System Service Call Implementations in the WRK

Windows Research Kernel @ HPI

The kernel of a Windows Server 2003 Enterprise Edition system provides 296 system service calls. A complete list which allows comparison between Windows versions can be found here.

Not all system service call implementations are contained in the Windows Research Kernel source code. The following table shows the available system service implementations (Nt*-functions) with reference to the corresponding source code file.

As the WRK readme.txt states …

The kernel sources excluded from the kit are primarily in the areas of plug-and-play, power management, the device verifier, kernel debugger interface, and virtual dos machine.

… the most of the missing system service implementations are related to power management, plug-and-play, and device drivers.


Nr. Function File Line
0×0000 NtAcceptConnectPort base/ntos/lpc/lpccompl.c 38
0×0001 NtAccessCheck base/ntos/se/accessck.c 2370
0×0002 NtAccessCheckAndAuditAlarm base/ntos/se/seaudit.c 1794
0×0003 NtAccessCheckByType base/ntos/se/accessck.c 2458
0×0004 NtAccessCheckByTypeAndAuditAlarm base/ntos/se/seaudit.c 1855
0×0005 NtAccessCheckByTypeResultList base/ntos/se/accessck.c 2559
0×0006 NtAccessCheckByTypeResultListAndAuditAlarm base/ntos/se/seaudit.c 1921
0×0007 NtAccessCheckByTypeResultListAndAuditAlarmByHandle base/ntos/se/seaudit.c 1987
0×0008 NtAddAtom base/ntos/ex/exatom.c 53
0×0009 NtAddBootEntry
0×000A NtAddDriverEntry
0×000B NtAdjustGroupsToken base/ntos/se/tokenadj.c 435
0×000C NtAdjustPrivilegesToken base/ntos/se/tokenadj.c 41
0×000D NtAlertResumeThread base/ntos/ps/psspnd.c 534
0×000E NtAlertThread base/ntos/ps/psspnd.c 483
0×000F NtAllocateLocallyUniqueId base/ntos/ex/luid.c 67
0×0010 NtAllocateUserPhysicalPages base/ntos/mm/physical.c 1415
0×0011 NtAllocateUuids base/ntos/ex/uuid.c 628
0×0012 NtAllocateVirtualMemory base/ntos/mm/allocvm.c 54
0×0013 NtApphelpCacheControl
0×0014 NtAreMappedFilesTheSame base/ntos/mm/mapview.c 4357
0×0015 NtAssignProcessToJobObject base/ntos/ps/psjob.c 267
0×0016 NtCallbackReturn base/ntos/ke/i386/callout.asm 400
0×0017 NtCancelDeviceWakeupRequest
0×0018 NtCancelIoFile base/ntos/io/iomgr/misc.c 40
0×0019 NtCancelTimer base/ntos/ex/timer.c 710
0×001A NtClearEvent base/ntos/ex/event.c 125
0×001B NtClose base/ntos/ob/obclose.c 399
0×001C NtCloseObjectAuditAlarm base/ntos/se/seaudit.c 2468
0×001D NtCompactKeys base/ntos/config/ntapi.c 5248
0×001E NtCompareTokens base/ntos/se/token.c 3951
0×001F NtCompleteConnectPort base/ntos/lpc/lpccompl.c 865
0×0020 NtCompressKey base/ntos/config/ntapi.c 5438
0×0021 NtConnectPort base/ntos/lpc/lpcconn.c 42
