All pointers are initialized to nullptr and assigned only by the resolver. “User
mode” describes the pointer resolved by this project; an identically named kernel
export may also exist. Native Nt* calls still enter the kernel and remain subject
to normal access checks.
The table is a Windows 10/11 research surface, not a claim that every export is
present on every build. Use UnresolvedFunctions() after resolution and record the
full target build in MSRC reproduction artifacts.
| Pointer | Resolved module | Purpose and mode |
|---|---|---|
_NtSetInformationFile |
ntdll.dll |
User mode (ntdll native API): set information file; not a kernel-only pointer. |
_NtDeleteFile |
ntdll.dll |
User mode (ntdll native API): delete file; not a kernel-only pointer. |
_NtOpenDirectoryObject |
ntdll.dll |
User mode (ntdll native API): open directory object; not a kernel-only pointer. |
_NtQueryDirectoryObject |
ntdll.dll |
User mode (ntdll native API): query directory object; not a kernel-only pointer. |
_NtQueryInformationFile |
ntdll.dll |
User mode (ntdll native API): query information file; not a kernel-only pointer. |
_NtCreateFile |
ntdll.dll |
User mode (ntdll native API): create file; not a kernel-only pointer. |
_NtOpenFile |
ntdll.dll |
User mode (ntdll native API): open file; not a kernel-only pointer. |
_NtReadFile |
ntdll.dll |
User mode (ntdll native API): read file; not a kernel-only pointer. |
_NtWriteFile |
ntdll.dll |
User mode (ntdll native API): write file; not a kernel-only pointer. |
_NtFsControlFile |
ntdll.dll |
User mode (ntdll native API): fs control file; not a kernel-only pointer. |
_NtDeviceIoControlFile |
ntdll.dll |
User mode (ntdll native API): device io control file; not a kernel-only pointer. |
_NtQueryDirectoryFile |
ntdll.dll |
User mode (ntdll native API): query directory file; not a kernel-only pointer. |
_NtQueryVolumeInformationFile |
ntdll.dll |
User mode (ntdll native API): query volume information file; not a kernel-only pointer. |
_NtSetVolumeInformationFile |
ntdll.dll |
User mode (ntdll native API): set volume information file; not a kernel-only pointer. |
_NtQuerySystemInformation |
ntdll.dll |
User mode (ntdll native API): query system information; not a kernel-only pointer. |
_NtSetSystemInformation |
ntdll.dll |
User mode (ntdll native API): set system information; not a kernel-only pointer. |
_NtQueryInformationProcess |
ntdll.dll |
User mode (ntdll native API): query information process; not a kernel-only pointer. |
_NtSetInformationProcess |
ntdll.dll |
User mode (ntdll native API): set information process; not a kernel-only pointer. |
_NtQueryInformationThread |
ntdll.dll |
User mode (ntdll native API): query information thread; not a kernel-only pointer. |
_NtSetInformationThread |
ntdll.dll |
User mode (ntdll native API): set information thread; not a kernel-only pointer. |
_NtOpenProcess |
ntdll.dll |
User mode (ntdll native API): open process; not a kernel-only pointer. |
_NtOpenThread |
ntdll.dll |
User mode (ntdll native API): open thread; not a kernel-only pointer. |
_NtSuspendProcess |
ntdll.dll |
User mode (ntdll native API): suspend process; not a kernel-only pointer. |
_NtResumeProcess |
ntdll.dll |
User mode (ntdll native API): resume process; not a kernel-only pointer. |
_NtTerminateProcess |
ntdll.dll |
User mode (ntdll native API): terminate process; not a kernel-only pointer. |
_NtCreateProcessEx |
ntdll.dll |
User mode (ntdll native API): create process ex; not a kernel-only pointer. |
_NtCreateThreadEx |
ntdll.dll |
User mode (ntdll native API): create thread ex; not a kernel-only pointer. |
_NtAllocateVirtualMemory |
ntdll.dll |
User mode (ntdll native API): allocate virtual memory; not a kernel-only pointer. |
_NtFreeVirtualMemory |
ntdll.dll |
User mode (ntdll native API): free virtual memory; not a kernel-only pointer. |
_NtProtectVirtualMemory |
ntdll.dll |
User mode (ntdll native API): protect virtual memory; not a kernel-only pointer. |
_NtQueryVirtualMemory |
ntdll.dll |
User mode (ntdll native API): query virtual memory; not a kernel-only pointer. |
_NtReadVirtualMemory |
ntdll.dll |
