Windows Syscalls
Windows NT system call numbers for 54 releases, from Windows NT 3.1 through Windows 11 25H2: 30388 number mappings across x86 and x64, with per-release number tracking, category classification and stability analysis.
30388
syscall numbers
54
OS versions
0
stable
15+
volatile
Syscall Growth
One bar per release in build order: the x86 count, or the x64 count for releases that shipped only as x64.
NT 3.1
179
NT 3.5
187
NT 3.51
196
NT 4.0 SP0
210
NT 4.0 SP1
210
NT 4.0 SP2
212
NT 4.0 SP3
212
NT 4.0 SP3 TSE
217
NT 4.0 SP4
211
NT 4.0 SP5
211
NT 4.0 SP6
211
2000 SP0
248
2000 SP1
248
2000 SP2
248
2000 SP3
248
2000 SP4
248
XP SP0
284
XP SP1
284
XP SP2
284
XP SP3
284
Server 2003 SP0
295
Server 2003 SP1
296
Server 2003 SP2
296
Server 2003 R2
296
Server 2003 R2 SP2
296
Vista SP0
398
Vista SP1
391
Vista SP2
391
7 SP0
401
7 SP1
401
8.0
429
8.1
433
10 1507
441
10 1511
444
10 1607
450
10 1703
456
10 1709
460
10 1803
462
10 1809
463
10 1903
464
10 1909
464
10 2004
471
10 20H2
471
10 21H1
471
10 21H2
473
10 22H2
473
Server 2022
478
11 21H2
482
11 22H2
486
11 23H2
486
Server 23H2
488
11 24H2
489
Server 2025
489
11 25H2
489
Categories
Other
311
Query
61
Set
56
ALPC
23
Sync
17
Security
14
Registry
10
Memory
8
File
6
Notify
5
IPC
4
Process
4
Thread
4
Object
2
Section
2
IO
1
System
1
Version Deltas
Syscalls added and removed against the previous release of the same architecture.
NT 3.5 x86 +11 -3
Added:
NtClearEventNtCreateIoCompletionNtDeleteFileNtOpenIoCompletionNtQueryAttributesFileNtQueryIoCompletionNtQueryTimerResolutionNtRemoveIoCompletionNtSetInformationObjectNtSetSystemInformationNtSetTimerResolution
Removed:
NtInitializeVDMNtRenameValueKeyNtVdmStartExecution
NT 3.51 x86 +9
Added:
NtAllocateUuidsNtCallbackReturnNtEnumerateBusNtGetPlugPlayEventNtPlugPlayControlNtRegisterNewDeviceNtSetIoCompletionNtSetSystemPowerStateNtW32Call
NT 4.0 SP0 x86 +18 -4
Added:
NtAddAtomNtCreateChannelNtDeleteAtomNtDeleteObjectAuditAlarmNtFindAtomNtListenChannelNtLoadKey2NtOpenChannelNtQueryFullAttributesFileNtQueryInformationAtomNtQueryMultipleValueKeyNtQueryOleDirectoryFileNtQueueApcThreadNtReplyWaitSendChannelNtSendWaitReplyChannelNtSetContextChannelNtSignalAndWaitForSingleObjectNtYieldExecution
Removed:
NtEnumerateBusNtRegisterNewDeviceNtReleaseProcessMutantNtWaitForProcessMutant
NT 4.0 SP2 x86 +2
Added:
NtReadFileScatterNtWriteFileGather
NT 4.0 SP3 TSE x86 +5
Added:
NtCreateWinStationNtOpenWinStationNtQueryWinStationInformationNtSetWinStationInformationNtWriteErrorLogEntry
NT 4.0 SP4 x86 -6
Removed:
NtCreateWinStationNtOpenWinStationNtQueryWinStationInformationNtSetWinStationInformationNtW32CallNtWriteErrorLogEntry
2000 SP0 x86 +40 -3
Added:
