObjectType]]
 
|31
 
|31
−
|Variable?
+
|
 +
|Variable: OBJECT_TYPE
 
|-
 
|-
 
|[[Kernel/ExfInterlockedInsertHeadList]]
 
|[[Kernel/ExfInterlockedInsertHeadList]]
 
|32
 
|32
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExfInterlockedInsertTailList]]
 
|[[Kernel/ExfInterlockedInsertTailList]]
 
|33
 
|33
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ExfInterlockedRemoveHeadList]]
 
|[[Kernel/ExfInterlockedRemoveHeadList]]
 
|34
 
|34
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/FscGetCacheSize]]
 
|[[Kernel/FscGetCacheSize]]
 
|35
 
|35
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/FscInvalidateIdleBlocks]]
 
|[[Kernel/FscInvalidateIdleBlocks]]
 
|36
 
|36
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/FscSetCacheSize]]
 
|[[Kernel/FscSetCacheSize]]
 
|37
 
|37
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/HalClearSoftwareInterrupt]]
 
|[[Kernel/HalClearSoftwareInterrupt]]
 
|38
 
|38
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/HalDisableSystemInterrupt]]
 
|[[Kernel/HalDisableSystemInterrupt]]
 
|39
 
|39
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/HalDiskCachePartitionCount]]
 
|[[Kernel/HalDiskCachePartitionCount]]
 
|40
 
|40
−
|Variable?
+
|
 +
|Variable: ULONG
 
|-
 
|-
 
|[[Kernel/HalDiskModelNumber]]
 
|[[Kernel/HalDiskModelNumber]]
 
|41
 
|41
−
|Variable?
+
|
 +
|Variable: STRING
 
|-
 
|-
 
|[[Kernel/HalDiskSerialNumber]]
 
|[[Kernel/HalDiskSerialNumber]]
 
|42
 
|42
−
|Variable?
+
|
 +
|Variable: STRING
 
|-
 
|-
 
|[[Kernel/HalEnableSystemInterrupt]]
 
|[[Kernel/HalEnableSystemInterrupt]]
 
|43
 
|43
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/HalGetInterruptVector]]
 
|[[Kernel/HalGetInterruptVector]]
 
|44
 
|44
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/HalReadSMBusValue]]
 
|[[Kernel/HalReadSMBusValue]]
 
|45
 
|45
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/HalReadWritePCISpace]]
 
|[[Kernel/HalReadWritePCISpace]]
 
|46
 
|46
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/HalRegisterShutdownNotification]]
 
|[[Kernel/HalRegisterShutdownNotification]]
 
|47
 
|47
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/HalRequestSoftwareInterrupt]]
 
|[[Kernel/HalRequestSoftwareInterrupt]]
 
|48
 
|48
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/HalReturnToFirmware]]
 
|[[Kernel/HalReturnToFirmware]]
 
|49
 
|49
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/HalWriteSMBusValue]]
 
|[[Kernel/HalWriteSMBusValue]]
 
|50
 
|50
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/InterlockedCompareExchange]]
 
|[[Kernel/InterlockedCompareExchange]]
 
|51
 
|51
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/InterlockedDecrement]]
 
|[[Kernel/InterlockedDecrement]]
 
|52
 
|52
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/InterlockedIncrement]]
 
|[[Kernel/InterlockedIncrement]]
 
|53
 
|53
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/InterlockedExchange]]
 
|[[Kernel/InterlockedExchange]]
 
|54
 
|54
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/InterlockedExchangeAdd]]
 
|[[Kernel/InterlockedExchangeAdd]]
 
|55
 
|55
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/InterlockedFlushSList]]
 
|[[Kernel/InterlockedFlushSList]]
 
|56
 
|56
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/InterlockedPopEntrySList]]
 
|[[Kernel/InterlockedPopEntrySList]]
 
|57
 
|57
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/InterlockedPushEntrySList]]
 
|[[Kernel/InterlockedPushEntrySList]]
 
|58
 
|58
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoAllocateIrp]]
 
|[[Kernel/IoAllocateIrp]]
 
|59
 
|59
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoBuildAsynchronousFsdRequest]]
 
|[[Kernel/IoBuildAsynchronousFsdRequest]]
 
|60
 
|60
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoBuildDeviceIoControlRequest]]
 
|[[Kernel/IoBuildDeviceIoControlRequest]]
 
|61
 
|61
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoBuildSynchronousFsdRequest]]
 
|[[Kernel/IoBuildSynchronousFsdRequest]]
 
|62
 
|62
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoCheckShareAccess]]
 
|[[Kernel/IoCheckShareAccess]]
 
|63
 
|63
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoCompletionObjectType]]
 
|[[Kernel/IoCompletionObjectType]]
 
|64
 
|64
−
|Variable?
+
|
 +
|Variable: OBJECT_TYPE
 
|-
 
|-
 
|[[Kernel/IoCreateDevice]]
 
|[[Kernel/IoCreateDevice]]
 
|65
 
|65
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoCreateFile]]
 
|[[Kernel/IoCreateFile]]
 
|66
 
|66
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoCreateSymbolicLink]]
 
|[[Kernel/IoCreateSymbolicLink]]
 
|67
 
|67
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoDeleteDevice]]
 
|[[Kernel/IoDeleteDevice]]
 
|68
 
|68
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoDeleteSymbolicLink]]
 
|[[Kernel/IoDeleteSymbolicLink]]
 
|69
 
|69
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoDeviceObjectType]]
 
|[[Kernel/IoDeviceObjectType]]
 
|70
 
|70
−
|Variable?
+
|
 +
|Variable: OBJECT_TYPE
 
|-
 
|-
 
|[[Kernel/IoFileObjectType]]
 
|[[Kernel/IoFileObjectType]]
 
|71
 
|71
−
|Variable?
+
|
 +
|Variable: OBJECT_TYPE
 
|-
 
|-
 
|[[Kernel/IoFreeIrp]]
 
|[[Kernel/IoFreeIrp]]
 
|72
 
|72
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoInitializeIrp]]
 
|[[Kernel/IoInitializeIrp]]
 
|73
 
|73
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoInvalidDeviceRequest]]
 
|[[Kernel/IoInvalidDeviceRequest]]
 
|74
 
|74
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoQueryFileInformation]]
 
|[[Kernel/IoQueryFileInformation]]
 
|75
 
|75
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoQueryVolumeInformation]]
 
|[[Kernel/IoQueryVolumeInformation]]
 
|76
 
|76
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoQueueThreadIrp]]
 
|[[Kernel/IoQueueThreadIrp]]
 
|77
 
|77
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoRemoveShareAccess]]
 
|[[Kernel/IoRemoveShareAccess]]
 
|78
 
|78
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoSetIoCompletion]]
 
|[[Kernel/IoSetIoCompletion]]
 
|79
 
|79
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoSetShareAccess]]
 
|[[Kernel/IoSetShareAccess]]
 
|80
 
|80
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoStartNextPacket]]
 
|[[Kernel/IoStartNextPacket]]
 
|81
 
|81
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoStartNextPacketByKey]]
 
|[[Kernel/IoStartNextPacketByKey]]
 
|82
 
|82
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoStartPacket]]
 
|[[Kernel/IoStartPacket]]
 
|83
 
|83
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoSynchronousDeviceIoControlRequest]]
 
|[[Kernel/IoSynchronousDeviceIoControlRequest]]
 
|84
 
|84
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoSynchronousFsdRequest]]
 
|[[Kernel/IoSynchronousFsdRequest]]
 
|85
 
|85
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IofCallDriver]]
 
|[[Kernel/IofCallDriver]]
 
|86
 
|86
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IofCompleteRequest]]
 
|[[Kernel/IofCompleteRequest]]
 
|87
 
|87
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KdDebuggerEnabled]]
 
|[[Kernel/KdDebuggerEnabled]]
 
|88
 
|88
−
|Variable?
+
|
 +
|Variable: BOOLEAN
 
|-
 
|-
 
|[[Kernel/KdDebuggerNotPresent]]
 
|[[Kernel/KdDebuggerNotPresent]]
 
|89
 
|89
−
|Variable?
+
|
 +
|Variable: BOOLEAN
 
|-
 
|-
 
|[[Kernel/IoDismountVolume]]
 
|[[Kernel/IoDismountVolume]]
 
|90
 
|90
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoDismountVolumeByName]]
 
|[[Kernel/IoDismountVolumeByName]]
 
|91
 
|91
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeAlertResumeThread]]
 
|[[Kernel/KeAlertResumeThread]]
 
|92
 
|92
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeAlertThread]]
 
|[[Kernel/KeAlertThread]]
 
|93
 
|93
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeBoostPriorityThread]]
 
|[[Kernel/KeBoostPriorityThread]]
 
|94
 
|94
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeBugCheck]]
 
|[[Kernel/KeBugCheck]]
 
|95
 
|95
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeBugCheckEx]]
 
|[[Kernel/KeBugCheckEx]]
 
|96
 
|96
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeCancelTimer]]
 
|[[Kernel/KeCancelTimer]]
 