User mode (ntdll native API): read virtual memory; not a kernel-only pointer. |
_NtWriteVirtualMemory |
ntdll.dll |
User mode (ntdll native API): write virtual memory; not a kernel-only pointer. |
_NtFlushInstructionCache |
ntdll.dll |
User mode (ntdll native API): flush instruction cache; not a kernel-only pointer. |
_NtQueryInformationToken |
ntdll.dll |
User mode (ntdll native API): query information token; not a kernel-only pointer. |
_NtSetInformationToken |
ntdll.dll |
User mode (ntdll native API): set information token; not a kernel-only pointer. |
_NtDuplicateToken |
ntdll.dll |
User mode (ntdll native API): duplicate token; not a kernel-only pointer. |
_NtFilterToken |
ntdll.dll |
User mode (ntdll native API): filter token; not a kernel-only pointer. |
_NtAdjustPrivilegesToken |
ntdll.dll |
User mode (ntdll native API): adjust privileges token; not a kernel-only pointer. |
_NtCreateKey |
ntdll.dll |
User mode (ntdll native API): create key; not a kernel-only pointer. |
_NtOpenKey |
ntdll.dll |
User mode (ntdll native API): open key; not a kernel-only pointer. |
_NtOpenKeyEx |
ntdll.dll |
User mode (ntdll native API): open key ex; not a kernel-only pointer. |
_NtDeleteKey |
ntdll.dll |
User mode (ntdll native API): delete key; not a kernel-only pointer. |
_NtDeleteValueKey |
ntdll.dll |
User mode (ntdll native API): delete value key; not a kernel-only pointer. |
_NtEnumerateKey |
ntdll.dll |
User mode (ntdll native API): enumerate key; not a kernel-only pointer. |
_NtEnumerateValueKey |
ntdll.dll |
User mode (ntdll native API): enumerate value key; not a kernel-only pointer. |
_NtQueryKey |
ntdll.dll |
User mode (ntdll native API): query key; not a kernel-only pointer. |
_NtQueryValueKey |
ntdll.dll |
User mode (ntdll native API): query value key; not a kernel-only pointer. |
_NtSetValueKey |
ntdll.dll |
User mode (ntdll native API): set value key; not a kernel-only pointer. |
_NtFlushKey |
ntdll.dll |
User mode (ntdll native API): flush key; not a kernel-only pointer. |
_NtSaveKey |
ntdll.dll |
User mode (ntdll native API): save key; not a kernel-only pointer. |
_NtRestoreKey |
ntdll.dll |
User mode (ntdll native API): restore key; not a kernel-only pointer. |
_NtLoadKey |
ntdll.dll |
User mode (ntdll native API): load key; not a kernel-only pointer. |
_NtUnloadKey |
ntdll.dll |
User mode (ntdll native API): unload key; not a kernel-only pointer. |
_NtCreateSection |
ntdll.dll |
User mode (ntdll native API): create section; not a kernel-only pointer. |
_NtOpenSection |
ntdll.dll |
User mode (ntdll native API): open section; not a kernel-only pointer. |
_NtMapViewOfSection |
ntdll.dll |
User mode (ntdll native API): map view of section; not a kernel-only pointer. |
_NtUnmapViewOfSection |
ntdll.dll |
User mode (ntdll native API): unmap view of section; not a kernel-only pointer. |
_NtQueryObject |
ntdll.dll |
User mode (ntdll native API): query object; not a kernel-only pointer. |
_NtSetInformationObject |
ntdll.dll |
User mode (ntdll native API): set information object; not a kernel-only pointer. |
_NtDuplicateObject |
ntdll.dll |
User mode (ntdll native API): duplicate object; not a kernel-only pointer. |
_NtMakeTemporaryObject |
ntdll.dll |
User mode (ntdll native API): make temporary object; not a kernel-only pointer. |
_NtMakePermanentObject |
ntdll.dll |
User mode (ntdll native API): make permanent object; not a kernel-only pointer. |
_NtCreateNamedPipeFile |
ntdll.dll |
User mode (ntdll native API): create named pipe file; not a kernel-only pointer. |
_NtDebugActiveProcess |
ntdll.dll |
User mode (ntdll native API): debug active process; not a kernel-only pointer. |
_NtRemoveProcessDebug |
ntdll.dll |
User mode (ntdll native API): remove process debug; not a kernel-only pointer. |
_NtWaitForDebugEvent |
ntdll.dll |
User mode (ntdll native API): wait for debug event; not a kernel-only pointer. |
_NtDebugContinue |
ntdll.dll |
User mode (ntdll native API): debug continue; not a kernel-only pointer. |
_NtCreateEvent |
ntdll.dll |
User mode (ntdll native API): create event; not a kernel-only pointer. |
_NtSetEvent |
ntdll.dll |
User mode (ntdll native API): set event; not a kernel-only pointer. |
