系统调用表参考(System Call Table - SSDT)

最新推荐文章于 2020-11-22 01:53:19 发布
最新推荐文章于 2020-11-22 01:53:19 发布
阅读量721 收藏
点赞数
分类专栏： Win32驱动程序设计 文章标签： system table windows 360 build api
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/qq7183316/article/details/4742891
版权
本文档提供了系统调用表(SystemCallTable-SSDT)的详细信息，包括不同API名称及其在各种Windows版本中的构建号和支持情况。从Windows 2000 SP0到Windows 7，展示了每个系统调用API的索引编号变化。
摘要由CSDN通过智能技术生成

 

系统调用表参考(System Call Table - SSDT) 


Api Name (*)
Build No (*)
Os Ver (*)
Idx
ZwAcceptConnectPort
2195
Win2000 SP0-SP4
0
2600
WinXP SP0-SP3
0
3790
Win2003 SP0-SP2
0
6000
Vista SP0
0
6001
Vista SP1, Win2008
0
7000
Windows 7
0
ZwAccessCheck
2195
Win2000 SP0-SP4
1
2600
WinXP SP0-SP3
1
3790
Win2003 SP0-SP2
1
6000
Vista SP0
1
6001
Vista SP1, Win2008
1
7000
Windows 7
1
ZwAccessCheckAndAuditAlarm
2195
Win2000 SP0-SP4
2
2600
WinXP SP0-SP3
2
3790
Win2003 SP0-SP2
2
6000
Vista SP0
2
6001
Vista SP1, Win2008
2
7000
Windows 7
2
ZwAccessCheckByType
2195
Win2000 SP0-SP4
3
2600
WinXP SP0-SP3
3
3790
Win2003 SP0-SP2
3
6000
Vista SP0
3
6001
Vista SP1, Win2008
3
7000
Windows 7
3
ZwAccessCheckByTypeAndAuditAlarm
2195
Win2000 SP0-SP4
4
2600
WinXP SP0-SP3
4
3790
Win2003 SP0-SP2
4
6000
Vista SP0
4
6001
Vista SP1, Win2008
4
7000
Windows 7
4
ZwAccessCheckByTypeResultList
2195
Win2000 SP0-SP4
5
2600
WinXP SP0-SP3
5
3790
Win2003 SP0-SP2
5
6000
Vista SP0
5
6001
Vista SP1, Win2008
5
7000
Windows 7
5
ZwAccessCheckByTypeResultListAndAuditAlarm
2195
Win2000 SP0-SP4
6
2600
WinXP SP0-SP3
6
3790
Win2003 SP0-SP2
6
6000
Vista SP0
6
6001
Vista SP1, Win2008
6
7000
Windows 7
6
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
2195
Win2000 SP0-SP4
7
2600
WinXP SP0-SP3
7
3790
Win2003 SP0-SP2
7
6000
Vista SP0
7
6001
Vista SP1, Win2008
7
7000
Windows 7
7
ZwAcquireCMFViewOwnership
6000
Vista SP0
396
6001
Vista SP1, Win2008
389
7000
Windows 7
8
ZwAddAtom
2195
Win2000 SP0-SP4
8
2600
WinXP SP0-SP3
8
3790
Win2003 SP0-SP2
8
6000
Vista SP0
8
6001
Vista SP1, Win2008
8
7000
Windows 7
9
ZwAddBootEntry
2600
WinXP SP0-SP3
9
3790
Win2003 SP0-SP2
9
6000
Vista SP0
9
6001
Vista SP1, Win2008
9
7000
Windows 7
10
ZwAddDriverEntry
3790
Win2003 SP0-SP2
10
6000
Vista SP0
10
6001
Vista SP1, Win2008
10
7000
Windows 7
11
ZwAdjustGroupsToken
2195
Win2000 SP0-SP4
9
2600
WinXP SP0-SP3
10
3790
Win2003 SP0-SP2
11
6000
Vista SP0
11
6001
Vista SP1, Win2008
11
7000
Windows 7
12
ZwAdjustPrivilegesToken
2195
Win2000 SP0-SP4
10
2600
WinXP SP0-SP3
11
3790
Win2003 SP0-SP2
12
6000
Vista SP0
12
6001
Vista SP1, Win2008
12
7000
Windows 7
13
ZwAlertResumeThread
2195
Win2000 SP0-SP4
11
2600
WinXP SP0-SP3
12
3790
Win2003 SP0-SP2
13
6000
Vista SP0
13
6001
Vista SP1, Win2008
13
7000
Windows 7
14
ZwAlertThread
2195
Win2000 SP0-SP4
12
2600
WinXP SP0-SP3
13
3790
Win2003 SP0-SP2
14
6000
Vista SP0
14
6001
Vista SP1, Win2008
14
7000
Windows 7
15
ZwAllocateLocallyUniqueId
2195
Win2000 SP0-SP4
13
2600
WinXP SP0-SP3
14
3790
Win2003 SP0-SP2
15
6000
Vista SP0
15
6001
Vista SP1, Win2008
15
7000
Windows 7
16
ZwAllocateReserveObject
7000
Windows 7
17
ZwAllocateUserPhysicalPages
2195
Win2000 SP0-SP4
14
2600
WinXP SP0-SP3
15
3790
Win2003 SP0-SP2
16
6000
Vista SP0
16
6001
Vista SP1, Win2008
16
7000
Windows 7
18
ZwAllocateUuids
2195
Win2000 SP0-SP4
15
2600
WinXP SP0-SP3
16
3790
Win2003 SP0-SP2
17
6000
Vista SP0
17
6001
Vista SP1, Win2008
17
7000
Windows 7
19
ZwAllocateVirtualMemory
2195
Win2000 SP0-SP4
16
2600
WinXP SP0-SP3
17
3790
Win2003 SP0-SP2
18
6000
Vista SP0
18
6001
Vista SP1, Win2008
18
7000
Windows 7
20
ZwAlpcAcceptConnectPort
6000
Vista SP0
19
6001
Vista SP1, Win2008
19
7000
Windows 7
21
ZwAlpcCancelMessage
6000
Vista SP0
20
6001
Vista SP1, Win2008
20
7000
Windows 7
22
ZwAlpcConnectPort
6000
Vista SP0
21
6001
Vista SP1, Win2008
21
7000
Windows 7
23
ZwAlpcCreatePort
6000
Vista SP0
22
6001
Vista SP1, Win2008
22
7000
Windows 7
24
ZwAlpcCreatePortSection
6000
Vista SP0
23
6001
Vista SP1, Win2008
23
7000
Windows 7
25
ZwAlpcCreateResourceReserve
6000
Vista SP0
24
6001
Vista SP1, Win2008
24
7000
Windows 7
26
ZwAlpcCreateSectionView
6000
Vista SP0
25
6001
Vista SP1, Win2008
25
7000
Windows 7
27
ZwAlpcCreateSecurityContext
6000
Vista SP0
26
6001
Vista SP1, Win2008
26
7000
Windows 7
28
ZwAlpcDeletePortSection
6000
Vista SP0
27
6001
Vista SP1, Win2008
27
7000
Windows 7
29
ZwAlpcDeleteResourceReserve
6000
Vista SP0
28
6001
Vista SP1, Win2008
28
7000
Windows 7
30
ZwAlpcDeleteSectionView
6000
Vista SP0
29
6001
Vista SP1, Win2008
29
7000
Windows 7
31
ZwAlpcDeleteSecurityContext
6000
Vista SP0
30
6001
Vista SP1, Win2008
30
7000
Windows 7
32
ZwAlpcDisconnectPort
6000
Vista SP0
31
6001
Vista SP1, Win2008
31
7000
Windows 7
33
ZwAlpcImpersonateClientOfPort
6000
Vista SP0
32
6001
Vista SP1, Win2008
32
7000
Windows 7
34
ZwAlpcOpenSenderProcess
6000
Vista SP0
33
6001
Vista SP1, Win2008
33
7000
Windows 7
35
ZwAlpcOpenSenderThread
6000
Vista SP0
34
6001
Vista SP1, Win2008
34
7000
Windows 7
36
ZwAlpcQueryInformation
6000
Vista SP0
35
6001
Vista SP1, Win2008
35
7000
Windows 7
37
ZwAlpcQueryInformationMessage
6000
Vista SP0
36
6001
Vista SP1, Win2008
36
7000
Windows 7
38
ZwAlpcRevokeSecurityContext
6000
Vista SP0
37
6001
Vista SP1, Win2008
37
7000
Windows 7
39
ZwAlpcSendWaitReceivePort
6000
Vista SP0
38
6001
Vista SP1, Win2008
38
7000
Windows 7
40
ZwAlpcSetInformation
6000
Vista SP0
39
6001
Vista SP1, Win2008
39
7000
Windows 7
41
ZwApphelpCacheControl
3790
Win2003 SP0-SP2
19
6000
Vista SP0
40
6001
Vista SP1, Win2008
40
7000
Windows 7
42
ZwAreMappedFilesTheSame
2195
Win2000 SP0-SP4
17
2600
WinXP SP0-SP3
18
3790
Win2003 SP0-SP2
20
6000
Vista SP0
41
6001
Vista SP1, Win2008
41
7000
Windows 7
43
ZwAssignProcessToJobObject
2195
Win2000 SP0-SP4
18
2600
WinXP SP0-SP3
19
3790
Win2003 SP0-SP2
21
6000
Vista SP0
42
6001
Vista SP1, Win2008
42
7000
Windows 7
44
ZwCallbackReturn
2195
Win2000 SP0-SP4
19
2600
WinXP SP0-SP3
20
3790
Win2003 SP0-SP2
22
6000
Vista SP0
43
6001
Vista SP1, Win2008
43
7000
Windows 7
45
ZwCancelDeviceWakeupRequest
2195
Win2000 SP0-SP4
22
2600
WinXP SP0-SP3
21
3790
Win2003 SP0-SP2
23
6000
Vista SP0
44
6001
Vista SP1, Win2008
44
ZwCancelIoFile
2195
Win2000 SP0-SP4
20
2600
WinXP SP0-SP3
22
3790
Win2003 SP0-SP2
24
6000
Vista SP0
45
6001
Vista SP1, Win2008
45
7000
Windows 7
46
ZwCancelIoFileEx
6000
Vista SP0
373
6001
Vista SP1, Win2008
369
7000
Windows 7
47
ZwCancelSynchronousIoFile
6000
Vista SP0
374
6001
Vista SP1, Win2008
370
7000
Windows 7
48
ZwCancelTimer
2195
Win2000 SP0-SP4
21
2600
WinXP SP0-SP3
23
3790
Win2003 SP0-SP2
25
6000
Vista SP0
46
6001
Vista SP1, Win2008
46
7000
Windows 7
49
ZwClearAllSavepointsTransaction
6000
Vista SP0
286
ZwClearEvent
2195
Win2000 SP0-SP4
23
2600
WinXP SP0-SP3
24
3790
Win2003 SP0-SP2
26
6000
Vista SP0
47
6001
Vista SP1, Win2008
47
7000
Windows 7
50
ZwClearSavepointTransaction
6000
Vista SP0
285
ZwClose
2195
Win2000 SP0-SP4
24
2600
WinXP SP0-SP3
25
3790
Win2003 SP0-SP2
27
6000
Vista SP0
48
6001
Vista SP1, Win2008
48
7000
Windows 7
51
ZwCloseObjectAuditAlarm
2195
Win2000 SP0-SP4
25
2600
WinXP SP0-SP3
26
3790
Win2003 SP0-SP2
28
6000
Vista SP0
49
6001
Vista SP1, Win2008
49
7000
Windows 7
52
ZwCommitComplete
6000
Vista SP0
95
6001
Vista SP1, Win2008
95
7000
Windows 7
53
ZwCommitEnlistment
6000
Vista SP0
87
6001
Vista SP1, Win2008
87
7000
Windows 7
54
ZwCommitTransaction
6000
Vista SP0
91
6001
Vista SP1, Win2008
91
7000
Windows 7
55
ZwCompactKeys
2600
WinXP SP0-SP3
27
3790
Win2003 SP0-SP2
29
6000
Vista SP0
50
6001
Vista SP1, Win2008
50
7000
Windows 7
56
ZwCompareTokens
2600
WinXP SP0-SP3
28
3790
Win2003 SP0-SP2
30
6000
Vista SP0
51
6001
Vista SP1, Win2008
51
7000
Windows 7
57
ZwCompleteConnectPort
2195
Win2000 SP0-SP4
26
2600
WinXP SP0-SP3
29
3790
Win2003 SP0-SP2
31
6000
Vista SP0
52
6001
Vista SP1, Win2008
52
7000
Windows 7
58
ZwCompressKey
2600
WinXP SP0-SP3
30
3790
Win2003 SP0-SP2
32
6000
Vista SP0
53
6001
Vista SP1, Win2008
53
7000
Windows 7
59
ZwConnectPort
2195
Win2000 SP0-SP4
27
2600
WinXP SP0-SP3
31
3790
Win2003 SP0-SP2
33
6000
Vista SP0
54
6001
Vista SP1, Win2008
54
7000
Windows 7
60
ZwContinue
2195
Win2000 SP0-SP4
28
ZwContinue
2600
WinXP SP0-SP3
32
ZwContinue
3790
Win2003 SP0-SP2
34
ZwContinue
6000
Vista SP0
55
ZwContinue
6001
Vista SP1, Win2008
55
ZwContinue
7000
Windows 7
61
ZwCreateChannel
2195
Win2000 SP0-SP4
241
ZwCreateDebugObject
2600
WinXP SP0-SP3
33
ZwCreateDebugObject
3790
Win2003 SP0-SP2
35
ZwCreateDebugObject
6000
Vista SP0
56
ZwCreateDebugObject
6001
Vista SP1, Win2008
56
ZwCreateDebugObject
7000
Windows 7
62
ZwCreateDirectoryObject
2195
Win2000 SP0-SP4
29
ZwCreateDirectoryObject
2600
WinXP SP0-SP3
34
ZwCreateDirectoryObject
3790
Win2003 SP0-SP2
36
ZwCreateDirectoryObject
6000
Vista SP0
57
ZwCreateDirectoryObject
6001
Vista SP1, Win2008
57
ZwCreateDirectoryObject
7000
Windows 7
63
ZwCreateEnlistment
6000
Vista SP0
110
ZwCreateEnlistment
6001
Vista SP1, Win2008
111
ZwCreateEnlistment
7000
Windows 7
64
ZwCreateEvent
2195
Win2000 SP0-SP4
30
ZwCreateEvent
2600
WinXP SP0-SP3
35
ZwCreateEvent
3790
Win2003 SP0-SP2
37
ZwCreateEvent
6000
Vista SP0
58
ZwCreateEvent
6001
Vista SP1, Win2008
58
ZwCreateEvent
7000
Windows 7
65
ZwCreateEventPair
2195
Win2000 SP0-SP4
31
ZwCreateEventPair
2600
WinXP SP0-SP3
36
ZwCreateEventPair
3790
Win2003 SP0-SP2
38
ZwCreateEventPair
6000
Vista SP0
59
ZwCreateEventPair
6001
Vista SP1, Win2008
59
ZwCreateEventPair
7000
Windows 7
66
ZwCreateFile
2195
Win2000 SP0-SP4
32
ZwCreateFile
2600
WinXP SP0-SP3
37
ZwCreateFile
3790
Win2003 SP0-SP2
39
ZwCreateFile
6000
Vista SP0
60
ZwCreateFile
6001
Vista SP1, Win2008
60
ZwCreateFile
7000
Windows 7
67
ZwCreateIoCompletion
2195
Win2000 SP0-SP4
33
ZwCreateIoCompletion
2600
WinXP SP0-SP3
38
ZwCreateIoCompletion
3790
Win2003 SP0-SP2
40
ZwCreateIoCompletion
6000
Vista SP0
61
ZwCreateIoCompletion
6001
Vista SP1, Win2008
61
ZwCreateIoCompletion
7000
Windows 7
68
ZwCreateJobObject
2195
Win2000 SP0-SP4
34
ZwCreateJobObject
2600
WinXP SP0-SP3
39
ZwCreateJobObject
3790
Win2003 SP0-SP2
41
ZwCreateJobObject
6000
Vista SP0
62
ZwCreateJobObject
6001
Vista SP1, Win2008
62
ZwCreateJobObject
7000
Windows 7
69
ZwCreateJobSet
2600
WinXP SP0-SP3
40
ZwCreateJobSet
3790
Win2003 SP0-SP2
42
ZwCreateJobSet
6000
Vista SP0
63
ZwCreateJobSet
6001
Vista SP1, Win2008
63
ZwCreateJobSet
7000
Windows 7
70
ZwCreateKey
2195
Win2000 SP0-SP4
35
ZwCreateKey
2600
WinXP SP0-SP3
41
ZwCreateKey
3790
Win2003 SP0-SP2
43
ZwCreateKey
6000
Vista SP0
64
ZwCreateKey
6001
Vista SP1, Win2008
64
ZwCreateKey
7000
Windows 7
71
ZwCreateKeyedEvent
2600
WinXP SP0-SP3
279
ZwCreateKeyedEvent
3790
Win2003 SP0-SP2
289
ZwCreateKeyedEvent
6000
Vista SP0
364
ZwCreateKeyedEvent
6001
Vista SP1, Win2008
360
ZwCreateKeyedEvent
7000
Windows 7
72
ZwCreateKeyTransacted
6000
Vista SP0
65
ZwCreateKeyTransacted
6001
Vista SP1, Win2008
65
ZwCreateKeyTransacted
7000
Windows 7
73
ZwCreateMailslotFile
2195
Win2000 SP0-SP4
36
ZwCreateMailslotFile
2600
WinXP SP0-SP3
42
ZwCreateMailslotFile