|97
 
|97
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeConnectInterrupt]]
 
|[[Kernel/KeConnectInterrupt]]
 
|98
 
|98
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeDelayExecutionThread]]
 
|[[Kernel/KeDelayExecutionThread]]
 
|99
 
|99
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeDisconnectInterrupt]]
 
|[[Kernel/KeDisconnectInterrupt]]
 
|100
 
|100
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeEnterCriticalRegion]]
 
|[[Kernel/KeEnterCriticalRegion]]
 
|101
 
|101
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmGlobalData]]
 
|[[Kernel/MmGlobalData]]
 
|102
 
|102
−
|Variable?
+
|
 +
|Variable: MMGLOBALDATA
 
|-
 
|-
 
|[[Kernel/KeGetCurrentIrql]]
 
|[[Kernel/KeGetCurrentIrql]]
 
|103
 
|103
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeGetCurrentThread]]
 
|[[Kernel/KeGetCurrentThread]]
 
|104
 
|104
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInitializeApc]]
 
|[[Kernel/KeInitializeApc]]
 
|105
 
|105
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInitializeDeviceQueue]]
 
|[[Kernel/KeInitializeDeviceQueue]]
 
|106
 
|106
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInitializeDpc]]
 
|[[Kernel/KeInitializeDpc]]
 
|107
 
|107
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInitializeEvent]]
 
|[[Kernel/KeInitializeEvent]]
 
|108
 
|108
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInitializeInterrupt]]
 
|[[Kernel/KeInitializeInterrupt]]
 
|109
 
|109
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInitializeMutant]]
 
|[[Kernel/KeInitializeMutant]]
 
|110
 
|110
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInitializeQueue]]
 
|[[Kernel/KeInitializeQueue]]
 
|111
 
|111
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInitializeSemaphore]]
 
|[[Kernel/KeInitializeSemaphore]]
 
|112
 
|112
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInitializeTimerEx]]
 
|[[Kernel/KeInitializeTimerEx]]
 
|113
 
|113
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInsertByKeyDeviceQueue]]
 
|[[Kernel/KeInsertByKeyDeviceQueue]]
 
|114
 
|114
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInsertDeviceQueue]]
 
|[[Kernel/KeInsertDeviceQueue]]
 
|115
 
|115
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInsertHeadQueue]]
 
|[[Kernel/KeInsertHeadQueue]]
 
|116
 
|116
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInsertQueue]]
 
|[[Kernel/KeInsertQueue]]
 
|117
 
|117
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInsertQueueApc]]
 
|[[Kernel/KeInsertQueueApc]]
 
|118
 
|118
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInsertQueueDpc]]
 
|[[Kernel/KeInsertQueueDpc]]
 
|119
 
|119
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeInterruptTime]]
 
|[[Kernel/KeInterruptTime]]
 
|120
 
|120
−
|Variable?
+
|
 +
|Variable: KSYSTEM_TIME
 
|-
 
|-
 
|[[Kernel/KeIsExecutingDpc]]
 
|[[Kernel/KeIsExecutingDpc]]
 
|121
 
|121
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeLeaveCriticalRegion]]
 
|[[Kernel/KeLeaveCriticalRegion]]
 
|122
 
|122
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KePulseEvent]]
 
|[[Kernel/KePulseEvent]]
 
|123
 
|123
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeQueryBasePriorityThread]]
 
|[[Kernel/KeQueryBasePriorityThread]]
 
|124
 
|124
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeQueryInterruptTime]]
 
|[[Kernel/KeQueryInterruptTime]]
 
|125
 
|125
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeQueryPerformanceCounter]]
 
|[[Kernel/KeQueryPerformanceCounter]]
 
|126
 
|126
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeQueryPerformanceFrequency]]
 
|[[Kernel/KeQueryPerformanceFrequency]]
 
|127
 
|127
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeQuerySystemTime]]
 
|[[Kernel/KeQuerySystemTime]]
 
|128
 
|128
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeRaiseIrqlToDpcLevel]]
 
|[[Kernel/KeRaiseIrqlToDpcLevel]]
 
|129
 
|129
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeRaiseIrqlToSynchLevel]]
 
|[[Kernel/KeRaiseIrqlToSynchLevel]]
 
|130
 
|130
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeReleaseMutant]]
 
|[[Kernel/KeReleaseMutant]]
 
|131
 
|131
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeReleaseSemaphore]]
 
|[[Kernel/KeReleaseSemaphore]]
 
|132
 
|132
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeRemoveByKeyDeviceQueue]]
 
|[[Kernel/KeRemoveByKeyDeviceQueue]]
 
|133
 
|133
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeRemoveDeviceQueue]]
 
|[[Kernel/KeRemoveDeviceQueue]]
 
|134
 
|134
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeRemoveEntryDeviceQueue]]
 
|[[Kernel/KeRemoveEntryDeviceQueue]]
 
|135
 
|135
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeRemoveQueue]]
 
|[[Kernel/KeRemoveQueue]]
 
|136
 
|136
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeRemoveQueueDpc]]
 
|[[Kernel/KeRemoveQueueDpc]]
 
|137
 
|137
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeResetEvent]]
 
|[[Kernel/KeResetEvent]]
 
|138
 
|138
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeRestoreFloatingPointState]]
 
|[[Kernel/KeRestoreFloatingPointState]]
 
|139
 
|139
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeResumeThread]]
 
|[[Kernel/KeResumeThread]]
 
|140
 
|140
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeRundownQueue]]
 
|[[Kernel/KeRundownQueue]]
 
|141
 
|141
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeSaveFloatingPointState]]
 
|[[Kernel/KeSaveFloatingPointState]]
 
|142
 
|142
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeSetBasePriorityThread]]
 
|[[Kernel/KeSetBasePriorityThread]]
 
|143
 
|143
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeSetDisableBoostThread]]
 
|[[Kernel/KeSetDisableBoostThread]]
 
|144
 
|144
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeSetEvent]]
 
|[[Kernel/KeSetEvent]]
 
|145
 
|145
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeSetEventBoostPriority]]
 
|[[Kernel/KeSetEventBoostPriority]]
 
|146
 
|146
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeSetPriorityProcess]]
 
|[[Kernel/KeSetPriorityProcess]]
 
|147
 
|147
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeSetPriorityThread]]
 
|[[Kernel/KeSetPriorityThread]]
 
|148
 
|148
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeSetTimer]]
 
|[[Kernel/KeSetTimer]]
 
|149
 
|149
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeSetTimerEx]]
 
|[[Kernel/KeSetTimerEx]]
 
|150
 
|150
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeStallExecutionProcessor]]
 
|[[Kernel/KeStallExecutionProcessor]]
 
|151
 
|151
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeSuspendThread]]
 
|[[Kernel/KeSuspendThread]]
 
|152
 
|152
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeSynchronizeExecution]]
 
|[[Kernel/KeSynchronizeExecution]]
 
|153
 
|153
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeSystemTime]]
 
|[[Kernel/KeSystemTime]]
 
|154
 
|154
−
|Variable?
+
|
 +
|Variable: KSYSTEM_TIME
 
|-
 
|-
 
|[[Kernel/KeTestAlertThread]]
 
|[[Kernel/KeTestAlertThread]]
 
|155
 
|155
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeTickCount]]
 
|[[Kernel/KeTickCount]]
 
|156
 
|156
−
|Variable?
+
|
 +
|Variable: ULONG
 
|-
 
|-
 
|[[Kernel/KeTimeIncrement]]
 
|[[Kernel/KeTimeIncrement]]
 
|157
 
|157
−
|Variable?
+
|
 +
|Variable: ULONG
 
|-
 
|-
 
|[[Kernel/KeWaitForMultipleObjects]]
 
|[[Kernel/KeWaitForMultipleObjects]]
 
|158
 
|158
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KeWaitForSingleObject]]
 
|[[Kernel/KeWaitForSingleObject]]
 
|159
 
|159
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KfRaiseIrql]]
 
|[[Kernel/KfRaiseIrql]]
 
|160
 
|160
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KfLowerIrql]]
 
|[[Kernel/KfLowerIrql]]
 
|161
 
|161
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/KiBugCheckData]]
 
|[[Kernel/KiBugCheckData]]
 
|162
 
|162
−
|Variable?
+
|
 +
|Variable: ULONG_PTR[5]
 
|-
 
|-
 
|[[Kernel/KiUnlockDispatcherDatabase]]
 
|[[Kernel/KiUnlockDispatcherDatabase]]
 
|163
 
|163
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/LaunchDataPage]]
 
|[[Kernel/LaunchDataPage]]
 
|164
 
|164
−
|Variable?
+
|
 +
|Variable: PLAUNCH_DATA_PAGE
 
|-
 
|-
 
|[[Kernel/MmAllocateContiguousMemory]]
 
|[[Kernel/MmAllocateContiguousMemory]]
 
|165
 
|165
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmAllocateContiguousMemoryEx]]
 
|[[Kernel/MmAllocateContiguousMemoryEx]]
 