NtAccessCheckByTypeNtAccessCheckByTypeAndAuditAlarmNtAccessCheckByTypeResultListNtAccessCheckByTypeResultListAndAuditAlarmNtAccessCheckByTypeResultListAndAuditAlarmByHandleNtAllocateUserPhysicalPagesNtAreMappedFilesTheSameNtAssignProcessToJobObjectNtCancelDeviceWakeupRequestNtCreateJobObjectNtCreateWaitablePortNtFilterTokenNtFreeUserPhysicalPagesNtGetDevicePowerStateNtGetWriteWatchNtImpersonateAnonymousTokenNtInitiatePowerActionNtIsSystemResumeAutomaticNtMapUserPhysicalPagesNtMapUserPhysicalPagesScatterNtNotifyChangeMultipleKeysNtOpenJobObjectNtPowerInformationNtQueryDefaultUILanguageNtQueryInformationJobObjectNtQueryInstallUILanguageNtQueryOpenSubKeysNtQueryQuotaInformationFileNtReplyWaitReceivePortExNtRequestDeviceWakeupNtRequestWakeupLatencyNtResetWriteWatchNtSaveMergedKeysNtSecureConnectPortNtSetDefaultUILanguageNtSetInformationJobObjectNtSetQuotaInformationFileNtSetThreadExecutionStateNtSetUuidSeedNtTerminateJobObject
Removed:
NtQueryOleDirectoryFileNtSetHighWaitLowThreadNtSetLowWaitHighThread
XP SP0 x86 +43 -7
Added:
NtAddBootEntryNtCompactKeysNtCompareTokensNtCompressKeyNtCreateDebugObjectNtCreateJobSetNtCreateKeyedEventNtCreateProcessExNtDebugActiveProcessNtDebugContinueNtDeleteBootEntryNtEnumerateBootEntriesNtEnumerateSystemEnvironmentValuesExNtIsProcessInJobNtLockProductActivationKeysNtLockRegistryKeyNtMakePermanentObjectNtModifyBootEntryNtOpenKeyedEventNtOpenProcessTokenExNtOpenThreadTokenExNtQueryBootEntryOrderNtQueryBootOptionsNtQueryDebugFilterStateNtQueryPortInformationProcessNtQuerySystemEnvironmentValueExNtReleaseKeyedEventNtRemoveProcessDebugNtRenameKeyNtResumeProcessNtSaveKeyExNtSetBootEntryOrderNtSetBootOptionsNtSetDebugFilterStateNtSetEventBoostPriorityNtSetInformationDebugObjectNtSetSystemEnvironmentValueExNtSuspendProcessNtTraceEventNtTranslateFilePathNtUnloadKeyExNtWaitForDebugEventNtWaitForKeyedEvent
Removed:
NtCreateChannelNtGetTickCountNtListenChannelNtOpenChannelNtReplyWaitSendChannelNtSendWaitReplyChannelNtSetContextChannel
Server 2003 SP0 x86 +11
Added:
NtAddDriverEntryNtApphelpCacheControlNtDeleteDriverEntryNtEnumerateDriverEntriesNtGetCurrentProcessorNumberNtLoadKeyExNtModifyDriverEntryNtQueryDriverEntryOrderNtQueryOpenSubKeysExNtSetDriverEntryOrderNtUnloadKey2
Server 2003 SP1 x86 +1
Added:
NtWaitForMultipleObjects32
Vista SP0 x64 · x86 +102
Added:
NtAcquireCMFViewOwnershipNtAlpcAcceptConnectPortNtAlpcCancelMessageNtAlpcConnectPortNtAlpcCreatePortNtAlpcCreatePortSectionNtAlpcCreateResourceReserveNtAlpcCreateSectionViewNtAlpcCreateSecurityContextNtAlpcDeletePortSectionNtAlpcDeleteResourceReserveNtAlpcDeleteSectionViewNtAlpcDeleteSecurityContextNtAlpcDisconnectPortNtAlpcImpersonateClientOfPortNtAlpcOpenSenderProcessNtAlpcOpenSenderThreadNtAlpcQueryInformationNtAlpcQueryInformationMessageNtAlpcRevokeSecurityContextNtAlpcSendWaitReceivePortNtAlpcSetInformationNtCancelIoFileExNtCancelSynchronousIoFileNtClearAllSavepointsTransactionNtClearSavepointTransactionNtCommitCompleteNtCommitEnlistmentNtCommitTransactionNtCreateEnlistmentNtCreateKeyTransactedNtCreatePrivateNamespaceNtCreateResourceManagerNtCreateThreadExNtCreateTransactionNtCreateTransactionManagerNtCreateUserProcessNtCreateWorkerFactoryNtDeletePrivateNamespaceNtEnumerateTransactionObjectNtFlushInstallUILanguageNtFlushProcessWriteBuffersNtFreezeRegistryNtFreezeTransactionsNtGetMUIRegistryInfoNtGetNextProcessNtGetNextThreadNtGetNlsSectionPtrNtGetNotificationResourceManagerNtInitializeNlsFilesNtIsUILanguageComittedNtListTransactionsNtMapCMFModuleNtMarshallTransactionNtOpenEnlistmentNtOpenKeyTransactedNtOpenPrivateNamespaceNtOpenResourceManagerNtOpenSessionNtOpenTransactionNtOpenTransactionManagerNtPrePrepareCompleteNtPrePrepareEnlistmentNtPrepareCompleteNtPrepareEnlistmentNtPropagationCompleteNtPropagationFailedNtPullTransactionNtQueryInformationEnlistmentNtQueryInformationResourceManagerNtQueryInformationTransactionNtQueryInformationTransactionManagerNtQueryInformationWorkerFactoryNtQueryLicenseValueNtReadOnlyEnlistmentNtRecoverEnlistmentNtRecoverResourceManagerNtRecoverTransactionManagerNtRegisterProtocolAddressInformationNtReleaseCMFViewOwnershipNtReleaseWorkerFactoryWorkerNtRemoveIoCompletionExNtRollbackCompleteNtRollbackEnlistmentNtRollbackSavepointTransactionNtRollbackTransactionNtRollforwardTransactionManagerNtSavepointCompleteNtSavepointTransactionNtSetInformationEnlistmentNtSetInformationResourceManagerNtSetInformationTransactionNtSetInformationTransactionManagerNtSetInformationWorkerFactoryNtShutdownWorkerFactoryNtSinglePhaseRejectNtStartTmNtThawRegistryNtThawTransactionsNtTraceControlNtWaitForWorkViaWorkerFactoryNtWorkerFactoryWorkerReady
Vista SP1 x64 · x86 +2 -9
Added:
NtRenameTransactionManagerNtReplacePartitionUnit
Removed:
NtClearAllSavepointsTransactionNtClearSavepointTransactionNtListTransactionsNtMarshallTransactionNtPullTransactionNtRollbackSavepointTransactionNtSavepointCompleteNtSavepointTransactionNtStartTm
7 SP0 x64 · x86 +15 -5
Added:
NtAllocateReserveObjectNtCreateProfileExNtDisableLastKnownGoodNtDrawTextNtEnableLastKnownGoodNtNotifyChangeSessionNtOpenKeyExNtOpenKeyTransactedExNtQuerySecurityAttributesTokenNtQuerySystemInformationExNtQueueApcThreadExNtSerializeBootNtSetIoCompletionExNtSetTimerExNtUmsThreadYield
Removed:
NtAcquireCMFViewOwnershipNtCancelDeviceWakeupRequestNtReleaseCMFViewOwnershipNtRequestDeviceWakeupNtRequestWakeupLatency
8.0 x64 · x86 +29 -1
Added:
NtAddAtomExNtAdjustTokenClaimsAndDeviceGroupsNtAlertThreadByThreadIdNtAlpcConnectPortExNtAssociateWaitCompletionPacketNtCancelWaitCompletionPacketNtCreateDirectoryObjectExNtCreateIRTimerNtCreateLowBoxTokenNtCreateTokenExNtCreateWaitCompletionPacketNtCreateWnfStateNameNtDeleteWnfStateDataNtDeleteWnfStateNameNtFilterBootOptionNtFilterTokenExNtFlushBuffersFileExNtGetCachedSigningLevelNtQueryWnfStateDataNtQueryWnfStateNameInformationNtSetCachedSigningLevelNtSetIRTimerNtSetInformationVirtualMemoryNtSubscribeWnfStateChangeNtUnmapViewOfSectionExNtUnsubscribeWnfStateChangeNtUpdateWnfStateDataNtWaitForAlertByThreadIdNtWaitForWnfNotifications
Removed:
NtGetPlugPlayEvent
8.1 x64 · x86 +5 -1
Added:
NtCancelTimer2NtCreateTimer2NtGetCompleteWnfStateSubscriptionNtSetTimer2NtSetWnfProcessNotificationEvent
Removed:
NtWaitForWnfNotifications
10 1507 x64 · x86 +8
Added:
NtAlpcImpersonateClientContainerOfPortNtCompareObjectsNtCreatePartitionNtGetCurrentProcessorNumberExNtManagePartitionNtOpenPartitionNtRevertContainerImpersonationNtSetInformationSymbolicLink
10 1511 x64 · x86 +3
Added:
NtCreateEnclaveNtInitializeEnclaveNtLoadEnclaveData
10 1607 x64 · x86 +6
Added:
NtCommitRegistryTransactionNtCreateRegistryTransactionNtOpenRegistryTransactionNtQuerySecurityPolicyNtRollbackRegistryTransactionNtSetCachedSigningLevel2
10 1703 x64 · x86 +6
Added:
NtAcquireProcessActivityReferenceNtCompareSigningLevelsNtConvertBetweenAuxiliaryCounterAndPerformanceCounterNtLoadHotPatchNtQueryAuxiliaryCounterFrequencyNtQueryInformationByName
10 1709 x64 · x86 +4
Added:
NtCallEnclaveNtNotifyChangeDirectoryFileExNtQueryDirectoryFileExNtTerminateEnclave
10 1803 x64 · x86 +2
Added:
NtAllocateVirtualMemoryExNtMapViewOfSectionEx
10 1809 x64 · x86 +2 -1
Added:
NtCreateSectionExNtManageHotPatch
Removed:
NtLoadHotPatch
10 1903 x64 · x86 +1
Added:
NtCreateCrossVmEvent
10 2004 x64 · x86 +7
Added:
NtAcquireCrossVmMutantNtAllocateUserPhysicalPagesExNtContinueExNtCreateCrossVmMutantNtDirectGraphicsCallNtLoadKey3NtPssCaptureVaSpaceBulk
10 21H2 x64 · x86 +2
Added:
NtCopyFileChunkNtQueueApcThreadEx2
Server 2022 x64 +5
Added:
NtChangeProcessStateNtChangeThreadStateNtCreateProcessStateChangeNtCreateThreadStateChangeNtReadVirtualMemoryEx
11 21H2 x64 +4
Added:
NtCreateIoRingNtQueryIoRingCapabilitiesNtSetInformationIoRingNtSubmitIoRing
11 22H2 x64 +4
Added:
NtCreateCpuPartitionNtOpenCpuPartitionNtQueryInformationCpuPartitionNtSetInformationCpuPartition
Server 23H2 x64 +2
Added:
NtAlertThreadByThreadIdExNtSetEventEx
11 24H2 x64 +1
Added:
NtAlertMultipleThreadByThreadId
Most Volatile Syscalls
Largest range of syscall numbers across versions
| Name | Cat | # | Range |
|---|---|---|---|
| NtWaitLowEventPair | Other | 35 | 0x0006-0x01E8 |
| NtWaitHighEventPair | Other | 35 | 0x0007-0x01E7 |
| NtWaitForWorkViaWorkerFactory | Sync | 26 | 0x0008-0x01E6 |
| NtWaitForKeyedEvent | Sync | 28 | 0x000D-0x01E5 |
| NtWaitForDebugEvent | Sync | 28 | 0x000E-0x01E4 |
| NtWaitForAlertByThreadId | Sync | 19 | 0x000F-0x01E3 |
| NtVdmControl | Other | 34 | 0x0010-0x01E2 |
| NtUnsubscribeWnfStateChange | Other | 19 | 0x0011-0x01E0 |
| NtUpdateWnfStateData | Other | 19 | 0x0012-0x01E1 |
| NtUnmapViewOfSectionEx | Other | 19 | 0x0014-0x01DF |
| NtUnlockVirtualMemory | Other | 34 | 0x0015-0x01DE |
| NtAccessCheckAndAuditAlarm | Security | 14 | 0x0002-0x01C9 |
| NtUnlockFile | Other | 34 | 0x0016-0x01DD |
| NtAccessCheckByType | Security | 12 | 0x0003-0x01C8 |
| NtUnloadKeyEx | Other | 28 | 0x0017-0x01DC |
Rock Solid
0 syscalls keep the same number across all 81 version-and-architecture pairs
| Number | Name | Version | Arch | Category | Description |
|---|---|---|---|---|---|
| Loading... | |||||