Memory Three BIOS Public API Comparison - Mainkill1/SpiritBoot GitHub Wiki

Public API size comparison for Complex retail 5838 and SpiritBoot

Every 366 retail-reference ordinal is listed here, with the 330 callable Complex slots from the retained reference census joined by ordinal and verified public name. SpiritBoot values come from the current measured-main compiler ledger, rather than the older owned column of the Complex comparison. This table is a starting point for finding helper and lifetime differences; entry-size ratios are not recoverable RAM estimates.

What each size means

Column Measurement Limit
Complex decoded bytes Inferred reachable instruction bytes for that public entry walk Shared tails and helper calls prevent using the sum as code size
Complex envelope bytes Address envelope of that walk Gaps and noncontiguous code can inflate it; not a compiler function extent
Retail decoded bytes Inferred reachable instruction bytes for that public entry walk Incomplete indirect/callback coverage; not total service code
Retail envelope bytes Address envelope of that walk Same non-additive limit
SpiritBoot main bytes Exact retained COFF compiler input-section extent May be a wrapper; includes inlining/padding and omits separately emitted callees

Main measured source tree: 6e7666c73c916a235d29ec793dc9ee0920df299b, recorded at product f60f8de605cbbdce2f22e4bc3489e1c1487dcb59. Main flash: 75bee35302ea9b004f1e6fc1ea9d1e5857985c96489635c56b7461a46849ca73. Complex is the supplied 4627 reference; retail is the supplied 5838 reference. Their original section/walk inventories and capture epochs remain separate. No freshly synchronized three-BIOS launch is implied.

Unknown means the corresponding exact measurement is absent, not zero and not an unsupported API. Complex rows missing from this callable census can be data, aliases or uncovered exports. The 366-row space has callable and data ordinals. SpiritBoot's broader export index has 371 slots; extra slots outside this reference range remain in Export-Index. ABI argument bytes are decoration/interface evidence, not full typed prototypes.

For example, the 37 B owned ExAllocatePoolWithTag entry wraps the real allocator; its size cannot be compared to the reference's 439 B walk as if the allocator were twelve times smaller. Likewise, a 52 B owned virtual-memory wrapper can retain substantially larger backing services. Inspect the owned implementation closure and physical page ledger before choosing a removal.

Every reference ordinal

Ordinal Public API ABI evidence Complex decoded B Complex envelope B Retail decoded B Retail envelope B SpiritBoot main exact B
1 AvGetSavedDataAddress stdcall, 0 ABI bytes 6 6 6 6 6
2 AvSendTVEncoderOption stdcall, 16 ABI bytes 65 1074 78 1743 374
3 AvSetDisplayMode stdcall, 24 ABI bytes 1308 1308 1687 1687 128
4 AvSetSavedDataAddress stdcall, 4 ABI bytes 12 12 12 12 12
5 DbgBreakPoint stdcall, 0 ABI bytes 1 1 1 1 Unknown
6 DbgBreakPointWithStatus stdcall, 4 ABI bytes 5 5 5 5 Unknown
7 DbgLoadImageSymbols stdcall, 12 ABI bytes Unknown Unknown unknown / data unknown / data 13