0×0022 NtContinue base/ntos/ke/i386/trap.asm 6534
0×0023 NtCreateDebugObject base/ntos/dbgk/dbgkobj.c 458
0×0024 NtCreateDirectoryObject base/ntos/ob/obdir.c 145
0×0025 NtCreateEvent base/ntos/ex/event.c 180
0×0026 NtCreateEventPair base/ntos/ex/eventpr.c 121
0×0027 NtCreateFile base/ntos/io/iomgr/create.c 28
0×0028 NtCreateIoCompletion base/ntos/io/iomgr/complete.c 45
0×0029 NtCreateJobObject base/ntos/ps/psjob.c 73
0×002A NtCreateJobSet base/ntos/ps/psjob.c 3260
0×002B NtCreateKey base/ntos/config/ntapi.c 132
0×002C NtCreateMailslotFile base/ntos/io/iomgr/create.c 276
0×002D NtCreateMutant base/ntos/ex/mutant.c 152
0×002E NtCreateNamedPipeFile base/ntos/io/iomgr/create.c 116
0×002F NtCreatePagingFile base/ntos/mm/modwrite.c 329
0×0030 NtCreatePort base/ntos/lpc/lpccreat.c 43
0×0031 NtCreateProcess base/ntos/ps/create.c 816
0×0032 NtCreateProcessEx base/ntos/ps/create.c 853
0×0033 NtCreateProfile base/ntos/ex/profile.c 204
0×0034 NtCreateSection base/ntos/mm/creasect.c 132
0×0035 NtCreateSemaphore base/ntos/ex/semphore.c 121
0×0036 NtCreateSymbolicLinkObject base/ntos/ob/oblink.c 57
0×0037 NtCreateThread base/ntos/ps/create.c 78
0×0038 NtCreateTimer base/ntos/ex/timer.c 488
0×0039 NtCreateToken base/ntos/se/token.c 1934
0×003A NtCreateWaitablePort base/ntos/lpc/lpccreat.c 85
0×003B NtDebugActiveProcess base/ntos/dbgk/dbgkobj.c 1457
0×003C NtDebugContinue base/ntos/dbgk/dbgkobj.c 2010
0×003D NtDelayExecution base/ntos/ex/delay.c 24
0×003E NtDeleteAtom base/ntos/ex/exatom.c 263
0×003F NtDeleteBootEntry
0×0040 NtDeleteDriverEntry
0×0041 NtDeleteFile base/ntos/io/iomgr/misc.c 291
0×0042 NtDeleteKey base/ntos/config/ntapi.c 392
0×0043 NtDeleteObjectAuditAlarm base/ntos/se/seaudit.c 2598
0×0044 NtDeleteValueKey base/ntos/config/ntapi.c 499
0×0045 NtDeviceIoControlFile base/ntos/io/iomgr/devctrl.c 25
0×0046 NtDisplayString
0×0047 NtDuplicateObject base/ntos/ob/obhandle.c 727
0×0048 NtDuplicateToken base/ntos/se/tokendup.c 39
0×0049 NtEnumerateBootEntries
0×004A NtEnumerateDriverEntries
0×004B NtEnumerateKey base/ntos/config/ntapi.c 624
0×004C NtEnumerateSystemEnvironmentValuesEx
0×004D NtEnumerateValueKey base/ntos/config/ntapi.c 786
0×004E NtExtendSection base/ntos/mm/extsect.c 86
0×004F NtFilterToken base/ntos/se/tokendup.c 1365
0×0050 NtFindAtom base/ntos/ex/exatom.c 158
0×0051 NtFlushBuffersFile base/ntos/io/iomgr/misc.c 380
0×0052 NtFlushInstructionCache base/ntos/mm/flushbuf.c 149
0×0053 NtFlushKey base/ntos/config/ntapi.c 950
0×0054 NtFlushVirtualMemory base/ntos/mm/flushsec.c 43
0×0055 NtFlushWriteBuffer base/ntos/mm/flushbuf.c 39
0×0056 NtFreeUserPhysicalPages base/ntos/mm/physical.c 2013
0×0057 NtFreeVirtualMemory base/ntos/mm/freevm.c 42