3790
Win2003 SP0-SP2
44
ZwCreateMailslotFile
6000
Vista SP0
66
ZwCreateMailslotFile
6001
Vista SP1, Win2008
66
ZwCreateMailslotFile
7000
Windows 7
74
ZwCreateMutant
2195
Win2000 SP0-SP4
37
ZwCreateMutant
2600
WinXP SP0-SP3
43
ZwCreateMutant
3790
Win2003 SP0-SP2
45
ZwCreateMutant
6000
Vista SP0
67
ZwCreateMutant
6001
Vista SP1, Win2008
67
ZwCreateMutant
7000
Windows 7
75
ZwCreateNamedPipeFile
2195
Win2000 SP0-SP4
38
ZwCreateNamedPipeFile
2600
WinXP SP0-SP3
44
ZwCreateNamedPipeFile
3790
Win2003 SP0-SP2
46
ZwCreateNamedPipeFile
6000
Vista SP0
68
ZwCreateNamedPipeFile
6001
Vista SP1, Win2008
68
ZwCreateNamedPipeFile
7000
Windows 7
76
ZwCreatePagingFile
2195
Win2000 SP0-SP4
39
ZwCreatePagingFile
2600
WinXP SP0-SP3
45
ZwCreatePagingFile
3790
Win2003 SP0-SP2
47
ZwCreatePagingFile
6000
Vista SP0
70
ZwCreatePagingFile
6001
Vista SP1, Win2008
70
ZwCreatePagingFile
7000
Windows 7
77
ZwCreatePort
2195
Win2000 SP0-SP4
40
ZwCreatePort
2600
WinXP SP0-SP3
46
ZwCreatePort
3790
Win2003 SP0-SP2
48
ZwCreatePort
6000
Vista SP0
71
ZwCreatePort
6001
Vista SP1, Win2008
71
ZwCreatePort
7000
Windows 7
78
ZwCreatePrivateNamespace
6000
Vista SP0
69
ZwCreatePrivateNamespace
6001
Vista SP1, Win2008
69
ZwCreatePrivateNamespace
7000
Windows 7
79
ZwCreateProcess
2195
Win2000 SP0-SP4
41
ZwCreateProcess
2600
WinXP SP0-SP3
47
ZwCreateProcess
3790
Win2003 SP0-SP2
49
ZwCreateProcess
6000
Vista SP0
72
ZwCreateProcess
6001
Vista SP1, Win2008
72
ZwCreateProcess
7000
Windows 7
80
ZwCreateProcessEx
2600
WinXP SP0-SP3
48
ZwCreateProcessEx
3790
Win2003 SP0-SP2
50
ZwCreateProcessEx
6000
Vista SP0
73
ZwCreateProcessEx
6001
Vista SP1, Win2008
73
ZwCreateProcessEx
7000
Windows 7
81
ZwCreateProfile
2195
Win2000 SP0-SP4
42
ZwCreateProfile
2600
WinXP SP0-SP3
49
ZwCreateProfile
3790
Win2003 SP0-SP2
51
ZwCreateProfile
6000
Vista SP0
74
ZwCreateProfile
6001
Vista SP1, Win2008
74
ZwCreateProfile
7000
Windows 7
82
ZwCreateProfileEx
7000
Windows 7
83
ZwCreateResourceManager
6000
Vista SP0
106
ZwCreateResourceManager
6001
Vista SP1, Win2008
107
ZwCreateResourceManager
7000
Windows 7
84
ZwCreateSection
2195
Win2000 SP0-SP4
43
ZwCreateSection
2600
WinXP SP0-SP3
50
ZwCreateSection
3790
Win2003 SP0-SP2
52
ZwCreateSection
6000
Vista SP0
75
ZwCreateSection
6001
Vista SP1, Win2008
75
ZwCreateSection
7000
Windows 7
85
ZwCreateSemaphore
2195
Win2000 SP0-SP4
44
ZwCreateSemaphore
2600
WinXP SP0-SP3
51
ZwCreateSemaphore
3790
Win2003 SP0-SP2
53
ZwCreateSemaphore
6000
Vista SP0
76
ZwCreateSemaphore
6001
Vista SP1, Win2008
76
ZwCreateSemaphore
7000
Windows 7
86
ZwCreateSymbolicLinkObject
2195
Win2000 SP0-SP4
45
ZwCreateSymbolicLinkObject
2600
WinXP SP0-SP3
52
ZwCreateSymbolicLinkObject
3790
Win2003 SP0-SP2
54
ZwCreateSymbolicLinkObject
6000
Vista SP0
77
ZwCreateSymbolicLinkObject
6001
Vista SP1, Win2008
77
ZwCreateSymbolicLinkObject
7000
Windows 7
87
ZwCreateThread
2195
Win2000 SP0-SP4
46
ZwCreateThread
2600
WinXP SP0-SP3
53
ZwCreateThread
3790
Win2003 SP0-SP2
55
ZwCreateThread
6000
Vista SP0
78
ZwCreateThread
6001
Vista SP1, Win2008
78
ZwCreateThread
7000
Windows 7
88
ZwCreateThreadEx
6000
Vista SP0
388
ZwCreateThreadEx
6001
Vista SP1, Win2008
382
ZwCreateThreadEx
7000
Windows 7
89
ZwCreateTimer
2195
Win2000 SP0-SP4
47
ZwCreateTimer
2600
WinXP SP0-SP3
54
ZwCreateTimer
3790
Win2003 SP0-SP2
56
ZwCreateTimer
6000
Vista SP0
79
ZwCreateTimer
6001
Vista SP1, Win2008
79
ZwCreateTimer
7000
Windows 7
90
ZwCreateToken
2195
Win2000 SP0-SP4
48
ZwCreateToken
2600
WinXP SP0-SP3
55
ZwCreateToken
3790
Win2003 SP0-SP2
57
ZwCreateToken
6000
Vista SP0
80
ZwCreateToken
6001
Vista SP1, Win2008
80
ZwCreateToken
7000
Windows 7
91
ZwCreateTransaction
6000
Vista SP0
81
ZwCreateTransaction
6001
Vista SP1, Win2008
81
ZwCreateTransaction
7000
Windows 7
92
ZwCreateTransactionManager
6000
Vista SP0
100
ZwCreateTransactionManager
6001
Vista SP1, Win2008
100
ZwCreateTransactionManager
7000
Windows 7
93
ZwCreateUserProcess
6000
Vista SP0
389
ZwCreateUserProcess
6001
Vista SP1, Win2008
383
ZwCreateUserProcess
7000
Windows 7
94
ZwCreateWaitablePort
2195
Win2000 SP0-SP4
49
ZwCreateWaitablePort
2600
WinXP SP0-SP3
56
ZwCreateWaitablePort
3790
Win2003 SP0-SP2
58
ZwCreateWaitablePort
6000
Vista SP0
115
ZwCreateWaitablePort
6001
Vista SP1, Win2008
115
ZwCreateWaitablePort
7000
Windows 7
95
ZwCreateWorkerFactory
6000
Vista SP0
381
ZwCreateWorkerFactory
6001
Vista SP1, Win2008
375
ZwCreateWorkerFactory
7000
Windows 7
96
ZwDebugActiveProcess
2600
WinXP SP0-SP3
57
ZwDebugActiveProcess
3790
Win2003 SP0-SP2
59
ZwDebugActiveProcess
6000
Vista SP0
116
ZwDebugActiveProcess
6001
Vista SP1, Win2008
116
ZwDebugActiveProcess
7000
Windows 7
97
ZwDebugContinue
2600
WinXP SP0-SP3
58
ZwDebugContinue
3790
Win2003 SP0-SP2
60
ZwDebugContinue
6000
Vista SP0
117
ZwDebugContinue
6001
Vista SP1, Win2008
117
ZwDebugContinue
7000
Windows 7
98
ZwDelayExecution
2195
Win2000 SP0-SP4
50
ZwDelayExecution
2600
WinXP SP0-SP3
59
ZwDelayExecution
3790
Win2003 SP0-SP2
61
ZwDelayExecution
6000
Vista SP0
118
ZwDelayExecution
6001
Vista SP1, Win2008
118
ZwDelayExecution
7000
Windows 7
99
ZwDeleteAtom
2195
Win2000 SP0-SP4
51
ZwDeleteAtom
2600
WinXP SP0-SP3
60
ZwDeleteAtom
3790
Win2003 SP0-SP2
62
ZwDeleteAtom
6000
Vista SP0
119
ZwDeleteAtom
6001
Vista SP1, Win2008
119
ZwDeleteAtom
7000
Windows 7
100
ZwDeleteBootEntry
2600
WinXP SP0-SP3
61
ZwDeleteBootEntry
3790
Win2003 SP0-SP2
63
ZwDeleteBootEntry
6000
Vista SP0
120
ZwDeleteBootEntry
6001
Vista SP1, Win2008
120
ZwDeleteBootEntry
7000
Windows 7
101
ZwDeleteDriverEntry
3790
Win2003 SP0-SP2
64
ZwDeleteDriverEntry
6000
Vista SP0
121
ZwDeleteDriverEntry
6001
Vista SP1, Win2008
121
ZwDeleteDriverEntry
7000
Windows 7
102
ZwDeleteFile
2195
Win2000 SP0-SP4
52
ZwDeleteFile
2600
WinXP SP0-SP3
62
ZwDeleteFile
3790
Win2003 SP0-SP2
65
ZwDeleteFile
6000
Vista SP0
122
ZwDeleteFile
6001
Vista SP1, Win2008
122
ZwDeleteFile
7000
Windows 7
103
ZwDeleteKey
2195
Win2000 SP0-SP4
53
ZwDeleteKey
2600
WinXP SP0-SP3
63
ZwDeleteKey
3790
Win2003 SP0-SP2
66
ZwDeleteKey
6000
Vista SP0
123
ZwDeleteKey
6001
Vista SP1, Win2008
123
ZwDeleteKey
7000
Windows 7
104
ZwDeleteObjectAuditAlarm
2195
Win2000 SP0-SP4
54
ZwDeleteObjectAuditAlarm
2600
WinXP SP0-SP3
64
ZwDeleteObjectAuditAlarm
3790
Win2003 SP0-SP2
67
ZwDeleteObjectAuditAlarm
6000
Vista SP0
125
ZwDeleteObjectAuditAlarm
6001
Vista SP1, Win2008
125
ZwDeleteObjectAuditAlarm
7000
Windows 7
105
ZwDeletePrivateNamespace
6000
Vista SP0
124
ZwDeletePrivateNamespace
6001
Vista SP1, Win2008
124
ZwDeletePrivateNamespace
7000
Windows 7
106
ZwDeleteValueKey
2195
Win2000 SP0-SP4
55
ZwDeleteValueKey
2600
WinXP SP0-SP3
65
ZwDeleteValueKey
3790
Win2003 SP0-SP2
68
ZwDeleteValueKey
6000
Vista SP0
126
ZwDeleteValueKey
6001
Vista SP1, Win2008
126
ZwDeleteValueKey
7000
Windows 7
107
ZwDeviceIoControlFile
2195
Win2000 SP0-SP4
56
ZwDeviceIoControlFile
2600
WinXP SP0-SP3
66
ZwDeviceIoControlFile
3790
Win2003 SP0-SP2
69
ZwDeviceIoControlFile
6000
Vista SP0
127
ZwDeviceIoControlFile
6001
Vista SP1, Win2008
127
ZwDeviceIoControlFile
7000
Windows 7
108
ZwDisplayString
2195
Win2000 SP0-SP4
57
ZwDisplayString
2600
WinXP SP0-SP3
67
ZwDisplayString
3790
Win2003 SP0-SP2
70
ZwDisplayString
6000
Vista SP0
128
ZwDisplayString
6001
Vista SP1, Win2008
128
ZwDisplayString
7000
Windows 7
109
ZwDrawText
7000
Windows 7
110
ZwDuplicateObject
2195
Win2000 SP0-SP4
58
ZwDuplicateObject
2600
WinXP SP0-SP3
68
ZwDuplicateObject
3790
Win2003 SP0-SP2
71
ZwDuplicateObject
6000
Vista SP0
129
ZwDuplicateObject
6001
Vista SP1, Win2008
129
ZwDuplicateObject
7000
Windows 7
111
ZwDuplicateToken
2195
Win2000 SP0-SP4
59
ZwDuplicateToken
2600
WinXP SP0-SP3
69
ZwDuplicateToken
3790
Win2003 SP0-SP2
72
ZwDuplicateToken
6000
Vista SP0
130
ZwDuplicateToken
6001
Vista SP1, Win2008
130
ZwDuplicateToken
7000
Windows 7
112
ZwEnumerateBootEntries
2600
WinXP SP0-SP3
70
ZwEnumerateBootEntries
3790
Win2003 SP0-SP2
73
ZwEnumerateBootEntries
6000
Vista SP0
131
ZwEnumerateBootEntries
6001
Vista SP1, Win2008
131
ZwEnumerateBootEntries
7000
Windows 7
113
ZwEnumerateDriverEntries
3790
Win2003 SP0-SP2
74
ZwEnumerateDriverEntries
6000
Vista SP0
132
ZwEnumerateDriverEntries
6001
Vista SP1, Win2008
132
ZwEnumerateDriverEntries
7000
Windows 7
114
ZwEnumerateKey
2195
Win2000 SP0-SP4
60
ZwEnumerateKey
2600
WinXP SP0-SP3
71
ZwEnumerateKey
3790
Win2003 SP0-SP2
75
ZwEnumerateKey
6000
Vista SP0
133
ZwEnumerateKey
6001
Vista SP1, Win2008
133
ZwEnumerateKey
7000
Windows 7
115
ZwEnumerateSystemEnvironmentValuesEx
2600
WinXP SP0-SP3
72
ZwEnumerateSystemEnvironmentValuesEx
3790
Win2003 SP0-SP2
76
ZwEnumerateSystemEnvironmentValuesEx
6000
Vista SP0
134
ZwEnumerateSystemEnvironmentValuesEx
6001
Vista SP1, Win2008
134
ZwEnumerateSystemEnvironmentValuesEx
7000
Windows 7
116
ZwEnumerateTransactionObject
6000
Vista SP0
135
ZwEnumerateTransactionObject
6001
Vista SP1, Win2008
135
ZwEnumerateTransactionObject
7000
Windows 7
117
ZwEnumerateValueKey
2195
Win2000 SP0-SP4
61
ZwEnumerateValueKey
2600
WinXP SP0-SP3
73
ZwEnumerateValueKey
3790
Win2003 SP0-SP2
77
ZwEnumerateValueKey
6000
Vista SP0
136
ZwEnumerateValueKey
6001
Vista SP1, Win2008
136
ZwEnumerateValueKey
7000
Windows 7
118
ZwExtendSection
2195
Win2000 SP0-SP4
62
ZwExtendSection
2600
WinXP SP0-SP3
74
ZwExtendSection
3790
Win2003 SP0-SP2
78
ZwExtendSection
6000
Vista SP0
137
ZwExtendSection
6001
Vista SP1, Win2008
137
ZwExtendSection
7000
Windows 7
119
ZwFilterToken
2195
Win2000 SP0-SP4
63
ZwFilterToken
2600
WinXP SP0-SP3
75
ZwFilterToken
3790
Win2003 SP0-SP2
79
ZwFilterToken
6000
Vista SP0
138
ZwFilterToken
6001
Vista SP1, Win2008
138
ZwFilterToken
7000
Windows 7
120
ZwFindAtom
2195
Win2000 SP0-SP4
64
ZwFindAtom
2600
WinXP SP0-SP3
76
ZwFindAtom
3790
Win2003 SP0-SP2
80
ZwFindAtom
6000
Vista SP0
139
ZwFindAtom
6001
Vista SP1, Win2008
139
ZwFindAtom
7000
Windows 7
121
ZwFlushBuffersFile
2195
Win2000 SP0-SP4
65
ZwFlushBuffersFile
2600
WinXP SP0-SP3
77
ZwFlushBuffersFile
3790
Win2003 SP0-SP2
81
ZwFlushBuffersFile
6000
Vista SP0
140
ZwFlushBuffersFile
6001
Vista SP1, Win2008
140
ZwFlushBuffersFile
7000
Windows 7
122
ZwFlushInstallUILanguage
6000
Vista SP0
394
ZwFlushInstallUILanguage
6001
Vista SP1, Win2008
387
ZwFlushInstallUILanguage
7000
Windows 7
123
ZwFlushInstructionCache
2195
Win2000 SP0-SP4
66
ZwFlushInstructionCache
2600
WinXP SP0-SP3
78
ZwFlushInstructionCache
3790
Win2003 SP0-SP2
82
ZwFlushInstructionCache
6000
Vista SP0
141
ZwFlushInstructionCache
6001
Vista SP1, Win2008
141
ZwFlushInstructionCache
7000
Windows 7
124
ZwFlushKey
2195
Win2000 SP0-SP4
67
ZwFlushKey
2600
WinXP SP0-SP3
79
ZwFlushKey
3790
Win2003 SP0-SP2
83
ZwFlushKey
6000
Vista SP0
142
ZwFlushKey
6001
Vista SP1, Win2008
142
ZwFlushKey
7000
Windows 7
125
ZwFlushProcessWriteBuffers
6000
Vista SP0
143
ZwFlushProcessWriteBuffers
6001
Vista SP1, Win2008
143
ZwFlushProcessWriteBuffers
7000
Windows 7
126
ZwFlushVirtualMemory
2195
Win2000 SP0-SP4
68
