System Service Call Implementations in the WRK

By Michael Schöbel

The kernel of a Windows Server 2003 Enterprise Edition system provides 296 system service calls. A complete list which allows comparison between Windows versions can be found here.

Not all system service call implementations are contained in the Windows Research Kernel source code. The following table shows the available system service implementations (Nt*-functions) with reference to the corresponding source code file.

As the WRK readme.txt states …

The kernel sources excluded from the kit are primarily in the areas of plug-and-play, power management, the device verifier, kernel debugger interface, and virtual dos machine.

… the most of the missing system service implementations are related to power management, plug-and-play, and device drivers.

---

Nr.	Function	File	Line
0×0000	NtAcceptConnectPort	base/ntos/lpc/lpccompl.c	38
0×0001	NtAccessCheck	base/ntos/se/accessck.c	2370
0×0002	NtAccessCheckAndAuditAlarm	base/ntos/se/seaudit.c	1794
0×0003	NtAccessCheckByType	base/ntos/se/accessck.c	2458
0×0004	NtAccessCheckByTypeAndAuditAlarm	base/ntos/se/seaudit.c	1855
0×0005	NtAccessCheckByTypeResultList	base/ntos/se/accessck.c	2559
0×0006	NtAccessCheckByTypeResultListAndAuditAlarm	base/ntos/se/seaudit.c	1921
0×0007	NtAccessCheckByTypeResultListAndAuditAlarmByHandle	base/ntos/se/seaudit.c	1987
0×0008	NtAddAtom	base/ntos/ex/exatom.c	53
0×0009	NtAddBootEntry
0×000A	NtAddDriverEntry
0×000B	NtAdjustGroupsToken	base/ntos/se/tokenadj.c	435
0×000C	NtAdjustPrivilegesToken	base/ntos/se/tokenadj.c	41
0×000D	NtAlertResumeThread	base/ntos/ps/psspnd.c	534
0×000E	NtAlertThread	base/ntos/ps/psspnd.c	483
0×000F	NtAllocateLocallyUniqueId	base/ntos/ex/luid.c	67
0×0010	NtAllocateUserPhysicalPages	base/ntos/mm/physical.c	1415
0×0011	NtAllocateUuids	base/ntos/ex/uuid.c	628
0×0012	NtAllocateVirtualMemory	base/ntos/mm/allocvm.c	54
0×0013	NtApphelpCacheControl
0×0014	NtAreMappedFilesTheSame	base/ntos/mm/mapview.c	4357
0×0015	NtAssignProcessToJobObject	base/ntos/ps/psjob.c	267
0×0016	NtCallbackReturn	base/ntos/ke/i386/callout.asm	400
0×0017	NtCancelDeviceWakeupRequest
0×0018	NtCancelIoFile	base/ntos/io/iomgr/misc.c	40
0×0019	NtCancelTimer	base/ntos/ex/timer.c	710
0×001A	NtClearEvent	base/ntos/ex/event.c	125
0×001B	NtClose	base/ntos/ob/obclose.c	399
0×001C	NtCloseObjectAuditAlarm	base/ntos/se/seaudit.c	2468
0×001D	NtCompactKeys	base/ntos/config/ntapi.c	5248
0×001E	NtCompareTokens	base/ntos/se/token.c	3951
0×001F	NtCompleteConnectPort	base/ntos/lpc/lpccompl.c	865
0×0020	NtCompressKey	base/ntos/config/ntapi.c	5438
0×0021	NtConnectPort	base/ntos/lpc/lpcconn.c	42