0×0058 NtFsControlFile base/ntos/io/iomgr/fsctrl.c 25
0×0059 NtGetContextThread base/ntos/ps/psctx.c 309
0×005A NtGetDevicePowerState
0×005B NtGetPlugPlayEvent
0×005C NtGetWriteWatch base/ntos/mm/wrtwatch.c 25
0×005D NtImpersonateAnonymousToken base/ntos/se/token.c 3584
0×005E NtImpersonateClientOfPort base/ntos/lpc/lpcpriv.c 29
0×005F NtImpersonateThread base/ntos/ps/psimpers.c 27
0×0060 NtInitializeRegistry base/ntos/config/ntapi.c 1030
0×0061 NtInitiatePowerAction
0×0062 NtIsProcessInJob base/ntos/ps/psjob.c 3117
0×0063 NtIsSystemResumeAutomatic
0×0064 NtListenPort base/ntos/lpc/lpclistn.c 27
0×0065 NtLoadDriver base/ntos/io/iomgr/loadunld.c 27
0×0066 NtLoadKey base/ntos/config/ntapi.c 3159
0×0067 NtLoadKey2 base/ntos/config/ntapi.c 3207
0×0068 NtLoadKeyEx base/ntos/config/ntapi.c 3260
0×0069 NtLockFile base/ntos/io/iomgr/lock.c 26
0×006A NtLockProductActivationKeys
0×006B NtLockRegistryKey base/ntos/config/ntapi.c 5510
0×006C NtLockVirtualMemory base/ntos/mm/lockvm.c 24
0×006D NtMakePermanentObject base/ntos/ob/obdir.c 2881
0×006E NtMakeTemporaryObject base/ntos/ob/obclose.c 425
0×006F NtMapUserPhysicalPages base/ntos/mm/physical.c 118
0×0070 NtMapUserPhysicalPagesScatter base/ntos/mm/physical.c 633
0×0071 NtMapViewOfSection base/ntos/mm/mapview.c 181
0×0072 NtModifyBootEntry
0×0073 NtModifyDriverEntry
0×0074 NtNotifyChangeDirectoryFile base/ntos/io/iomgr/dir.c 859
0×0075 NtNotifyChangeKey base/ntos/config/ntapi.c 1219
0×0076 NtNotifyChangeMultipleKeys base/ntos/config/ntapi.c 1375
0×0077 NtOpenDirectoryObject base/ntos/ob/obdir.c 259
0×0078 NtOpenEvent base/ntos/ex/event.c 305
0×0079 NtOpenEventPair base/ntos/ex/eventpr.c 233
0×007A NtOpenFile base/ntos/io/iomgr/open.c 25
0×007B NtOpenIoCompletion base/ntos/io/iomgr/complete.c 172
0×007C NtOpenJobObject base/ntos/ps/psjob.c 191
0×007D NtOpenKey base/ntos/config/ntapi.c 2028
0×007E NtOpenMutant base/ntos/ex/mutant.c 272
0×007F NtOpenObjectAuditAlarm base/ntos/se/seaudit.c 2054
0×0080 NtOpenProcess base/ntos/ps/psopen.c 28
0×0081 NtOpenProcessToken base/ntos/se/tokenopn.c 182
0×0082 NtOpenProcessTokenEx base/ntos/se/tokenopn.c 220
0×0083 NtOpenSection base/ntos/mm/creasect.c 4982
0×0084 NtOpenSemaphore base/ntos/ex/semphore.c 252
0×0085 NtOpenSymbolicLinkObject base/ntos/ob/oblink.c 246
0×0086 NtOpenThread base/ntos/ps/psopen.c 272
0×0087 NtOpenThreadToken base/ntos/se/tokenopn.c 489
0×0088 NtOpenThreadTokenEx base/ntos/se/tokenopn.c 551
0×0089 NtOpenTimer base/ntos/ex/timer.c 620
0×008A NtPlugPlayControl
0×008B NtPowerInformation
0×008C NtPrivilegeCheck base/ntos/se/privileg.c 228
0×008D NtPrivilegeObjectAuditAlarm base/ntos/se/seaudit.c 407