|166
 
|166
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmAllocateSystemMemory]]
 
|[[Kernel/MmAllocateSystemMemory]]
 
|167
 
|167
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmClaimGpuInstanceMemory]]
 
|[[Kernel/MmClaimGpuInstanceMemory]]
 
|168
 
|168
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmCreateKernelStack]]
 
|[[Kernel/MmCreateKernelStack]]
 
|169
 
|169
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmDeleteKernelStack]]
 
|[[Kernel/MmDeleteKernelStack]]
 
|170
 
|170
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmFreeContiguousMemory]]
 
|[[Kernel/MmFreeContiguousMemory]]
 
|171
 
|171
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmFreeSystemMemory]]
 
|[[Kernel/MmFreeSystemMemory]]
 
|172
 
|172
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmGetPhysicalAddress]]
 
|[[Kernel/MmGetPhysicalAddress]]
 
|173
 
|173
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmIsAddressValid]]
 
|[[Kernel/MmIsAddressValid]]
 
|174
 
|174
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmLockUnlockBufferPages]]
 
|[[Kernel/MmLockUnlockBufferPages]]
 
|175
 
|175
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmLockUnlockPhysicalPage]]
 
|[[Kernel/MmLockUnlockPhysicalPage]]
 
|176
 
|176
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmMapIoSpace]]
 
|[[Kernel/MmMapIoSpace]]
 
|177
 
|177
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmPersistContiguousMemory]]
 
|[[Kernel/MmPersistContiguousMemory]]
 
|178
 
|178
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmQueryAddressProtect]]
 
|[[Kernel/MmQueryAddressProtect]]
 
|179
 
|179
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmQueryAllocationSize]]
 
|[[Kernel/MmQueryAllocationSize]]
 
|180
 
|180
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmQueryStatistics]]
 
|[[Kernel/MmQueryStatistics]]
 
|181
 
|181
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmSetAddressProtect]]
 
|[[Kernel/MmSetAddressProtect]]
 
|182
 
|182
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/MmUnmapIoSpace]]
 
|[[Kernel/MmUnmapIoSpace]]
 
|183
 
|183
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtAllocateVirtualMemory]]
 
|[[Kernel/NtAllocateVirtualMemory]]
 
|184
 
|184
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtCancelTimer]]
 
|[[Kernel/NtCancelTimer]]
 
|185
 
|185
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtClearEvent]]
 
|[[Kernel/NtClearEvent]]
 
|186
 
|186
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtClose]]
 
|[[Kernel/NtClose]]
 
|187
 
|187
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtCreateDirectoryObject]]
 
|[[Kernel/NtCreateDirectoryObject]]
 
|188
 
|188
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtCreateEvent]]
 
|[[Kernel/NtCreateEvent]]
 
|189
 
|189
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtCreateFile]]
 
|[[Kernel/NtCreateFile]]
 
|190
 
|190
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtCreateIoCompletion]]
 
|[[Kernel/NtCreateIoCompletion]]
 
|191
 
|191
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtCreateMutant]]
 
|[[Kernel/NtCreateMutant]]
 
|192
 
|192
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtCreateSemaphore]]
 
|[[Kernel/NtCreateSemaphore]]
 
|193
 
|193
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtCreateTimer]]
 
|[[Kernel/NtCreateTimer]]
 
|194
 
|194
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtDeleteFile]]
 
|[[Kernel/NtDeleteFile]]
 
|195
 
|195
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtDeviceIoControlFile]]
 
|[[Kernel/NtDeviceIoControlFile]]
 
|196
 
|196
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtDuplicateObject]]
 
|[[Kernel/NtDuplicateObject]]
 
|197
 
|197
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtFlushBuffersFile]]
 
|[[Kernel/NtFlushBuffersFile]]
 
|198
 
|198
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtFreeVirtualMemory]]
 
|[[Kernel/NtFreeVirtualMemory]]
 
|199
 
|199
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtFsControlFile]]
 
|[[Kernel/NtFsControlFile]]
 
|200
 
|200
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtOpenDirectoryObject]]
 
|[[Kernel/NtOpenDirectoryObject]]
 
|201
 
|201
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtOpenFile]]
 
|[[Kernel/NtOpenFile]]
 
|202
 
|202
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtOpenSymbolicLinkObject]]
 
|[[Kernel/NtOpenSymbolicLinkObject]]
 
|203
 
|203
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtProtectVirtualMemory]]
 
|[[Kernel/NtProtectVirtualMemory]]
 
|204
 
|204
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtPulseEvent]]
 
|[[Kernel/NtPulseEvent]]
 
|205
 
|205
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtQueueApcThread]]
 
|[[Kernel/NtQueueApcThread]]
 
|206
 
|206
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtQueryDirectoryFile]]
 
|[[Kernel/NtQueryDirectoryFile]]
 
|207
 
|207
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtQueryDirectoryObject]]
 
|[[Kernel/NtQueryDirectoryObject]]
 
|208
 
|208
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtQueryEvent]]
 
|[[Kernel/NtQueryEvent]]
 
|209
 
|209
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtQueryFullAttributesFile]]
 
|[[Kernel/NtQueryFullAttributesFile]]
 
|210
 
|210
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtQueryInformationFile]]
 
|[[Kernel/NtQueryInformationFile]]
 
|211
 
|211
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtQueryIoCompletion]]
 
|[[Kernel/NtQueryIoCompletion]]
 
|212
 
|212
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtQueryMutant]]
 
|[[Kernel/NtQueryMutant]]
 
|213
 
|213
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtQuerySemaphore]]
 
|[[Kernel/NtQuerySemaphore]]
 
|214
 
|214
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtQuerySymbolicLinkObject]]
 
|[[Kernel/NtQuerySymbolicLinkObject]]
 
|215
 
|215
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtQueryTimer]]
 
|[[Kernel/NtQueryTimer]]
 
|216
 
|216
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtQueryVirtualMemory]]
 
|[[Kernel/NtQueryVirtualMemory]]
 
|217
 
|217
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtQueryVolumeInformationFile]]
 
|[[Kernel/NtQueryVolumeInformationFile]]
 
|218
 
|218
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtReadFile]]
 
|[[Kernel/NtReadFile]]
 
|219
 
|219
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtReadFileScatter]]
 
|[[Kernel/NtReadFileScatter]]
 
|220
 
|220
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtReleaseMutant]]
 
|[[Kernel/NtReleaseMutant]]
 
|221
 
|221
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtReleaseSemaphore]]
 
|[[Kernel/NtReleaseSemaphore]]
 
|222
 
|222
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtRemoveIoCompletion]]
 
|[[Kernel/NtRemoveIoCompletion]]
 
|223
 
|223
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtResumeThread]]
 
|[[Kernel/NtResumeThread]]
 
|224
 
|224
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtSetEvent]]
 
|[[Kernel/NtSetEvent]]
 
|225
 
|225
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtSetInformationFile]]
 
|[[Kernel/NtSetInformationFile]]
 
|226
 
|226
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtSetIoCompletion]]
 
|[[Kernel/NtSetIoCompletion]]
 
|227
 
|227
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtSetSystemTime]]
 
|[[Kernel/NtSetSystemTime]]
 
|228
 
|228
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtSetTimerEx]]
 
|[[Kernel/NtSetTimerEx]]
 
|229
 
|229
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtSignalAndWaitForSingleObjectEx]]
 
|[[Kernel/NtSignalAndWaitForSingleObjectEx]]
 
|230
 
|230
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtSuspendThread]]
 
|[[Kernel/NtSuspendThread]]
 
|231
 
|231
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtUserIoApcDispatcher]]
 
|[[Kernel/NtUserIoApcDispatcher]]
 
|232
 
|232
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtWaitForSingleObject]]
 
|[[Kernel/NtWaitForSingleObject]]
 
|233
 
|233
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtWaitForSingleObjectEx]]
 
|[[Kernel/NtWaitForSingleObjectEx]]
 
|234
 
|234
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtWaitForMultipleObjectsEx]]
 
|[[Kernel/NtWaitForMultipleObjectsEx]]
 
|235
 
|235
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtWriteFile]]
 
|[[Kernel/NtWriteFile]]
 
|236
 
|236
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtWriteFileGather]]
 
|[[Kernel/NtWriteFileGather]]
 
|237
 
|237
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/NtYieldExecution]]
 
|[[Kernel/NtYieldExecution]]
 
|238
 
|238
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ObCreateObject]]
 
|[[Kernel/ObCreateObject]]
 
|239
 
|239
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ObDirectoryObjectType]]
 
|[[Kernel/ObDirectoryObjectType]]
 
|240
 
|240
−
|Variable?
+
|
 +
|Variable: OBJECT_TYPE
 
|-
 
|-
 
|[[Kernel/ObInsertObject]]
 
|[[Kernel/ObInsertObject]]
 
|241
 
|241
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ObMakeTemporaryObject]]
 
|[[Kernel/ObMakeTemporaryObject]]
 
|242
 
|242
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ObOpenObjectByName]]
 
|[[Kernel/ObOpenObjectByName]]
 