8 DbgPrint cdecl, 0 ABI bytes 90 90 90 90 3
9 HalReadSMCTrayState stdcall, 8 ABI bytes 132 132 132 132 81
10 DbgPrompt stdcall, 12 ABI bytes 63 63 63 63 23
11 DbgUnLoadImageSymbols stdcall, 12 ABI bytes Unknown Unknown unknown / data unknown / data 13
12 ExAcquireReadWriteLockExclusive stdcall, 4 ABI bytes 35 35 35 35 74
13 ExAcquireReadWriteLockShared stdcall, 4 ABI bytes 48 48 48 48 110
14 ExAllocatePool stdcall, 4 ABI bytes 17 17 17 17 38
15 ExAllocatePoolWithTag stdcall, 8 ABI bytes 439 439 439 439 37
16 ExEventObjectType data Unknown Unknown unknown / data unknown / data Unknown
17 ExFreePool stdcall, 4 ABI bytes 349 349 349 349 29
18 ExInitializeReadWriteLock stdcall, 4 ABI bytes 55 55 55 55 75
19 ExInterlockedAddLargeInteger stdcall, 16 ABI bytes 49 49 49 49 45
20 ExInterlockedAddLargeStatistic fastcall, 8 ABI bytes 7 7 7 7 Unknown
21 ExInterlockedCompareExchange64 fastcall, 12 ABI bytes 27 27 27 27 29
22 ExMutantObjectType data Unknown Unknown unknown / data unknown / data Unknown
23 ExQueryPoolBlockSize stdcall, 4 ABI bytes 31 31 31 31 188
24 ExQueryNonVolatileSetting stdcall, 20 ABI bytes 397 397 394 394 384
25 ExReadWriteRefurbInfo stdcall, 12 ABI bytes 262 262 262 262 171
26 ExRaiseException stdcall, 4 ABI bytes 152 152 152 152 Unknown
27 ExRaiseStatus stdcall, 4 ABI bytes 178 178 178 178 Unknown
28 ExReleaseReadWriteLock stdcall, 4 ABI bytes 86 86 86 86 152
29 ExSaveNonVolatileSetting stdcall, 16 ABI bytes 471 471 478 478 277
30 ExSemaphoreObjectType data Unknown Unknown unknown / data unknown / data Unknown
31 ExTimerObjectType data Unknown Unknown unknown / data unknown / data Unknown
32 ExfInterlockedInsertHeadList fastcall, 8 ABI bytes 22 22 22 22 51
33 ExfInterlockedInsertTailList fastcall, 8 ABI bytes 23 23 23 23 51
34 ExfInterlockedRemoveHeadList fastcall, 4 ABI bytes 21 21 21 21 51
35 FscGetCacheSize stdcall, 0 ABI bytes 6 6 6 6 9
36 FscInvalidateIdleBlocks stdcall, 0 ABI bytes 121 121 121 121 213
37 FscSetCacheSize stdcall, 4 ABI bytes 102 102 102 102 459
38 HalClearSoftwareInterrupt fastcall, 4 ABI bytes 16 16 16 16 14
39 HalDisableSystemInterrupt stdcall, 4 ABI bytes 43 43 43 43 37
40 HalDiskCachePartitionCount data Unknown Unknown unknown / data unknown / data Unknown
41 HalDiskModelNumber data Unknown Unknown unknown / data unknown / data Unknown
42 HalDiskSerialNumber data Unknown Unknown unknown / data unknown / data Unknown
43 HalEnableSystemInterrupt stdcall, 8 ABI bytes 96 96 96 96 45
44 HalGetInterruptVector stdcall, 8 ABI bytes 34 34 34 34 56
45 HalReadSMBusValue stdcall, 16 ABI bytes 154 154 190 190 111
46 HalReadWritePCISpace stdcall, 24 ABI bytes 117 117 117 117 156
47 HalRegisterShutdownNotification stdcall, 8 ABI bytes 135 135 135 135 161
48 HalRequestSoftwareInterrupt fastcall, 4 ABI bytes 50 50 50 50 57
49 HalReturnToFirmware stdcall, 4 ABI bytes 123 123 123 123 582
50 HalWriteSMBusValue stdcall, 16 ABI bytes 133 133 158 158 66
51 InterlockedCompareExchange fastcall, 12 ABI bytes 10 10 10 10 11
52 InterlockedDecrement fastcall, 4 ABI bytes 10 10 10 10 9
53 InterlockedIncrement fastcall, 4 ABI bytes 10 10 10 10 11