0×008E NtPrivilegedServiceAuditAlarm base/ntos/se/seaudit.c 709
0×008F NtProtectVirtualMemory base/ntos/mm/protect.c 50
0×0090 NtPulseEvent base/ntos/ex/event.c 395
0×0091 NtQueryAttributesFile base/ntos/io/iomgr/misc.c 625
0×0092 NtQueryBootEntryOrder
0×0093 NtQueryBootOptions
0×0094 NtQueryDebugFilterState
0×0095 NtQueryDefaultLocale base/ntos/ex/sysinfo.c 465
0×0096 NtQueryDefaultUILanguage base/ntos/ex/sysinfo.c 696
0×0097 NtQueryDirectoryFile base/ntos/io/iomgr/dir.c 716
0×0098 NtQueryDirectoryObject base/ntos/ob/obdir.c 343
0×0099 NtQueryDriverEntryOrder
0×009A NtQueryEaFile base/ntos/io/iomgr/qsea.c 26
0×009B NtQueryEvent base/ntos/ex/event.c 489
0×009C NtQueryFullAttributesFile base/ntos/io/iomgr/misc.c 749
0×009D NtQueryInformationAtom base/ntos/ex/exatom.c 301
0×009E NtQueryInformationFile base/ntos/io/iomgr/qsinfo.c 91
0×009F NtQueryInformationJobObject base/ntos/ps/psjob.c 904
0×00A0 NtQueryInformationPort base/ntos/lpc/lpcquery.c 28
0×00A1 NtQueryInformationProcess base/ntos/ps/psquery.c 590
0×00A2 NtQueryInformationThread base/ntos/ps/psquery.c 3041
0×00A3 NtQueryInformationToken base/ntos/se/tokenqry.c 34
0×00A4 NtQueryInstallUILanguage base/ntos/ex/sysinfo.c 665
0×00A5 NtQueryIntervalProfile base/ntos/ex/profile.c 757
0×00A6 NtQueryIoCompletion base/ntos/io/iomgr/complete.c 275
0×00A7 NtQueryKey base/ntos/config/ntapi.c 2189
0×00A8 NtQueryMultipleValueKey base/ntos/config/ntapi.c 4191
0×00A9 NtQueryMutant base/ntos/ex/mutant.c 368
0×00AA NtQueryObject base/ntos/ob/obquery.c 53
0×00AB NtQueryOpenSubKeys base/ntos/config/ntapi.c 4750
0×00AC NtQueryOpenSubKeysEx base/ntos/config/ntapi.c 4905
0×00AD NtQueryPerformanceCounter base/ntos/ex/profile.c 821
0×00AE NtQueryQuotaInformationFile base/ntos/io/iomgr/qsquota.c 26
0×00AF NtQuerySection base/ntos/mm/querysec.c 28
0×00B0 NtQuerySecurityObject base/ntos/ob/obse.c 251
0×00B1 NtQuerySemaphore base/ntos/ex/semphore.c 343
0×00B2 NtQuerySymbolicLinkObject base/ntos/ob/oblink.c 331
0×00B3 NtQuerySystemEnvironmentValue
0×00B4 NtQuerySystemEnvironmentValueEx
0×00B5 NtQuerySystemInformation base/ntos/ex/sysinfo.c 1391
0×00B6 NtQuerySystemTime
0×00B7 NtQueryTimer base/ntos/ex/timer.c 846
0×00B8 NtQueryTimerResolution
0×00B9 NtQueryValueKey base/ntos/config/ntapi.c 2370
0×00BA NtQueryVirtualMemory base/ntos/mm/queryvm.c 39
0×00BB NtQueryVolumeInformationFile base/ntos/io/iomgr/qsfs.c 28
0×00BC NtQueueApcThread base/ntos/ps/psctx.c 61
0×00BD NtRaiseException base/ntos/ke/i386/trap.asm 6622
0×00BE NtRaiseHardError base/ntos/ex/harderr.c 606
0×00BF NtReadFile base/ntos/io/iomgr/read.c 31
0×00C0 NtReadFileScatter base/ntos/io/iomgr/read.c 737
0×00C1 NtReadRequestData base/ntos/lpc/lpcreply.c 870
