Windows Syscalls
Complete NT kernel system call reference extracted from ntdll.dll across 54 Windows versions. 30388 syscall number mappings from Windows 10 1507 through Windows 11 24H2, with per-version number tracking, category classification, and stability analysis.
30388
syscall numbers
54
OS versions
0
stable
15+
volatile
Syscall Growth
1507
441
1507
441
1511
444
1511
444
1607
450
1607
450
1703
456
1703
456
1709
460
1709
460
1803
462
1803
462
1809
463
1809
463
1903
464
1903
464
1909
464
1909
464
2004
471
2004
471
20H2
471
20H2
471
21H1
471
21H1
471
21H2
473
21H2
473
22H2
473
22H2
473
11-and Server 11-21H2
482
11-and Server 11-22H2
486
11-and Server 11-23H2
486
11-and Server 11-24H2
489
11-and Server 11-25H2
489
11-and Server Server 2022
478
11-and Server Server 2025
489
11-and Server Server 23H2
488
2000 SP0
248
2000 SP1
248
2000 SP2
248
2000 SP3
248
2000 SP4
248
7 SP0
401
7 SP0
401
7 SP1
401
7 SP1
401
8 8.0
429
8 8.0
429
8 8.1
433
8 8.1
433
NT 3.x 3.1
179
NT 3.x 3.5
187
NT 3.x 3.51
196
NT 4.0 SP0
210
NT 4.0 SP1
210
NT 4.0 SP2
212
NT 4.0 SP3
212
NT 4.0 SP3 TSE
217
NT 4.0 SP4
211
NT 4.0 SP5
211
NT 4.0 SP6
211
Server 2003 R2
296
Server 2003 R2
296
Server 2003 R2 SP2
296
Server 2003 R2 SP2
296
Server 2003 SP0
296
Server 2003 SP0
295
Server 2003 SP1
296
Server 2003 SP2
296
Server 2003 SP2
296
Vista SP0
398
Vista SP0
398
Vista SP1
391
Vista SP1
391
Vista SP2
391
Vista SP2
391
XP SP0
284
XP SP1
296
XP SP1
284
XP SP2
296
XP SP2
284
XP SP3
284
Categories
Other
311
Query
61
Set
56
ALPC
23
Sync
17
Security
14
Registry
10
Memory
8
File
6
Notify
5
IPC
4
Process
4
Thread
4
Object
2
Section
2
IO
1
System
1
Version Deltas
10 1511 +3
Added:
NtCreateEnclaveNtInitializeEnclaveNtLoadEnclaveData
10 1607 +6
Added:
NtCommitRegistryTransactionNtCreateRegistryTransactionNtOpenRegistryTransactionNtQuerySecurityPolicyNtRollbackRegistryTransactionNtSetCachedSigningLevel2
10 1703 +6
Added:
NtAcquireProcessActivityReferenceNtCompareSigningLevelsNtConvertBetweenAuxiliaryCounterAndPerformanceCounterNtLoadHotPatchNtQueryAuxiliaryCounterFrequencyNtQueryInformationByName
10 1709 +4
Added:
NtCallEnclaveNtNotifyChangeDirectoryFileExNtQueryDirectoryFileExNtTerminateEnclave
10 1803 +2
Added:
NtAllocateVirtualMemoryExNtMapViewOfSectionEx
10 1809 +2 -1
Added:
NtCreateSectionExNtManageHotPatch
Removed:
NtLoadHotPatch
10 1903 +1
Added:
NtCreateCrossVmEvent
10 2004 +7
Added:
NtAcquireCrossVmMutantNtAllocateUserPhysicalPagesExNtContinueExNtCreateCrossVmMutantNtDirectGraphicsCallNtLoadKey3NtPssCaptureVaSpaceBulk
10 21H2 +2
Added:
NtCopyFileChunkNtQueueApcThreadEx2
11 and Server 11 21H2 +9
Added:
NtChangeProcessStateNtChangeThreadStateNtCreateIoRingNtCreateProcessStateChangeNtCreateThreadStateChangeNtQueryIoRingCapabilitiesNtReadVirtualMemoryExNtSetInformationIoRingNtSubmitIoRing
11 and Server 11 22H2 +4
Added:
NtCreateCpuPartitionNtOpenCpuPartitionNtQueryInformationCpuPartitionNtSetInformationCpuPartition
11 and Server 11 24H2 +3
Added:
NtAlertMultipleThreadByThreadIdNtAlertThreadByThreadIdExNtSetEventEx
11 and Server Server 2022 -11
Removed:
NtAlertMultipleThreadByThreadIdNtAlertThreadByThreadIdExNtCreateCpuPartitionNtCreateIoRingNtOpenCpuPartitionNtQueryInformationCpuPartitionNtQueryIoRingCapabilitiesNtSetEventExNtSetInformationCpuPartitionNtSetInformationIoRingNtSubmitIoRing
11 and Server Server 2025 +11
Added:
NtAlertMultipleThreadByThreadIdNtAlertThreadByThreadIdExNtCreateCpuPartitionNtCreateIoRingNtOpenCpuPartitionNtQueryInformationCpuPartitionNtQueryIoRingCapabilitiesNtSetEventExNtSetInformationCpuPartitionNtSetInformationIoRingNtSubmitIoRing
11 and Server Server 23H2 -1
Removed:
NtAlertMultipleThreadByThreadId
2000 SP0 +11 -251
Added:
NtCancelDeviceWakeupRequestNtCreateChannelNtGetPlugPlayEventNtGetTickCountNtListenChannelNtOpenChannelNtReplyWaitSendChannelNtRequestDeviceWakeupNtRequestWakeupLatencyNtSendWaitReplyChannelNtSetContextChannel
Removed:
NtAcquireCrossVmMutantNtAcquireProcessActivityReferenceNtAddAtomExNtAddBootEntryNtAddDriverEntryNtAdjustTokenClaimsAndDeviceGroupsNtAlertThreadByThreadIdNtAlertThreadByThreadIdExNtAllocateReserveObjectNtAllocateUserPhysicalPagesExNtAllocateVirtualMemoryExNtAlpcAcceptConnectPortNtAlpcCancelMessageNtAlpcConnectPortNtAlpcConnectPortExNtAlpcCreatePortNtAlpcCreatePortSectionNtAlpcCreateResourceReserveNtAlpcCreateSectionViewNtAlpcCreateSecurityContextNtAlpcDeletePortSectionNtAlpcDeleteResourceReserveNtAlpcDeleteSectionViewNtAlpcDeleteSecurityContextNtAlpcDisconnectPortNtAlpcImpersonateClientContainerOfPortNtAlpcImpersonateClientOfPortNtAlpcOpenSenderProcessNtAlpcOpenSenderThreadNtAlpcQueryInformationNtAlpcQueryInformationMessageNtAlpcRevokeSecurityContextNtAlpcSendWaitReceivePortNtAlpcSetInformationNtApphelpCacheControlNtAssociateWaitCompletionPacketNtCallEnclaveNtCancelIoFileExNtCancelSynchronousIoFileNtCancelTimer2NtCancelWaitCompletionPacketNtChangeProcessStateNtChangeThreadStateNtCommitCompleteNtCommitEnlistmentNtCommitRegistryTransactionNtCommitTransactionNtCompactKeysNtCompareObjectsNtCompareSigningLevelsNtCompareTokensNtCompressKeyNtContinueExNtConvertBetweenAuxiliaryCounterAndPerformanceCounterNtCopyFileChunkNtCreateCpuPartitionNtCreateCrossVmEventNtCreateCrossVmMutantNtCreateDebugObjectNtCreateDirectoryObjectExNtCreateEnclaveNtCreateEnlistmentNtCreateIRTimerNtCreateIoRingNtCreateJobSetNtCreateKeyTransactedNtCreateKeyedEventNtCreateLowBoxTokenNtCreatePartitionNtCreatePrivateNamespaceNtCreateProcessExNtCreateProcessStateChangeNtCreateProfileExNtCreateRegistryTransactionNtCreateResourceManagerNtCreateSectionExNtCreateThreadExNtCreateThreadStateChangeNtCreateTimer2NtCreateTokenExNtCreateTransactionNtCreateTransactionManagerNtCreateUserProcessNtCreateWaitCompletionPacketNtCreateWnfStateNameNtCreateWorkerFactoryNtDebugActiveProcessNtDebugContinueNtDeleteBootEntryNtDeleteDriverEntryNtDeletePrivateNamespaceNtDeleteWnfStateDataNtDeleteWnfStateNameNtDirectGraphicsCallNtDisableLastKnownGoodNtDrawTextNtEnableLastKnownGoodNtEnumerateBootEntriesNtEnumerateDriverEntriesNtEnumerateSystemEnvironmentValuesExNtEnumerateTransactionObjectNtFilterBootOptionNtFilterTokenExNtFlushBuffersFileExNtFlushInstallUILanguageNtFlushProcessWriteBuffersNtFreezeRegistryNtFreezeTransactionsNtGetCachedSigningLevelNtGetCompleteWnfStateSubscriptionNtGetCurrentProcessorNumberNtGetCurrentProcessorNumberExNtGetMUIRegistryInfoNtGetNextProcessNtGetNextThreadNtGetNlsSectionPtrNtGetNotificationResourceManagerNtInitializeEnclaveNtInitializeNlsFilesNtIsProcessInJobNtIsUILanguageComittedNtLoadEnclaveDataNtLoadKey3NtLoadKeyExNtLockProductActivationKeysNtLockRegistryKeyNtMakePermanentObjectNtManageHotPatchNtManagePartitionNtMapCMFModuleNtMapViewOfSectionExNtModifyBootEntryNtModifyDriverEntryNtNotifyChangeDirectoryFileExNtNotifyChangeSessionNtOpenCpuPartitionNtOpenEnlistmentNtOpenKeyExNtOpenKeyTransactedNtOpenKeyTransactedExNtOpenKeyedEventNtOpenPartitionNtOpenPrivateNamespaceNtOpenProcessTokenExNtOpenRegistryTransactionNtOpenResourceManagerNtOpenSessionNtOpenThreadTokenExNtOpenTransactionNtOpenTransactionManagerNtPrePrepareCompleteNtPrePrepareEnlistmentNtPrepareCompleteNtPrepareEnlistmentNtPropagationCompleteNtPropagationFailedNtPssCaptureVaSpaceBulkNtQueryAuxiliaryCounterFrequencyNtQueryBootEntryOrderNtQueryBootOptionsNtQueryDebugFilterStateNtQueryDirectoryFileExNtQueryDriverEntryOrderNtQueryInformationByNameNtQueryInformationCpuPartitionNtQueryInformationEnlistmentNtQueryInformationResourceManagerNtQueryInformationTransactionNtQueryInformationTransactionManagerNtQueryInformationWorkerFactoryNtQueryIoRingCapabilitiesNtQueryLicenseValueNtQueryOpenSubKeysExNtQueryPortInformationProcessNtQuerySecurityAttributesTokenNtQuerySecurityPolicyNtQuerySystemEnvironmentValueExNtQuerySystemInformationExNtQueryWnfStateDataNtQueryWnfStateNameInformationNtQueueApcThreadExNtQueueApcThreadEx2NtReadOnlyEnlistmentNtReadVirtualMemoryExNtRecoverEnlistmentNtRecoverResourceManagerNtRecoverTransactionManagerNtRegisterProtocolAddressInformationNtReleaseKeyedEventNtReleaseWorkerFactoryWorkerNtRemoveIoCompletionExNtRemoveProcessDebugNtRenameKeyNtRenameTransactionManagerNtReplacePartitionUnitNtResumeProcessNtRevertContainerImpersonationNtRollbackCompleteNtRollbackEnlistmentNtRollbackRegistryTransactionNtRollbackTransactionNtRollforwardTransactionManagerNtSaveKeyExNtSerializeBootNtSetBootEntryOrderNtSetBootOptionsNtSetCachedSigningLevelNtSetCachedSigningLevel2NtSetDebugFilterStateNtSetDriverEntryOrderNtSetEventBoostPriorityNtSetEventExNtSetIRTimerNtSetInformationCpuPartitionNtSetInformationDebugObjectNtSetInformationEnlistmentNtSetInformationIoRingNtSetInformationResourceManagerNtSetInformationSymbolicLinkNtSetInformationTransactionNtSetInformationTransactionManagerNtSetInformationVirtualMemoryNtSetInformationWorkerFactoryNtSetIoCompletionExNtSetSystemEnvironmentValueExNtSetTimer2NtSetTimerExNtSetWnfProcessNotificationEventNtShutdownWorkerFactoryNtSinglePhaseRejectNtSubmitIoRingNtSubscribeWnfStateChangeNtSuspendProcessNtTerminateEnclaveNtThawRegistryNtThawTransactionsNtTraceControlNtTraceEventNtTranslateFilePathNtUmsThreadYieldNtUnloadKey2NtUnloadKeyExNtUnmapViewOfSectionExNtUnsubscribeWnfStateChangeNtUpdateWnfStateDataNtWaitForAlertByThreadIdNtWaitForDebugEventNtWaitForKeyedEventNtWaitForMultipleObjects32NtWaitForWorkViaWorkerFactoryNtWorkerFactoryWorkerReady
7 SP0 +163 -10
Added:
NtAddBootEntryNtAddDriverEntryNtAllocateReserveObjectNtAlpcAcceptConnectPortNtAlpcCancelMessageNtAlpcConnectPortNtAlpcCreatePortNtAlpcCreatePortSectionNtAlpcCreateResourceReserveNtAlpcCreateSectionViewNtAlpcCreateSecurityContextNtAlpcDeletePortSectionNtAlpcDeleteResourceReserveNtAlpcDeleteSectionViewNtAlpcDeleteSecurityContextNtAlpcDisconnectPortNtAlpcImpersonateClientOfPortNtAlpcOpenSenderProcessNtAlpcOpenSenderThreadNtAlpcQueryInformationNtAlpcQueryInformationMessageNtAlpcRevokeSecurityContextNtAlpcSendWaitReceivePortNtAlpcSetInformationNtApphelpCacheControlNtCancelIoFileExNtCancelSynchronousIoFileNtCommitCompleteNtCommitEnlistmentNtCommitTransactionNtCompactKeysNtCompareTokensNtCompressKeyNtCreateDebugObjectNtCreateEnlistmentNtCreateJobSetNtCreateKeyTransactedNtCreateKeyedEventNtCreatePrivateNamespaceNtCreateProcessExNtCreateProfileExNtCreateResourceManagerNtCreateThreadExNtCreateTransactionNtCreateTransactionManagerNtCreateUserProcessNtCreateWorkerFactoryNtDebugActiveProcessNtDebugContinueNtDeleteBootEntryNtDeleteDriverEntryNtDeletePrivateNamespaceNtDisableLastKnownGoodNtDrawTextNtEnableLastKnownGoodNtEnumerateBootEntriesNtEnumerateDriverEntriesNtEnumerateSystemEnvironmentValuesExNtEnumerateTransactionObjectNtFlushInstallUILanguageNtFlushProcessWriteBuffersNtFreezeRegistryNtFreezeTransactionsNtGetCurrentProcessorNumberNtGetMUIRegistryInfoNtGetNextProcessNtGetNextThreadNtGetNlsSectionPtrNtGetNotificationResourceManagerNtInitializeNlsFilesNtIsProcessInJobNtIsUILanguageComittedNtLoadKeyExNtLockProductActivationKeysNtLockRegistryKeyNtMakePermanentObjectNtMapCMFModuleNtModifyBootEntryNtModifyDriverEntryNtNotifyChangeSessionNtOpenEnlistmentNtOpenKeyExNtOpenKeyTransactedNtOpenKeyTransactedExNtOpenKeyedEventNtOpenPrivateNamespaceNtOpenProcessTokenExNtOpenResourceManagerNtOpenSessionNtOpenThreadTokenExNtOpenTransactionNtOpenTransactionManagerNtPrePrepareCompleteNtPrePrepareEnlistmentNtPrepareCompleteNtPrepareEnlistmentNtPropagationCompleteNtPropagationFailedNtQueryBootEntryOrderNtQueryBootOptionsNtQueryDebugFilterStateNtQueryDriverEntryOrderNtQueryInformationEnlistmentNtQueryInformationResourceManagerNtQueryInformationTransactionNtQueryInformationTransactionManagerNtQueryInformationWorkerFactoryNtQueryLicenseValueNtQueryOpenSubKeysExNtQueryPortInformationProcessNtQuerySecurityAttributesTokenNtQuerySystemEnvironmentValueExNtQuerySystemInformationExNtQueueApcThreadExNtReadOnlyEnlistmentNtRecoverEnlistmentNtRecoverResourceManagerNtRecoverTransactionManagerNtRegisterProtocolAddressInformationNtReleaseKeyedEventNtReleaseWorkerFactoryWorkerNtRemoveIoCompletionExNtRemoveProcessDebugNtRenameKeyNtRenameTransactionManagerNtReplacePartitionUnitNtResumeProcessNtRollbackCompleteNtRollbackEnlistmentNtRollbackTransactionNtRollforwardTransactionManagerNtSaveKeyExNtSerializeBootNtSetBootEntryOrderNtSetBootOptionsNtSetDebugFilterStateNtSetDriverEntryOrderNtSetEventBoostPriorityNtSetInformationDebugObjectNtSetInformationEnlistmentNtSetInformationResourceManagerNtSetInformationTransactionNtSetInformationTransactionManagerNtSetInformationWorkerFactoryNtSetIoCompletionExNtSetSystemEnvironmentValueExNtSetTimerExNtShutdownWorkerFactoryNtSinglePhaseRejectNtSuspendProcessNtThawRegistryNtThawTransactionsNtTraceControlNtTraceEventNtTranslateFilePathNtUmsThreadYieldNtUnloadKey2NtUnloadKeyExNtWaitForDebugEventNtWaitForKeyedEventNtWaitForMultipleObjects32NtWaitForWorkViaWorkerFactoryNtWorkerFactoryWorkerReady
Removed:
NtCancelDeviceWakeupRequestNtCreateChannelNtGetTickCountNtListenChannelNtOpenChannelNtReplyWaitSendChannelNtRequestDeviceWakeupNtRequestWakeupLatencyNtSendWaitReplyChannelNtSetContextChannel
8 8.0 +29 -1
Added:
NtAddAtomExNtAdjustTokenClaimsAndDeviceGroupsNtAlertThreadByThreadIdNtAlpcConnectPortExNtAssociateWaitCompletionPacketNtCancelWaitCompletionPacketNtCreateDirectoryObjectExNtCreateIRTimerNtCreateLowBoxTokenNtCreateTokenExNtCreateWaitCompletionPacketNtCreateWnfStateNameNtDeleteWnfStateDataNtDeleteWnfStateNameNtFilterBootOptionNtFilterTokenExNtFlushBuffersFileExNtGetCachedSigningLevelNtQueryWnfStateDataNtQueryWnfStateNameInformationNtSetCachedSigningLevelNtSetIRTimerNtSetInformationVirtualMemoryNtSubscribeWnfStateChangeNtUnmapViewOfSectionExNtUnsubscribeWnfStateChangeNtUpdateWnfStateDataNtWaitForAlertByThreadIdNtWaitForWnfNotifications
Removed:
NtGetPlugPlayEvent
8 8.1 +5 -1
Added:
NtCancelTimer2NtCreateTimer2NtGetCompleteWnfStateSubscriptionNtSetTimer2NtSetWnfProcessNotificationEvent
Removed:
NtWaitForWnfNotifications
NT 3.x 3.1 +8 -262
Added:
NtGetTickCountNtInitializeVDMNtReleaseProcessMutantNtRenameValueKeyNtSetHighWaitLowThreadNtSetLowWaitHighThreadNtVdmStartExecutionNtWaitForProcessMutant
Removed:
NtAccessCheckByTypeNtAccessCheckByTypeAndAuditAlarmNtAccessCheckByTypeResultListNtAccessCheckByTypeResultListAndAuditAlarmNtAccessCheckByTypeResultListAndAuditAlarmByHandleNtAddAtomNtAddAtomExNtAddBootEntryNtAddDriverEntryNtAdjustTokenClaimsAndDeviceGroupsNtAlertThreadByThreadIdNtAllocateReserveObjectNtAllocateUserPhysicalPagesNtAllocateUuidsNtAlpcAcceptConnectPortNtAlpcCancelMessageNtAlpcConnectPortNtAlpcConnectPortExNtAlpcCreatePortNtAlpcCreatePortSectionNtAlpcCreateResourceReserveNtAlpcCreateSectionViewNtAlpcCreateSecurityContextNtAlpcDeletePortSectionNtAlpcDeleteResourceReserveNtAlpcDeleteSectionViewNtAlpcDeleteSecurityContextNtAlpcDisconnectPortNtAlpcImpersonateClientOfPortNtAlpcOpenSenderProcessNtAlpcOpenSenderThreadNtAlpcQueryInformationNtAlpcQueryInformationMessageNtAlpcRevokeSecurityContextNtAlpcSendWaitReceivePortNtAlpcSetInformationNtApphelpCacheControlNtAreMappedFilesTheSameNtAssignProcessToJobObjectNtAssociateWaitCompletionPacketNtCallbackReturnNtCancelIoFileExNtCancelSynchronousIoFileNtCancelTimer2NtCancelWaitCompletionPacketNtClearEventNtCommitCompleteNtCommitEnlistmentNtCommitTransactionNtCompactKeysNtCompareTokensNtCompressKeyNtCreateDebugObjectNtCreateDirectoryObjectExNtCreateEnlistmentNtCreateIRTimerNtCreateIoCompletionNtCreateJobObjectNtCreateJobSetNtCreateKeyTransactedNtCreateKeyedEventNtCreateLowBoxTokenNtCreatePrivateNamespaceNtCreateProcessExNtCreateProfileExNtCreateResourceManagerNtCreateThreadExNtCreateTimer2NtCreateTokenExNtCreateTransactionNtCreateTransactionManagerNtCreateUserProcessNtCreateWaitCompletionPacketNtCreateWaitablePortNtCreateWnfStateNameNtCreateWorkerFactoryNtDebugActiveProcessNtDebugContinueNtDeleteAtomNtDeleteBootEntryNtDeleteDriverEntryNtDeleteFileNtDeleteObjectAuditAlarmNtDeletePrivateNamespaceNtDeleteWnfStateDataNtDeleteWnfStateNameNtDisableLastKnownGoodNtDrawTextNtEnableLastKnownGoodNtEnumerateBootEntriesNtEnumerateDriverEntriesNtEnumerateSystemEnvironmentValuesExNtEnumerateTransactionObjectNtFilterBootOptionNtFilterTokenNtFilterTokenExNtFindAtomNtFlushBuffersFileExNtFlushInstallUILanguageNtFlushProcessWriteBuffersNtFreeUserPhysicalPagesNtFreezeRegistryNtFreezeTransactionsNtGetCachedSigningLevelNtGetCompleteWnfStateSubscriptionNtGetCurrentProcessorNumberNtGetDevicePowerStateNtGetMUIRegistryInfoNtGetNextProcessNtGetNextThreadNtGetNlsSectionPtrNtGetNotificationResourceManagerNtGetWriteWatchNtImpersonateAnonymousTokenNtInitializeNlsFilesNtInitiatePowerActionNtIsProcessInJobNtIsSystemResumeAutomaticNtIsUILanguageComittedNtLoadKey2NtLoadKeyExNtLockProductActivationKeysNtLockRegistryKeyNtMakePermanentObjectNtMapCMFModuleNtMapUserPhysicalPagesNtMapUserPhysicalPagesScatterNtModifyBootEntryNtModifyDriverEntryNtNotifyChangeMultipleKeysNtNotifyChangeSessionNtOpenEnlistmentNtOpenIoCompletionNtOpenJobObjectNtOpenKeyExNtOpenKeyTransactedNtOpenKeyTransactedExNtOpenKeyedEventNtOpenPrivateNamespaceNtOpenProcessTokenExNtOpenResourceManagerNtOpenSessionNtOpenThreadTokenExNtOpenTransactionNtOpenTransactionManagerNtPlugPlayControlNtPowerInformationNtPrePrepareCompleteNtPrePrepareEnlistmentNtPrepareCompleteNtPrepareEnlistmentNtPropagationCompleteNtPropagationFailedNtQueryAttributesFileNtQueryBootEntryOrderNtQueryBootOptionsNtQueryDebugFilterStateNtQueryDefaultUILanguageNtQueryDriverEntryOrderNtQueryFullAttributesFileNtQueryInformationAtomNtQueryInformationEnlistmentNtQueryInformationJobObjectNtQueryInformationResourceManagerNtQueryInformationTransactionNtQueryInformationTransactionManagerNtQueryInformationWorkerFactoryNtQueryInstallUILanguageNtQueryIoCompletionNtQueryLicenseValueNtQueryMultipleValueKeyNtQueryOpenSubKeysNtQueryOpenSubKeysExNtQueryPortInformationProcessNtQueryQuotaInformationFileNtQuerySecurityAttributesTokenNtQuerySystemEnvironmentValueExNtQuerySystemInformationExNtQueryTimerResolutionNtQueryWnfStateDataNtQueryWnfStateNameInformationNtQueueApcThreadNtQueueApcThreadExNtReadFileScatterNtReadOnlyEnlistmentNtRecoverEnlistmentNtRecoverResourceManagerNtRecoverTransactionManagerNtRegisterProtocolAddressInformationNtReleaseKeyedEventNtReleaseWorkerFactoryWorkerNtRemoveIoCompletionNtRemoveIoCompletionExNtRemoveProcessDebugNtRenameKeyNtRenameTransactionManagerNtReplacePartitionUnitNtReplyWaitReceivePortExNtResetWriteWatchNtResumeProcessNtRollbackCompleteNtRollbackEnlistmentNtRollbackTransactionNtRollforwardTransactionManagerNtSaveKeyExNtSaveMergedKeysNtSecureConnectPortNtSerializeBootNtSetBootEntryOrderNtSetBootOptionsNtSetCachedSigningLevelNtSetDebugFilterStateNtSetDefaultUILanguageNtSetDriverEntryOrderNtSetEventBoostPriorityNtSetIRTimerNtSetInformationDebugObjectNtSetInformationEnlistmentNtSetInformationJobObjectNtSetInformationObjectNtSetInformationResourceManagerNtSetInformationTransactionNtSetInformationTransactionManagerNtSetInformationVirtualMemoryNtSetInformationWorkerFactoryNtSetIoCompletionNtSetIoCompletionExNtSetQuotaInformationFileNtSetSystemEnvironmentValueExNtSetSystemInformationNtSetSystemPowerStateNtSetThreadExecutionStateNtSetTimer2NtSetTimerExNtSetTimerResolutionNtSetUuidSeedNtSetWnfProcessNotificationEventNtShutdownWorkerFactoryNtSignalAndWaitForSingleObjectNtSinglePhaseRejectNtSubscribeWnfStateChangeNtSuspendProcessNtTerminateJobObjectNtThawRegistryNtThawTransactionsNtTraceControlNtTraceEventNtTranslateFilePathNtUmsThreadYieldNtUnloadKey2NtUnloadKeyExNtUnmapViewOfSectionExNtUnsubscribeWnfStateChangeNtUpdateWnfStateDataNtWaitForAlertByThreadIdNtWaitForDebugEventNtWaitForKeyedEventNtWaitForMultipleObjects32NtWaitForWorkViaWorkerFactoryNtWorkerFactoryWorkerReadyNtWriteFileGatherNtYieldExecution
NT 3.x 3.5 +11 -3
Added:
NtClearEventNtCreateIoCompletionNtDeleteFileNtOpenIoCompletionNtQueryAttributesFileNtQueryIoCompletionNtQueryTimerResolutionNtRemoveIoCompletionNtSetInformationObjectNtSetSystemInformationNtSetTimerResolution
Removed:
NtInitializeVDMNtRenameValueKeyNtVdmStartExecution
NT 3.x 3.51 +9
Added:
NtAllocateUuidsNtCallbackReturnNtEnumerateBusNtGetPlugPlayEventNtPlugPlayControlNtRegisterNewDeviceNtSetIoCompletionNtSetSystemPowerStateNtW32Call
NT 4.0 SP0 +18 -4
Added:
NtAddAtomNtCreateChannelNtDeleteAtomNtDeleteObjectAuditAlarmNtFindAtomNtListenChannelNtLoadKey2NtOpenChannelNtQueryFullAttributesFileNtQueryInformationAtomNtQueryMultipleValueKeyNtQueryOleDirectoryFileNtQueueApcThreadNtReplyWaitSendChannelNtSendWaitReplyChannelNtSetContextChannelNtSignalAndWaitForSingleObjectNtYieldExecution
Removed:
NtEnumerateBusNtRegisterNewDeviceNtReleaseProcessMutantNtWaitForProcessMutant
NT 4.0 SP2 +2
Added:
NtReadFileScatterNtWriteFileGather
NT 4.0 SP3 TSE +5
Added:
NtCreateWinStationNtOpenWinStationNtQueryWinStationInformationNtSetWinStationInformationNtWriteErrorLogEntry
NT 4.0 SP4 -6
Removed:
NtCreateWinStationNtOpenWinStationNtQueryWinStationInformationNtSetWinStationInformationNtW32CallNtWriteErrorLogEntry
Server 2003 R2 +95 -10
Added:
NtAccessCheckByTypeNtAccessCheckByTypeAndAuditAlarmNtAccessCheckByTypeResultListNtAccessCheckByTypeResultListAndAuditAlarmNtAccessCheckByTypeResultListAndAuditAlarmByHandleNtAddBootEntryNtAddDriverEntryNtAllocateUserPhysicalPagesNtApphelpCacheControlNtAreMappedFilesTheSameNtAssignProcessToJobObjectNtCancelDeviceWakeupRequestNtCompactKeysNtCompareTokensNtCompressKeyNtCreateDebugObjectNtCreateJobObjectNtCreateJobSetNtCreateKeyedEventNtCreateProcessExNtCreateWaitablePortNtDebugActiveProcessNtDebugContinueNtDeleteBootEntryNtDeleteDriverEntryNtEnumerateBootEntriesNtEnumerateDriverEntriesNtEnumerateSystemEnvironmentValuesExNtFilterTokenNtFreeUserPhysicalPagesNtGetCurrentProcessorNumberNtGetDevicePowerStateNtGetWriteWatchNtImpersonateAnonymousTokenNtInitiatePowerActionNtIsProcessInJobNtIsSystemResumeAutomaticNtLoadKeyExNtLockProductActivationKeysNtLockRegistryKeyNtMakePermanentObjectNtMapUserPhysicalPagesNtMapUserPhysicalPagesScatterNtModifyBootEntryNtModifyDriverEntryNtNotifyChangeMultipleKeysNtOpenJobObjectNtOpenKeyedEventNtOpenProcessTokenExNtOpenThreadTokenExNtPowerInformationNtQueryBootEntryOrderNtQueryBootOptionsNtQueryDebugFilterStateNtQueryDefaultUILanguageNtQueryDriverEntryOrderNtQueryInformationJobObjectNtQueryInstallUILanguageNtQueryOpenSubKeysNtQueryOpenSubKeysExNtQueryPortInformationProcessNtQueryQuotaInformationFileNtQuerySystemEnvironmentValueExNtReleaseKeyedEventNtRemoveProcessDebugNtRenameKeyNtReplyWaitReceivePortExNtRequestDeviceWakeupNtRequestWakeupLatencyNtResetWriteWatchNtResumeProcessNtSaveKeyExNtSaveMergedKeysNtSecureConnectPortNtSetBootEntryOrderNtSetBootOptionsNtSetDebugFilterStateNtSetDefaultUILanguageNtSetDriverEntryOrderNtSetEventBoostPriorityNtSetInformationDebugObjectNtSetInformationJobObjectNtSetQuotaInformationFileNtSetSystemEnvironmentValueExNtSetThreadExecutionStateNtSetUuidSeedNtSuspendProcessNtTerminateJobObjectNtTraceEventNtTranslateFilePathNtUnloadKey2NtUnloadKeyExNtWaitForDebugEventNtWaitForKeyedEventNtWaitForMultipleObjects32