ZwFlushVirtualMemory
2600
WinXP SP0-SP3
80
ZwFlushVirtualMemory
3790
Win2003 SP0-SP2
84
ZwFlushVirtualMemory
6000
Vista SP0
144
ZwFlushVirtualMemory
6001
Vista SP1, Win2008
144
ZwFlushVirtualMemory
7000
Windows 7
127
ZwFlushWriteBuffer
2195
Win2000 SP0-SP4
69
ZwFlushWriteBuffer
2600
WinXP SP0-SP3
81
ZwFlushWriteBuffer
3790
Win2003 SP0-SP2
85
ZwFlushWriteBuffer
6000
Vista SP0
145
ZwFlushWriteBuffer
6001
Vista SP1, Win2008
145
ZwFlushWriteBuffer
7000
Windows 7
128
ZwFreeUserPhysicalPages
2195
Win2000 SP0-SP4
70
ZwFreeUserPhysicalPages
2600
WinXP SP0-SP3
82
ZwFreeUserPhysicalPages
3790
Win2003 SP0-SP2
86
ZwFreeUserPhysicalPages
6000
Vista SP0
146
ZwFreeUserPhysicalPages
6001
Vista SP1, Win2008
146
ZwFreeUserPhysicalPages
7000
Windows 7
129
ZwFreeVirtualMemory
2195
Win2000 SP0-SP4
71
ZwFreeVirtualMemory
2600
WinXP SP0-SP3
83
ZwFreeVirtualMemory
3790
Win2003 SP0-SP2
87
ZwFreeVirtualMemory
6000
Vista SP0
147
ZwFreeVirtualMemory
6001
Vista SP1, Win2008
147
ZwFreeVirtualMemory
7000
Windows 7
130
ZwFreezeRegistry
6000
Vista SP0
148
ZwFreezeRegistry
6001
Vista SP1, Win2008
148
ZwFreezeRegistry
7000
Windows 7
131
ZwFreezeTransactions
6000
Vista SP0
149
ZwFreezeTransactions
6001
Vista SP1, Win2008
149
ZwFreezeTransactions
7000
Windows 7
132
ZwFsControlFile
2195
Win2000 SP0-SP4
72
ZwFsControlFile
2600
WinXP SP0-SP3
84
ZwFsControlFile
3790
Win2003 SP0-SP2
88
ZwFsControlFile
6000
Vista SP0
150
ZwFsControlFile
6001
Vista SP1, Win2008
150
ZwFsControlFile
7000
Windows 7
133
ZwGetContextThread
2195
Win2000 SP0-SP4
73
ZwGetContextThread
2600
WinXP SP0-SP3
85
ZwGetContextThread
3790
Win2003 SP0-SP2
89
ZwGetContextThread
6000
Vista SP0
151
ZwGetContextThread
6001
Vista SP1, Win2008
151
ZwGetContextThread
7000
Windows 7
134
ZwGetCurrentProcessorNumber
3790
Win2003 SP0-SP2
294
ZwGetCurrentProcessorNumber
6000
Vista SP0
369
ZwGetCurrentProcessorNumber
6001
Vista SP1, Win2008
365
ZwGetCurrentProcessorNumber
7000
Windows 7
135
ZwGetDevicePowerState
2195
Win2000 SP0-SP4
74
ZwGetDevicePowerState
2600
WinXP SP0-SP3
86
ZwGetDevicePowerState
3790
Win2003 SP0-SP2
90
ZwGetDevicePowerState
6000
Vista SP0
152
ZwGetDevicePowerState
6001
Vista SP1, Win2008
152
ZwGetDevicePowerState
7000
Windows 7
136
ZwGetMUIRegistryInfo
6000
Vista SP0
395
ZwGetMUIRegistryInfo
6001
Vista SP1, Win2008
388
ZwGetMUIRegistryInfo
7000
Windows 7
137
ZwGetNextProcess
6000
Vista SP0
371
ZwGetNextProcess
6001
Vista SP1, Win2008
367
ZwGetNextProcess
7000
Windows 7
138
ZwGetNextThread
6000
Vista SP0
372
ZwGetNextThread
6001
Vista SP1, Win2008
368
ZwGetNextThread
7000
Windows 7
139
ZwGetNlsSectionPtr
6000
Vista SP0
153
ZwGetNlsSectionPtr
6001
Vista SP1, Win2008
153
ZwGetNlsSectionPtr
7000
Windows 7
140
ZwGetNotificationResourceManager
6000
Vista SP0
108
ZwGetNotificationResourceManager
6001
Vista SP1, Win2008
109
ZwGetNotificationResourceManager
7000
Windows 7
141
ZwGetPlugPlayEvent
2195
Win2000 SP0-SP4
75
ZwGetPlugPlayEvent
2600
WinXP SP0-SP3
87
ZwGetPlugPlayEvent
3790
Win2003 SP0-SP2
91
ZwGetPlugPlayEvent
6000
Vista SP0
154
ZwGetPlugPlayEvent
6001
Vista SP1, Win2008
154
ZwGetPlugPlayEvent
7000
Windows 7
142
ZwGetTickCount
2195
Win2000 SP0-SP4
76
ZwGetWriteWatch
2195
Win2000 SP0-SP4
77
ZwGetWriteWatch
2600
WinXP SP0-SP3
88
ZwGetWriteWatch
3790
Win2003 SP0-SP2
92
ZwGetWriteWatch
6000
Vista SP0
155
ZwGetWriteWatch
6001
Vista SP1, Win2008
155
ZwGetWriteWatch
7000
Windows 7
143
ZwImpersonateAnonymousToken
2195
Win2000 SP0-SP4
78
ZwImpersonateAnonymousToken
2600
WinXP SP0-SP3
89
ZwImpersonateAnonymousToken
3790
Win2003 SP0-SP2
93
ZwImpersonateAnonymousToken
6000
Vista SP0
156
ZwImpersonateAnonymousToken
6001
Vista SP1, Win2008
156
ZwImpersonateAnonymousToken
7000
Windows 7
144
ZwImpersonateClientOfPort
2195
Win2000 SP0-SP4
79
ZwImpersonateClientOfPort
2600
WinXP SP0-SP3
90
ZwImpersonateClientOfPort
3790
Win2003 SP0-SP2
94
ZwImpersonateClientOfPort
6000
Vista SP0
157
ZwImpersonateClientOfPort
6001
Vista SP1, Win2008
157
ZwImpersonateClientOfPort
7000
Windows 7
145
ZwImpersonateThread
2195
Win2000 SP0-SP4
80
ZwImpersonateThread
2600
WinXP SP0-SP3
91
ZwImpersonateThread
3790
Win2003 SP0-SP2
95
ZwImpersonateThread
6000
Vista SP0
158
ZwImpersonateThread
6001
Vista SP1, Win2008
158
ZwImpersonateThread
7000
Windows 7
146
ZwInitializeNlsFiles
6000
Vista SP0
159
ZwInitializeNlsFiles
6001
Vista SP1, Win2008
159
ZwInitializeNlsFiles
7000
Windows 7
147
ZwInitializeRegistry
2195
Win2000 SP0-SP4
81
ZwInitializeRegistry
2600
WinXP SP0-SP3
92
ZwInitializeRegistry
3790
Win2003 SP0-SP2
96
ZwInitializeRegistry
6000
Vista SP0
160
ZwInitializeRegistry
6001
Vista SP1, Win2008
160
ZwInitializeRegistry
7000
Windows 7
148
ZwInitiatePowerAction
2195
Win2000 SP0-SP4
82
ZwInitiatePowerAction
2600
WinXP SP0-SP3
93
ZwInitiatePowerAction
3790
Win2003 SP0-SP2
97
ZwInitiatePowerAction
6000
Vista SP0
161
ZwInitiatePowerAction
6001
Vista SP1, Win2008
161
ZwInitiatePowerAction
7000
Windows 7
149
ZwIsProcessInJob
2600
WinXP SP0-SP3
94
ZwIsProcessInJob
3790
Win2003 SP0-SP2
98
ZwIsProcessInJob
6000
Vista SP0
162
ZwIsProcessInJob
6001
Vista SP1, Win2008
162
ZwIsProcessInJob
7000
Windows 7
150
ZwIsSystemResumeAutomatic
2195
Win2000 SP0-SP4
83
ZwIsSystemResumeAutomatic
2600
WinXP SP0-SP3
95
ZwIsSystemResumeAutomatic
3790
Win2003 SP0-SP2
99
ZwIsSystemResumeAutomatic
6000
Vista SP0
163
ZwIsSystemResumeAutomatic
6001
Vista SP1, Win2008
163
ZwIsSystemResumeAutomatic
7000
Windows 7
151
ZwIsUILanguageComitted
6000
Vista SP0
393
ZwIsUILanguageComitted
6001
Vista SP1, Win2008
386
ZwIsUILanguageComitted
7000
Windows 7
152
ZwListenChannel
2195
Win2000 SP0-SP4
242
ZwListenPort
2195
Win2000 SP0-SP4
84
ZwListenPort
2600
WinXP SP0-SP3
96
ZwListenPort
3790
Win2003 SP0-SP2
100
ZwListenPort
6000
Vista SP0
164
ZwListenPort
6001
Vista SP1, Win2008
164
ZwListenPort
7000
Windows 7
153
ZwListTransactions
6000
Vista SP0
392
ZwLoadDriver
2195
Win2000 SP0-SP4
85
ZwLoadDriver
2600
WinXP SP0-SP3
97
ZwLoadDriver
3790
Win2003 SP0-SP2
101
ZwLoadDriver
6000
Vista SP0
165
ZwLoadDriver
6001
Vista SP1, Win2008
165
ZwLoadDriver
7000
Windows 7
154
ZwLoadKey
2195
Win2000 SP0-SP4
86
ZwLoadKey
2600
WinXP SP0-SP3
98
ZwLoadKey
3790
Win2003 SP0-SP2
102
ZwLoadKey
6000
Vista SP0
166
ZwLoadKey
6001
Vista SP1, Win2008
166
ZwLoadKey
7000
Windows 7
155
ZwLoadKey2
2195
Win2000 SP0-SP4
87
ZwLoadKey2
2600
WinXP SP0-SP3
99
ZwLoadKey2
3790
Win2003 SP0-SP2
103
ZwLoadKey2
6000
Vista SP0
167
ZwLoadKey2
6001
Vista SP1, Win2008
167
ZwLoadKey2
7000
Windows 7
156
ZwLoadKeyEx
3790
Win2003 SP0-SP2
104
ZwLoadKeyEx
6000
Vista SP0
168
ZwLoadKeyEx
6001
Vista SP1, Win2008
168
ZwLoadKeyEx
7000
Windows 7
157
ZwLockFile
2195
Win2000 SP0-SP4
88
ZwLockFile
2600
WinXP SP0-SP3
100
ZwLockFile
3790
Win2003 SP0-SP2
105
ZwLockFile
6000
Vista SP0
169
ZwLockFile
6001
Vista SP1, Win2008
169
ZwLockFile
7000
Windows 7
158
ZwLockProductActivationKeys
2600
WinXP SP0-SP3
101
ZwLockProductActivationKeys
3790
Win2003 SP0-SP2
106
ZwLockProductActivationKeys
6000
Vista SP0
170
ZwLockProductActivationKeys
6001
Vista SP1, Win2008
170
ZwLockProductActivationKeys
7000
Windows 7
159
ZwLockRegistryKey
2600
WinXP SP0-SP3
102
ZwLockRegistryKey
3790
Win2003 SP0-SP2
107
ZwLockRegistryKey
6000
Vista SP0
171
ZwLockRegistryKey
6001
Vista SP1, Win2008
171
ZwLockRegistryKey
7000
Windows 7
160
ZwLockVirtualMemory
2195
Win2000 SP0-SP4
89
ZwLockVirtualMemory
2600
WinXP SP0-SP3
103
ZwLockVirtualMemory
3790
Win2003 SP0-SP2
108
ZwLockVirtualMemory
6000
Vista SP0
172
ZwLockVirtualMemory
6001
Vista SP1, Win2008
172
ZwLockVirtualMemory
7000
Windows 7
161
ZwMakePermanentObject
2600
WinXP SP0-SP3
104
ZwMakePermanentObject
3790
Win2003 SP0-SP2
109
ZwMakePermanentObject
6000
Vista SP0
173
ZwMakePermanentObject
6001
Vista SP1, Win2008
173
ZwMakePermanentObject
7000
Windows 7
162
ZwMakeTemporaryObject
2195
Win2000 SP0-SP4
90
ZwMakeTemporaryObject
2600
WinXP SP0-SP3
105
ZwMakeTemporaryObject
3790
Win2003 SP0-SP2
110
ZwMakeTemporaryObject
6000
Vista SP0
174
ZwMakeTemporaryObject
6001
Vista SP1, Win2008
174
ZwMakeTemporaryObject
7000
Windows 7
163
ZwMapCMFModule
6000
Vista SP0
391
ZwMapCMFModule
6001
Vista SP1, Win2008
385
ZwMapCMFModule
7000
Windows 7
164
ZwMapUserPhysicalPages
2195
Win2000 SP0-SP4
91
ZwMapUserPhysicalPages
2600
WinXP SP0-SP3
106
ZwMapUserPhysicalPages
3790
Win2003 SP0-SP2
111
ZwMapUserPhysicalPages
6000
Vista SP0
175
ZwMapUserPhysicalPages
6001
Vista SP1, Win2008
175
ZwMapUserPhysicalPages
7000
Windows 7
165
ZwMapUserPhysicalPagesScatter
2195
Win2000 SP0-SP4
92
ZwMapUserPhysicalPagesScatter
2600
WinXP SP0-SP3
107
ZwMapUserPhysicalPagesScatter
3790
Win2003 SP0-SP2
112
ZwMapUserPhysicalPagesScatter
6000
Vista SP0
176
ZwMapUserPhysicalPagesScatter
6001
Vista SP1, Win2008
176
ZwMapUserPhysicalPagesScatter
7000
Windows 7
166
ZwMapViewOfSection
2195
Win2000 SP0-SP4
93
ZwMapViewOfSection
2600
WinXP SP0-SP3
108
ZwMapViewOfSection
3790
Win2003 SP0-SP2
113
ZwMapViewOfSection
6000
Vista SP0
177
ZwMapViewOfSection
6001
Vista SP1, Win2008
177
ZwMapViewOfSection
7000
Windows 7
167
ZwMarshallTransaction
6000
Vista SP0
378
ZwModifyBootEntry
2600
WinXP SP0-SP3
109
ZwModifyBootEntry
3790
Win2003 SP0-SP2
114
ZwModifyBootEntry
6000
Vista SP0
178
ZwModifyBootEntry
6001
Vista SP1, Win2008
178
ZwModifyBootEntry
7000
Windows 7
168
ZwModifyDriverEntry
3790
Win2003 SP0-SP2
115
ZwModifyDriverEntry
6000
Vista SP0
179
ZwModifyDriverEntry
6001
Vista SP1, Win2008
179
ZwModifyDriverEntry
7000
Windows 7
169
ZwNotifyChangeDirectoryFile
2195
Win2000 SP0-SP4
94
ZwNotifyChangeDirectoryFile
2600
WinXP SP0-SP3
110
ZwNotifyChangeDirectoryFile
3790
Win2003 SP0-SP2
116
ZwNotifyChangeDirectoryFile
6000
Vista SP0
180
ZwNotifyChangeDirectoryFile
6001
Vista SP1, Win2008
180
ZwNotifyChangeDirectoryFile
7000
Windows 7
170
ZwNotifyChangeKey
2195
Win2000 SP0-SP4
95
ZwNotifyChangeKey
2600
WinXP SP0-SP3
111
ZwNotifyChangeKey
3790
Win2003 SP0-SP2
117
ZwNotifyChangeKey
6000
Vista SP0
181
ZwNotifyChangeKey
6001
Vista SP1, Win2008
181
ZwNotifyChangeKey
7000
Windows 7
171
ZwNotifyChangeMultipleKeys
2195
Win2000 SP0-SP4
96
ZwNotifyChangeMultipleKeys
2600
WinXP SP0-SP3
112
ZwNotifyChangeMultipleKeys
3790
Win2003 SP0-SP2
118
ZwNotifyChangeMultipleKeys
6000
Vista SP0
182
ZwNotifyChangeMultipleKeys
6001
Vista SP1, Win2008
182
ZwNotifyChangeMultipleKeys
7000
Windows 7
172
ZwNotifyChangeSession
7000
Windows 7
173
ZwOpenChannel
2195
Win2000 SP0-SP4
243
ZwOpenDirectoryObject
2195
Win2000 SP0-SP4
97
ZwOpenDirectoryObject
2600
WinXP SP0-SP3
113
ZwOpenDirectoryObject
3790
Win2003 SP0-SP2
119
ZwOpenDirectoryObject
6000
Vista SP0
183
ZwOpenDirectoryObject
6001
Vista SP1, Win2008
183
ZwOpenDirectoryObject
7000
Windows 7
174
ZwOpenEnlistment
6000
Vista SP0
111
ZwOpenEnlistment
6001
Vista SP1, Win2008
112
ZwOpenEnlistment
7000
Windows 7
175
ZwOpenEvent
2195
Win2000 SP0-SP4
98
ZwOpenEvent
2600
WinXP SP0-SP3
114
ZwOpenEvent
3790
Win2003 SP0-SP2
120
ZwOpenEvent
6000
Vista SP0
184