0×00C2 NtReadVirtualMemory base/ntos/mm/readwrt.c 92
0×00C3 NtRegisterThreadTerminatePort base/ntos/ps/psdelete.c 1679
0×00C4 NtReleaseMutant base/ntos/ex/mutant.c 505
0×00C5 NtReleaseSemaphore base/ntos/ex/semphore.c 476
0×00C6 NtRemoveIoCompletion base/ntos/io/iomgr/complete.c 479
0×00C7 NtRemoveProcessDebug base/ntos/dbgk/dbgkobj.c 1548
0×00C8 NtRenameKey base/ntos/config/ntapi.c 5084
0×00C9 NtReplaceKey base/ntos/config/ntapi.c 4068
0×00CA NtReplyPort base/ntos/lpc/lpcreply.c 59
0×00CB NtReplyWaitReceivePort base/ntos/lpc/lpcrecv.c 28
0×00CC NtReplyWaitReceivePortEx base/ntos/lpc/lpcrecv.c 102
0×00CD NtReplyWaitReplyPort base/ntos/lpc/lpcreply.c 399
0×00CE NtRequestDeviceWakeup
0×00CF NtRequestPort base/ntos/lpc/lpcsend.c 41
0×00D0 NtRequestWaitReplyPort base/ntos/lpc/lpcsend.c 430
0×00D1 NtRequestWakeupLatency
0×00D2 NtResetEvent base/ntos/ex/event.c 620
0×00D3 NtResetWriteWatch base/ntos/mm/wrtwatch.c 607
0×00D4 NtRestoreKey base/ntos/config/ntapi.c 2555
0×00D5 NtResumeProcess base/ntos/ps/psspnd.c 441
0×00D6 NtResumeThread base/ntos/ps/psspnd.c 323
0×00D7 NtSaveKey base/ntos/config/ntapi.c 2679
0×00D8 NtSaveKeyEx base/ntos/config/ntapi.c 2764
0×00D9 NtSaveMergedKeys base/ntos/config/ntapi.c 2871
0×00DA NtSecureConnectPort base/ntos/lpc/lpcconn.c 83
0×00DB NtSetBootEntryOrder
0×00DC NtSetBootOptions
0×00DD NtSetContextThread base/ntos/ps/psctx.c 529
0×00DE NtSetDebugFilterState
0×00DF NtSetDefaultHardErrorPort base/ntos/ex/harderr.c 918
0×00E0 NtSetDefaultLocale base/ntos/ex/sysinfo.c 502
0×00E1 NtSetDefaultUILanguage base/ntos/ex/sysinfo.c 962
0×00E2 NtSetDriverEntryOrder
0×00E3 NtSetEaFile base/ntos/io/iomgr/qsea.c 645
0×00E4 NtSetEvent base/ntos/ex/event.c 712
0×00E5 NtSetEventBoostPriority base/ntos/ex/event.c 800
0×00E6 NtSetHighEventPair base/ntos/ex/eventpr.c 621
0×00E7 NtSetHighWaitLowEventPair base/ntos/ex/eventpr.c 504
0×00E8 NtSetInformationDebugObject base/ntos/dbgk/dbgkobj.c 2126
0×00E9 NtSetInformationFile base/ntos/io/iomgr/qsinfo.c 836
0×00EA NtSetInformationJobObject base/ntos/ps/psjob.c 1444
0×00EB NtSetInformationKey base/ntos/config/ntapi.c 3894
0×00EC NtSetInformationObject base/ntos/ob/obquery.c 657
0×00ED NtSetInformationProcess base/ntos/ps/psquery.c 1981
0×00EE NtSetInformationThread base/ntos/ps/psquery.c 3503
0×00EF NtSetInformationToken base/ntos/se/tokenset.c 38
0×00F0 NtSetIntervalProfile base/ntos/ex/profile.c 730
0×00F1 NtSetIoCompletion base/ntos/io/iomgr/complete.c 411
0×00F2 NtSetLdtEntries base/ntos/ps/i386/psldt.c 1465
0×00F3 NtSetLowEventPair base/ntos/ex/eventpr.c 563
0×00F4 NtSetLowWaitHighEventPair base/ntos/ex/eventpr.c 445