_NtResetEvent |
ntdll.dll |
User mode (ntdll native API): reset event; not a kernel-only pointer. |
_NtClearEvent |
ntdll.dll |
User mode (ntdll native API): clear event; not a kernel-only pointer. |
_NtCreateMutant |
ntdll.dll |
User mode (ntdll native API): create mutant; not a kernel-only pointer. |
_NtReleaseMutant |
ntdll.dll |
User mode (ntdll native API): release mutant; not a kernel-only pointer. |
_NtCreateSemaphore |
ntdll.dll |
User mode (ntdll native API): create semaphore; not a kernel-only pointer. |
_NtReleaseSemaphore |
ntdll.dll |
User mode (ntdll native API): release semaphore; not a kernel-only pointer. |
_NtWaitForSingleObject |
ntdll.dll |
User mode (ntdll native API): wait for single object; not a kernel-only pointer. |
_NtWaitForMultipleObjects |
ntdll.dll |
User mode (ntdll native API): wait for multiple objects; not a kernel-only pointer. |
_NtClose |
ntdll.dll |
User mode (ntdll native API): close; not a kernel-only pointer. |
_NtDelayExecution |
ntdll.dll |
User mode (ntdll native API): delay execution; not a kernel-only pointer. |
_NtYieldExecution |
ntdll.dll |
User mode (ntdll native API): yield execution; not a kernel-only pointer. |
_NtRaiseHardError |
ntdll.dll |
User mode (ntdll native API): raise hard error; not a kernel-only pointer. |
_NtSetSystemEnvironmentValue |
ntdll.dll |
User mode (ntdll native API): set system environment value; not a kernel-only pointer. |
_NtQuerySystemEnvironmentValue |
ntdll.dll |
User mode (ntdll native API): query system environment value; not a kernel-only pointer. |
_NtShutdownSystem |
ntdll.dll |
User mode (ntdll native API): shutdown system; not a kernel-only pointer. |
_RtlInitUnicodeString |
ntdll.dll |
User mode (ntdll native API): initializes a UNICODE_STRING view over caller-owned text; not a kernel-only pointer. |
_RtlFreeUnicodeString |
ntdll.dll |
User mode (ntdll native API): frees a UNICODE_STRING buffer allocated by an RTL routine; not a kernel-only pointer. |
_RtlNtStatusToDosError |
ntdll.dll |
User mode (ntdll native API): maps NTSTATUS to a Win32 error code; not a kernel-only pointer. |
_DbgPrint |
ntdll.dll |
User mode (ntdll native API): writes formatted text to the debugger; not a kernel-only pointer. |
_LsaOpenPolicy |
advapi32.dll / kernel32.dll |
User mode (advapi32): lsa open policy; documented Win32/LSA API. |
_LsaClose |
advapi32.dll / kernel32.dll |
User mode (advapi32): lsa close; documented Win32/LSA API. |
_LsaEnumerateLogonSessions |
advapi32.dll / kernel32.dll |
User mode (advapi32): lsa enumerate logon sessions; documented Win32/LSA API. |
_LsaGetLogonSessionData |
advapi32.dll / kernel32.dll |
User mode (advapi32): lsa get logon session data; documented Win32/LSA API. |
_LsaFreeReturnBuffer |
advapi32.dll / kernel32.dll |
User mode (advapi32): lsa free return buffer; documented Win32/LSA API. |
_LsaQueryInformationPolicy |
advapi32.dll / kernel32.dll |
User mode (advapi32): lsa query information policy; documented Win32/LSA API. |
_LsaSetInformationPolicy |
advapi32.dll / kernel32.dll |
User mode (advapi32): lsa set information policy; documented Win32/LSA API. |
_LsaRetrievePrivateData |
advapi32.dll / kernel32.dll |
User mode (advapi32): lsa retrieve private data; documented Win32/LSA API. |
_LsaStorePrivateData |
advapi32.dll / kernel32.dll |
User mode (advapi32): lsa store private data; documented Win32/LSA API. |
_LsaCreateSecret |
advapi32.dll / kernel32.dll |
User mode (advapi32): lsa create secret; documented Win32/LSA API. |
_LsaOpenSecret |
advapi32.dll / kernel32.dll |
User mode (advapi32): lsa open secret; documented Win32/LSA API. |
_LsaQuerySecret |
advapi32.dll / kernel32.dll |
User mode (advapi32): lsa query secret; documented Win32/LSA API. |
_OpenSCManagerA_opt |
advapi32.dll / kernel32.dll |
User mode (advapi32): open sc manager a; documented Win32/LSA API. |
_CreateProcessInternalW |
advapi32.dll / kernel32.dll |
User mode (kernel32): create process internal w; internal/version-sensitive. |
_VirtualProtectEx_opt |
advapi32.dll / kernel32.dll |
User mode (kernel32): virtual protect ex; documented Win32/LSA API. |