0×0022	NtContinue	base/ntos/ke/i386/trap.asm	6534
0×0023	NtCreateDebugObject	base/ntos/dbgk/dbgkobj.c	458
0×0024	NtCreateDirectoryObject	base/ntos/ob/obdir.c	145
0×0025	NtCreateEvent	base/ntos/ex/event.c	180
0×0026	NtCreateEventPair	base/ntos/ex/eventpr.c	121
0×0027	NtCreateFile	base/ntos/io/iomgr/create.c	28
0×0028	NtCreateIoCompletion	base/ntos/io/iomgr/complete.c	45
0×0029	NtCreateJobObject	base/ntos/ps/psjob.c	73
0×002A	NtCreateJobSet	base/ntos/ps/psjob.c	3260
0×002B	NtCreateKey	base/ntos/config/ntapi.c	132
0×002C	NtCreateMailslotFile	base/ntos/io/iomgr/create.c	276
0×002D	NtCreateMutant	base/ntos/ex/mutant.c	152
0×002E	NtCreateNamedPipeFile	base/ntos/io/iomgr/create.c	116
0×002F	NtCreatePagingFile	base/ntos/mm/modwrite.c	329
0×0030	NtCreatePort	base/ntos/lpc/lpccreat.c	43
0×0031	NtCreateProcess	base/ntos/ps/create.c	816
0×0032	NtCreateProcessEx	base/ntos/ps/create.c	853
0×0033	NtCreateProfile	base/ntos/ex/profile.c	204
0×0034	NtCreateSection	base/ntos/mm/creasect.c	132
0×0035	NtCreateSemaphore	base/ntos/ex/semphore.c	121
0×0036	NtCreateSymbolicLinkObject	base/ntos/ob/oblink.c	57
0×0037	NtCreateThread	base/ntos/ps/create.c	78
0×0038	NtCreateTimer	base/ntos/ex/timer.c	488
0×0039	NtCreateToken	base/ntos/se/token.c	1934
0×003A	NtCreateWaitablePort	base/ntos/lpc/lpccreat.c	85
0×003B	NtDebugActiveProcess	base/ntos/dbgk/dbgkobj.c	1457
0×003C	NtDebugContinue	base/ntos/dbgk/dbgkobj.c	2010
0×003D	NtDelayExecution	base/ntos/ex/delay.c	24
0×003E	NtDeleteAtom	base/ntos/ex/exatom.c	263
0×003F	NtDeleteBootEntry
0×0040	NtDeleteDriverEntry
0×0041	NtDeleteFile	base/ntos/io/iomgr/misc.c	291
0×0042	NtDeleteKey	base/ntos/config/ntapi.c	392
0×0043	NtDeleteObjectAuditAlarm	base/ntos/se/seaudit.c	2598
0×0044	NtDeleteValueKey	base/ntos/config/ntapi.c	499
0×0045	NtDeviceIoControlFile	base/ntos/io/iomgr/devctrl.c	25
0×0046	NtDisplayString
0×0047	NtDuplicateObject	base/ntos/ob/obhandle.c	727
0×0048	NtDuplicateToken	base/ntos/se/tokendup.c	39
0×0049	NtEnumerateBootEntries
0×004A	NtEnumerateDriverEntries
0×004B	NtEnumerateKey	base/ntos/config/ntapi.c	624
0×004C	NtEnumerateSystemEnvironmentValuesEx
0×004D	NtEnumerateValueKey	base/ntos/config/ntapi.c	786
0×004E	NtExtendSection	base/ntos/mm/extsect.c	86
0×004F	NtFilterToken	base/ntos/se/tokendup.c	1365
0×0050	NtFindAtom	base/ntos/ex/exatom.c	158
0×0051	NtFlushBuffersFile	base/ntos/io/iomgr/misc.c	380
0×0052	NtFlushInstructionCache	base/ntos/mm/flushbuf.c	149
0×0053	NtFlushKey	base/ntos/config/ntapi.c	950
0×0054	NtFlushVirtualMemory	base/ntos/mm/flushsec.c	43
0×0055	NtFlushWriteBuffer	base/ntos/mm/flushbuf.c	39
0×0056	NtFreeUserPhysicalPages	base/ntos/mm/physical.c	2013