|243
 
|243
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ObOpenObjectByPointer]]
 
|[[Kernel/ObOpenObjectByPointer]]
 
|244
 
|244
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ObpObjectHandleTable]]
 
|[[Kernel/ObpObjectHandleTable]]
 
|245
 
|245
−
|Variable?
+
|
 +
|Variable: OBJECT_HANDLE_TABLE
 
|-
 
|-
 
|[[Kernel/ObReferenceObjectByHandle]]
 
|[[Kernel/ObReferenceObjectByHandle]]
 
|246
 
|246
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ObReferenceObjectByName]]
 
|[[Kernel/ObReferenceObjectByName]]
 
|247
 
|247
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ObReferenceObjectByPointer]]
 
|[[Kernel/ObReferenceObjectByPointer]]
 
|248
 
|248
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ObSymbolicLinkObjectType]]
 
|[[Kernel/ObSymbolicLinkObjectType]]
 
|249
 
|249
−
|Variable?
+
|
 +
|Variable: OBJECT_TYPE
 
|-
 
|-
 
|[[Kernel/ObfDereferenceObject]]
 
|[[Kernel/ObfDereferenceObject]]
 
|250
 
|250
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/ObfReferenceObject]]
 
|[[Kernel/ObfReferenceObject]]
 
|251
 
|251
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/PhyGetLinkState]]
 
|[[Kernel/PhyGetLinkState]]
 
|252
 
|252
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/PhyInitialize]]
 
|[[Kernel/PhyInitialize]]
 
|253
 
|253
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/PsCreateSystemThread]]
 
|[[Kernel/PsCreateSystemThread]]
 
|254
 
|254
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/PsCreateSystemThreadEx]]
 
|[[Kernel/PsCreateSystemThreadEx]]
 
|255
 
|255
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/PsQueryStatistics]]
 
|[[Kernel/PsQueryStatistics]]
 
|256
 
|256
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/PsSetCreateThreadNotifyRoutine]]
 
|[[Kernel/PsSetCreateThreadNotifyRoutine]]
 
|257
 
|257
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/PsTerminateSystemThread]]
 
|[[Kernel/PsTerminateSystemThread]]
 
|258
 
|258
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/PsThreadObjectType]]
 
|[[Kernel/PsThreadObjectType]]
 
|259
 
|259
−
|Variable?
+
|
 +
|Variable: OBJECT_TYPE
 
|-
 
|-
 
|[[Kernel/RtlAnsiStringToUnicodeString]]
 
|[[Kernel/RtlAnsiStringToUnicodeString]]
 
|260
 
|260
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlAppendStringToString]]
 
|[[Kernel/RtlAppendStringToString]]
 
|261
 
|261
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlAppendUnicodeStringToString]]
 
|[[Kernel/RtlAppendUnicodeStringToString]]
 
|262
 
|262
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlAppendUnicodeToString]]
 
|[[Kernel/RtlAppendUnicodeToString]]
 
|263
 
|263
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlAssert]]
 
|[[Kernel/RtlAssert]]
 
|264
 
|264
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlCaptureContext]]
 
|[[Kernel/RtlCaptureContext]]
 
|265
 
|265
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlCaptureStackBackTrace]]
 
|[[Kernel/RtlCaptureStackBackTrace]]
 
|266
 
|266
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlCharToInteger]]
 
|[[Kernel/RtlCharToInteger]]
 
|267
 
|267
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlCompareMemory]]
 
|[[Kernel/RtlCompareMemory]]
 
|268
 
|268
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlCompareMemoryUlong]]
 
|[[Kernel/RtlCompareMemoryUlong]]
 
|269
 
|269
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlCompareString]]
 
|[[Kernel/RtlCompareString]]
 
|270
 
|270
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlCompareUnicodeString]]
 
|[[Kernel/RtlCompareUnicodeString]]
 
|271
 
|271
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlCopyString]]
 
|[[Kernel/RtlCopyString]]
 
|272
 
|272
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlCopyUnicodeString]]
 
|[[Kernel/RtlCopyUnicodeString]]
 
|273
 
|273
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlCreateUnicodeString]]
 
|[[Kernel/RtlCreateUnicodeString]]
 
|274
 
|274
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlDowncaseUnicodeChar]]
 
|[[Kernel/RtlDowncaseUnicodeChar]]
 
|275
 
|275
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlDowncaseUnicodeString]]
 
|[[Kernel/RtlDowncaseUnicodeString]]
 
|276
 
|276
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlEnterCriticalSection]]
 
|[[Kernel/RtlEnterCriticalSection]]
 
|277
 
|277
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlEnterCriticalSectionAndRegion]]
 
|[[Kernel/RtlEnterCriticalSectionAndRegion]]
 
|278
 
|278
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlEqualString]]
 
|[[Kernel/RtlEqualString]]
 
|279
 
|279
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlEqualUnicodeString]]
 
|[[Kernel/RtlEqualUnicodeString]]
 
|280
 
|280
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlExtendedIntegerMultiply]]
 
|[[Kernel/RtlExtendedIntegerMultiply]]
 
|281
 
|281
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlExtendedLargeIntegerDivide]]
 
|[[Kernel/RtlExtendedLargeIntegerDivide]]
 
|282
 
|282
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlExtendedMagicDivide]]
 
|[[Kernel/RtlExtendedMagicDivide]]
 
|283
 
|283
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlFillMemory]]
 
|[[Kernel/RtlFillMemory]]
 
|284
 
|284
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlFillMemoryUlong]]
 
|[[Kernel/RtlFillMemoryUlong]]
 
|285
 
|285
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlFreeAnsiString]]
 
|[[Kernel/RtlFreeAnsiString]]
 
|286
 
|286
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlFreeUnicodeString]]
 
|[[Kernel/RtlFreeUnicodeString]]
 
|287
 
|287
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlGetCallersAddress]]
 
|[[Kernel/RtlGetCallersAddress]]
 
|288
 
|288
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlInitAnsiString]]
 
|[[Kernel/RtlInitAnsiString]]
 
|289
 
|289
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlInitUnicodeString]]
 
|[[Kernel/RtlInitUnicodeString]]
 
|290
 
|290
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlInitializeCriticalSection]]
 
|[[Kernel/RtlInitializeCriticalSection]]
 
|291
 
|291
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlIntegerToChar]]
 
|[[Kernel/RtlIntegerToChar]]
 
|292
 
|292
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlIntegerToUnicodeString]]
 
|[[Kernel/RtlIntegerToUnicodeString]]
 
|293
 
|293
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlLeaveCriticalSection]]
 
|[[Kernel/RtlLeaveCriticalSection]]
 
|294
 
|294
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlLeaveCriticalSectionAndRegion]]
 
|[[Kernel/RtlLeaveCriticalSectionAndRegion]]
 
|295
 
|295
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlLowerChar]]
 
|[[Kernel/RtlLowerChar]]
 
|296
 
|296
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlMapGenericMask]]
 
|[[Kernel/RtlMapGenericMask]]
 
|297
 
|297
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlMoveMemory]]
 
|[[Kernel/RtlMoveMemory]]
 
|298
 
|298
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlMultiByteToUnicodeN]]
 
|[[Kernel/RtlMultiByteToUnicodeN]]
 
|299
 
|299
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlMultiByteToUnicodeSize]]
 
|[[Kernel/RtlMultiByteToUnicodeSize]]
 
|300
 
|300
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlNtStatusToDosError]]
 
|[[Kernel/RtlNtStatusToDosError]]
 
|301
 
|301
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlRaiseException]]
 
|[[Kernel/RtlRaiseException]]
 
|302
 
|302
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlRaiseStatus]]
 
|[[Kernel/RtlRaiseStatus]]
 
|303
 
|303
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlTimeFieldsToTime]]
 
|[[Kernel/RtlTimeFieldsToTime]]
 
|304
 
|304
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlTimeToTimeFields]]
 
|[[Kernel/RtlTimeToTimeFields]]
 
|305
 
|305
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlTryEnterCriticalSection]]
 
|[[Kernel/RtlTryEnterCriticalSection]]
 
|306
 
|306
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlUlongByteSwap]]
 
|[[Kernel/RtlUlongByteSwap]]
 
|307
 
|307
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlUnicodeStringToAnsiString]]
 
|[[Kernel/RtlUnicodeStringToAnsiString]]
 
|308
 
|308
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlUnicodeStringToInteger]]
 
|[[Kernel/RtlUnicodeStringToInteger]]
 
|309
 
|309
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlUnicodeToMultiByteN]]
 
|[[Kernel/RtlUnicodeToMultiByteN]]
 
|310
 
|310
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlUnicodeToMultiByteSize]]
 
|[[Kernel/RtlUnicodeToMultiByteSize]]
 
|311
 
|311
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlUnwind]]
 
|[[Kernel/RtlUnwind]]
 
|312
 
|312
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlUpcaseUnicodeChar]]
 
|[[Kernel/RtlUpcaseUnicodeChar]]
 
|313
 
|313
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlUpcaseUnicodeString]]
 
