NtReadVirtualMemoryEx

Other → NTSTATUS

NtReadVirtualMemoryEx is a Windows NT kernel system call, in the Other category, returning NTSTATUS. Its syscall number is not the same on every Windows release: across the 8 version-and-architecture pairs recorded here it takes 5 distinct values, from 0x0170 to 0x0177.

The number is an index into the system service table of one particular build, not a stable identifier, so it is not portable between Windows versions. The table below gives the value recorded for each.

Numbers across OS versions (8)

OS VersionArchitectureNumber
Windows 11 and Server 11 21H2 x64 0x0172 (370)
Windows 11 and Server 11 22H2 x64 0x0175 (373)
Windows 11 and Server 11 23H2 x64 0x0175 (373)
Windows 11 and Server 11 24H2 x64 0x0177 (375)
Windows 11 and Server 11 25H2 x64 0x0177 (375)
Windows 11 and Server Server 2022 x64 0x0170 (368)
Windows 11 and Server Server 2025 x64 0x0177 (375)
Windows 11 and Server Server 23H2 x64 0x0176 (374)