ZwOpenEvent
6001
Vista SP1, Win2008
184
ZwOpenEvent
7000
Windows 7
176
ZwOpenEventPair
2195
Win2000 SP0-SP4
99
ZwOpenEventPair
2600
WinXP SP0-SP3
115
ZwOpenEventPair
3790
Win2003 SP0-SP2
121
ZwOpenEventPair
6000
Vista SP0
185
ZwOpenEventPair
6001
Vista SP1, Win2008
185
ZwOpenEventPair
7000
Windows 7
177
ZwOpenFile
2195
Win2000 SP0-SP4
100
ZwOpenFile
2600
WinXP SP0-SP3
116
ZwOpenFile
3790
Win2003 SP0-SP2
122
ZwOpenFile
6000
Vista SP0
186
ZwOpenFile
6001
Vista SP1, Win2008
186
ZwOpenFile
7000
Windows 7
178
ZwOpenIoCompletion
2195
Win2000 SP0-SP4
101
ZwOpenIoCompletion
2600
WinXP SP0-SP3
117
ZwOpenIoCompletion
3790
Win2003 SP0-SP2
123
ZwOpenIoCompletion
6000
Vista SP0
187
ZwOpenIoCompletion
6001
Vista SP1, Win2008
187
ZwOpenIoCompletion
7000
Windows 7
179
ZwOpenJobObject
2195
Win2000 SP0-SP4
102
ZwOpenJobObject
2600
WinXP SP0-SP3
118
ZwOpenJobObject
3790
Win2003 SP0-SP2
124
ZwOpenJobObject
6000
Vista SP0
188
ZwOpenJobObject
6001
Vista SP1, Win2008
188
ZwOpenJobObject
7000
Windows 7
180
ZwOpenKey
2195
Win2000 SP0-SP4
103
ZwOpenKey
2600
WinXP SP0-SP3
119
ZwOpenKey
3790
Win2003 SP0-SP2
125
ZwOpenKey
6000
Vista SP0
189
ZwOpenKey
6001
Vista SP1, Win2008
189
ZwOpenKey
7000
Windows 7
181
ZwOpenKeyedEvent
2600
WinXP SP0-SP3
280
ZwOpenKeyedEvent
3790
Win2003 SP0-SP2
290
ZwOpenKeyedEvent
6000
Vista SP0
365
ZwOpenKeyedEvent
6001
Vista SP1, Win2008
361
ZwOpenKeyedEvent
7000
Windows 7
183
ZwOpenKeyEx
7000
Windows 7
182
ZwOpenKeyTransacted
6000
Vista SP0
190
ZwOpenKeyTransacted
6001
Vista SP1, Win2008
190
ZwOpenKeyTransacted
7000
Windows 7
184
ZwOpenKeyTransactedEx
7000
Windows 7
185
ZwOpenMutant
2195
Win2000 SP0-SP4
104
ZwOpenMutant
2600
WinXP SP0-SP3
120
ZwOpenMutant
3790
Win2003 SP0-SP2
126
ZwOpenMutant
6000
Vista SP0
191
ZwOpenMutant
6001
Vista SP1, Win2008
191
ZwOpenMutant
7000
Windows 7
186
ZwOpenObjectAuditAlarm
2195
Win2000 SP0-SP4
105
ZwOpenObjectAuditAlarm
2600
WinXP SP0-SP3
121
ZwOpenObjectAuditAlarm
3790
Win2003 SP0-SP2
127
ZwOpenObjectAuditAlarm
6000
Vista SP0
193
ZwOpenObjectAuditAlarm
6001
Vista SP1, Win2008
193
ZwOpenObjectAuditAlarm
7000
Windows 7
187
ZwOpenPrivateNamespace
6000
Vista SP0
192
ZwOpenPrivateNamespace
6001
Vista SP1, Win2008
192
ZwOpenPrivateNamespace
7000
Windows 7
188
ZwOpenProcess
2195
Win2000 SP0-SP4
106
ZwOpenProcess
2600
WinXP SP0-SP3
122
ZwOpenProcess
3790
Win2003 SP0-SP2
128
ZwOpenProcess
6000
Vista SP0
194
ZwOpenProcess
6001
Vista SP1, Win2008
194
ZwOpenProcess
7000
Windows 7
189
ZwOpenProcessToken
2195
Win2000 SP0-SP4
107
ZwOpenProcessToken
2600
WinXP SP0-SP3
123
ZwOpenProcessToken
3790
Win2003 SP0-SP2
129
ZwOpenProcessToken
6000
Vista SP0
195
ZwOpenProcessToken
6001
Vista SP1, Win2008
195
ZwOpenProcessToken
7000
Windows 7
190
ZwOpenProcessTokenEx
2600
WinXP SP0-SP3
124
ZwOpenProcessTokenEx
3790
Win2003 SP0-SP2
130
ZwOpenProcessTokenEx
6000
Vista SP0
196
ZwOpenProcessTokenEx
6001
Vista SP1, Win2008
196
ZwOpenProcessTokenEx
7000
Windows 7
191
ZwOpenResourceManager
6000
Vista SP0
107
ZwOpenResourceManager
6001
Vista SP1, Win2008
108
ZwOpenResourceManager
7000
Windows 7
192
ZwOpenSection
2195
Win2000 SP0-SP4
108
ZwOpenSection
2600
WinXP SP0-SP3
125
ZwOpenSection
3790
Win2003 SP0-SP2
131
ZwOpenSection
6000
Vista SP0
197
ZwOpenSection
6001
Vista SP1, Win2008
197
ZwOpenSection
7000
Windows 7
193
ZwOpenSemaphore
2195
Win2000 SP0-SP4
109
ZwOpenSemaphore
2600
WinXP SP0-SP3
126
ZwOpenSemaphore
3790
Win2003 SP0-SP2
132
ZwOpenSemaphore
6000
Vista SP0
198
ZwOpenSemaphore
6001
Vista SP1, Win2008
198
ZwOpenSemaphore
7000
Windows 7
194
ZwOpenSession
6000
Vista SP0
199
ZwOpenSession
6001
Vista SP1, Win2008
199
ZwOpenSession
7000
Windows 7
195
ZwOpenSymbolicLinkObject
2195
Win2000 SP0-SP4
110
ZwOpenSymbolicLinkObject
2600
WinXP SP0-SP3
127
ZwOpenSymbolicLinkObject
3790
Win2003 SP0-SP2
133
ZwOpenSymbolicLinkObject
6000
Vista SP0
200
ZwOpenSymbolicLinkObject
6001
Vista SP1, Win2008
200
ZwOpenSymbolicLinkObject
7000
Windows 7
196
ZwOpenThread
2195
Win2000 SP0-SP4
111
ZwOpenThread
2600
WinXP SP0-SP3
128
ZwOpenThread
3790
Win2003 SP0-SP2
134
ZwOpenThread
6000
Vista SP0
201
ZwOpenThread
6001
Vista SP1, Win2008
201
ZwOpenThread
7000
Windows 7
197
ZwOpenThreadToken
2195
Win2000 SP0-SP4
112
ZwOpenThreadToken
2600
WinXP SP0-SP3
129
ZwOpenThreadToken
3790
Win2003 SP0-SP2
135
ZwOpenThreadToken
6000
Vista SP0
202
ZwOpenThreadToken
6001
Vista SP1, Win2008
202
ZwOpenThreadToken
7000
Windows 7
198
ZwOpenThreadTokenEx
2600
WinXP SP0-SP3
130
ZwOpenThreadTokenEx
3790
Win2003 SP0-SP2
136
ZwOpenThreadTokenEx
6000
Vista SP0
203
ZwOpenThreadTokenEx
6001
Vista SP1, Win2008
203
ZwOpenThreadTokenEx
7000
Windows 7
199
ZwOpenTimer
2195
Win2000 SP0-SP4
113
ZwOpenTimer
2600
WinXP SP0-SP3
131
ZwOpenTimer
3790
Win2003 SP0-SP2
137
ZwOpenTimer
6000
Vista SP0
204
ZwOpenTimer
6001
Vista SP1, Win2008
204
ZwOpenTimer
7000
Windows 7
200
ZwOpenTransaction
6000
Vista SP0
82
ZwOpenTransaction
6001
Vista SP1, Win2008
82
ZwOpenTransaction
7000
Windows 7
201
ZwOpenTransactionManager
6000
Vista SP0
101
ZwOpenTransactionManager
6001
Vista SP1, Win2008
101
ZwOpenTransactionManager
7000
Windows 7
202
ZwPlugPlayControl
2195
Win2000 SP0-SP4
114
ZwPlugPlayControl
2600
WinXP SP0-SP3
132
ZwPlugPlayControl
3790
Win2003 SP0-SP2
138
ZwPlugPlayControl
6000
Vista SP0
205
ZwPlugPlayControl
6001
Vista SP1, Win2008
205
ZwPlugPlayControl
7000
Windows 7
203
ZwPowerInformation
2195
Win2000 SP0-SP4
115
ZwPowerInformation
2600
WinXP SP0-SP3
133
ZwPowerInformation
3790
Win2003 SP0-SP2
139
ZwPowerInformation
6000
Vista SP0
206
ZwPowerInformation
6001
Vista SP1, Win2008
206
ZwPowerInformation
7000
Windows 7
204
ZwPrepareComplete
6000
Vista SP0
94
ZwPrepareComplete
6001
Vista SP1, Win2008
94
ZwPrepareComplete
7000
Windows 7
205
ZwPrepareEnlistment
6000
Vista SP0
86
ZwPrepareEnlistment
6001
Vista SP1, Win2008
86
ZwPrepareEnlistment
7000
Windows 7
206
ZwPrePrepareComplete
6000
Vista SP0
93
ZwPrePrepareComplete
6001
Vista SP1, Win2008
93
ZwPrePrepareComplete
7000
Windows 7
207
ZwPrePrepareEnlistment
6000
Vista SP0
85
ZwPrePrepareEnlistment
6001
Vista SP1, Win2008
85
ZwPrePrepareEnlistment
7000
Windows 7
208
ZwPrivilegeCheck
2195
Win2000 SP0-SP4
116
ZwPrivilegeCheck
2600
WinXP SP0-SP3
134
ZwPrivilegeCheck
3790
Win2003 SP0-SP2
140
ZwPrivilegeCheck
6000
Vista SP0
207
ZwPrivilegeCheck
6001
Vista SP1, Win2008
207
ZwPrivilegeCheck
7000
Windows 7
209
ZwPrivilegedServiceAuditAlarm
2195
Win2000 SP0-SP4
117
ZwPrivilegedServiceAuditAlarm
2600
WinXP SP0-SP3
136
ZwPrivilegedServiceAuditAlarm
3790
Win2003 SP0-SP2
142
ZwPrivilegedServiceAuditAlarm
6000
Vista SP0
209
ZwPrivilegedServiceAuditAlarm
6001
Vista SP1, Win2008
209
ZwPrivilegedServiceAuditAlarm
7000
Windows 7
210
ZwPrivilegeObjectAuditAlarm
2195
Win2000 SP0-SP4
118
ZwPrivilegeObjectAuditAlarm
2600
WinXP SP0-SP3
135
ZwPrivilegeObjectAuditAlarm
3790
Win2003 SP0-SP2
141
ZwPrivilegeObjectAuditAlarm
6000
Vista SP0
208
ZwPrivilegeObjectAuditAlarm
6001
Vista SP1, Win2008
208
ZwPrivilegeObjectAuditAlarm
7000
Windows 7
211
ZwPropagationComplete
6000
Vista SP0
379
ZwPropagationComplete
6001
Vista SP1, Win2008
373
ZwPropagationComplete
7000
Windows 7
212
ZwPropagationFailed
6000
Vista SP0
380
ZwPropagationFailed
6001
Vista SP1, Win2008
374
ZwPropagationFailed
7000
Windows 7
213
ZwProtectVirtualMemory
2195
Win2000 SP0-SP4
119
ZwProtectVirtualMemory
2600
WinXP SP0-SP3
137
ZwProtectVirtualMemory
3790
Win2003 SP0-SP2
143
ZwProtectVirtualMemory
6000
Vista SP0
210
ZwProtectVirtualMemory
6001
Vista SP1, Win2008
210
ZwProtectVirtualMemory
7000
Windows 7
214
ZwPullTransaction
6000
Vista SP0
377
ZwPulseEvent
2195
Win2000 SP0-SP4
120
ZwPulseEvent
2600
WinXP SP0-SP3
138
ZwPulseEvent
3790
Win2003 SP0-SP2
144
ZwPulseEvent
6000
Vista SP0
211
ZwPulseEvent
6001
Vista SP1, Win2008
211
ZwPulseEvent
7000
Windows 7
215
ZwQueryAttributesFile
2195
Win2000 SP0-SP4
122
ZwQueryAttributesFile
2600
WinXP SP0-SP3
139
ZwQueryAttributesFile
3790
Win2003 SP0-SP2
145
ZwQueryAttributesFile
6000
Vista SP0
212
ZwQueryAttributesFile
6001
Vista SP1, Win2008
212
ZwQueryAttributesFile
7000
Windows 7
216
ZwQueryBootEntryOrder
2600
WinXP SP0-SP3
140
ZwQueryBootEntryOrder
3790
Win2003 SP0-SP2
146
ZwQueryBootEntryOrder
6000
Vista SP0
213
ZwQueryBootEntryOrder
6001
Vista SP1, Win2008
213
ZwQueryBootEntryOrder
7000
Windows 7
217
ZwQueryBootOptions
2600
WinXP SP0-SP3
141
ZwQueryBootOptions
3790
Win2003 SP0-SP2
147
ZwQueryBootOptions
6000
Vista SP0
214
ZwQueryBootOptions
6001
Vista SP1, Win2008
214
ZwQueryBootOptions
7000
Windows 7
218
ZwQueryDebugFilterState
2600
WinXP SP0-SP3
142
ZwQueryDebugFilterState
3790
Win2003 SP0-SP2
148
ZwQueryDebugFilterState
6000
Vista SP0
215
ZwQueryDebugFilterState
6001
Vista SP1, Win2008
215
ZwQueryDebugFilterState
7000
Windows 7
219
ZwQueryDefaultLocale
2195
Win2000 SP0-SP4
123
ZwQueryDefaultLocale
2600
WinXP SP0-SP3
143
ZwQueryDefaultLocale
3790
Win2003 SP0-SP2
149
ZwQueryDefaultLocale
6000
Vista SP0
216
ZwQueryDefaultLocale
6001
Vista SP1, Win2008
216
ZwQueryDefaultLocale
7000
Windows 7
220
ZwQueryDefaultUILanguage
2195
Win2000 SP0-SP4
124
ZwQueryDefaultUILanguage
2600
WinXP SP0-SP3
144
ZwQueryDefaultUILanguage
3790
Win2003 SP0-SP2
150
ZwQueryDefaultUILanguage
6000
Vista SP0
217
ZwQueryDefaultUILanguage
6001
Vista SP1, Win2008
217
ZwQueryDefaultUILanguage
7000
Windows 7
221
ZwQueryDirectoryFile
2195
Win2000 SP0-SP4
125
ZwQueryDirectoryFile
2600
WinXP SP0-SP3
145
ZwQueryDirectoryFile
3790
Win2003 SP0-SP2
151
ZwQueryDirectoryFile
6000
Vista SP0
218
ZwQueryDirectoryFile
6001
Vista SP1, Win2008
218
ZwQueryDirectoryFile
7000
Windows 7
222
ZwQueryDirectoryObject
2195
Win2000 SP0-SP4
126
ZwQueryDirectoryObject
2600
WinXP SP0-SP3
146
ZwQueryDirectoryObject
3790
Win2003 SP0-SP2
152
ZwQueryDirectoryObject
6000
Vista SP0
219
ZwQueryDirectoryObject
6001
Vista SP1, Win2008
219
ZwQueryDirectoryObject
7000
Windows 7
223
ZwQueryDriverEntryOrder
3790
Win2003 SP0-SP2
153
ZwQueryDriverEntryOrder
6000
Vista SP0
220
ZwQueryDriverEntryOrder
6001
Vista SP1, Win2008
220
ZwQueryDriverEntryOrder
7000
Windows 7
224
ZwQueryEaFile
2195
Win2000 SP0-SP4
127
ZwQueryEaFile
2600
WinXP SP0-SP3
147
ZwQueryEaFile
3790
Win2003 SP0-SP2
154
ZwQueryEaFile
6000
Vista SP0
221
ZwQueryEaFile
6001
Vista SP1, Win2008
221
ZwQueryEaFile
7000
Windows 7
225
ZwQueryEvent
2195
Win2000 SP0-SP4
128
ZwQueryEvent
2600
WinXP SP0-SP3
148
ZwQueryEvent
3790
Win2003 SP0-SP2
155
ZwQueryEvent
6000
Vista SP0
222
ZwQueryEvent
6001
Vista SP1, Win2008
222
ZwQueryEvent
7000
Windows 7
226
ZwQueryFullAttributesFile
2195
Win2000 SP0-SP4
129
ZwQueryFullAttributesFile
2600
WinXP SP0-SP3
149
ZwQueryFullAttributesFile
3790
Win2003 SP0-SP2
156
ZwQueryFullAttributesFile
6000
Vista SP0
223
ZwQueryFullAttributesFile
6001
Vista SP1, Win2008
223
ZwQueryFullAttributesFile
7000
Windows 7
227
ZwQueryInformationAtom
2195
Win2000 SP0-SP4
121
ZwQueryInformationAtom
2600
WinXP SP0-SP3
150
ZwQueryInformationAtom
3790
Win2003 SP0-SP2