|[[Kernel/RtlUpcaseUnicodeString]]
 
|314
 
|314
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlUpcaseUnicodeToMultiByteN]]
 
|[[Kernel/RtlUpcaseUnicodeToMultiByteN]]
 
|315
 
|315
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlUpperChar]]
 
|[[Kernel/RtlUpperChar]]
 
|316
 
|316
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlUpperString]]
 
|[[Kernel/RtlUpperString]]
 
|317
 
|317
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlUshortByteSwap]]
 
|[[Kernel/RtlUshortByteSwap]]
 
|318
 
|318
 +
|fastcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlWalkFrameChain]]
 
|[[Kernel/RtlWalkFrameChain]]
 
|319
 
|319
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlZeroMemory]]
 
|[[Kernel/RtlZeroMemory]]
 
|320
 
|320
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XboxEEPROMKey]]
 
|[[Kernel/XboxEEPROMKey]]
 
|321
 
|321
−
|Variable?
+
|
 +
|Variable: XBOX_KEY_DATA
 
|-
 
|-
 
|[[Kernel/XboxHardwareInfo]]
 
|[[Kernel/XboxHardwareInfo]]
 
|322
 
|322
−
|Variable?
+
|
 +
|Variable: XBOX_HARDWARE_INFO
 
|-
 
|-
 
|[[Kernel/XboxHDKey]]
 
|[[Kernel/XboxHDKey]]
 
|323
 
|323
−
|Variable?
+
|
 +
|Variable: XBOX_KEY_DATA
 
|-
 
|-
 
|[[Kernel/XboxKrnlVersion]]
 
|[[Kernel/XboxKrnlVersion]]
 
|324
 
|324
−
|Variable?
+
|
 +
|Variable: XBOX_KRNL_VERSION
 
|-
 
|-
 
|[[Kernel/XboxSignatureKey]]
 
|[[Kernel/XboxSignatureKey]]
 
|325
 
|325
−
|Variable?
+
|
 +
|Variable: XBOX_KEY_DATA; modified by active XBE Certificate
 
|-
 
|-
 
|[[Kernel/XeImageFileName]]
 
|[[Kernel/XeImageFileName]]
 
|326
 
|326
−
|Variable?
+
|
 +
|Variable: OBJECT_STRING
 
|-
 
|-
 
|[[Kernel/XeLoadSection]]
 
|[[Kernel/XeLoadSection]]
 
|327
 
|327
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XeUnloadSection]]
 
|[[Kernel/XeUnloadSection]]
 
|328
 
|328
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/READ_PORT_BUFFER_UCHAR]]
 
|[[Kernel/READ_PORT_BUFFER_UCHAR]]
 
|329
 
|329
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/READ_PORT_BUFFER_USHORT]]
 
|[[Kernel/READ_PORT_BUFFER_USHORT]]
 
|330
 
|330
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/READ_PORT_BUFFER_ULONG]]
 
|[[Kernel/READ_PORT_BUFFER_ULONG]]
 
|331
 
|331
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/WRITE_PORT_BUFFER_UCHAR]]
 
|[[Kernel/WRITE_PORT_BUFFER_UCHAR]]
 
|332
 
|332
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/WRITE_PORT_BUFFER_USHORT]]
 
|[[Kernel/WRITE_PORT_BUFFER_USHORT]]
 
|333
 
|333
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/WRITE_PORT_BUFFER_ULONG]]
 
|[[Kernel/WRITE_PORT_BUFFER_ULONG]]
 
|334
 
|334
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcSHAInit]]
 
|[[Kernel/XcSHAInit]]
 
|335
 
|335
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcSHAUpdate]]
 
|[[Kernel/XcSHAUpdate]]
 
|336
 
|336
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcSHAFinal]]
 
|[[Kernel/XcSHAFinal]]
 
|337
 
|337
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcRC4Key]]
 
|[[Kernel/XcRC4Key]]
 
|338
 
|338
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcRC4Crypt]]
 
|[[Kernel/XcRC4Crypt]]
 
|339
 
|339
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcHMAC]]
 
|[[Kernel/XcHMAC]]
 
|340
 
|340
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcPKEncPublic]]
 
|[[Kernel/XcPKEncPublic]]
 
|341
 
|341
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcPKDecPrivate]]
 
|[[Kernel/XcPKDecPrivate]]
 
|342
 
|342
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcPKGetKeyLen]]
 
|[[Kernel/XcPKGetKeyLen]]
 
|343
 
|343
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcVerifyPKCS1Signature]]
 
|[[Kernel/XcVerifyPKCS1Signature]]
 
|344
 
|344
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcModExp]]
 
|[[Kernel/XcModExp]]
 
|345
 
|345
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcDESKeyParity]]
 
|[[Kernel/XcDESKeyParity]]
 
|346
 
|346
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcKeyTable]]
 
|[[Kernel/XcKeyTable]]
 
|347
 
|347
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcBlockCrypt]]
 
|[[Kernel/XcBlockCrypt]]
 
|348
 
|348
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcBlockCryptCBC]]
 
|[[Kernel/XcBlockCryptCBC]]
 
|349
 
|349
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcCryptService]]
 
|[[Kernel/XcCryptService]]
 
|350
 
|350
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/XcUpdateCrypto]]
 
|[[Kernel/XcUpdateCrypto]]
 
|351
 
|351
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlRip]]
 
|[[Kernel/RtlRip]]
 
|352
 
|352
 +
|stdcall
 
|
 
|
 
|-
 
|-
Line 1,468: Line 1,819:
 
|353
 
|353
 
|
 
|
 +
|Variable: XBOX_KEY_DATA; modified by active XBE Certificate
 
|-
 
|-
 
|[[Kernel/XboxAlternateSignatureKeys]]
 
|[[Kernel/XboxAlternateSignatureKeys]]
 
|354
 
|354
−
|Variable?
+
|
 +
|Variable: XBOX_KEY_DATA[XBEIMAGE_ALTERNATE_TITLE_ID_COUNT]; modified by active XBE Certificate
 
|-
 
|-
 
|[[Kernel/XePublicKeyData]]
 
|[[Kernel/XePublicKeyData]]
 
|355
 
|355
−
|Variable?
+
|
 +
|Variable: UCHAR[XC_PUBLIC_KEYDATA_SIZE]
 
|-
 
|-
 
|[[Kernel/HalBootSMCVideoMode]]
 
|[[Kernel/HalBootSMCVideoMode]]
 
|356
 
|356
−
|Variable?
+
|
 +
|Variable: ULONG
 
|-
 
|-
 
|[[Kernel/IdexChannelObject]]
 
|[[Kernel/IdexChannelObject]]
 
|357
 
|357
−
|Variable?
+
|
 +
|Variable: IDE_CHANNEL_OBJECT
 
|-
 
|-
 
|[[Kernel/HalIsResetOrShutdownPending]]
 
|[[Kernel/HalIsResetOrShutdownPending]]
 
|358
 
|358
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/IoMarkIrpMustComplete]]
 
|[[Kernel/IoMarkIrpMustComplete]]
 
|359
 
|359
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/HalInitiateShutdown]]
 
|[[Kernel/HalInitiateShutdown]]
 
|360
 
|360
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/RtlSnprintf]]
 
|[[Kernel/RtlSnprintf]]
 
|361
 
|361
 +
|stdcall
 
|Unused?
 
|Unused?
 
|-
 
|-
 
|[[Kernel/RtlSprintf]]
 
|[[Kernel/RtlSprintf]]
 
|362
 
|362
 +
|stdcall
 
|Unused?
 
|Unused?
 
|-
 
|-
 
|[[Kernel/RtlVsnprintf]]
 
|[[Kernel/RtlVsnprintf]]
 
|363
 
|363
 +
|stdcall
 
|Unused?
 
|Unused?
 
|-
 
|-
 
|[[Kernel/RtlVsprintf]]
 
|[[Kernel/RtlVsprintf]]
 
|364
 
|364
 +
|stdcall
 
|Unused?
 
|Unused?
 
|-
 
|-
 
|[[Kernel/HalEnableSecureTrayEject]]
 
|[[Kernel/HalEnableSecureTrayEject]]
 
|365
 
|365
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|[[Kernel/HalWriteSMCScratchRegister]]
 
|[[Kernel/HalWriteSMCScratchRegister]]
−
|366  
+
|366
 +
|stdcall
 
|
 
|
 
|-
 
|-
 
|
 
|
 
|367
 
|367
 +
|
 
|Unused?
 
|Unused?
 
|-
 
|-
 
|
 
|
 
|368
 
|368
 +
|
 
|Unused?
 
|Unused?
 
|-
 
|-
 
|
 
|
 
|369
 
|369
 +
|
 
|Unused?
 
|Unused?
 
|-
 
|-
 +
|[[Kernel/XProfpControl]]
 +
|370
 
|
 
|
−
|370
+
|Profiling-enabled builds only!
−
|Unused?
 
 
|-
 
|-
 +
|[[Kernel/XProfpGetData]]
 +
|371
 
|
 
|
−
|371
+
|Profiling-enabled builds only!
−
|Unused?
 