54 InterlockedExchange fastcall, 8 ABI bytes 8 8 8 8 10
55 InterlockedExchangeAdd fastcall, 8 ABI bytes 6 6 6 6 7
56 InterlockedFlushSList fastcall, 4 ABI bytes 33 33 33 33 Unknown
57 InterlockedPopEntrySList fastcall, 4 ABI bytes 33 33 33 33 88
58 InterlockedPushEntrySList fastcall, 8 ABI bytes 31 31 31 31 105
59 IoAllocateIrp stdcall, 4 ABI bytes 114 114 114 114 30
60 IoBuildAsynchronousFsdRequest stdcall, 24 ABI bytes 113 113 113 113 519
61 IoBuildDeviceIoControlRequest stdcall, 36 ABI bytes 168 168 168 168 567
62 IoBuildSynchronousFsdRequest stdcall, 28 ABI bytes 88 88 88 88 84
63 IoCheckShareAccess stdcall, 20 ABI bytes 301 301 301 301 383
64 IoCompletionObjectType data Unknown Unknown unknown / data unknown / data Unknown
65 IoCreateDevice stdcall, 24 ABI bytes 368 368 368 368 190
66 IoCreateFile stdcall, 40 ABI bytes 410 410 410 410 143
67 IoCreateSymbolicLink stdcall, 8 ABI bytes 61 61 61 61 126
68 IoDeleteDevice stdcall, 4 ABI bytes 60 60 60 60 176
69 IoDeleteSymbolicLink stdcall, 4 ABI bytes 72 72 72 72 158
70 IoDeviceObjectType data Unknown Unknown unknown / data unknown / data Unknown
71 IoFileObjectType data Unknown Unknown unknown / data unknown / data Unknown
72 IoFreeIrp stdcall, 4 ABI bytes 40 40 40 40 143
73 IoInitializeIrp stdcall, 12 ABI bytes 83 83 83 83 87
74 IoInvalidDeviceRequest stdcall, 8 ABI bytes 26 26 26 26 8
75 IoQueryFileInformation stdcall, 20 ABI bytes 29 29 29 29 89
76 IoQueryVolumeInformation stdcall, 20 ABI bytes 29 29 29 29 76
77 IoQueueThreadIrp stdcall, 4 ABI bytes 51 51 51 51 82
78 IoRemoveShareAccess stdcall, 8 ABI bytes 73 73 73 73 96
79 IoSetIoCompletion stdcall, 20 ABI bytes 72 72 72 72 58
80 IoSetShareAccess stdcall, 16 ABI bytes 206 206 206 206 257
81 IoStartNextPacket stdcall, 4 ABI bytes 43 43 43 43 29
82 IoStartNextPacketByKey stdcall, 8 ABI bytes 52 52 52 52 71
83 IoStartPacket stdcall, 12 ABI bytes 104 104 104 104 44
84 IoSynchronousDeviceIoControlRequest stdcall, 32 ABI bytes 126 126 123 123 180
85 IoSynchronousFsdRequest stdcall, 20 ABI bytes 108 108 105 105 150
86 IofCallDriver fastcall, 8 ABI bytes 51 51 51 51 93
87 IofCompleteRequest fastcall, 8 ABI bytes 489 489 490 490 924
88 KdDebuggerEnabled data Unknown Unknown unknown / data unknown / data Unknown
89 KdDebuggerNotPresent data Unknown Unknown unknown / data unknown / data Unknown
90 IoDismountVolume stdcall, 4 ABI bytes 81 81 81 81 Unknown
91 IoDismountVolumeByName stdcall, 4 ABI bytes 56 56 56 56 69
92 KeAlertResumeThread stdcall, 4 ABI bytes 103 103 103 103 142
93 KeAlertThread stdcall, 8 ABI bytes 81 81 81 81 113
94 KeBoostPriorityThread stdcall, 8 ABI bytes 73 73 73 73 93
95 KeBugCheck stdcall, 4 ABI bytes 16 16 16 16 39
96 KeBugCheckEx stdcall, 20 ABI bytes 110 110 110 110 51
97 KeCancelTimer stdcall, 4 ABI bytes 47 47 47 47 164
98 KeConnectInterrupt stdcall, 4 ABI bytes 128 128 128 128 108
99 KeDelayExecutionThread stdcall, 12 ABI bytes 465 465 465 465 919
100 KeDisconnectInterrupt stdcall, 4 ABI bytes 104 104 104 104 53
101 KeEnterCriticalRegion stdcall, 0 ABI bytes 9 9 9 9 10
102 MmGlobalData data Unknown Unknown unknown / data unknown / data Unknown
