Windows Syscalls

Complete NT kernel system call reference extracted from ntdll.dll across 11 Windows versions. 5169 syscall number mappings from Windows 10 1507 through Windows 11 24H2, with per-version number tracking, category classification, and stability analysis.

5169 syscall numbers
11 OS versions
102 stable
15+ volatile
Search
NT Version
Category

Syscall Growth

1507
441
1607
450
1809
462
1903
464
2004
470
21H2
472
22H2
472
11-21H2
480
11-22H2
485
11-23H2
485
11-24H2
488

Categories

System
53
Sync
49
Registry
41
Port
37
Other
33
File
33
Thread
30
Memory
30
Transaction
28
Token
19
Object
19
Process
17
Boot
15
Security
12
WNF
10
Io
9
Partition
8
Debug
6
Misc
5
Enclave
5
Job
5
WorkerFactory
5
Atom
4
Profile
4
CrossVm
3
Namespace
3
Driver
2
Trace
2
Paging
1

Version Deltas

10 1607 +9
Added: NtCommitRegistryTransactionNtCreateEnclaveNtCreateRegistryTransactionNtInitializeEnclaveNtLoadEnclaveDataNtOpenRegistryTransactionNtQuerySecurityPolicyNtRollbackRegistryTransactionNtSetCachedSigningLevel2
10 1809 +13 -1
Added: NtAcquireProcessActivityReferenceNtAllocateVirtualMemoryExNtCallEnclaveNtCompareSigningLevelsNtConvertBetweenAuxiliaryCounterAndPerformanceCounterNtCreateSectionExNtManageHotPatchNtMapViewOfSectionExNtNotifyChangeDirectoryFileExNtQueryAuxiliaryCounterFrequencyNtQueryDirectoryFileExNtQueryInformationByNameNtTerminateEnclave
Removed: NtLoadKey3
10 1903 +2
Added: NtCreateCrossVmEventNtLoadKey3
10 2004 +6
Added: NtAcquireCrossVmMutantNtAllocateUserPhysicalPagesExNtContinueExNtCreateCrossVmMutantNtDirectGraphicsCallNtPssCaptureVaSpaceBulk
10 21H2 +2
Added: NtCopyFileChunkNtQueueApcThreadEx2
11 21H2 +9 -1
Added: NtChangeProcessStateNtChangeThreadStateNtCreateIoRingNtCreateProcessStateChangeNtCreateThreadStateChangeNtQueryIoRingCapabilitiesNtReadVirtualMemoryExNtSetInformationIoRingNtSubmitIoRing
Removed: NtCopyFileChunk
11 22H2 +5
Added: NtCopyFileChunkNtCreateCpuPartitionNtOpenCpuPartitionNtQueryInformationCpuPartitionNtSetInformationCpuPartition
11 24H2 +3
Added: NtAlertMultipleThreadByThreadIdNtAlertThreadByThreadIdExNtSetEventEx

Most Volatile Syscalls

Largest range of syscall numbers across versions

NameCat#Range
NtLoadKey3 Registry 8 0x010E-0x01D7
NtTerminateJobObject Job 9 0x01A2-0x01D2
NtTestAlert Thread 9 0x01A3-0x01D3
NtThawRegistry Registry 9 0x01A4-0x01D4
NtThawTransactions Transaction 9 0x01A5-0x01D5
NtTraceControl Trace 9 0x01A6-0x01D6
NtTranslateFilePath File 9 0x01A7-0x01D7
NtUmsThreadYield Thread 9 0x01A8-0x01D8
NtUnloadDriver Driver 9 0x01A9-0x01D9
NtUnloadKey Registry 9 0x01AA-0x01DA
NtUnloadKey2 Registry 9 0x01AB-0x01DB
NtUnloadKeyEx Registry 9 0x01AC-0x01DC
NtUnlockFile File 9 0x01AD-0x01DD
NtUnlockVirtualMemory Memory 9 0x01AE-0x01DE
NtUnmapViewOfSectionEx Memory 9 0x01AF-0x01DF

Rock Solid

102 syscalls keep the same number across all 11 versions

0x0000 NtAccessCheck 0x0001 NtWorkerFactoryWorkerReady 0x0002 NtAcceptConnectPort 0x0003 NtMapUserPhysicalPagesScatter 0x0004 NtWaitForSingleObject 0x0005 NtCallbackReturn 0x0006 NtReadFile 0x0007 NtDeviceIoControlFile 0x0008 NtWriteFile 0x0009 NtRemoveIoCompletion 0x000A NtReleaseSemaphore 0x000B NtReplyWaitReceivePort 0x000C NtReplyPort 0x000D NtSetInformationThread 0x000E NtSetEvent +87 more
Number Name Version Category Description
Loading...