 
|-
 
|-
 +
|[[Kernel/IrtClientInitFast]]
 +
|372
 
|
 
|
−
|372
+
|Profiling-enabled builds only!
−
|Unused?
 
 
|-
 
|-
 +
|[[Kernel/IrtSweep]]
 +
|373
 
|
 
|
−
|373
+
|Profiling-enabled builds only!
−
|Unused?
 
 
|-
 
|-
 
|[[Kernel/MmDbgAllocateMemory]]
 
|[[Kernel/MmDbgAllocateMemory]]
 
|374
 
|374
 +
|stdcall
 
|Devkits only!
 
|Devkits only!
 
|-
 
|-
 
|[[Kernel/MmDbgFreeMemory]]
 
|[[Kernel/MmDbgFreeMemory]]
 
|375
 
|375
 +
|stdcall
 
|Devkits only!
 
|Devkits only!
 
|-
 
|-
 
|[[Kernel/MmDbgQueryAvailablePages]]
 
|[[Kernel/MmDbgQueryAvailablePages]]
 
|376
 
|376
 +
|stdcall
 
|Devkits only!
 
|Devkits only!
 
|-
 
|-
 
|[[Kernel/MmDbgReleaseAddress]]
 
|[[Kernel/MmDbgReleaseAddress]]
 
|377
 
|377
 +
|stdcall
 
|Devkits only!
 
|Devkits only!
 
|-
 
|-
 
|[[Kernel/MmDbgWriteCheck]]
 
|[[Kernel/MmDbgWriteCheck]]
 
|378
 
|378
 +
|stdcall
 
|Devkits only!
 
|Devkits only!
 
|}
 
|}
−
 
−
== See Also ==
 
−
 
−
[[Hard Drive Files]]
 

Latest revision as of 17:23, 21 October 2018

The Xbox kernel is called xboxkrnl.exe. It is closely related to the Windows NT ntoskrnl.exe. Its image base address is always 0x80010000.

Header modifications

xboxkrnl.exe is a mostly standard exe file. However, the MS-DOS header was patched to contain Xbox specific data in the reserved 20 byte block starting at offset 40:

Offset Meaning
40 Size of uninitialized portion of the .data section
44 Size of initialized portion of the .data section
48 Memory address of initialized portion of the .data section (usually in Flash).
Used to re-initialize the data section pointed to by the next field.
Note that the pointer might be invalid during normal execution as the Flash might not be mapped at all times.
52 Memory address where the .data section is stored (usually the same as in the section header + image base).

Sections

All sections are identity mapped (meaning file offsets and offsets in RAM match). This is because the kernel is not loaded through a traditional PE / exe loader, but just unpacked into memory.

.text

The .text section contains the kernel exports.

.data

The .data section stores initialized and uninitialized data. A copy of the initialized portion of this section is usually stored in the BIOS.

STICKY

Stores variables which must be preserved across a quick-reboot.

IDEXPRDT

A Physical Region Descriptor Table (PRDT) for the IDE bus. This section serves as a memory allocation only, it does not have to be initialized when loading the kernel[citation needed].

INIT

This section is always the last one. It contains the entrypoint of the kernel. This does all the cold-boot kernel initialization as described here. Later kernels[FIXME] will discard this section after initialization. INIT also contains the Boot Animation, so once the kernel has finished booting it can't do a full hardware re-initialization or play the boot animation anymore.

