Windows Syscalls
Complete NT kernel system call reference extracted from ntdll.dll across 11 Windows versions. 5169 syscall number mappings from Windows 10 1507 through Windows 11 24H2, with per-version number tracking, category classification, and stability analysis.
5169
syscall numbers
11
OS versions
102
stable
15+
volatile
Syscall Growth
1507
441
1607
450
1809
462
1903
464
2004
470
21H2
472
22H2
472
11-21H2
480
11-22H2
485
11-23H2
485
11-24H2
488
Categories
System
53
Sync
49
Registry
41
Port
37
Other
33
File
33
Thread
30
Memory
30
Transaction
28
Token
19
Object
19
Process
17
Boot
15
Security
12
WNF
10
Io
9
Partition
8
Debug
6
Misc
5
Enclave
5
Job
5
WorkerFactory
5
Atom
4
Profile
4
CrossVm
3
Namespace
3
Driver
2
Trace
2
Paging
1
Version Deltas
10 1607 +9
Added:
NtCommitRegistryTransactionNtCreateEnclaveNtCreateRegistryTransactionNtInitializeEnclaveNtLoadEnclaveDataNtOpenRegistryTransactionNtQuerySecurityPolicyNtRollbackRegistryTransactionNtSetCachedSigningLevel2
10 1809 +13 -1
Added:
NtAcquireProcessActivityReferenceNtAllocateVirtualMemoryExNtCallEnclaveNtCompareSigningLevelsNtConvertBetweenAuxiliaryCounterAndPerformanceCounterNtCreateSectionExNtManageHotPatchNtMapViewOfSectionExNtNotifyChangeDirectoryFileExNtQueryAuxiliaryCounterFrequencyNtQueryDirectoryFileExNtQueryInformationByNameNtTerminateEnclave
Removed:
NtLoadKey3
10 1903 +2
Added:
NtCreateCrossVmEventNtLoadKey3
10 2004 +6
Added:
NtAcquireCrossVmMutantNtAllocateUserPhysicalPagesExNtContinueExNtCreateCrossVmMutantNtDirectGraphicsCallNtPssCaptureVaSpaceBulk
10 21H2 +2
Added:
NtCopyFileChunkNtQueueApcThreadEx2
11 21H2 +9 -1
Added:
NtChangeProcessStateNtChangeThreadStateNtCreateIoRingNtCreateProcessStateChangeNtCreateThreadStateChangeNtQueryIoRingCapabilitiesNtReadVirtualMemoryExNtSetInformationIoRingNtSubmitIoRing
Removed:
NtCopyFileChunk
11 22H2 +5
Added:
NtCopyFileChunkNtCreateCpuPartitionNtOpenCpuPartitionNtQueryInformationCpuPartitionNtSetInformationCpuPartition
11 24H2 +3
Added:
NtAlertMultipleThreadByThreadIdNtAlertThreadByThreadIdExNtSetEventEx
Most Volatile Syscalls
Largest range of syscall numbers across versions
| Name | Cat | # | Range |
|---|---|---|---|
| NtLoadKey3 | Registry | 8 | 0x010E-0x01D7 |
| NtTerminateJobObject | Job | 9 | 0x01A2-0x01D2 |
| NtTestAlert | Thread | 9 | 0x01A3-0x01D3 |
| NtThawRegistry | Registry | 9 | 0x01A4-0x01D4 |
| NtThawTransactions | Transaction | 9 | 0x01A5-0x01D5 |
| NtTraceControl | Trace | 9 | 0x01A6-0x01D6 |
| NtTranslateFilePath | File | 9 | 0x01A7-0x01D7 |
| NtUmsThreadYield | Thread | 9 | 0x01A8-0x01D8 |
| NtUnloadDriver | Driver | 9 | 0x01A9-0x01D9 |
| NtUnloadKey | Registry | 9 | 0x01AA-0x01DA |
| NtUnloadKey2 | Registry | 9 | 0x01AB-0x01DB |
| NtUnloadKeyEx | Registry | 9 | 0x01AC-0x01DC |
| NtUnlockFile | File | 9 | 0x01AD-0x01DD |
| NtUnlockVirtualMemory | Memory | 9 | 0x01AE-0x01DE |
| NtUnmapViewOfSectionEx | Memory | 9 | 0x01AF-0x01DF |
Rock Solid
102 syscalls keep the same number across all 11 versions
0x0000 NtAccessCheck
0x0001 NtWorkerFactoryWorkerReady
0x0002 NtAcceptConnectPort
0x0003 NtMapUserPhysicalPagesScatter
0x0004 NtWaitForSingleObject
0x0005 NtCallbackReturn
0x0006 NtReadFile
0x0007 NtDeviceIoControlFile
0x0008 NtWriteFile
0x0009 NtRemoveIoCompletion
0x000A NtReleaseSemaphore
0x000B NtReplyWaitReceivePort
0x000C NtReplyPort
0x000D NtSetInformationThread
0x000E NtSetEvent
+87 more
| Number | Name | Version | Category | Description |
|---|---|---|---|---|
| Loading... | ||||