103 KeGetCurrentIrql stdcall, 0 ABI bytes 8 8 8 8 6
104 KeGetCurrentThread stdcall, 0 ABI bytes 6 6 6 6 11
105 KeInitializeApc stdcall, 28 ABI bytes 68 68 68 68 70
106 KeInitializeDeviceQueue stdcall, 4 ABI bytes 28 28 28 28 22
107 KeInitializeDpc stdcall, 12 ABI bytes 30 30 30 30 30
108 KeInitializeEvent stdcall, 12 ABI bytes 33 33 33 33 34
109 KeInitializeInterrupt stdcall, 28 ABI bytes 109 109 121 121 156
110 KeInitializeMutant stdcall, 8 ABI bytes 93 93 93 93 137
111 KeInitializeQueue stdcall, 8 ABI bytes 66 66 66 66 71
112 KeInitializeSemaphore stdcall, 12 ABI bytes 36 36 36 36 37
113 KeInitializeTimerEx stdcall, 8 ABI bytes 45 45 45 45 47
114 KeInsertByKeyDeviceQueue stdcall, 12 ABI bytes 72 72 72 72 118
115 KeInsertDeviceQueue stdcall, 8 ABI bytes 46 46 46 46 83
116 KeInsertHeadQueue stdcall, 8 ABI bytes 40 40 40 40 70
117 KeInsertQueue stdcall, 8 ABI bytes 40 40 40 40 68
118 KeInsertQueueApc stdcall, 16 ABI bytes 63 63 63 63 339
119 KeInsertQueueDpc stdcall, 12 ABI bytes 120 120 120 120 174
120 KeInterruptTime data Unknown Unknown unknown / data unknown / data Unknown
121 KeIsExecutingDpc stdcall, 0 ABI bytes 6 6 6 6 13
122 KeLeaveCriticalRegion stdcall, 0 ABI bytes 35 35 33 33 47
123 KePulseEvent stdcall, 12 ABI bytes 86 86 86 86 111
124 KeQueryBasePriorityThread stdcall, 4 ABI bytes 49 49 49 49 69
125 KeQueryInterruptTime stdcall, 0 ABI bytes 24 24 24 24 10
126 KeQueryPerformanceCounter stdcall, 0 ABI bytes 59 59 59 59 122
127 KeQueryPerformanceFrequency stdcall, 0 ABI bytes 8 8 8 8 8
128 KeQuerySystemTime stdcall, 4 ABI bytes 35 35 35 35 38
129 KeRaiseIrqlToDpcLevel stdcall, 0 ABI bytes 15 15 15 15 13
130 KeRaiseIrqlToSynchLevel stdcall, 0 ABI bytes 15 15 15 15 13
131 KeReleaseMutant stdcall, 16 ABI bytes 165 165 165 165 263
132 KeReleaseSemaphore stdcall, 16 ABI bytes 117 117 117 117 128
133 KeRemoveByKeyDeviceQueue stdcall, 8 ABI bytes 79 79 79 79 117
134 KeRemoveDeviceQueue stdcall, 4 ABI bytes 37 37 37 37 82
135 KeRemoveEntryDeviceQueue stdcall, 8 ABI bytes 47 47 47 47 80
136 KeRemoveQueue stdcall, 12 ABI bytes 457 457 456 456 1592
137 KeRemoveQueueDpc stdcall, 4 ABI bytes 33 33 33 33 100
138 KeResetEvent stdcall, 4 ABI bytes 30 30 30 30 43
139 KeRestoreFloatingPointState stdcall, 4 ABI bytes 270 270 268 268 176
140 KeResumeThread stdcall, 4 ABI bytes 63 63 63 63 97
141 KeRundownQueue stdcall, 4 ABI bytes 73 73 73 73 137
142 KeSaveFloatingPointState stdcall, 4 ABI bytes 336 336 336 336 249
143 KeSetBasePriorityThread stdcall, 8 ABI bytes 206 206 206 206 309
144 KeSetDisableBoostThread stdcall, 8 ABI bytes 34 34 34 34 40
145 KeSetEvent stdcall, 12 ABI bytes 119 119 119 119 225
146 KeSetEventBoostPriority stdcall, 8 ABI bytes 72 72 72 72 226
147 KeSetPriorityProcess stdcall, 8 ABI bytes 250 250 250 250 80
148 KeSetPriorityThread stdcall, 8 ABI bytes 57 57 57 57 90
149 KeSetTimer stdcall, 16 ABI bytes 26 26 26 26 51
150 KeSetTimerEx stdcall, 20 ABI bytes 186 186 186 186 367
151 KeStallExecutionProcessor stdcall, 4 ABI bytes 42 56 42 56 Unknown
152 KeSuspendThread stdcall, 4 ABI bytes 91 91 91 91 141
153 KeSynchronizeExecution stdcall, 12 ABI bytes 45 45 45 45 154