Kernel exports

Kernel exports
Name Ordinal x86 Calling Convention Notes
Kernel/AvGetSavedDataAddress 1 stdcall
Kernel/AvSendTVEncoderOption 2 stdcall
Kernel/AvSetDisplayMode 3 stdcall
Kernel/AvSetSavedDataAddress 4 stdcall
Kernel/DbgBreakPoint 5 stdcall
Kernel/DbgBreakPointWithStatus 6 stdcall
Kernel/DbgLoadImageSymbols 7 stdcall Devkits only!
Kernel/DbgPrint 8 stdcall
Kernel/HalReadSMCTrayState 9 stdcall
Kernel/DbgPrompt 10 stdcall
Kernel/DbgUnLoadImageSymbols 11 stdcall Devkits only!
Kernel/ExAcquireReadWriteLockExclusive 12 stdcall
Kernel/ExAcquireReadWriteLockShared 13 stdcall
Kernel/ExAllocatePool 14 stdcall
Kernel/ExAllocatePoolWithTag 15 stdcall
Kernel/ExEventObjectType 16 Variable: OBJECT_TYPE
Kernel/ExFreePool 17 stdcall
Kernel/ExInitializeReadWriteLock 18 stdcall
Kernel/ExInterlockedAddLargeInteger 19 stdcall
Kernel/ExInterlockedAddLargeStatistic 20 fastcall
Kernel/ExInterlockedCompareExchange64 21 fastcall
Kernel/ExMutantObjectType 22 Variable: OBJECT_TYPE
Kernel/ExQueryPoolBlockSize 23 stdcall
Kernel/ExQueryNonVolatileSetting 24 stdcall
Kernel/ExReadWriteRefurbInfo 25 stdcall
Kernel/ExRaiseException 26 stdcall
Kernel/ExRaiseStatus 27 stdcall
Kernel/ExReleaseReadWriteLock 28 stdcall
Kernel/ExSaveNonVolatileSetting 29 stdcall
Kernel/ExSemaphoreObjectType 30 Variable: OBJECT_TYPE
Kernel/ExTimerObjectType 31 Variable: OBJECT_TYPE
Kernel/ExfInterlockedInsertHeadList 32 stdcall
Kernel/ExfInterlockedInsertTailList 33 fastcall
Kernel/ExfInterlockedRemoveHeadList 34 fastcall
Kernel/FscGetCacheSize 35 stdcall
Kernel/FscInvalidateIdleBlocks 36 stdcall
Kernel/FscSetCacheSize 37 stdcall
Kernel/HalClearSoftwareInterrupt 38 fastcall
Kernel/HalDisableSystemInterrupt 39 stdcall
Kernel/HalDiskCachePartitionCount 40 Variable: ULONG
Kernel/HalDiskModelNumber 41 Variable: STRING
Kernel/HalDiskSerialNumber 42 Variable: STRING
Kernel/HalEnableSystemInterrupt 43 stdcall
Kernel/HalGetInterruptVector 44 stdcall
Kernel/HalReadSMBusValue 45 stdcall
Kernel/HalReadWritePCISpace 46 stdcall
Kernel/HalRegisterShutdownNotification 47 stdcall
Kernel/HalRequestSoftwareInterrupt 48 fastcall
Kernel/HalReturnToFirmware 49 stdcall
Kernel/HalWriteSMBusValue 50 stdcall
Kernel/InterlockedCompareExchange 51 fastcall
Kernel/InterlockedDecrement 52 fastcall
Kernel/InterlockedIncrement 53 fastcall
Kernel/InterlockedExchange 54 fastcall
Kernel/InterlockedExchangeAdd 55 fastcall
Kernel/InterlockedFlushSList 56 fastcall
Kernel/InterlockedPopEntrySList 57 fastcall
Kernel/InterlockedPushEntrySList 58 fastcall
Kernel/IoAllocateIrp 59 stdcall
Kernel/IoBuildAsynchronousFsdRequest 60 stdcall
Kernel/IoBuildDeviceIoControlRequest 61 stdcall
Kernel/IoBuildSynchronousFsdRequest 62 stdcall
Kernel/IoCheckShareAccess 63 stdcall
Kernel/IoCompletionObjectType 64 Variable: OBJECT_TYPE
Kernel/IoCreateDevice 65 stdcall
Kernel/IoCreateFile 66 stdcall
Kernel/IoCreateSymbolicLink 67 stdcall
Kernel/IoDeleteDevice 68 stdcall
Kernel/IoDeleteSymbolicLink 69 stdcall
Kernel/IoDeviceObjectType 70 Variable: OBJECT_TYPE
Kernel/IoFileObjectType 71 Variable: OBJECT_TYPE
Kernel/IoFreeIrp 72 stdcall
Kernel/IoInitializeIrp 73 stdcall
Kernel/IoInvalidDeviceRequest 74 stdcall
Kernel/IoQueryFileInformation 75 stdcall
Kernel/IoQueryVolumeInformation 76 stdcall
Kernel/IoQueueThreadIrp 77 stdcall
Kernel/IoRemoveShareAccess 78 stdcall
Kernel/IoSetIoCompletion 79 stdcall
Kernel/IoSetShareAccess 80 stdcall
Kernel/IoStartNextPacket 81 stdcall
Kernel/IoStartNextPacketByKey 82 stdcall
Kernel/IoStartPacket 83 stdcall
Kernel/IoSynchronousDeviceIoControlRequest 84 stdcall
Kernel/IoSynchronousFsdRequest 85 stdcall
Kernel/IofCallDriver 86 fastcall
Kernel/IofCompleteRequest 87 fastcall
Kernel/KdDebuggerEnabled 88 Variable: BOOLEAN
Kernel/KdDebuggerNotPresent 89 Variable: BOOLEAN
Kernel/IoDismountVolume 90 stdcall
Kernel/IoDismountVolumeByName 91 stdcall
Kernel/KeAlertResumeThread 92 stdcall
Kernel/KeAlertThread 93 stdcall
Kernel/KeBoostPriorityThread 94 stdcall
Kernel/KeBugCheck 95 stdcall
Kernel/KeBugCheckEx 96 stdcall
Kernel/KeCancelTimer 97 stdcall
Kernel/KeConnectInterrupt 98 stdcall
Kernel/KeDelayExecutionThread 99 stdcall
Kernel/KeDisconnectInterrupt 100 stdcall
Kernel/KeEnterCriticalRegion 101 stdcall
Kernel/MmGlobalData 102 Variable: MMGLOBALDATA
Kernel/KeGetCurrentIrql 103 stdcall
Kernel/KeGetCurrentThread 104 stdcall
Kernel/KeInitializeApc 105 stdcall
Kernel/KeInitializeDeviceQueue 106 stdcall
Kernel/KeInitializeDpc 107 stdcall
Kernel/KeInitializeEvent 108 stdcall
Kernel/KeInitializeInterrupt 109 stdcall
Kernel/KeInitializeMutant 110 stdcall
Kernel/KeInitializeQueue 111 stdcall
Kernel/KeInitializeSemaphore 112 stdcall
Kernel/KeInitializeTimerEx 113 stdcall
Kernel/KeInsertByKeyDeviceQueue 114 stdcall
Kernel/KeInsertDeviceQueue 115 stdcall
Kernel/KeInsertHeadQueue 116 stdcall
Kernel/KeInsertQueue 117 stdcall
Kernel/KeInsertQueueApc 118 stdcall
Kernel/KeInsertQueueDpc 119 stdcall
Kernel/KeInterruptTime 120 Variable: KSYSTEM_TIME
Kernel/KeIsExecutingDpc 121 stdcall
Kernel/KeLeaveCriticalRegion 122 stdcall
Kernel/KePulseEvent 123 stdcall
Kernel/KeQueryBasePriorityThread 124 stdcall
Kernel/KeQueryInterruptTime 125 stdcall
Kernel/KeQueryPerformanceCounter 126 stdcall
Kernel/KeQueryPerformanceFrequency 127 stdcall
Kernel/KeQuerySystemTime 128 stdcall
Kernel/KeRaiseIrqlToDpcLevel 129 stdcall
Kernel/KeRaiseIrqlToSynchLevel 130 stdcall
Kernel/KeReleaseMutant 131 stdcall
Kernel/KeReleaseSemaphore 132 stdcall
Kernel/KeRemoveByKeyDeviceQueue 133 stdcall
Kernel/KeRemoveDeviceQueue 134 stdcall
Kernel/KeRemoveEntryDeviceQueue 135 stdcall
Kernel/KeRemoveQueue 136 stdcall
Kernel/KeRemoveQueueDpc 137 stdcall
Kernel/KeResetEvent 138 stdcall
Kernel/KeRestoreFloatingPointState 139 stdcall
Kernel/KeResumeThread 140 stdcall
Kernel/KeRundownQueue 141 stdcall
Kernel/KeSaveFloatingPointState 142 stdcall
Kernel/KeSetBasePriorityThread 143 stdcall
Kernel/KeSetDisableBoostThread 144 stdcall
Kernel/KeSetEvent 145 stdcall
Kernel/KeSetEventBoostPriority 146 stdcall
Kernel/KeSetPriorityProcess 147 stdcall
Kernel/KeSetPriorityThread 148 stdcall
Kernel/KeSetTimer 149 stdcall
Kernel/KeSetTimerEx 150 stdcall
Kernel/KeStallExecutionProcessor 151 stdcall
Kernel/KeSuspendThread 152 stdcall
Kernel/KeSynchronizeExecution 153 stdcall
Kernel/KeSystemTime 154 Variable: KSYSTEM_TIME
Kernel/KeTestAlertThread 155 stdcall
Kernel/KeTickCount 156 Variable: ULONG
Kernel/KeTimeIncrement 157 Variable: ULONG
Kernel/KeWaitForMultipleObjects 158 stdcall
Kernel/KeWaitForSingleObject 159 stdcall
Kernel/KfRaiseIrql 160 fastcall
Kernel/KfLowerIrql 161 fastcall
Kernel/KiBugCheckData 162 Variable: ULONG_PTR[5]
Kernel/KiUnlockDispatcherDatabase 163 fastcall
Kernel/LaunchDataPage 164 Variable: PLAUNCH_DATA_PAGE
Kernel/MmAllocateContiguousMemory 165 stdcall
Kernel/MmAllocateContiguousMemoryEx 166 stdcall
Kernel/MmAllocateSystemMemory 167 stdcall
Kernel/MmClaimGpuInstanceMemory 168 stdcall
Kernel/MmCreateKernelStack 169 stdcall
Kernel/MmDeleteKernelStack 170 stdcall
Kernel/MmFreeContiguousMemory 171 stdcall
Kernel/MmFreeSystemMemory 172 stdcall
Kernel/MmGetPhysicalAddress 173 stdcall
Kernel/MmIsAddressValid 174 stdcall
Kernel/MmLockUnlockBufferPages 175 stdcall
Kernel/MmLockUnlockPhysicalPage 176 stdcall
Kernel/MmMapIoSpace 177 stdcall
Kernel/MmPersistContiguousMemory 178 stdcall
Kernel/MmQueryAddressProtect 179 stdcall
Kernel/MmQueryAllocationSize 180 stdcall
Kernel/MmQueryStatistics 181 stdcall
Kernel/MmSetAddressProtect 182 stdcall
Kernel/MmUnmapIoSpace 183 stdcall
Kernel/NtAllocateVirtualMemory 184 stdcall
Kernel/NtCancelTimer 185 stdcall
Kernel/NtClearEvent 186 stdcall
Kernel/NtClose 187 stdcall
Kernel/NtCreateDirectoryObject 188 stdcall
Kernel/NtCreateEvent 189 stdcall
Kernel/NtCreateFile 190 stdcall
Kernel/NtCreateIoCompletion 191 stdcall