157
ZwQueryInformationAtom
6000
Vista SP0
224
ZwQueryInformationAtom
6001
Vista SP1, Win2008
224
ZwQueryInformationAtom
7000
Windows 7
228
ZwQueryInformationEnlistment
6000
Vista SP0
113
ZwQueryInformationEnlistment
6001
Vista SP1, Win2008
114
ZwQueryInformationEnlistment
7000
Windows 7
229
ZwQueryInformationFile
2195
Win2000 SP0-SP4
130
ZwQueryInformationFile
2600
WinXP SP0-SP3
151
ZwQueryInformationFile
3790
Win2003 SP0-SP2
158
ZwQueryInformationFile
6000
Vista SP0
225
ZwQueryInformationFile
6001
Vista SP1, Win2008
225
ZwQueryInformationFile
7000
Windows 7
230
ZwQueryInformationJobObject
2195
Win2000 SP0-SP4
131
ZwQueryInformationJobObject
2600
WinXP SP0-SP3
152
ZwQueryInformationJobObject
3790
Win2003 SP0-SP2
159
ZwQueryInformationJobObject
6000
Vista SP0
226
ZwQueryInformationJobObject
6001
Vista SP1, Win2008
226
ZwQueryInformationJobObject
7000
Windows 7
231
ZwQueryInformationPort
2195
Win2000 SP0-SP4
133
ZwQueryInformationPort
2600
WinXP SP0-SP3
153
ZwQueryInformationPort
3790
Win2003 SP0-SP2
160
ZwQueryInformationPort
6000
Vista SP0
227
ZwQueryInformationPort
6001
Vista SP1, Win2008
227
ZwQueryInformationPort
7000
Windows 7
232
ZwQueryInformationProcess
2195
Win2000 SP0-SP4
134
ZwQueryInformationProcess
2600
WinXP SP0-SP3
154
ZwQueryInformationProcess
3790
Win2003 SP0-SP2
161
ZwQueryInformationProcess
6000
Vista SP0
228
ZwQueryInformationProcess
6001
Vista SP1, Win2008
228
ZwQueryInformationProcess
7000
Windows 7
233
ZwQueryInformationResourceManager
6000
Vista SP0
109
ZwQueryInformationResourceManager
6001
Vista SP1, Win2008
110
ZwQueryInformationResourceManager
7000
Windows 7
234
ZwQueryInformationThread
2195
Win2000 SP0-SP4
135
ZwQueryInformationThread
2600
WinXP SP0-SP3
155
ZwQueryInformationThread
3790
Win2003 SP0-SP2
162
ZwQueryInformationThread
6000
Vista SP0
229
ZwQueryInformationThread
6001
Vista SP1, Win2008
229
ZwQueryInformationThread
7000
Windows 7
235
ZwQueryInformationToken
2195
Win2000 SP0-SP4
136
ZwQueryInformationToken
2600
WinXP SP0-SP3
156
ZwQueryInformationToken
3790
Win2003 SP0-SP2
163
ZwQueryInformationToken
6000
Vista SP0
230
ZwQueryInformationToken
6001
Vista SP1, Win2008
230
ZwQueryInformationToken
7000
Windows 7
236
ZwQueryInformationTransaction
6000
Vista SP0
83
ZwQueryInformationTransaction
6001
Vista SP1, Win2008
83
ZwQueryInformationTransaction
7000
Windows 7
237
ZwQueryInformationTransactionManager
6000
Vista SP0
84
ZwQueryInformationTransactionManager
6001
Vista SP1, Win2008
84
ZwQueryInformationTransactionManager
7000
Windows 7
238
ZwQueryInformationWorkerFactory
6000
Vista SP0
385
ZwQueryInformationWorkerFactory
6001
Vista SP1, Win2008
379
ZwQueryInformationWorkerFactory
7000
Windows 7
239
ZwQueryInstallUILanguage
2195
Win2000 SP0-SP4
137
ZwQueryInstallUILanguage
2600
WinXP SP0-SP3
157
ZwQueryInstallUILanguage
3790
Win2003 SP0-SP2
164
ZwQueryInstallUILanguage
6000
Vista SP0
231
ZwQueryInstallUILanguage
6001
Vista SP1, Win2008
231
ZwQueryInstallUILanguage
7000
Windows 7
240
ZwQueryIntervalProfile
2195
Win2000 SP0-SP4
138
ZwQueryIntervalProfile
2600
WinXP SP0-SP3
158
ZwQueryIntervalProfile
3790
Win2003 SP0-SP2
165
ZwQueryIntervalProfile
6000
Vista SP0
232
ZwQueryIntervalProfile
6001
Vista SP1, Win2008
232
ZwQueryIntervalProfile
7000
Windows 7
241
ZwQueryIoCompletion
2195
Win2000 SP0-SP4
132
ZwQueryIoCompletion
2600
WinXP SP0-SP3
159
ZwQueryIoCompletion
3790
Win2003 SP0-SP2
166
ZwQueryIoCompletion
6000
Vista SP0
233
ZwQueryIoCompletion
6001
Vista SP1, Win2008
233
ZwQueryIoCompletion
7000
Windows 7
242
ZwQueryKey
2195
Win2000 SP0-SP4
139
ZwQueryKey
2600
WinXP SP0-SP3
160
ZwQueryKey
3790
Win2003 SP0-SP2
167
ZwQueryKey
6000
Vista SP0
234
ZwQueryKey
6001
Vista SP1, Win2008
234
ZwQueryKey
7000
Windows 7
243
ZwQueryLicenseValue
6000
Vista SP0
390
ZwQueryLicenseValue
6001
Vista SP1, Win2008
384
ZwQueryLicenseValue
7000
Windows 7
244
ZwQueryMultipleValueKey
2195
Win2000 SP0-SP4
140
ZwQueryMultipleValueKey
2600
WinXP SP0-SP3
161
ZwQueryMultipleValueKey
3790
Win2003 SP0-SP2
168
ZwQueryMultipleValueKey
6000
Vista SP0
235
ZwQueryMultipleValueKey
6001
Vista SP1, Win2008
235
ZwQueryMultipleValueKey
7000
Windows 7
245
ZwQueryMutant
2195
Win2000 SP0-SP4
141
ZwQueryMutant
2600
WinXP SP0-SP3
162
ZwQueryMutant
3790
Win2003 SP0-SP2
169
ZwQueryMutant
6000
Vista SP0
236
ZwQueryMutant
6001
Vista SP1, Win2008
236
ZwQueryMutant
7000
Windows 7
246
ZwQueryObject
2195
Win2000 SP0-SP4
142
ZwQueryObject
2600
WinXP SP0-SP3
163
ZwQueryObject
3790
Win2003 SP0-SP2
170
ZwQueryObject
6000
Vista SP0
237
ZwQueryObject
6001
Vista SP1, Win2008
237
ZwQueryObject
7000
Windows 7
247
ZwQueryOpenSubKeys
2195
Win2000 SP0-SP4
143
ZwQueryOpenSubKeys
2600
WinXP SP0-SP3
164
ZwQueryOpenSubKeys
3790
Win2003 SP0-SP2
171
ZwQueryOpenSubKeys
6000
Vista SP0
238
ZwQueryOpenSubKeys
6001
Vista SP1, Win2008
238
ZwQueryOpenSubKeys
7000
Windows 7
248
ZwQueryOpenSubKeysEx
3790
Win2003 SP0-SP2
172
ZwQueryOpenSubKeysEx
6000
Vista SP0
239
ZwQueryOpenSubKeysEx
6001
Vista SP1, Win2008
239
ZwQueryOpenSubKeysEx
7000
Windows 7
249
ZwQueryPerformanceCounter
2195
Win2000 SP0-SP4
144
ZwQueryPerformanceCounter
2600
WinXP SP0-SP3
165
ZwQueryPerformanceCounter
3790
Win2003 SP0-SP2
173
ZwQueryPerformanceCounter
6000
Vista SP0
240
ZwQueryPerformanceCounter
6001
Vista SP1, Win2008
240
ZwQueryPerformanceCounter
7000
Windows 7
250
ZwQueryPortInformationProcess
2600
WinXP SP0-SP3
283
ZwQueryPortInformationProcess
3790
Win2003 SP0-SP2
293
ZwQueryPortInformationProcess
6000
Vista SP0
368
ZwQueryPortInformationProcess
6001
Vista SP1, Win2008
364
ZwQueryPortInformationProcess
7000
Windows 7
251
ZwQueryQuotaInformationFile
2195
Win2000 SP0-SP4
145
ZwQueryQuotaInformationFile
2600
WinXP SP0-SP3
166
ZwQueryQuotaInformationFile
3790
Win2003 SP0-SP2
174
ZwQueryQuotaInformationFile
6000
Vista SP0
241
ZwQueryQuotaInformationFile
6001
Vista SP1, Win2008
241
ZwQueryQuotaInformationFile
7000
Windows 7
252
ZwQuerySection
2195
Win2000 SP0-SP4
146
ZwQuerySection
2600
WinXP SP0-SP3
167
ZwQuerySection
3790
Win2003 SP0-SP2
175
ZwQuerySection
6000
Vista SP0
242
ZwQuerySection
6001
Vista SP1, Win2008
242
ZwQuerySection
7000
Windows 7
253
ZwQuerySecurityAttributesToken
7000
Windows 7
254
ZwQuerySecurityObject
2195
Win2000 SP0-SP4
147
ZwQuerySecurityObject
2600
WinXP SP0-SP3
168
ZwQuerySecurityObject
3790
Win2003 SP0-SP2
176
ZwQuerySecurityObject
6000
Vista SP0
243
ZwQuerySecurityObject
6001
Vista SP1, Win2008
243
ZwQuerySecurityObject
7000
Windows 7
255
ZwQuerySemaphore
2195
Win2000 SP0-SP4
148
ZwQuerySemaphore
2600
WinXP SP0-SP3
169
ZwQuerySemaphore
3790
Win2003 SP0-SP2
177
ZwQuerySemaphore
6000
Vista SP0
244
ZwQuerySemaphore
6001
Vista SP1, Win2008
244
ZwQuerySemaphore
7000
Windows 7
256
ZwQuerySymbolicLinkObject
2195
Win2000 SP0-SP4
149
ZwQuerySymbolicLinkObject
2600
WinXP SP0-SP3
170
ZwQuerySymbolicLinkObject
3790
Win2003 SP0-SP2
178
ZwQuerySymbolicLinkObject
6000
Vista SP0
245
ZwQuerySymbolicLinkObject
6001
Vista SP1, Win2008
245
ZwQuerySymbolicLinkObject
7000
Windows 7
257
ZwQuerySystemEnvironmentValue
2195
Win2000 SP0-SP4
150
ZwQuerySystemEnvironmentValue
2600
WinXP SP0-SP3
171
ZwQuerySystemEnvironmentValue
3790
Win2003 SP0-SP2
179
ZwQuerySystemEnvironmentValue
6000
Vista SP0
246
ZwQuerySystemEnvironmentValue
6001
Vista SP1, Win2008
246
ZwQuerySystemEnvironmentValue
7000
Windows 7
258
ZwQuerySystemEnvironmentValueEx
2600
WinXP SP0-SP3
172
ZwQuerySystemEnvironmentValueEx
3790
Win2003 SP0-SP2
180
ZwQuerySystemEnvironmentValueEx
6000
Vista SP0
247
ZwQuerySystemEnvironmentValueEx
6001
Vista SP1, Win2008
247
ZwQuerySystemEnvironmentValueEx
7000
Windows 7
259
ZwQuerySystemInformation
2195
Win2000 SP0-SP4
151
ZwQuerySystemInformation
2600
WinXP SP0-SP3
173
ZwQuerySystemInformation
3790
Win2003 SP0-SP2
181
ZwQuerySystemInformation
6000
Vista SP0
248
ZwQuerySystemInformation
6001
Vista SP1, Win2008
248
ZwQuerySystemInformation
7000
Windows 7
260
ZwQuerySystemInformationEx
7000
Windows 7
261
ZwQuerySystemTime
2195
Win2000 SP0-SP4
152
ZwQuerySystemTime
2600
WinXP SP0-SP3
174
ZwQuerySystemTime
3790
Win2003 SP0-SP2
182
ZwQuerySystemTime
6000
Vista SP0
249
ZwQuerySystemTime
6001
Vista SP1, Win2008
249
ZwQuerySystemTime
7000
Windows 7
262
ZwQueryTimer
2195
Win2000 SP0-SP4
153
ZwQueryTimer
2600
WinXP SP0-SP3
175
ZwQueryTimer
3790
Win2003 SP0-SP2
183
ZwQueryTimer
6000
Vista SP0
250
ZwQueryTimer
6001
Vista SP1, Win2008
250
ZwQueryTimer
7000
Windows 7
263
ZwQueryTimerResolution
2195
Win2000 SP0-SP4
154
ZwQueryTimerResolution
2600
WinXP SP0-SP3
176
ZwQueryTimerResolution
3790
Win2003 SP0-SP2
184
ZwQueryTimerResolution
6000
Vista SP0
251
ZwQueryTimerResolution
6001
Vista SP1, Win2008
251
ZwQueryTimerResolution
7000
Windows 7
264
ZwQueryValueKey
2195
Win2000 SP0-SP4
155
ZwQueryValueKey
2600
WinXP SP0-SP3
177
ZwQueryValueKey
3790
Win2003 SP0-SP2
185
ZwQueryValueKey
6000
Vista SP0
252
ZwQueryValueKey
6001
Vista SP1, Win2008
252
ZwQueryValueKey
7000
Windows 7
265
ZwQueryVirtualMemory
2195
Win2000 SP0-SP4
156
ZwQueryVirtualMemory
2600
WinXP SP0-SP3
178
ZwQueryVirtualMemory
3790
Win2003 SP0-SP2
186
ZwQueryVirtualMemory
6000
Vista SP0
253
ZwQueryVirtualMemory
6001
Vista SP1, Win2008
253
ZwQueryVirtualMemory
7000
Windows 7
266
ZwQueryVolumeInformationFile
2195
Win2000 SP0-SP4
157
ZwQueryVolumeInformationFile
2600
WinXP SP0-SP3
179
ZwQueryVolumeInformationFile
3790
Win2003 SP0-SP2
187
ZwQueryVolumeInformationFile
6000
Vista SP0
254
ZwQueryVolumeInformationFile
6001
Vista SP1, Win2008
254
ZwQueryVolumeInformationFile
7000
Windows 7
267
ZwQueueApcThread
2195
Win2000 SP0-SP4
158
ZwQueueApcThread
2600
WinXP SP0-SP3
180
ZwQueueApcThread
3790
Win2003 SP0-SP2
188
ZwQueueApcThread
6000
Vista SP0
255
ZwQueueApcThread
6001
Vista SP1, Win2008
255
ZwQueueApcThread
7000
Windows 7
268
ZwQueueApcThreadEx
7000
Windows 7
269
ZwRaiseException
2195
Win2000 SP0-SP4
159
ZwRaiseException
2600
WinXP SP0-SP3
181
ZwRaiseException
3790
Win2003 SP0-SP2
189
ZwRaiseException
6000
Vista SP0
256
ZwRaiseException
6001
Vista SP1, Win2008
256
ZwRaiseException
7000
Windows 7
270
ZwRaiseHardError
2195
Win2000 SP0-SP4
160
ZwRaiseHardError
2600
WinXP SP0-SP3
182
ZwRaiseHardError
3790
Win2003 SP0-SP2
190
ZwRaiseHardError
6000
Vista SP0
257
ZwRaiseHardError
6001
Vista SP1, Win2008
257
ZwRaiseHardError
7000
Windows 7
271
ZwReadFile
2195
Win2000 SP0-SP4
161
ZwReadFile
2600
WinXP SP0-SP3
183
ZwReadFile
3790
Win2003 SP0-SP2
191
ZwReadFile
6000
Vista SP0
258
ZwReadFile
6001
Vista SP1, Win2008
258
ZwReadFile
7000
Windows 7
272
ZwReadFileScatter
2195
Win2000 SP0-SP4
162
ZwReadFileScatter
2600
WinXP SP0-SP3
184
ZwReadFileScatter
3790
Win2003 SP0-SP2
192
ZwReadFileScatter
6000
Vista SP0
259
ZwReadFileScatter
6001
Vista SP1, Win2008
259
ZwReadFileScatter
7000
Windows 7
273
ZwReadOnlyEnlistment
6000
Vista SP0
88
ZwReadOnlyEnlistment
6001
Vista SP1, Win2008
88
ZwReadOnlyEnlistment
7000
Windows 7
274
ZwReadRequestData
2195