0×0057	NtFreeVirtualMemory	base/ntos/mm/freevm.c	42
0×0058	NtFsControlFile	base/ntos/io/iomgr/fsctrl.c	25
0×0059	NtGetContextThread	base/ntos/ps/psctx.c	309
0×005A	NtGetDevicePowerState
0×005B	NtGetPlugPlayEvent
0×005C	NtGetWriteWatch	base/ntos/mm/wrtwatch.c	25
0×005D	NtImpersonateAnonymousToken	base/ntos/se/token.c	3584
0×005E	NtImpersonateClientOfPort	base/ntos/lpc/lpcpriv.c	29
0×005F	NtImpersonateThread	base/ntos/ps/psimpers.c	27
0×0060	NtInitializeRegistry	base/ntos/config/ntapi.c	1030
0×0061	NtInitiatePowerAction
0×0062	NtIsProcessInJob	base/ntos/ps/psjob.c	3117
0×0063	NtIsSystemResumeAutomatic
0×0064	NtListenPort	base/ntos/lpc/lpclistn.c	27
0×0065	NtLoadDriver	base/ntos/io/iomgr/loadunld.c	27
0×0066	NtLoadKey	base/ntos/config/ntapi.c	3159
0×0067	NtLoadKey2	base/ntos/config/ntapi.c	3207
0×0068	NtLoadKeyEx	base/ntos/config/ntapi.c	3260
0×0069	NtLockFile	base/ntos/io/iomgr/lock.c	26
0×006A	NtLockProductActivationKeys
0×006B	NtLockRegistryKey	base/ntos/config/ntapi.c	5510
0×006C	NtLockVirtualMemory	base/ntos/mm/lockvm.c	24
0×006D	NtMakePermanentObject	base/ntos/ob/obdir.c	2881
0×006E	NtMakeTemporaryObject	base/ntos/ob/obclose.c	425
0×006F	NtMapUserPhysicalPages	base/ntos/mm/physical.c	118
0×0070	NtMapUserPhysicalPagesScatter	base/ntos/mm/physical.c	633
0×0071	NtMapViewOfSection	base/ntos/mm/mapview.c	181
0×0072	NtModifyBootEntry
0×0073	NtModifyDriverEntry
0×0074	NtNotifyChangeDirectoryFile	base/ntos/io/iomgr/dir.c	859
0×0075	NtNotifyChangeKey	base/ntos/config/ntapi.c	1219
0×0076	NtNotifyChangeMultipleKeys	base/ntos/config/ntapi.c	1375
0×0077	NtOpenDirectoryObject	base/ntos/ob/obdir.c	259
0×0078	NtOpenEvent	base/ntos/ex/event.c	305
0×0079	NtOpenEventPair	base/ntos/ex/eventpr.c	233
0×007A	NtOpenFile	base/ntos/io/iomgr/open.c	25
0×007B	NtOpenIoCompletion	base/ntos/io/iomgr/complete.c	172
0×007C	NtOpenJobObject	base/ntos/ps/psjob.c	191
0×007D	NtOpenKey	base/ntos/config/ntapi.c	2028
0×007E	NtOpenMutant	base/ntos/ex/mutant.c	272
0×007F	NtOpenObjectAuditAlarm	base/ntos/se/seaudit.c	2054
0×0080	NtOpenProcess	base/ntos/ps/psopen.c	28
0×0081	NtOpenProcessToken	base/ntos/se/tokenopn.c	182
0×0082	NtOpenProcessTokenEx	base/ntos/se/tokenopn.c	220
0×0083	NtOpenSection	base/ntos/mm/creasect.c	4982
0×0084	NtOpenSemaphore	base/ntos/ex/semphore.c	252
0×0085	NtOpenSymbolicLinkObject	base/ntos/ob/oblink.c	246
0×0086	NtOpenThread	base/ntos/ps/psopen.c	272
0×0087	NtOpenThreadToken	base/ntos/se/tokenopn.c	489
0×0088	NtOpenThreadTokenEx	base/ntos/se/tokenopn.c	551
0×0089	NtOpenTimer	base/ntos/ex/timer.c	620
0×008A	NtPlugPlayControl
0×008B	NtPowerInformation
0×008C	NtPrivilegeCheck	base/ntos/se/privileg.c	228