Kernel/NtCreateMutant 192 stdcall
Kernel/NtCreateSemaphore 193 stdcall
Kernel/NtCreateTimer 194 stdcall
Kernel/NtDeleteFile 195 stdcall
Kernel/NtDeviceIoControlFile 196 stdcall
Kernel/NtDuplicateObject 197 stdcall
Kernel/NtFlushBuffersFile 198 stdcall
Kernel/NtFreeVirtualMemory 199 stdcall
Kernel/NtFsControlFile 200 stdcall
Kernel/NtOpenDirectoryObject 201 stdcall
Kernel/NtOpenFile 202 stdcall
Kernel/NtOpenSymbolicLinkObject 203 stdcall
Kernel/NtProtectVirtualMemory 204 stdcall
Kernel/NtPulseEvent 205 stdcall
Kernel/NtQueueApcThread 206 stdcall
Kernel/NtQueryDirectoryFile 207 stdcall
Kernel/NtQueryDirectoryObject 208 stdcall
Kernel/NtQueryEvent 209 stdcall
Kernel/NtQueryFullAttributesFile 210 stdcall
Kernel/NtQueryInformationFile 211 stdcall
Kernel/NtQueryIoCompletion 212 stdcall
Kernel/NtQueryMutant 213 stdcall
Kernel/NtQuerySemaphore 214 stdcall
Kernel/NtQuerySymbolicLinkObject 215 stdcall
Kernel/NtQueryTimer 216 stdcall
Kernel/NtQueryVirtualMemory 217 stdcall
Kernel/NtQueryVolumeInformationFile 218 stdcall
Kernel/NtReadFile 219 stdcall
Kernel/NtReadFileScatter 220 stdcall
Kernel/NtReleaseMutant 221 stdcall
Kernel/NtReleaseSemaphore 222 stdcall
Kernel/NtRemoveIoCompletion 223 stdcall
Kernel/NtResumeThread 224 stdcall
Kernel/NtSetEvent 225 stdcall
Kernel/NtSetInformationFile 226 stdcall
Kernel/NtSetIoCompletion 227 stdcall
Kernel/NtSetSystemTime 228 stdcall
Kernel/NtSetTimerEx 229 stdcall
Kernel/NtSignalAndWaitForSingleObjectEx 230 stdcall
Kernel/NtSuspendThread 231 stdcall
Kernel/NtUserIoApcDispatcher 232 stdcall
Kernel/NtWaitForSingleObject 233 stdcall
Kernel/NtWaitForSingleObjectEx 234 stdcall
Kernel/NtWaitForMultipleObjectsEx 235 stdcall
Kernel/NtWriteFile 236 stdcall
Kernel/NtWriteFileGather 237 stdcall
Kernel/NtYieldExecution 238 stdcall
Kernel/ObCreateObject 239 stdcall
Kernel/ObDirectoryObjectType 240 Variable: OBJECT_TYPE
Kernel/ObInsertObject 241 stdcall
Kernel/ObMakeTemporaryObject 242 stdcall
Kernel/ObOpenObjectByName 243 stdcall
Kernel/ObOpenObjectByPointer 244 stdcall
Kernel/ObpObjectHandleTable 245 Variable: OBJECT_HANDLE_TABLE
Kernel/ObReferenceObjectByHandle 246 stdcall
Kernel/ObReferenceObjectByName 247 stdcall
Kernel/ObReferenceObjectByPointer 248 stdcall
Kernel/ObSymbolicLinkObjectType 249 Variable: OBJECT_TYPE
Kernel/ObfDereferenceObject 250 fastcall
Kernel/ObfReferenceObject 251 fastcall
Kernel/PhyGetLinkState 252 stdcall
Kernel/PhyInitialize 253 stdcall
Kernel/PsCreateSystemThread 254 stdcall
Kernel/PsCreateSystemThreadEx 255 stdcall
Kernel/PsQueryStatistics 256 stdcall
Kernel/PsSetCreateThreadNotifyRoutine 257 stdcall
Kernel/PsTerminateSystemThread 258 stdcall
Kernel/PsThreadObjectType 259 Variable: OBJECT_TYPE
Kernel/RtlAnsiStringToUnicodeString 260 stdcall
Kernel/RtlAppendStringToString 261 stdcall
Kernel/RtlAppendUnicodeStringToString 262 stdcall
Kernel/RtlAppendUnicodeToString 263 stdcall
Kernel/RtlAssert 264 stdcall
Kernel/RtlCaptureContext 265 stdcall
Kernel/RtlCaptureStackBackTrace 266 stdcall
Kernel/RtlCharToInteger 267 stdcall
Kernel/RtlCompareMemory 268 stdcall
Kernel/RtlCompareMemoryUlong 269 stdcall
Kernel/RtlCompareString 270 stdcall
Kernel/RtlCompareUnicodeString 271 stdcall
Kernel/RtlCopyString 272 stdcall
Kernel/RtlCopyUnicodeString 273 stdcall
Kernel/RtlCreateUnicodeString 274 stdcall
Kernel/RtlDowncaseUnicodeChar 275 stdcall
Kernel/RtlDowncaseUnicodeString 276 stdcall
Kernel/RtlEnterCriticalSection 277 stdcall
Kernel/RtlEnterCriticalSectionAndRegion 278 stdcall
Kernel/RtlEqualString 279 stdcall
Kernel/RtlEqualUnicodeString 280 stdcall
Kernel/RtlExtendedIntegerMultiply 281 stdcall
Kernel/RtlExtendedLargeIntegerDivide 282 stdcall
Kernel/RtlExtendedMagicDivide 283 stdcall
Kernel/RtlFillMemory 284 stdcall
Kernel/RtlFillMemoryUlong 285 stdcall
Kernel/RtlFreeAnsiString 286 stdcall
Kernel/RtlFreeUnicodeString 287 stdcall
Kernel/RtlGetCallersAddress 288 stdcall
Kernel/RtlInitAnsiString 289 stdcall
Kernel/RtlInitUnicodeString 290 stdcall
Kernel/RtlInitializeCriticalSection 291 stdcall
Kernel/RtlIntegerToChar 292 stdcall
Kernel/RtlIntegerToUnicodeString 293 stdcall
Kernel/RtlLeaveCriticalSection 294 stdcall
Kernel/RtlLeaveCriticalSectionAndRegion 295 stdcall
Kernel/RtlLowerChar 296 stdcall
Kernel/RtlMapGenericMask 297 stdcall
Kernel/RtlMoveMemory 298 stdcall
Kernel/RtlMultiByteToUnicodeN 299 stdcall
Kernel/RtlMultiByteToUnicodeSize 300 stdcall
Kernel/RtlNtStatusToDosError 301 stdcall
Kernel/RtlRaiseException 302 stdcall
Kernel/RtlRaiseStatus 303 stdcall
Kernel/RtlTimeFieldsToTime 304 stdcall
Kernel/RtlTimeToTimeFields 305 stdcall
Kernel/RtlTryEnterCriticalSection 306 stdcall
Kernel/RtlUlongByteSwap 307 fastcall
Kernel/RtlUnicodeStringToAnsiString 308 stdcall
Kernel/RtlUnicodeStringToInteger 309 stdcall
Kernel/RtlUnicodeToMultiByteN 310 stdcall
Kernel/RtlUnicodeToMultiByteSize 311 stdcall
Kernel/RtlUnwind 312 stdcall
Kernel/RtlUpcaseUnicodeChar 313 stdcall
Kernel/RtlUpcaseUnicodeString 314 stdcall
Kernel/RtlUpcaseUnicodeToMultiByteN 315 stdcall
Kernel/RtlUpperChar 316 stdcall
Kernel/RtlUpperString 317 stdcall
Kernel/RtlUshortByteSwap 318 fastcall
Kernel/RtlWalkFrameChain 319 stdcall
Kernel/RtlZeroMemory 320 stdcall
Kernel/XboxEEPROMKey 321 Variable: XBOX_KEY_DATA
Kernel/XboxHardwareInfo 322 Variable: XBOX_HARDWARE_INFO
Kernel/XboxHDKey 323 Variable: XBOX_KEY_DATA
Kernel/XboxKrnlVersion 324 Variable: XBOX_KRNL_VERSION
Kernel/XboxSignatureKey 325 Variable: XBOX_KEY_DATA; modified by active XBE Certificate
Kernel/XeImageFileName 326 Variable: OBJECT_STRING
Kernel/XeLoadSection 327 stdcall
Kernel/XeUnloadSection 328 stdcall
Kernel/READ_PORT_BUFFER_UCHAR 329 stdcall
Kernel/READ_PORT_BUFFER_USHORT 330 stdcall
Kernel/READ_PORT_BUFFER_ULONG 331 stdcall
Kernel/WRITE_PORT_BUFFER_UCHAR 332 stdcall
Kernel/WRITE_PORT_BUFFER_USHORT 333 stdcall
Kernel/WRITE_PORT_BUFFER_ULONG 334 stdcall
Kernel/XcSHAInit 335 stdcall
Kernel/XcSHAUpdate 336 stdcall
Kernel/XcSHAFinal 337 stdcall
Kernel/XcRC4Key 338 stdcall
Kernel/XcRC4Crypt 339 stdcall
Kernel/XcHMAC 340 stdcall
Kernel/XcPKEncPublic 341 stdcall
Kernel/XcPKDecPrivate 342 stdcall
Kernel/XcPKGetKeyLen 343 stdcall
Kernel/XcVerifyPKCS1Signature 344 stdcall
Kernel/XcModExp 345 stdcall
Kernel/XcDESKeyParity 346 stdcall
Kernel/XcKeyTable 347 stdcall
Kernel/XcBlockCrypt 348 stdcall
Kernel/XcBlockCryptCBC 349 stdcall
Kernel/XcCryptService 350 stdcall
Kernel/XcUpdateCrypto 351 stdcall
Kernel/RtlRip 352 stdcall
Kernel/XboxLANKey 353 Variable: XBOX_KEY_DATA; modified by active XBE Certificate
Kernel/XboxAlternateSignatureKeys 354 Variable: XBOX_KEY_DATA[XBEIMAGE_ALTERNATE_TITLE_ID_COUNT]; modified by active XBE Certificate
Kernel/XePublicKeyData 355 Variable: UCHAR[XC_PUBLIC_KEYDATA_SIZE]
Kernel/HalBootSMCVideoMode 356 Variable: ULONG
Kernel/IdexChannelObject 357 Variable: IDE_CHANNEL_OBJECT
Kernel/HalIsResetOrShutdownPending 358 stdcall
Kernel/IoMarkIrpMustComplete 359 stdcall
Kernel/HalInitiateShutdown 360 stdcall
Kernel/RtlSnprintf 361 stdcall Unused?
Kernel/RtlSprintf 362 stdcall Unused?
Kernel/RtlVsnprintf 363 stdcall Unused?
Kernel/RtlVsprintf 364 stdcall Unused?
Kernel/HalEnableSecureTrayEject 365 stdcall
Kernel/HalWriteSMCScratchRegister 366 stdcall
367 Unused?
368 Unused?
369 Unused?
Kernel/XProfpControl 370 Profiling-enabled builds only!
Kernel/XProfpGetData 371 Profiling-enabled builds only!
Kernel/IrtClientInitFast 372 Profiling-enabled builds only!
Kernel/IrtSweep 373 Profiling-enabled builds only!
Kernel/MmDbgAllocateMemory 374 stdcall Devkits only!
Kernel/MmDbgFreeMemory 375 stdcall Devkits only!
Kernel/MmDbgQueryAvailablePages 376 stdcall Devkits only!
Kernel/MmDbgReleaseAddress 377 stdcall Devkits only!
Kernel/MmDbgWriteCheck 378 stdcall Devkits only!
Retrieved from "https://xboxdevwiki.net/index.php?title=Kernel&oldid=6596"