Win2000 SP0-SP4
163
ZwReadRequestData
2600
WinXP SP0-SP3
185
ZwReadRequestData
3790
Win2003 SP0-SP2
193
ZwReadRequestData
6000
Vista SP0
260
ZwReadRequestData
6001
Vista SP1, Win2008
260
ZwReadRequestData
7000
Windows 7
275
ZwReadVirtualMemory
2195
Win2000 SP0-SP4
164
ZwReadVirtualMemory
2600
WinXP SP0-SP3
186
ZwReadVirtualMemory
3790
Win2003 SP0-SP2
194
ZwReadVirtualMemory
6000
Vista SP0
261
ZwReadVirtualMemory
6001
Vista SP1, Win2008
261
ZwReadVirtualMemory
7000
Windows 7
276
ZwRecoverEnlistment
6000
Vista SP0
103
ZwRecoverEnlistment
6001
Vista SP1, Win2008
104
ZwRecoverEnlistment
7000
Windows 7
277
ZwRecoverResourceManager
6000
Vista SP0
104
ZwRecoverResourceManager
6001
Vista SP1, Win2008
105
ZwRecoverResourceManager
7000
Windows 7
278
ZwRecoverTransactionManager
6000
Vista SP0
105
ZwRecoverTransactionManager
6001
Vista SP1, Win2008
106
ZwRecoverTransactionManager
7000
Windows 7
279
ZwRegisterProtocolAddressInformation
6000
Vista SP0
376
ZwRegisterProtocolAddressInformation
6001
Vista SP1, Win2008
372
ZwRegisterProtocolAddressInformation
7000
Windows 7
280
ZwRegisterThreadTerminatePort
2195
Win2000 SP0-SP4
165
ZwRegisterThreadTerminatePort
2600
WinXP SP0-SP3
187
ZwRegisterThreadTerminatePort
3790
Win2003 SP0-SP2
195
ZwRegisterThreadTerminatePort
6000
Vista SP0
262
ZwRegisterThreadTerminatePort
6001
Vista SP1, Win2008
262
ZwRegisterThreadTerminatePort
7000
Windows 7
281
ZwReleaseCMFViewOwnership
6000
Vista SP0
397
ZwReleaseCMFViewOwnership
6001
Vista SP1, Win2008
390
ZwReleaseCMFViewOwnership
7000
Windows 7
282
ZwReleaseKeyedEvent
2600
WinXP SP0-SP3
281
ZwReleaseKeyedEvent
3790
Win2003 SP0-SP2
291
ZwReleaseKeyedEvent
6000
Vista SP0
366
ZwReleaseKeyedEvent
6001
Vista SP1, Win2008
362
ZwReleaseKeyedEvent
7000
Windows 7
283
ZwReleaseMutant
2195
Win2000 SP0-SP4
166
ZwReleaseMutant
2600
WinXP SP0-SP3
188
ZwReleaseMutant
3790
Win2003 SP0-SP2
196
ZwReleaseMutant
6000
Vista SP0
263
ZwReleaseMutant
6001
Vista SP1, Win2008
263
ZwReleaseMutant
7000
Windows 7
284
ZwReleaseSemaphore
2195
Win2000 SP0-SP4
167
ZwReleaseSemaphore
2600
WinXP SP0-SP3
189
ZwReleaseSemaphore
3790
Win2003 SP0-SP2
197
ZwReleaseSemaphore
6000
Vista SP0
264
ZwReleaseSemaphore
6001
Vista SP1, Win2008
264
ZwReleaseSemaphore
7000
Windows 7
285
ZwReleaseWorkerFactoryWorker
6000
Vista SP0
382
ZwReleaseWorkerFactoryWorker
6001
Vista SP1, Win2008
376
ZwReleaseWorkerFactoryWorker
7000
Windows 7
286
ZwRemoveIoCompletion
2195
Win2000 SP0-SP4
168
ZwRemoveIoCompletion
2600
WinXP SP0-SP3
190
ZwRemoveIoCompletion
3790
Win2003 SP0-SP2
198
ZwRemoveIoCompletion
6000
Vista SP0
265
ZwRemoveIoCompletion
6001
Vista SP1, Win2008
265
ZwRemoveIoCompletion
7000
Windows 7
287
ZwRemoveIoCompletionEx
6000
Vista SP0
375
ZwRemoveIoCompletionEx
6001
Vista SP1, Win2008
371
ZwRemoveIoCompletionEx
7000
Windows 7
288
ZwRemoveProcessDebug
2600
WinXP SP0-SP3
191
ZwRemoveProcessDebug
3790
Win2003 SP0-SP2
199
ZwRemoveProcessDebug
6000
Vista SP0
266
ZwRemoveProcessDebug
6001
Vista SP1, Win2008
266
ZwRemoveProcessDebug
7000
Windows 7
289
ZwRenameKey
2600
WinXP SP0-SP3
192
ZwRenameKey
3790
Win2003 SP0-SP2
200
ZwRenameKey
6000
Vista SP0
267
ZwRenameKey
6001
Vista SP1, Win2008
267
ZwRenameKey
7000
Windows 7
290
ZwRenameTransactionManager
6001
Vista SP1, Win2008
102
ZwRenameTransactionManager
7000
Windows 7
291
ZwReplaceKey
2195
Win2000 SP0-SP4
169
ZwReplaceKey
2600
WinXP SP0-SP3
193
ZwReplaceKey
3790
Win2003 SP0-SP2
201
ZwReplaceKey
6000
Vista SP0
268
ZwReplaceKey
6001
Vista SP1, Win2008
268
ZwReplaceKey
7000
Windows 7
292
ZwReplacePartitionUnit
6001
Vista SP1, Win2008
269
ZwReplacePartitionUnit
7000
Windows 7
293
ZwReplyPort
2195
Win2000 SP0-SP4
170
ZwReplyPort
2600
WinXP SP0-SP3
194
ZwReplyPort
3790
Win2003 SP0-SP2
202
ZwReplyPort
6000
Vista SP0
269
ZwReplyPort
6001
Vista SP1, Win2008
270
ZwReplyPort
7000
Windows 7
294
ZwReplyWaitReceivePort
2195
Win2000 SP0-SP4
171
ZwReplyWaitReceivePort
2600
WinXP SP0-SP3
195
ZwReplyWaitReceivePort
3790
Win2003 SP0-SP2
203
ZwReplyWaitReceivePort
6000
Vista SP0
270
ZwReplyWaitReceivePort
6001
Vista SP1, Win2008
271
ZwReplyWaitReceivePort
7000
Windows 7
295
ZwReplyWaitReceivePortEx
2195
Win2000 SP0-SP4
172
ZwReplyWaitReceivePortEx
2600
WinXP SP0-SP3
196
ZwReplyWaitReceivePortEx
3790
Win2003 SP0-SP2
204
ZwReplyWaitReceivePortEx
6000
Vista SP0
271
ZwReplyWaitReceivePortEx
6001
Vista SP1, Win2008
272
ZwReplyWaitReceivePortEx
7000
Windows 7
296
ZwReplyWaitReplyPort
2195
Win2000 SP0-SP4
173
ZwReplyWaitReplyPort
2600
WinXP SP0-SP3
197
ZwReplyWaitReplyPort
3790
Win2003 SP0-SP2
205
ZwReplyWaitReplyPort
6000
Vista SP0
272
ZwReplyWaitReplyPort
6001
Vista SP1, Win2008
273
ZwReplyWaitReplyPort
7000
Windows 7
297
ZwReplyWaitSendChannel
2195
Win2000 SP0-SP4
244
ZwRequestDeviceWakeup
2195
Win2000 SP0-SP4
174
ZwRequestDeviceWakeup
2600
WinXP SP0-SP3
198
ZwRequestDeviceWakeup
3790
Win2003 SP0-SP2
206
ZwRequestDeviceWakeup
6000
Vista SP0
273
ZwRequestDeviceWakeup
6001
Vista SP1, Win2008
274
ZwRequestPort
2195
Win2000 SP0-SP4
175
ZwRequestPort
2600
WinXP SP0-SP3
199
ZwRequestPort
3790
Win2003 SP0-SP2
207
ZwRequestPort
6000
Vista SP0
274
ZwRequestPort
6001
Vista SP1, Win2008
275
ZwRequestPort
7000
Windows 7
298
ZwRequestWaitReplyPort
2195
Win2000 SP0-SP4
176
ZwRequestWaitReplyPort
2600
WinXP SP0-SP3
200
ZwRequestWaitReplyPort
3790
Win2003 SP0-SP2
208
ZwRequestWaitReplyPort
6000
Vista SP0
275
ZwRequestWaitReplyPort
6001
Vista SP1, Win2008
276
ZwRequestWaitReplyPort
7000
Windows 7
299
ZwRequestWakeupLatency
2195
Win2000 SP0-SP4
177
ZwRequestWakeupLatency
2600
WinXP SP0-SP3
201
ZwRequestWakeupLatency
3790
Win2003 SP0-SP2
209
ZwRequestWakeupLatency
6000
Vista SP0
276
ZwRequestWakeupLatency
6001
Vista SP1, Win2008
277
ZwResetEvent
2195
Win2000 SP0-SP4
178
ZwResetEvent
2600
WinXP SP0-SP3
202
ZwResetEvent
3790
Win2003 SP0-SP2
210
ZwResetEvent
6000
Vista SP0
277
ZwResetEvent
6001
Vista SP1, Win2008
278
ZwResetEvent
7000
Windows 7
300
ZwResetWriteWatch
2195
Win2000 SP0-SP4
179
ZwResetWriteWatch
2600
WinXP SP0-SP3
203
ZwResetWriteWatch
3790
Win2003 SP0-SP2
211
ZwResetWriteWatch
6000
Vista SP0
278
ZwResetWriteWatch
6001
Vista SP1, Win2008
279
ZwResetWriteWatch
7000
Windows 7
301
ZwRestoreKey
2195
Win2000 SP0-SP4
180
ZwRestoreKey
2600
WinXP SP0-SP3
204
ZwRestoreKey
3790
Win2003 SP0-SP2
212
ZwRestoreKey
6000
Vista SP0
279
ZwRestoreKey
6001
Vista SP1, Win2008
280
ZwRestoreKey
7000
Windows 7
302
ZwResumeProcess
2600
WinXP SP0-SP3
205
ZwResumeProcess
3790
Win2003 SP0-SP2
213
ZwResumeProcess
6000
Vista SP0
280
ZwResumeProcess
6001
Vista SP1, Win2008
281
ZwResumeProcess
7000
Windows 7
303
ZwResumeThread
2195
Win2000 SP0-SP4
181
ZwResumeThread
2600
WinXP SP0-SP3
206
ZwResumeThread
3790
Win2003 SP0-SP2
214
ZwResumeThread
6000
Vista SP0
281
ZwResumeThread
6001
Vista SP1, Win2008
282
ZwResumeThread
7000
Windows 7
304
ZwRollbackComplete
6000
Vista SP0
89
ZwRollbackComplete
6001
Vista SP1, Win2008
89
ZwRollbackComplete
7000
Windows 7
305
ZwRollbackEnlistment
6000
Vista SP0
90
ZwRollbackEnlistment
6001
Vista SP1, Win2008
90
ZwRollbackEnlistment
7000
Windows 7
306
ZwRollbackSavepointTransaction
6000
Vista SP0
287
ZwRollbackTransaction
6000
Vista SP0
92
ZwRollbackTransaction
6001
Vista SP1, Win2008
92
ZwRollbackTransaction
7000
Windows 7
307
ZwRollforwardTransactionManager
6000
Vista SP0
102
ZwRollforwardTransactionManager
6001
Vista SP1, Win2008
103
ZwRollforwardTransactionManager
7000
Windows 7
308
ZwSaveKey
2195
Win2000 SP0-SP4
182
ZwSaveKey
2600
WinXP SP0-SP3
207
ZwSaveKey
3790
Win2003 SP0-SP2
215
ZwSaveKey
6000
Vista SP0
282
ZwSaveKey
6001
Vista SP1, Win2008
283
ZwSaveKey
7000
Windows 7
309
ZwSaveKeyEx
2600
WinXP SP0-SP3
208
ZwSaveKeyEx
3790
Win2003 SP0-SP2
216
ZwSaveKeyEx
6000
Vista SP0
283
ZwSaveKeyEx
6001
Vista SP1, Win2008
284
ZwSaveKeyEx
7000
Windows 7
310
ZwSaveMergedKeys
2195
Win2000 SP0-SP4
183
ZwSaveMergedKeys
2600
WinXP SP0-SP3
209
ZwSaveMergedKeys
3790
Win2003 SP0-SP2
217
ZwSaveMergedKeys
6000
Vista SP0
284
ZwSaveMergedKeys
6001
Vista SP1, Win2008
285
ZwSaveMergedKeys
7000
Windows 7
311
ZwSavepointComplete
6000
Vista SP0
289
ZwSavepointTransaction
6000
Vista SP0
288
ZwSecureConnectPort
2195
Win2000 SP0-SP4
184
ZwSecureConnectPort
2600
WinXP SP0-SP3
210
ZwSecureConnectPort
3790
Win2003 SP0-SP2
218
ZwSecureConnectPort
6000
Vista SP0
290
ZwSecureConnectPort
6001
Vista SP1, Win2008
286
ZwSecureConnectPort
7000
Windows 7
312
ZwSendWaitReplyChannel
2195
Win2000 SP0-SP4
245
ZwSerializeBoot
7000
Windows 7
313
ZwSetBootEntryOrder
2600
WinXP SP0-SP3
211
ZwSetBootEntryOrder
3790
Win2003 SP0-SP2
219
ZwSetBootEntryOrder
6000
Vista SP0
291
ZwSetBootEntryOrder
6001
Vista SP1, Win2008
287
ZwSetBootEntryOrder
7000
Windows 7
314
ZwSetBootOptions
2600
WinXP SP0-SP3
212
ZwSetBootOptions
3790
Win2003 SP0-SP2
220
ZwSetBootOptions
6000
Vista SP0
292
ZwSetBootOptions
6001
Vista SP1, Win2008
288
ZwSetBootOptions
7000
Windows 7
315
ZwSetContextChannel
2195
Win2000 SP0-SP4
246
ZwSetContextThread
2195
Win2000 SP0-SP4
186
ZwSetContextThread
2600
WinXP SP0-SP3
213
ZwSetContextThread
3790
Win2003 SP0-SP2
221
ZwSetContextThread
6000
Vista SP0
293
ZwSetContextThread
6001
Vista SP1, Win2008
289
ZwSetContextThread
7000
Windows 7
316
ZwSetDebugFilterState
2600
WinXP SP0-SP3
214
ZwSetDebugFilterState
3790
Win2003 SP0-SP2
222
ZwSetDebugFilterState
6000
Vista SP0
294
ZwSetDebugFilterState
6001
Vista SP1, Win2008
290
ZwSetDebugFilterState
7000
Windows 7
317
ZwSetDefaultHardErrorPort
2195
Win2000 SP0-SP4
187
ZwSetDefaultHardErrorPort
2600
WinXP SP0-SP3
215
ZwSetDefaultHardErrorPort
3790
Win2003 SP0-SP2
223
ZwSetDefaultHardErrorPort
6000
Vista SP0
295
ZwSetDefaultHardErrorPort
6001
Vista SP1, Win2008
291
ZwSetDefaultHardErrorPort
7000
Windows 7
318
ZwSetDefaultLocale
2195
Win2000 SP0-SP4
188
ZwSetDefaultLocale
2600
WinXP SP0-SP3
216
ZwSetDefaultLocale
3790
Win2003 SP0-SP2
224
ZwSetDefaultLocale
6000
Vista SP0
296
ZwSetDefaultLocale
6001
Vista SP1, Win2008
292
ZwSetDefaultLocale
7000
Windows 7
319
ZwSetDefaultUILanguage
2195
Win2000 SP0-SP4
189
ZwSetDefaultUILanguage
2600
WinXP SP0-SP3
217
ZwSetDefaultUILanguage
3790
Win2003 SP0-SP2
225
ZwSetDefaultUILanguage
6000
Vista SP0
297
ZwSetDefaultUILanguage
6001
Vista SP1, Win2008
293
ZwSetDefaultUILanguage
7000
Windows 7
320
ZwSetDriverEntryOrder
3790
Win2003 SP0-SP2
226
ZwSetDriverEntryOrder
6000
Vista SP0
298
ZwSetDriverEntryOrder
6001
Vista SP1, Win2008
294
ZwSetDriverEntryOrder
7000
Windows 7
321
ZwSetEaFile
2195
Win2000 SP0-SP4
190
ZwSetEaFile
2600
WinXP SP0-SP3
218
ZwSetEaFile
3790
Win2003 SP0-SP2
227
ZwSetEaFile
6000
Vista SP0
299
ZwSetEaFile
6001
Vista SP1, Win2008
295
ZwSetEaFile
7000
Windows 7
322
ZwSetEvent
2195
Win2000 SP0-SP4
191
ZwSetEvent
2600
WinXP SP0-SP3
219
ZwSetEvent
3790
Win2003 SP0-SP2
228
ZwSetEvent
6000
Vista SP0
300
ZwSetEvent
6001
Vista SP1, Win2008
296
ZwSetEvent
7000
Windows 7
323
ZwSetEventBoostPriority
2600
WinXP SP0-SP3
220