0×008D	NtPrivilegeObjectAuditAlarm	base/ntos/se/seaudit.c	407
0×008E	NtPrivilegedServiceAuditAlarm	base/ntos/se/seaudit.c	709
0×008F	NtProtectVirtualMemory	base/ntos/mm/protect.c	50
0×0090	NtPulseEvent	base/ntos/ex/event.c	395
0×0091	NtQueryAttributesFile	base/ntos/io/iomgr/misc.c	625
0×0092	NtQueryBootEntryOrder
0×0093	NtQueryBootOptions
0×0094	NtQueryDebugFilterState
0×0095	NtQueryDefaultLocale	base/ntos/ex/sysinfo.c	465
0×0096	NtQueryDefaultUILanguage	base/ntos/ex/sysinfo.c	696
0×0097	NtQueryDirectoryFile	base/ntos/io/iomgr/dir.c	716
0×0098	NtQueryDirectoryObject	base/ntos/ob/obdir.c	343
0×0099	NtQueryDriverEntryOrder
0×009A	NtQueryEaFile	base/ntos/io/iomgr/qsea.c	26
0×009B	NtQueryEvent	base/ntos/ex/event.c	489
0×009C	NtQueryFullAttributesFile	base/ntos/io/iomgr/misc.c	749
0×009D	NtQueryInformationAtom	base/ntos/ex/exatom.c	301
0×009E	NtQueryInformationFile	base/ntos/io/iomgr/qsinfo.c	91
0×009F	NtQueryInformationJobObject	base/ntos/ps/psjob.c	904
0×00A0	NtQueryInformationPort	base/ntos/lpc/lpcquery.c	28
0×00A1	NtQueryInformationProcess	base/ntos/ps/psquery.c	590
0×00A2	NtQueryInformationThread	base/ntos/ps/psquery.c	3041
0×00A3	NtQueryInformationToken	base/ntos/se/tokenqry.c	34
0×00A4	NtQueryInstallUILanguage	base/ntos/ex/sysinfo.c	665
0×00A5	NtQueryIntervalProfile	base/ntos/ex/profile.c	757
0×00A6	NtQueryIoCompletion	base/ntos/io/iomgr/complete.c	275
0×00A7	NtQueryKey	base/ntos/config/ntapi.c	2189
0×00A8	NtQueryMultipleValueKey	base/ntos/config/ntapi.c	4191
0×00A9	NtQueryMutant	base/ntos/ex/mutant.c	368
0×00AA	NtQueryObject	base/ntos/ob/obquery.c	53
0×00AB	NtQueryOpenSubKeys	base/ntos/config/ntapi.c	4750
0×00AC	NtQueryOpenSubKeysEx	base/ntos/config/ntapi.c	4905
0×00AD	NtQueryPerformanceCounter	base/ntos/ex/profile.c	821
0×00AE	NtQueryQuotaInformationFile	base/ntos/io/iomgr/qsquota.c	26
0×00AF	NtQuerySection	base/ntos/mm/querysec.c	28
0×00B0	NtQuerySecurityObject	base/ntos/ob/obse.c	251
0×00B1	NtQuerySemaphore	base/ntos/ex/semphore.c	343
0×00B2	NtQuerySymbolicLinkObject	base/ntos/ob/oblink.c	331
0×00B3	NtQuerySystemEnvironmentValue
0×00B4	NtQuerySystemEnvironmentValueEx
0×00B5	NtQuerySystemInformation	base/ntos/ex/sysinfo.c	1391
0×00B6	NtQuerySystemTime
0×00B7	NtQueryTimer	base/ntos/ex/timer.c	846
0×00B8	NtQueryTimerResolution
0×00B9	NtQueryValueKey	base/ntos/config/ntapi.c	2370
0×00BA	NtQueryVirtualMemory	base/ntos/mm/queryvm.c	39
0×00BB	NtQueryVolumeInformationFile	base/ntos/io/iomgr/qsfs.c	28
0×00BC	NtQueueApcThread	base/ntos/ps/psctx.c	61
0×00BD	NtRaiseException	base/ntos/ke/i386/trap.asm	6622
0×00BE	NtRaiseHardError	base/ntos/ex/harderr.c	606
0×00BF	NtReadFile	base/ntos/io/iomgr/read.c	31