Removed:
NtCreateChannelNtGetTickCountNtListenChannelNtOpenChannelNtQueryOleDirectoryFileNtReplyWaitSendChannelNtSendWaitReplyChannelNtSetContextChannelNtSetHighWaitLowThreadNtSetLowWaitHighThread
Server 2003 SP0 -1
Removed:
NtWaitForMultipleObjects32
Server 2003 SP1 +1
Added:
NtWaitForMultipleObjects32
Vista SP0 +102
Added:
NtAcquireCMFViewOwnershipNtAlpcAcceptConnectPortNtAlpcCancelMessageNtAlpcConnectPortNtAlpcCreatePortNtAlpcCreatePortSectionNtAlpcCreateResourceReserveNtAlpcCreateSectionViewNtAlpcCreateSecurityContextNtAlpcDeletePortSectionNtAlpcDeleteResourceReserveNtAlpcDeleteSectionViewNtAlpcDeleteSecurityContextNtAlpcDisconnectPortNtAlpcImpersonateClientOfPortNtAlpcOpenSenderProcessNtAlpcOpenSenderThreadNtAlpcQueryInformationNtAlpcQueryInformationMessageNtAlpcRevokeSecurityContextNtAlpcSendWaitReceivePortNtAlpcSetInformationNtCancelIoFileExNtCancelSynchronousIoFileNtClearAllSavepointsTransactionNtClearSavepointTransactionNtCommitCompleteNtCommitEnlistmentNtCommitTransactionNtCreateEnlistmentNtCreateKeyTransactedNtCreatePrivateNamespaceNtCreateResourceManagerNtCreateThreadExNtCreateTransactionNtCreateTransactionManagerNtCreateUserProcessNtCreateWorkerFactoryNtDeletePrivateNamespaceNtEnumerateTransactionObjectNtFlushInstallUILanguageNtFlushProcessWriteBuffersNtFreezeRegistryNtFreezeTransactionsNtGetMUIRegistryInfoNtGetNextProcessNtGetNextThreadNtGetNlsSectionPtrNtGetNotificationResourceManagerNtInitializeNlsFilesNtIsUILanguageComittedNtListTransactionsNtMapCMFModuleNtMarshallTransactionNtOpenEnlistmentNtOpenKeyTransactedNtOpenPrivateNamespaceNtOpenResourceManagerNtOpenSessionNtOpenTransactionNtOpenTransactionManagerNtPrePrepareCompleteNtPrePrepareEnlistmentNtPrepareCompleteNtPrepareEnlistmentNtPropagationCompleteNtPropagationFailedNtPullTransactionNtQueryInformationEnlistmentNtQueryInformationResourceManagerNtQueryInformationTransactionNtQueryInformationTransactionManagerNtQueryInformationWorkerFactoryNtQueryLicenseValueNtReadOnlyEnlistmentNtRecoverEnlistmentNtRecoverResourceManagerNtRecoverTransactionManagerNtRegisterProtocolAddressInformationNtReleaseCMFViewOwnershipNtReleaseWorkerFactoryWorkerNtRemoveIoCompletionExNtRollbackCompleteNtRollbackEnlistmentNtRollbackSavepointTransactionNtRollbackTransactionNtRollforwardTransactionManagerNtSavepointCompleteNtSavepointTransactionNtSetInformationEnlistmentNtSetInformationResourceManagerNtSetInformationTransactionNtSetInformationTransactionManagerNtSetInformationWorkerFactoryNtShutdownWorkerFactoryNtSinglePhaseRejectNtStartTmNtThawRegistryNtThawTransactionsNtTraceControlNtWaitForWorkViaWorkerFactoryNtWorkerFactoryWorkerReady
Vista SP1 +2 -9
Added:
NtRenameTransactionManagerNtReplacePartitionUnit
Removed:
NtClearAllSavepointsTransactionNtClearSavepointTransactionNtListTransactionsNtMarshallTransactionNtPullTransactionNtRollbackSavepointTransactionNtSavepointCompleteNtSavepointTransactionNtStartTm
XP SP0 -107
Removed:
NtAcquireCMFViewOwnershipNtAddDriverEntryNtAlpcAcceptConnectPortNtAlpcCancelMessageNtAlpcConnectPortNtAlpcCreatePortNtAlpcCreatePortSectionNtAlpcCreateResourceReserveNtAlpcCreateSectionViewNtAlpcCreateSecurityContextNtAlpcDeletePortSectionNtAlpcDeleteResourceReserveNtAlpcDeleteSectionViewNtAlpcDeleteSecurityContextNtAlpcDisconnectPortNtAlpcImpersonateClientOfPortNtAlpcOpenSenderProcessNtAlpcOpenSenderThreadNtAlpcQueryInformationNtAlpcQueryInformationMessageNtAlpcRevokeSecurityContextNtAlpcSendWaitReceivePortNtAlpcSetInformationNtApphelpCacheControlNtCancelIoFileExNtCancelSynchronousIoFileNtCommitCompleteNtCommitEnlistmentNtCommitTransactionNtCreateEnlistmentNtCreateKeyTransactedNtCreatePrivateNamespaceNtCreateResourceManagerNtCreateThreadExNtCreateTransactionNtCreateTransactionManagerNtCreateUserProcessNtCreateWorkerFactoryNtDeleteDriverEntryNtDeletePrivateNamespaceNtEnumerateDriverEntriesNtEnumerateTransactionObjectNtFlushInstallUILanguageNtFlushProcessWriteBuffersNtFreezeRegistryNtFreezeTransactionsNtGetCurrentProcessorNumberNtGetMUIRegistryInfoNtGetNextProcessNtGetNextThreadNtGetNlsSectionPtrNtGetNotificationResourceManagerNtInitializeNlsFilesNtIsUILanguageComittedNtLoadKeyExNtMapCMFModuleNtModifyDriverEntryNtOpenEnlistmentNtOpenKeyTransactedNtOpenPrivateNamespaceNtOpenResourceManagerNtOpenSessionNtOpenTransactionNtOpenTransactionManagerNtPrePrepareCompleteNtPrePrepareEnlistmentNtPrepareCompleteNtPrepareEnlistmentNtPropagationCompleteNtPropagationFailedNtQueryDriverEntryOrderNtQueryInformationEnlistmentNtQueryInformationResourceManagerNtQueryInformationTransactionNtQueryInformationTransactionManagerNtQueryInformationWorkerFactoryNtQueryLicenseValueNtQueryOpenSubKeysExNtReadOnlyEnlistmentNtRecoverEnlistmentNtRecoverResourceManagerNtRecoverTransactionManagerNtRegisterProtocolAddressInformationNtReleaseCMFViewOwnershipNtReleaseWorkerFactoryWorkerNtRemoveIoCompletionExNtRenameTransactionManagerNtReplacePartitionUnitNtRollbackCompleteNtRollbackEnlistmentNtRollbackTransactionNtRollforwardTransactionManagerNtSetDriverEntryOrderNtSetInformationEnlistmentNtSetInformationResourceManagerNtSetInformationTransactionNtSetInformationTransactionManagerNtSetInformationWorkerFactoryNtShutdownWorkerFactoryNtSinglePhaseRejectNtThawRegistryNtThawTransactionsNtTraceControlNtUnloadKey2NtWaitForMultipleObjects32NtWaitForWorkViaWorkerFactoryNtWorkerFactoryWorkerReady
XP SP1 +12
Added:
NtAddDriverEntryNtApphelpCacheControlNtDeleteDriverEntryNtEnumerateDriverEntriesNtGetCurrentProcessorNumberNtLoadKeyExNtModifyDriverEntryNtQueryDriverEntryOrderNtQueryOpenSubKeysExNtSetDriverEntryOrderNtUnloadKey2NtWaitForMultipleObjects32
XP SP1 -12
Removed:
NtAddDriverEntryNtApphelpCacheControlNtDeleteDriverEntryNtEnumerateDriverEntriesNtGetCurrentProcessorNumberNtLoadKeyExNtModifyDriverEntryNtQueryDriverEntryOrderNtQueryOpenSubKeysExNtSetDriverEntryOrderNtUnloadKey2NtWaitForMultipleObjects32
XP SP2 +12
Added:
NtAddDriverEntryNtApphelpCacheControlNtDeleteDriverEntryNtEnumerateDriverEntriesNtGetCurrentProcessorNumberNtLoadKeyExNtModifyDriverEntryNtQueryDriverEntryOrderNtQueryOpenSubKeysExNtSetDriverEntryOrderNtUnloadKey2NtWaitForMultipleObjects32
XP SP2 -12
Removed:
NtAddDriverEntryNtApphelpCacheControlNtDeleteDriverEntryNtEnumerateDriverEntriesNtGetCurrentProcessorNumberNtLoadKeyExNtModifyDriverEntryNtQueryDriverEntryOrderNtQueryOpenSubKeysExNtSetDriverEntryOrderNtUnloadKey2NtWaitForMultipleObjects32
Most Volatile Syscalls
Largest range of syscall numbers across versions
| Name | Cat | # | Range |
|---|---|---|---|
| NtWaitLowEventPair | Other | 35 | 0x0006-0x01E8 |
| NtWaitHighEventPair | Other | 35 | 0x0007-0x01E7 |
| NtWaitForWorkViaWorkerFactory | Sync | 26 | 0x0008-0x01E6 |
| NtWaitForKeyedEvent | Sync | 28 | 0x000D-0x01E5 |
| NtWaitForDebugEvent | Sync | 28 | 0x000E-0x01E4 |
| NtWaitForAlertByThreadId | Sync | 19 | 0x000F-0x01E3 |
| NtVdmControl | Other | 34 | 0x0010-0x01E2 |
| NtUnsubscribeWnfStateChange | Other | 19 | 0x0011-0x01E0 |
| NtUpdateWnfStateData | Other | 19 | 0x0012-0x01E1 |
| NtUnmapViewOfSectionEx | Other | 19 | 0x0014-0x01DF |
| NtUnlockVirtualMemory | Other | 34 | 0x0015-0x01DE |
| NtAccessCheckAndAuditAlarm | Security | 14 | 0x0002-0x01C9 |
| NtUnlockFile | Other | 34 | 0x0016-0x01DD |
| NtAccessCheckByType | Security | 12 | 0x0003-0x01C8 |
| NtUnloadKeyEx | Other | 28 | 0x0017-0x01DC |
Rock Solid
0 syscalls keep the same number across all 81 versions
| Number | Name | Version | Category | Description |
|---|---|---|---|---|
| Loading... | ||||