ZwSetEventBoostPriority
3790
Win2003 SP0-SP2
229
ZwSetEventBoostPriority
6000
Vista SP0
301
ZwSetEventBoostPriority
6001
Vista SP1, Win2008
297
ZwSetEventBoostPriority
7000
Windows 7
324
ZwSetHighEventPair
2195
Win2000 SP0-SP4
192
ZwSetHighEventPair
2600
WinXP SP0-SP3
221
ZwSetHighEventPair
3790
Win2003 SP0-SP2
230
ZwSetHighEventPair
6000
Vista SP0
302
ZwSetHighEventPair
6001
Vista SP1, Win2008
298
ZwSetHighEventPair
7000
Windows 7
325
ZwSetHighWaitLowEventPair
2195
Win2000 SP0-SP4
193
ZwSetHighWaitLowEventPair
2600
WinXP SP0-SP3
222
ZwSetHighWaitLowEventPair
3790
Win2003 SP0-SP2
231
ZwSetHighWaitLowEventPair
6000
Vista SP0
303
ZwSetHighWaitLowEventPair
6001
Vista SP1, Win2008
299
ZwSetHighWaitLowEventPair
7000
Windows 7
326
ZwSetInformationDebugObject
2600
WinXP SP0-SP3
223
ZwSetInformationDebugObject
3790
Win2003 SP0-SP2
232
ZwSetInformationDebugObject
6000
Vista SP0
304
ZwSetInformationDebugObject
6001
Vista SP1, Win2008
300
ZwSetInformationDebugObject
7000
Windows 7
327
ZwSetInformationEnlistment
6000
Vista SP0
112
ZwSetInformationEnlistment
6001
Vista SP1, Win2008
113
ZwSetInformationEnlistment
7000
Windows 7
328
ZwSetInformationFile
2195
Win2000 SP0-SP4
194
ZwSetInformationFile
2600
WinXP SP0-SP3
224
ZwSetInformationFile
3790
Win2003 SP0-SP2
233
ZwSetInformationFile
6000
Vista SP0
305
ZwSetInformationFile
6001
Vista SP1, Win2008
301
ZwSetInformationFile
7000
Windows 7
329
ZwSetInformationJobObject
2195
Win2000 SP0-SP4
195
ZwSetInformationJobObject
2600
WinXP SP0-SP3
225
ZwSetInformationJobObject
3790
Win2003 SP0-SP2
234
ZwSetInformationJobObject
6000
Vista SP0
306
ZwSetInformationJobObject
6001
Vista SP1, Win2008
302
ZwSetInformationJobObject
7000
Windows 7
330
ZwSetInformationKey
2195
Win2000 SP0-SP4
196
ZwSetInformationKey
2600
WinXP SP0-SP3
226
ZwSetInformationKey
3790
Win2003 SP0-SP2
235
ZwSetInformationKey
6000
Vista SP0
307
ZwSetInformationKey
6001
Vista SP1, Win2008
303
ZwSetInformationKey
7000
Windows 7
331
ZwSetInformationObject
2195
Win2000 SP0-SP4
197
ZwSetInformationObject
2600
WinXP SP0-SP3
227
ZwSetInformationObject
3790
Win2003 SP0-SP2
236
ZwSetInformationObject
6000
Vista SP0
308
ZwSetInformationObject
6001
Vista SP1, Win2008
304
ZwSetInformationObject
7000
Windows 7
332
ZwSetInformationProcess
2195
Win2000 SP0-SP4
198
ZwSetInformationProcess
2600
WinXP SP0-SP3
228
ZwSetInformationProcess
3790
Win2003 SP0-SP2
237
ZwSetInformationProcess
6000
Vista SP0
309
ZwSetInformationProcess
6001
Vista SP1, Win2008
305
ZwSetInformationProcess
7000
Windows 7
333
ZwSetInformationResourceManager
6000
Vista SP0
99
ZwSetInformationResourceManager
6001
Vista SP1, Win2008
99
ZwSetInformationResourceManager
7000
Windows 7
334
ZwSetInformationThread
2195
Win2000 SP0-SP4
199
ZwSetInformationThread
2600
WinXP SP0-SP3
229
ZwSetInformationThread
3790
Win2003 SP0-SP2
238
ZwSetInformationThread
6000
Vista SP0
310
ZwSetInformationThread
6001
Vista SP1, Win2008
306
ZwSetInformationThread
7000
Windows 7
335
ZwSetInformationToken
2195
Win2000 SP0-SP4
200
ZwSetInformationToken
2600
WinXP SP0-SP3
230
ZwSetInformationToken
3790
Win2003 SP0-SP2
239
ZwSetInformationToken
6000
Vista SP0
311
ZwSetInformationToken
6001
Vista SP1, Win2008
307
ZwSetInformationToken
7000
Windows 7
336
ZwSetInformationTransaction
6000
Vista SP0
97
ZwSetInformationTransaction
6001
Vista SP1, Win2008
97
ZwSetInformationTransaction
7000
Windows 7
337
ZwSetInformationTransactionManager
6000
Vista SP0
98
ZwSetInformationTransactionManager
6001
Vista SP1, Win2008
98
ZwSetInformationTransactionManager
7000
Windows 7
338
ZwSetInformationWorkerFactory
6000
Vista SP0
384
ZwSetInformationWorkerFactory
6001
Vista SP1, Win2008
378
ZwSetInformationWorkerFactory
7000
Windows 7
339
ZwSetIntervalProfile
2195
Win2000 SP0-SP4
201
ZwSetIntervalProfile
2600
WinXP SP0-SP3
231
ZwSetIntervalProfile
3790
Win2003 SP0-SP2
240
ZwSetIntervalProfile
6000
Vista SP0
312
ZwSetIntervalProfile
6001
Vista SP1, Win2008
308
ZwSetIntervalProfile
7000
Windows 7
340
ZwSetIoCompletion
2195
Win2000 SP0-SP4
185
ZwSetIoCompletion
2600
WinXP SP0-SP3
232
ZwSetIoCompletion
3790
Win2003 SP0-SP2
241
ZwSetIoCompletion
6000
Vista SP0
313
ZwSetIoCompletion
6001
Vista SP1, Win2008
309
ZwSetIoCompletion
7000
Windows 7
341
ZwSetIoCompletionEx
7000
Windows 7
342
ZwSetLdtEntries
2195
Win2000 SP0-SP4
202
ZwSetLdtEntries
2600
WinXP SP0-SP3
233
ZwSetLdtEntries
3790
Win2003 SP0-SP2
242
ZwSetLdtEntries
6000
Vista SP0
314
ZwSetLdtEntries
6001
Vista SP1, Win2008
310
ZwSetLdtEntries
7000
Windows 7
343
ZwSetLowEventPair
2195
Win2000 SP0-SP4
203
ZwSetLowEventPair
2600
WinXP SP0-SP3
234
ZwSetLowEventPair
3790
Win2003 SP0-SP2
243
ZwSetLowEventPair
6000
Vista SP0
315
ZwSetLowEventPair
6001
Vista SP1, Win2008
311
ZwSetLowEventPair
7000
Windows 7
344
ZwSetLowWaitHighEventPair
2195
Win2000 SP0-SP4
204
ZwSetLowWaitHighEventPair
2600
WinXP SP0-SP3
235
ZwSetLowWaitHighEventPair
3790
Win2003 SP0-SP2
244
ZwSetLowWaitHighEventPair
6000
Vista SP0
316
ZwSetLowWaitHighEventPair
6001
Vista SP1, Win2008
312
ZwSetLowWaitHighEventPair
7000
Windows 7
345
ZwSetQuotaInformationFile
2195
Win2000 SP0-SP4
205
ZwSetQuotaInformationFile
2600
WinXP SP0-SP3
236
ZwSetQuotaInformationFile
3790
Win2003 SP0-SP2
245
ZwSetQuotaInformationFile
6000
Vista SP0
317
ZwSetQuotaInformationFile
6001
Vista SP1, Win2008
313
ZwSetQuotaInformationFile
7000
Windows 7
346
ZwSetSecurityObject
2195
Win2000 SP0-SP4
206
ZwSetSecurityObject
2600
WinXP SP0-SP3
237
ZwSetSecurityObject
3790
Win2003 SP0-SP2
246
ZwSetSecurityObject
6000
Vista SP0
318
ZwSetSecurityObject
6001
Vista SP1, Win2008
314
ZwSetSecurityObject
7000
Windows 7
347
ZwSetSystemEnvironmentValue
2195
Win2000 SP0-SP4
207
ZwSetSystemEnvironmentValue
2600
WinXP SP0-SP3
238
ZwSetSystemEnvironmentValue
3790
Win2003 SP0-SP2
247
ZwSetSystemEnvironmentValue
6000
Vista SP0
319
ZwSetSystemEnvironmentValue
6001
Vista SP1, Win2008
315
ZwSetSystemEnvironmentValue
7000
Windows 7
348
ZwSetSystemEnvironmentValueEx
2600
WinXP SP0-SP3
239
ZwSetSystemEnvironmentValueEx
3790
Win2003 SP0-SP2
248
ZwSetSystemEnvironmentValueEx
6000
Vista SP0
320
ZwSetSystemEnvironmentValueEx
6001
Vista SP1, Win2008
316
ZwSetSystemEnvironmentValueEx
7000
Windows 7
349
ZwSetSystemInformation
2195
Win2000 SP0-SP4
208
ZwSetSystemInformation
2600
WinXP SP0-SP3
240
ZwSetSystemInformation
3790
Win2003 SP0-SP2
249
ZwSetSystemInformation
6000
Vista SP0
321
ZwSetSystemInformation
6001
Vista SP1, Win2008
317
ZwSetSystemInformation
7000
Windows 7
350
ZwSetSystemPowerState
2195
Win2000 SP0-SP4
209
ZwSetSystemPowerState
2600
WinXP SP0-SP3
241
ZwSetSystemPowerState
3790
Win2003 SP0-SP2
250
ZwSetSystemPowerState
6000
Vista SP0
322
ZwSetSystemPowerState
6001
Vista SP1, Win2008
318
ZwSetSystemPowerState
7000
Windows 7
351
ZwSetSystemTime
2195
Win2000 SP0-SP4
210
ZwSetSystemTime
2600
WinXP SP0-SP3
242
ZwSetSystemTime
3790
Win2003 SP0-SP2
251
ZwSetSystemTime
6000
Vista SP0
323
ZwSetSystemTime
6001
Vista SP1, Win2008
319
ZwSetSystemTime
7000
Windows 7
352
ZwSetThreadExecutionState
2195
Win2000 SP0-SP4
211
ZwSetThreadExecutionState
2600
WinXP SP0-SP3
243
ZwSetThreadExecutionState
3790
Win2003 SP0-SP2
252
ZwSetThreadExecutionState
6000
Vista SP0
324
ZwSetThreadExecutionState
6001
Vista SP1, Win2008
320
ZwSetThreadExecutionState
7000
Windows 7
353
ZwSetTimer
2195
Win2000 SP0-SP4
212
ZwSetTimer
2600
WinXP SP0-SP3
244
ZwSetTimer
3790
Win2003 SP0-SP2
253
ZwSetTimer
6000
Vista SP0
325
ZwSetTimer
6001
Vista SP1, Win2008
321
ZwSetTimer
7000
Windows 7
354
ZwSetTimerEx
7000
Windows 7
355
ZwSetTimerResolution
2195
Win2000 SP0-SP4
213
ZwSetTimerResolution
2600
WinXP SP0-SP3
245
ZwSetTimerResolution
3790
Win2003 SP0-SP2
254
ZwSetTimerResolution
6000
Vista SP0
326
ZwSetTimerResolution
6001
Vista SP1, Win2008
322
ZwSetTimerResolution
7000
Windows 7
356
ZwSetUuidSeed
2195
Win2000 SP0-SP4
214
ZwSetUuidSeed
2600
WinXP SP0-SP3
246
ZwSetUuidSeed
3790
Win2003 SP0-SP2
255
ZwSetUuidSeed
6000
Vista SP0
327
ZwSetUuidSeed
6001
Vista SP1, Win2008
323
ZwSetUuidSeed
7000
Windows 7
357
ZwSetValueKey
2195
Win2000 SP0-SP4
215
ZwSetValueKey
2600
WinXP SP0-SP3
247
ZwSetValueKey
3790
Win2003 SP0-SP2
256
ZwSetValueKey
6000
Vista SP0
328
ZwSetValueKey
6001
Vista SP1, Win2008
324
ZwSetValueKey
7000
Windows 7
358
ZwSetVolumeInformationFile
2195
Win2000 SP0-SP4
216
ZwSetVolumeInformationFile
2600
WinXP SP0-SP3
248
ZwSetVolumeInformationFile
3790
Win2003 SP0-SP2
257
ZwSetVolumeInformationFile
6000
Vista SP0
329
ZwSetVolumeInformationFile
6001
Vista SP1, Win2008
325
ZwSetVolumeInformationFile
7000
Windows 7
359
ZwShutdownSystem
2195
Win2000 SP0-SP4
217
ZwShutdownSystem
2600
WinXP SP0-SP3
249
ZwShutdownSystem
3790
Win2003 SP0-SP2
258
ZwShutdownSystem
6000
Vista SP0
330
ZwShutdownSystem
6001
Vista SP1, Win2008
326
ZwShutdownSystem
7000
Windows 7
360
ZwShutdownWorkerFactory
6000
Vista SP0
387
ZwShutdownWorkerFactory
6001
Vista SP1, Win2008
381
ZwShutdownWorkerFactory
7000
Windows 7
361
ZwSignalAndWaitForSingleObject
2195
Win2000 SP0-SP4
218
ZwSignalAndWaitForSingleObject
2600
WinXP SP0-SP3
250
ZwSignalAndWaitForSingleObject
3790
Win2003 SP0-SP2
259
ZwSignalAndWaitForSingleObject
6000
Vista SP0
331
ZwSignalAndWaitForSingleObject
6001
Vista SP1, Win2008
327
ZwSignalAndWaitForSingleObject
7000
Windows 7
362
ZwSinglePhaseReject
6000
Vista SP0
96
ZwSinglePhaseReject
6001
Vista SP1, Win2008
96
ZwSinglePhaseReject
7000
Windows 7
363
ZwStartProfile
2195
Win2000 SP0-SP4
219
ZwStartProfile
2600
WinXP SP0-SP3
251
ZwStartProfile
3790
Win2003 SP0-SP2
260
ZwStartProfile
6000
Vista SP0
332
ZwStartProfile
6001
Vista SP1, Win2008
328
ZwStartProfile
7000
Windows 7
364
ZwStartTm
6000
Vista SP0
114
ZwStopProfile
2195
Win2000 SP0-SP4
220
ZwStopProfile
2600
WinXP SP0-SP3
252
ZwStopProfile
3790
Win2003 SP0-SP2
261
ZwStopProfile
6000
Vista SP0
333
ZwStopProfile
6001
Vista SP1, Win2008
329
ZwStopProfile
7000
Windows 7
365
ZwSuspendProcess
2600
WinXP SP0-SP3
253
ZwSuspendProcess
3790
Win2003 SP0-SP2
262
ZwSuspendProcess
6000
Vista SP0
334
ZwSuspendProcess
6001
Vista SP1, Win2008
330
ZwSuspendProcess
7000
Windows 7
366
ZwSuspendThread
2195
Win2000 SP0-SP4
221
ZwSuspendThread
2600
WinXP SP0-SP3
254
ZwSuspendThread
3790
Win2003 SP0-SP2
263
ZwSuspendThread
6000
Vista SP0
335
ZwSuspendThread
6001
Vista SP1, Win2008
331
ZwSuspendThread
7000
Windows 7
367
ZwSystemDebugControl
2195
Win2000 SP0-SP4
222
ZwSystemDebugControl
2600
WinXP SP0-SP3
255
ZwSystemDebugControl
3790
Win2003 SP0-SP2
264
ZwSystemDebugControl
6000
Vista SP0
336
ZwSystemDebugControl
6001
Vista SP1, Win2008
332
ZwSystemDebugControl
7000
Windows 7
368
ZwTerminateJobObject
2195
Win2000 SP0-SP4
223
ZwTerminateJobObject
2600
WinXP SP0-SP3
256
ZwTerminateJobObject
3790
Win2003 SP0-SP2
265
ZwTerminateJobObject
6000
Vista SP0
337
ZwTerminateJobObject
6001
Vista SP1, Win2008
333
ZwTerminateJobObject
7000
Windows 7
369
ZwTerminateProcess
2195
Win2000 SP0-SP4
224
ZwTerminateProcess