0×00C0	NtReadFileScatter	base/ntos/io/iomgr/read.c	737
0×00C1	NtReadRequestData	base/ntos/lpc/lpcreply.c	870
0×00C2	NtReadVirtualMemory	base/ntos/mm/readwrt.c	92
0×00C3	NtRegisterThreadTerminatePort	base/ntos/ps/psdelete.c	1679
0×00C4	NtReleaseMutant	base/ntos/ex/mutant.c	505
0×00C5	NtReleaseSemaphore	base/ntos/ex/semphore.c	476
0×00C6	NtRemoveIoCompletion	base/ntos/io/iomgr/complete.c	479
0×00C7	NtRemoveProcessDebug	base/ntos/dbgk/dbgkobj.c	1548
0×00C8	NtRenameKey	base/ntos/config/ntapi.c	5084
0×00C9	NtReplaceKey	base/ntos/config/ntapi.c	4068
0×00CA	NtReplyPort	base/ntos/lpc/lpcreply.c	59
0×00CB	NtReplyWaitReceivePort	base/ntos/lpc/lpcrecv.c	28
0×00CC	NtReplyWaitReceivePortEx	base/ntos/lpc/lpcrecv.c	102
0×00CD	NtReplyWaitReplyPort	base/ntos/lpc/lpcreply.c	399
0×00CE	NtRequestDeviceWakeup
0×00CF	NtRequestPort	base/ntos/lpc/lpcsend.c	41
0×00D0	NtRequestWaitReplyPort	base/ntos/lpc/lpcsend.c	430
0×00D1	NtRequestWakeupLatency
0×00D2	NtResetEvent	base/ntos/ex/event.c	620
0×00D3	NtResetWriteWatch	base/ntos/mm/wrtwatch.c	607
0×00D4	NtRestoreKey	base/ntos/config/ntapi.c	2555
0×00D5	NtResumeProcess	base/ntos/ps/psspnd.c	441
0×00D6	NtResumeThread	base/ntos/ps/psspnd.c	323
0×00D7	NtSaveKey	base/ntos/config/ntapi.c	2679
0×00D8	NtSaveKeyEx	base/ntos/config/ntapi.c	2764
0×00D9	NtSaveMergedKeys	base/ntos/config/ntapi.c	2871
0×00DA	NtSecureConnectPort	base/ntos/lpc/lpcconn.c	83
0×00DB	NtSetBootEntryOrder
0×00DC	NtSetBootOptions
0×00DD	NtSetContextThread	base/ntos/ps/psctx.c	529
0×00DE	NtSetDebugFilterState
0×00DF	NtSetDefaultHardErrorPort	base/ntos/ex/harderr.c	918
0×00E0	NtSetDefaultLocale	base/ntos/ex/sysinfo.c	502
0×00E1	NtSetDefaultUILanguage	base/ntos/ex/sysinfo.c	962
0×00E2	NtSetDriverEntryOrder
0×00E3	NtSetEaFile	base/ntos/io/iomgr/qsea.c	645
0×00E4	NtSetEvent	base/ntos/ex/event.c	712
0×00E5	NtSetEventBoostPriority	base/ntos/ex/event.c	800
0×00E6	NtSetHighEventPair	base/ntos/ex/eventpr.c	621
0×00E7	NtSetHighWaitLowEventPair	base/ntos/ex/eventpr.c	504
0×00E8	NtSetInformationDebugObject	base/ntos/dbgk/dbgkobj.c	2126
0×00E9	NtSetInformationFile	base/ntos/io/iomgr/qsinfo.c	836
0×00EA	NtSetInformationJobObject	base/ntos/ps/psjob.c	1444
0×00EB	NtSetInformationKey	base/ntos/config/ntapi.c	3894
0×00EC	NtSetInformationObject	base/ntos/ob/obquery.c	657
0×00ED	NtSetInformationProcess	base/ntos/ps/psquery.c	1981
0×00EE	NtSetInformationThread	base/ntos/ps/psquery.c	3503
0×00EF	NtSetInformationToken	base/ntos/se/tokenset.c	38
0×00F0	NtSetIntervalProfile	base/ntos/ex/profile.c	730
0×00F1	NtSetIoCompletion	base/ntos/io/iomgr/complete.c	411
0×00F2	NtSetLdtEntries	base/ntos/ps/i386/psldt.c	1465