0×00F5 NtSetQuotaInformationFile base/ntos/io/iomgr/qsquota.c 609
0×00F6 NtSetSecurityObject base/ntos/ob/obse.c 44
0×00F7 NtSetSystemEnvironmentValue
0×00F8 NtSetSystemEnvironmentValueEx
0×00F9 NtSetSystemInformation base/ntos/ex/sysinfo.c 3068
0×00FA NtSetSystemPowerState
0×00FB NtSetSystemTime
0×00FC NtSetThreadExecutionState
0×00FD NtSetTimer base/ntos/ex/timer.c 981
0×00FE NtSetTimerResolution
0×00FF NtSetUuidSeed base/ntos/ex/uuid.c 541
0×0100 NtSetValueKey base/ntos/config/ntapi.c 2976
0×0101 NtSetVolumeInformationFile base/ntos/io/iomgr/qsfs.c 534
0×0102 NtShutdownSystem base/ntos/ex/exinit.c 460
0×0103 NtSignalAndWaitForSingleObject base/ntos/ob/obwait.c 45
0×0104 NtStartProfile base/ntos/ex/profile.c 499
0×0105 NtStopProfile base/ntos/ex/profile.c 651
0×0106 NtSuspendProcess base/ntos/ps/psspnd.c 398
0×0107 NtSuspendThread base/ntos/ps/psspnd.c 206
0×0108 NtSystemDebugControl
0×0109 NtTerminateJobObject base/ntos/ps/psjob.c 2412
0×010A NtTerminateProcess base/ntos/ps/psdelete.c 274
0×010B NtTerminateThread base/ntos/ps/psdelete.c 528
0×010C NtTestAlert base/ntos/ps/psspnd.c 611
0×010D NtTraceEvent base/ntos/wmi/traceapi.c 1034
0×010E NtTranslateFilePath
0×010F NtUnloadDriver base/ntos/io/iomgr/loadunld.c 247
0×0110 NtUnloadKey base/ntos/config/ntapi.c 3466
0×0111 NtUnloadKey2 base/ntos/config/ntapi.c 3504
0×0112 NtUnloadKeyEx base/ntos/config/ntapi.c 3710
0×0113 NtUnlockFile base/ntos/io/iomgr/lock.c 475
0×0114 NtUnlockVirtualMemory base/ntos/mm/lockvm.c 571
0×0115 NtUnmapViewOfSection base/ntos/mm/umapview.c 29
0×0116 NtVdmControl
0×0117 NtWaitForDebugEvent base/ntos/dbgk/dbgkobj.c 1812
0×0118 NtWaitForMultipleObjects base/ntos/ob/obwait.c 422
0×0119 NtWaitForSingleObject base/ntos/ob/obwait.c 296
0×011A NtWaitHighEventPair base/ntos/ex/eventpr.c 385
0×011B NtWaitLowEventPair base/ntos/ex/eventpr.c 325
0×011C NtWriteFile base/ntos/io/iomgr/write.c 25
0×011D NtWriteFileGather base/ntos/io/iomgr/write.c 788
0×011E NtWriteRequestData base/ntos/lpc/lpcreply.c 927
0×011F NtWriteVirtualMemory base/ntos/mm/readwrt.c 226
0×0120 NtYieldExecution base/ntos/ke/yield.c 23
0×0121 NtCreateKeyedEvent base/ntos/ex/keyedevent.c 198
0×0122 NtOpenKeyedEvent base/ntos/ex/keyedevent.c 309
0×0123 NtReleaseKeyedEvent base/ntos/ex/keyedevent.c 383
0×0124 NtWaitForKeyedEvent base/ntos/ex/keyedevent.c 552
0×0125 NtQueryPortInformationProcess base/ntos/ps/psquery.c 1668
0×0126 NtGetCurrentProcessorNumber base/ntos/ps/psquery.c 4214
0×0127 NtWaitForMultipleObjects32 base/ntos/ob/obwait.c 519

Comments

1 Response to "System Service Call Implementations in the WRK"

  1. xuyibo on December 16th, 2008 09:00r

    It's useful, especially the existed files detail, thx!