2600
WinXP SP0-SP3
257
ZwTerminateProcess
3790
Win2003 SP0-SP2
266
ZwTerminateProcess
6000
Vista SP0
338
ZwTerminateProcess
6001
Vista SP1, Win2008
334
ZwTerminateProcess
7000
Windows 7
370
ZwTerminateThread
2195
Win2000 SP0-SP4
225
ZwTerminateThread
2600
WinXP SP0-SP3
258
ZwTerminateThread
3790
Win2003 SP0-SP2
267
ZwTerminateThread
6000
Vista SP0
339
ZwTerminateThread
6001
Vista SP1, Win2008
335
ZwTerminateThread
7000
Windows 7
371
ZwTestAlert
2195
Win2000 SP0-SP4
226
ZwTestAlert
2600
WinXP SP0-SP3
259
ZwTestAlert
3790
Win2003 SP0-SP2
268
ZwTestAlert
6000
Vista SP0
340
ZwTestAlert
6001
Vista SP1, Win2008
336
ZwTestAlert
7000
Windows 7
372
ZwThawRegistry
6000
Vista SP0
341
ZwThawRegistry
6001
Vista SP1, Win2008
337
ZwThawRegistry
7000
Windows 7
373
ZwThawTransactions
6000
Vista SP0
342
ZwThawTransactions
6001
Vista SP1, Win2008
338
ZwThawTransactions
7000
Windows 7
374
ZwTraceControl
6000
Vista SP0
344
ZwTraceControl
6001
Vista SP1, Win2008
340
ZwTraceControl
7000
Windows 7
375
ZwTraceEvent
2600
WinXP SP0-SP3
260
ZwTraceEvent
3790
Win2003 SP0-SP2
269
ZwTraceEvent
6000
Vista SP0
343
ZwTraceEvent
6001
Vista SP1, Win2008
339
ZwTraceEvent
7000
Windows 7
376
ZwTranslateFilePath
2600
WinXP SP0-SP3
261
ZwTranslateFilePath
3790
Win2003 SP0-SP2
270
ZwTranslateFilePath
6000
Vista SP0
345
ZwTranslateFilePath
6001
Vista SP1, Win2008
341
ZwTranslateFilePath
7000
Windows 7
377
ZwUmsThreadYield
7000
Windows 7
378
ZwUnloadDriver
2195
Win2000 SP0-SP4
227
ZwUnloadDriver
2600
WinXP SP0-SP3
262
ZwUnloadDriver
3790
Win2003 SP0-SP2
271
ZwUnloadDriver
6000
Vista SP0
346
ZwUnloadDriver
6001
Vista SP1, Win2008
342
ZwUnloadDriver
7000
Windows 7
379
ZwUnloadKey
2195
Win2000 SP0-SP4
228
ZwUnloadKey
2600
WinXP SP0-SP3
263
ZwUnloadKey
3790
Win2003 SP0-SP2
272
ZwUnloadKey
6000
Vista SP0
347
ZwUnloadKey
6001
Vista SP1, Win2008
343
ZwUnloadKey
7000
Windows 7
380
ZwUnloadKey2
3790
Win2003 SP0-SP2
273
ZwUnloadKey2
6000
Vista SP0
348
ZwUnloadKey2
6001
Vista SP1, Win2008
344
ZwUnloadKey2
7000
Windows 7
381
ZwUnloadKeyEx
2600
WinXP SP0-SP3
264
ZwUnloadKeyEx
3790
Win2003 SP0-SP2
274
ZwUnloadKeyEx
6000
Vista SP0
349
ZwUnloadKeyEx
6001
Vista SP1, Win2008
345
ZwUnloadKeyEx
7000
Windows 7
382
ZwUnlockFile
2195
Win2000 SP0-SP4
229
ZwUnlockFile
2600
WinXP SP0-SP3
265
ZwUnlockFile
3790
Win2003 SP0-SP2
275
ZwUnlockFile
6000
Vista SP0
350
ZwUnlockFile
6001
Vista SP1, Win2008
346
ZwUnlockFile
7000
Windows 7
383
ZwUnlockVirtualMemory
2195
Win2000 SP0-SP4
230
ZwUnlockVirtualMemory
2600
WinXP SP0-SP3
266
ZwUnlockVirtualMemory
3790
Win2003 SP0-SP2
276
ZwUnlockVirtualMemory
6000
Vista SP0
351
ZwUnlockVirtualMemory
6001
Vista SP1, Win2008
347
ZwUnlockVirtualMemory
7000
Windows 7
384
ZwUnmapViewOfSection
2195
Win2000 SP0-SP4
231
ZwUnmapViewOfSection
2600
WinXP SP0-SP3
267
ZwUnmapViewOfSection
3790
Win2003 SP0-SP2
277
ZwUnmapViewOfSection
6000
Vista SP0
352
ZwUnmapViewOfSection
6001
Vista SP1, Win2008
348
ZwUnmapViewOfSection
7000
Windows 7
385
ZwVdmControl
2195
Win2000 SP0-SP4
232
ZwVdmControl
2600
WinXP SP0-SP3
268
ZwVdmControl
3790
Win2003 SP0-SP2
278
ZwVdmControl
6000
Vista SP0
353
ZwVdmControl
6001
Vista SP1, Win2008
349
ZwVdmControl
7000
Windows 7
386
ZwWaitForDebugEvent
2600
WinXP SP0-SP3
269
ZwWaitForDebugEvent
3790
Win2003 SP0-SP2
279
ZwWaitForDebugEvent
6000
Vista SP0
354
ZwWaitForDebugEvent
6001
Vista SP1, Win2008
350
ZwWaitForDebugEvent
7000
Windows 7
387
ZwWaitForKeyedEvent
2600
WinXP SP0-SP3
282
ZwWaitForKeyedEvent
3790
Win2003 SP0-SP2
292
ZwWaitForKeyedEvent
6000
Vista SP0
367
ZwWaitForKeyedEvent
6001
Vista SP1, Win2008
363
ZwWaitForKeyedEvent
7000
Windows 7
388
ZwWaitForMultipleObjects
2195
Win2000 SP0-SP4
233
ZwWaitForMultipleObjects
2600
WinXP SP0-SP3
270
ZwWaitForMultipleObjects
3790
Win2003 SP0-SP2
280
ZwWaitForMultipleObjects
6000
Vista SP0
355
ZwWaitForMultipleObjects
6001
Vista SP1, Win2008
351
ZwWaitForMultipleObjects
7000
Windows 7
389
ZwWaitForMultipleObjects32
3790
Win2003 SP0-SP2
295
ZwWaitForMultipleObjects32
6000
Vista SP0
370
ZwWaitForMultipleObjects32
6001
Vista SP1, Win2008
366
ZwWaitForMultipleObjects32
7000
Windows 7
390
ZwWaitForSingleObject
2195
Win2000 SP0-SP4
234
ZwWaitForSingleObject
2600
WinXP SP0-SP3
271
ZwWaitForSingleObject
3790
Win2003 SP0-SP2
281
ZwWaitForSingleObject
6000
Vista SP0
356
ZwWaitForSingleObject
6001
Vista SP1, Win2008
352
ZwWaitForSingleObject
7000
Windows 7
391
ZwWaitForWorkViaWorkerFactory
6000
Vista SP0
383
ZwWaitForWorkViaWorkerFactory
6001
Vista SP1, Win2008
377
ZwWaitForWorkViaWorkerFactory
7000
Windows 7
392
ZwWaitHighEventPair
2195
Win2000 SP0-SP4
235
ZwWaitHighEventPair
2600
WinXP SP0-SP3
272
ZwWaitHighEventPair
3790
Win2003 SP0-SP2
282
ZwWaitHighEventPair
6000
Vista SP0
357
ZwWaitHighEventPair
6001
Vista SP1, Win2008
353
ZwWaitHighEventPair
7000
Windows 7
393
ZwWaitLowEventPair
2195
Win2000 SP0-SP4
236
ZwWaitLowEventPair
2600
WinXP SP0-SP3
273
ZwWaitLowEventPair
3790
Win2003 SP0-SP2
283
ZwWaitLowEventPair
6000
Vista SP0
358
ZwWaitLowEventPair
6001
Vista SP1, Win2008
354
ZwWaitLowEventPair
7000
Windows 7
394
ZwWorkerFactoryWorkerReady
6000
Vista SP0
386
ZwWorkerFactoryWorkerReady
6001
Vista SP1, Win2008
380
ZwWorkerFactoryWorkerReady
7000
Windows 7
395
ZwWriteFile
2195
Win2000 SP0-SP4
237
ZwWriteFile
2600
WinXP SP0-SP3
274
ZwWriteFile
3790
Win2003 SP0-SP2
284
ZwWriteFile
6000
Vista SP0
359
ZwWriteFile
6001
Vista SP1, Win2008
355
ZwWriteFile
7000
Windows 7
396
ZwWriteFileGather
2195
Win2000 SP0-SP4
238
ZwWriteFileGather
2600
WinXP SP0-SP3
275
ZwWriteFileGather
3790
Win2003 SP0-SP2
285
ZwWriteFileGather
6000
Vista SP0
360
ZwWriteFileGather
6001
Vista SP1, Win2008
356
ZwWriteFileGather
7000
Windows 7
397
ZwWriteRequestData
2195
Win2000 SP0-SP4
239
ZwWriteRequestData
2600
WinXP SP0-SP3
276
ZwWriteRequestData
3790
Win2003 SP0-SP2
286
ZwWriteRequestData
6000
Vista SP0
361
ZwWriteRequestData
6001
Vista SP1, Win2008
357
ZwWriteRequestData
7000
Windows 7
398
ZwWriteVirtualMemory
2195
Win2000 SP0-SP4
240
ZwWriteVirtualMemory
2600
WinXP SP0-SP3
277
ZwWriteVirtualMemory
3790
Win2003 SP0-SP2
287
ZwWriteVirtualMemory
6000
Vista SP0
362
ZwWriteVirtualMemory
6001
Vista SP1, Win2008
358
ZwWriteVirtualMemory
7000
Windows 7
399
ZwYieldExecution
2195
Win2000 SP0-SP4
247
ZwYieldExecution
2600
WinXP SP0-SP3
278
ZwYieldExecution
3790
Win2003 SP0-SP2
288
ZwYieldExecution
6000
Vista SP0
363
ZwYieldExecution
6001
Vista SP1, Win2008
359
ZwYieldExecution
7000
Windows 7
400
    

 

NemoHu
关注
专栏目录
Windows API 每日一练之 FlushInstructionCache
weixin_30335353的博客
07-16 461
FlushInstructionCache 在 MSDN 中解释说是 flush 指定进程的指令缓存。其声明如下所示：BOOL WINAPI FlushInstructionCache( HANDLE hProcess, LPCVOID lpBaseAddress, SIZE_T dwSize ); MSDN 中说，如果应用程序生成或更改了内存中的代码那么就应该调用此函数。这...
windows ALPC简单研究
weixin_43787608的博客
11-26 9461
0x00 本文是对ALPC的简单研究，由于时间有限，还有很多细节没有搞清楚，还有很多疏漏。希望能起到抛砖引玉的作用，能找到高手讨论学习。 ALPC（Advanced/Asynchronous Local Procedure Call），是微软发展出来替代LPC，用于本机RPC的一种C/S模型技术。但是对用户来说，能看到只有RPC概念，很少能看到ALPC。 我们看一个典型的ALPC同步调用堆栈： ...
Windows API一日一练(84)FlushInstructionCache函数
anjichan4261的博客
12-06 218
一般的程序都是在运行前已经编译好的，因此修改指令的机会比较少，但在软件的防破解里，倒是使用很多。当修改指令之后，怎么样才能让CPU去执行新的指令呢？这样就需要使用函数FlushInstructionCache来把缓存里的数据重写回主内存里去，让CPU重新加载新的指令，才能执行新的指令。下面就来学习一下使用这个函数来实现跳到一个静态函数里执行，而不是直接地调用这个函数。 函数Flu...
本地过程调用
09-07
LPC=function（）{Int ，long ,char }
Zw 系列函数
huanongying131的博客
11-19 3729
转：http://blog.sina.com.cn/s/blog_4a1acc7f0100cfud.html      896  37F 0000D379 ZwAcceptConnectPort         897  380 0000D38E ZwAccessCheck         898  381 0000D3A3 ZwAccessCheckAndAuditAlarm         ...
驱动编程-ssdt hook--系统服务表
健景的博客
05-04 640
整理下自己的驱动编程。 ssdt是系统服务表，每个window系统都会维护自己的系统服务表。我们可以使用kernel detective看下ssdt表。 以openProcess为例子： 开windbg kd> u nt!ZwOpenProcess nt!ZwOpenProcess: 804ff720 b87a000000      mov     eax,7Ah  //7A 8
SSDT表的Hook原理和示例代码
06-25
SSDT（System Service Descriptor Table）表是Windows操作系统中一个关键的数据结构，它包含了系统服务的入口点。在系统服务调用（System Call）时，这些入口点被用来调度到相应的服务处理函数。Hook SSDT是一种高级...
WIN64_SSDTHOOK.rar_64 ssdT_64 ssdt c_TDL_win64 ssdt hook_win7 SS
07-15
在Windows操作系统中，系统服务描述表（System Service Dispatch Table，简称SSDT）是内核模式下的一个重要组件，它存储了所有系统服务的入口点。在32位版本的Windows（即WIN32）中，SSDT是通过全局描述符表（GDT）...
win10系统调用架构分析
liuyez123的博客
03-27 8846
1.  操作系统模型 大多数操作系统中，都会把应用程序和内核代码分离运行在不同的模式下。内核模式访问系统数据和硬件，应用程序运行在没有特权的模式下（用户模式），只能使用有限的API，且不能直接访问硬件。当用户模式调用系统服务时，CPU执行一个特殊的指令以切换到内核模式（Ring0），当系统服务调用完成时，操作系统切换回用户模式（Ring3）。 Windows与大多数UNIX系统类似，驱动程
Windows内核情景分析 第二章 从用户空间发起系统调用的过程(仅供自赏)
For Geek
05-15 904
系统调用/系统服务存在的需求 从应用程序的角度看，内核的作用在于提供了一组可供应用程序调用的接口。这组调用我们称为“系统调用”。也可以认为系统调用是内核提供的一种服务。所以系统调用也称为系统服务。 从程序运行的角度来看：进程是主动的，有活性的，是发出调用请求的一方。而内核是被动的，只是应程序的需求来提供相应的服务。 从整个系统的角度看：内核也有活性的一面，只不过从应用程序本身是看不到的，隐形的。诸...
Mark备查。。。Win8 RP的ntdll新增函数列表
a1875566250的专栏
06-04 4100
Win7 SP1对比Win8 RP [C:\Users\Windows\Desktop\ntdll.dll] compare [C:\Windows\system32\ntdll.dll],file1 not: NtGetPlugPlayEvent RtlEnlargedUnsignedDivide TpDbgGetFreeInfo TpPoolFreeUnusedNodes
异步机制 - IO完成端口
weixin_30919235的博客
04-10 177
1 KQUEUE KeInitializeQueue VOID KeInitializeQueue( IN PKQUEUE Queue, IN ULONG Count OPTIONAL ); lkd> dt _KQUEUE nt!_KQUEUE +0x000 Header : _DISPATCHER_HEADER ...
ICEID
playmaker的博客
08-31 1165
文章目录基本信息样本基本信息主要执行流程office宏pfsdnskdf.exe解密exe傀儡进程关键技术概览1.时间差检测2.cpuid3.隐写术4.傀儡进程5.浏览器注入6.流量混淆详细分析宏代码部分PFSDNSKDF.EXE微步云在线分析手动分析PFSDNSKDF.EXE下载解密文件分析微步云在线分析手动分析新shellcode傀儡进程火绒剑分析开启监听端口生成自签名证书对谷歌浏览器执行远线程注入手动分析其他参考链接 基本信息 样本基本信息 文件名称 fram.doc 样本类型 doc
LPC服务器拒绝客户端的表白
nethm的专栏
09-25 726
  开场白： 项目中遇见了一个奇怪的问题。在64位系统下，LPC的服务端是wow32位进程，在调用了ZwAcceptConnectPort拒绝客户端的连接后，ZwAcceptConnectPort返回   // // MessageId: STATUS_INVALID_MESSAGE // // MessageText: // // The ALPC message supplied is ...
易语言无模块注入_针对银行木马BokBot核心模块的深入分析
weixin_39707201的博客
11-22 2608
一、概述BokBot恶意软件由LUNAR SPIDER恶意组织开发和运营，在2017年首次出现，CrowdStrike的Falcon Overwatch和Falcon Intelligenc团队对被感染主机进行了分析。最近，由于借助MUMMY SPIDER恶意组织的Emotet恶意软件进行分发活动，BokBot的感染数量又有所增加。BokBot恶意软件具有强大的功能，分为命令和控制、模...
LSP安装
10-26 1854
关于LSP是什么我就不多说了，假定大家都知道，不知道的可以去Google问问。      LSP其实还是很有用的，不过最近看到许多人在学习过程中老遇到一些问题，下面就把我的一些经验说出来，纯属个人理解，有错勿怪。1，安装LSP后系统逐渐卡死？      额，我当时学习的时候曾经遇到过这个问题，没仔细研究是什么原因，最近解决的方法是禁止Explorer.exe进程加载。2，安装LSP后上不了
《Windows内核编程》---内核模式下字符串的基本操作 收藏
02-09 1241
<br />《Windows内核编程》---内核模式下字符串的基本操作 收藏 驱动程序中字符串操作涉及到ASCII字符串、宽字符串，还有DDK定义的ANSI_STRING数据结构和UNICODE_STRING数据结构。 1）ASCII字符串和宽字符串 在应用程序中使用两种字符：一是char型字符串，负责记录ANSI字符集，它是指向一个char数组的指针，每个char型变量大小是一个字节，字符串是以0标志字符串结束的；一是wchar_t型的宽字符串，负责描述unicode字符集，它是
让一切输入都难逃法眼——驱动级键盘过滤钩子的实现
12-25 1159
<br />让一切输入都难逃法眼——驱动级键盘过滤钩子的实现 <br /> <br />作者：中国石油大学胜利学院 小麒麟（王龙）<br />上一期给大家带来了SSDT的详细说明，基本上挂钩SSDT就可以实现我们想要的很多功能了，但是有时候，挂钩SSDT有局限性，这时我们就可以充分利用Windows驱动的分层特性，充分挖掘系统的特性。上一篇文章可以说写的有些快，这篇我将从头讲起，希望对有兴趣进入驱动编程的人有些帮助。 <br />驱动分层结构是Windows的特性，I/O管理器有两个重要设计：一是Windo
SSDT DELPHI钩子检测工具使用教程
资源摘要信息: "ssdt.rar_SSDT DELPHI_SSDT-hook delphi_Table_delphi ssdt_ssdt" 知识点详细说明： 1. SSDT（系统服务描述表）概念： SSDT是Windows操作系统中的一个核心组件，它是一个数据结构，用来告诉...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值