0×00F3	NtSetLowEventPair	base/ntos/ex/eventpr.c	563
0×00F4	NtSetLowWaitHighEventPair	base/ntos/ex/eventpr.c	445
0×00F5	NtSetQuotaInformationFile	base/ntos/io/iomgr/qsquota.c	609
0×00F6	NtSetSecurityObject	base/ntos/ob/obse.c	44
0×00F7	NtSetSystemEnvironmentValue
0×00F8	NtSetSystemEnvironmentValueEx
0×00F9	NtSetSystemInformation	base/ntos/ex/sysinfo.c	3068
0×00FA	NtSetSystemPowerState
0×00FB	NtSetSystemTime
0×00FC	NtSetThreadExecutionState
0×00FD	NtSetTimer	base/ntos/ex/timer.c	981
0×00FE	NtSetTimerResolution
0×00FF	NtSetUuidSeed	base/ntos/ex/uuid.c	541
0×0100	NtSetValueKey	base/ntos/config/ntapi.c	2976
0×0101	NtSetVolumeInformationFile	base/ntos/io/iomgr/qsfs.c	534
0×0102	NtShutdownSystem	base/ntos/ex/exinit.c	460
0×0103	NtSignalAndWaitForSingleObject	base/ntos/ob/obwait.c	45
0×0104	NtStartProfile	base/ntos/ex/profile.c	499
0×0105	NtStopProfile	base/ntos/ex/profile.c	651
0×0106	NtSuspendProcess	base/ntos/ps/psspnd.c	398
0×0107	NtSuspendThread	base/ntos/ps/psspnd.c	206
0×0108	NtSystemDebugControl
0×0109	NtTerminateJobObject	base/ntos/ps/psjob.c	2412
0×010A	NtTerminateProcess	base/ntos/ps/psdelete.c	274
0×010B	NtTerminateThread	base/ntos/ps/psdelete.c	528
0×010C	NtTestAlert	base/ntos/ps/psspnd.c	611
0×010D	NtTraceEvent	base/ntos/wmi/traceapi.c	1034
0×010E	NtTranslateFilePath
0×010F	NtUnloadDriver	base/ntos/io/iomgr/loadunld.c	247
0×0110	NtUnloadKey	base/ntos/config/ntapi.c	3466
0×0111	NtUnloadKey2	base/ntos/config/ntapi.c	3504
0×0112	NtUnloadKeyEx	base/ntos/config/ntapi.c	3710
0×0113	NtUnlockFile	base/ntos/io/iomgr/lock.c	475
0×0114	NtUnlockVirtualMemory	base/ntos/mm/lockvm.c	571
0×0115	NtUnmapViewOfSection	base/ntos/mm/umapview.c	29
0×0116	NtVdmControl
0×0117	NtWaitForDebugEvent	base/ntos/dbgk/dbgkobj.c	1812
0×0118	NtWaitForMultipleObjects	base/ntos/ob/obwait.c	422
0×0119	NtWaitForSingleObject	base/ntos/ob/obwait.c	296
0×011A	NtWaitHighEventPair	base/ntos/ex/eventpr.c	385
0×011B	NtWaitLowEventPair	base/ntos/ex/eventpr.c	325
0×011C	NtWriteFile	base/ntos/io/iomgr/write.c	25
0×011D	NtWriteFileGather	base/ntos/io/iomgr/write.c	788
0×011E	NtWriteRequestData	base/ntos/lpc/lpcreply.c	927
0×011F	NtWriteVirtualMemory	base/ntos/mm/readwrt.c	226
0×0120	NtYieldExecution	base/ntos/ke/yield.c	23
0×0121	NtCreateKeyedEvent	base/ntos/ex/keyedevent.c	198
0×0122	NtOpenKeyedEvent	base/ntos/ex/keyedevent.c	309
0×0123	NtReleaseKeyedEvent	base/ntos/ex/keyedevent.c	383
0×0124	NtWaitForKeyedEvent	base/ntos/ex/keyedevent.c	552
0×0125	NtQueryPortInformationProcess	base/ntos/ps/psquery.c	1668
0×0126	NtGetCurrentProcessorNumber	base/ntos/ps/psquery.c	4214
0×0127	NtWaitForMultipleObjects32	base/ntos/ob/obwait.c	519

---

Comments