154 KeSystemTime data Unknown Unknown unknown / data unknown / data Unknown
155 KeTestAlertThread stdcall, 4 ABI bytes 66 66 66 66 89
156 KeTickCount data Unknown Unknown unknown / data unknown / data Unknown
157 KeTimeIncrement data Unknown Unknown unknown / data unknown / data Unknown
158 KeWaitForMultipleObjects stdcall, 32 ABI bytes 769 769 769 769 1463
159 KeWaitForSingleObject stdcall, 20 ABI bytes 620 620 619 619 1203
160 KfRaiseIrql fastcall, 4 ABI bytes 14 14 14 14 12
161 KfLowerIrql fastcall, 4 ABI bytes 82 83 82 83 78
162 KiBugCheckData data Unknown Unknown unknown / data unknown / data Unknown
163 KiUnlockDispatcherDatabase fastcall, 4 ABI bytes 148 148 148 148 282
164 LaunchDataPage data Unknown Unknown unknown / data unknown / data Unknown
165 MmAllocateContiguousMemory stdcall, 4 ABI bytes 20 20 20 20 52
166 MmAllocateContiguousMemoryEx stdcall, 20 ABI bytes 450 450 450 450 404
167 MmAllocateSystemMemory stdcall, 8 ABI bytes 30 30 30 30 530
168 MmClaimGpuInstanceMemory stdcall, 8 ABI bytes 188 188 188 188 229
169 MmCreateKernelStack stdcall, 8 ABI bytes 42 42 42 42 87
170 MmDeleteKernelStack stdcall, 8 ABI bytes 32 32 32 32 85
171 MmFreeContiguousMemory stdcall, 4 ABI bytes 99 99 99 99 429
172 MmFreeSystemMemory stdcall, 8 ABI bytes 21 21 21 21 199
173 MmGetPhysicalAddress stdcall, 4 ABI bytes 78 78 78 78 36
174 MmIsAddressValid stdcall, 4 ABI bytes 80 80 80 80 80
175 MmLockUnlockBufferPages stdcall, 12 ABI bytes 143 143 143 143 632
176 MmLockUnlockPhysicalPage stdcall, 8 ABI bytes 62 62 62 62 55
177 MmMapIoSpace stdcall, 12 ABI bytes 201 201 201 201 67
178 MmPersistContiguousMemory stdcall, 12 ABI bytes 96 96 96 96 257
179 MmQueryAddressProtect stdcall, 4 ABI bytes 97 97 97 97 195
180 MmQueryAllocationSize stdcall, 4 ABI bytes 61 61 61 61 95
181 MmQueryStatistics stdcall, 4 ABI bytes 118 118 118 118 220
182 MmSetAddressProtect stdcall, 12 ABI bytes 131 131 131 131 276
183 MmUnmapIoSpace stdcall, 8 ABI bytes 83 83 83 83 3
184 NtAllocateVirtualMemory stdcall, 20 ABI bytes 1047 1076 1047 1076 52
185 NtCancelTimer stdcall, 8 ABI bytes 156 156 156 156 442
186 NtClearEvent stdcall, 4 ABI bytes 49 49 49 49 85
187 NtClose stdcall, 4 ABI bytes 136 136 136 136 29
188 NtCreateDirectoryObject stdcall, 8 ABI bytes 58 58 58 58 77
189 NtCreateEvent stdcall, 16 ABI bytes 107 107 107 107 238
190 NtCreateFile stdcall, 36 ABI bytes 41 41 41 41 140
191 NtCreateIoCompletion stdcall, 16 ABI bytes 72 72 72 72 83
192 NtCreateMutant stdcall, 12 ABI bytes 58 58 58 58 189
193 NtCreateSemaphore stdcall, 16 ABI bytes 85 85 85 85 240
194 NtCreateTimer stdcall, 12 ABI bytes 105 105 105 105 84
195 NtDeleteFile stdcall, 4 ABI bytes 110 110 110 110 233
196 NtDeviceIoControlFile stdcall, 40 ABI bytes 44 44 44 44 95
197 NtDuplicateObject stdcall, 12 ABI bytes 77 77 77 77 1283
198 NtFlushBuffersFile stdcall, 8 ABI bytes 224 224 221 221 501
199 NtFreeVirtualMemory stdcall, 12 ABI bytes 684 684 684 684 556
200 NtFsControlFile stdcall, 40 ABI bytes 44 44 44 44 93
201 NtOpenDirectoryObject stdcall, 8 ABI bytes 23 23 23 23 77
202 NtOpenFile stdcall, 24 ABI bytes 37 37 37 37 137
203 NtOpenSymbolicLinkObject stdcall, 8 ABI bytes 23 23 23 23 77
204 NtProtectVirtualMemory stdcall, 16 ABI bytes 387 387 387 387 387
205 NtPulseEvent stdcall, 8 ABI bytes 67 67 67 67 99
206 NtQueueApcThread stdcall, 20 ABI bytes 122 122 122 122 244
207 NtQueryDirectoryFile stdcall, 40 ABI bytes 281 281 281 281 305
208 NtQueryDirectoryObject stdcall, 24 ABI bytes 239 239 239 239 1013
209 NtQueryEvent stdcall, 8 ABI bytes 60 60 60 60 51
210 NtQueryFullAttributesFile stdcall, 8 ABI bytes 109 109 109 109 249
211 NtQueryInformationFile stdcall, 20 ABI bytes 574 574 571 571 1352
212 NtQueryIoCompletion stdcall, 8 ABI bytes 52 52 52 52 51
213 NtQueryMutant stdcall, 8 ABI bytes 80 80 80 80 51
214 NtQuerySemaphore stdcall, 8 ABI bytes 60 60 60 60 51
215 NtQuerySymbolicLinkObject stdcall, 12 ABI bytes 119 119 119 119 177
216 NtQueryTimer stdcall, 8 ABI bytes 100 100 100 100 51
217 NtQueryVirtualMemory stdcall, 8 ABI bytes 516 516 516 516 448
218 NtQueryVolumeInformationFile stdcall, 20 ABI bytes 335 335 332 332 867
219 NtReadFile stdcall, 32 ABI bytes 460 460 460 460 79
220 NtReadFileScatter stdcall, 32 ABI bytes 501 501 501 501 64
221 NtReleaseMutant stdcall, 8 ABI bytes 88 88 88 88 145
222 NtReleaseSemaphore stdcall, 12 ABI bytes 102 102 102 102 201
223 NtRemoveIoCompletion stdcall, 20 ABI bytes 167 167 167 167 302
224 NtResumeThread stdcall, 8 ABI bytes 59 59 59 59 101
225 NtSetEvent stdcall, 8 ABI bytes 67 67 67 67 185
226 NtSetInformationFile stdcall, 20 ABI bytes 951 951 948 948 524
227 NtSetIoCompletion stdcall, 20 ABI bytes 64 64 64 64 132
228 NtSetSystemTime stdcall, 8 ABI bytes 125 125 125 125 427
229 NtSetTimerEx stdcall, 32 ABI bytes 366 366 366 366 67
230 NtSignalAndWaitForSingleObjectEx stdcall, 20 ABI bytes 219 277 219 277 54
231 NtSuspendThread stdcall, 8 ABI bytes 119 165 119 165 122
232 NtUserIoApcDispatcher stdcall, 12 ABI bytes 46 46 46 46 71
233 NtWaitForSingleObject stdcall, 12 ABI bytes 22 22 22 22 200
234 NtWaitForSingleObjectEx stdcall, 16 ABI bytes 97 117 97 117 147
235 NtWaitForMultipleObjectsEx stdcall, 24 ABI bytes 345 371 333 353 92
236 NtWriteFile stdcall, 32 ABI bytes 482 482 482 482 79
237 NtWriteFileGather stdcall, 32 ABI bytes 523 523 523 523 67
238 NtYieldExecution stdcall, 0 ABI bytes 166 166 166 166 408
239 ObCreateObject stdcall, 16 ABI bytes 270 270 270 270 654
240 ObDirectoryObjectType data Unknown Unknown unknown / data unknown / data Unknown
241 ObInsertObject stdcall, 16 ABI bytes 496 496 496 496 560
242 ObMakeTemporaryObject stdcall, 4 ABI bytes 56 56 56 56 52
243 ObOpenObjectByName stdcall, 16 ABI bytes 97 97 97 97 130
244 ObOpenObjectByPointer stdcall, 12 ABI bytes 80 80 80 80 278
245 ObpObjectHandleTable data Unknown Unknown unknown / data unknown / data Unknown
246 ObReferenceObjectByHandle stdcall, 12 ABI bytes 119 119 119 119 186
247 ObReferenceObjectByName stdcall, 20 ABI bytes 29 29 29 29 283
248 ObReferenceObjectByPointer stdcall, 8 ABI bytes 45 45 45 45 110
249 ObSymbolicLinkObjectType data Unknown Unknown unknown / data unknown / data Unknown
250 ObfDereferenceObject fastcall, 4 ABI bytes 67 67 62 62 46
251 ObfReferenceObject fastcall, 4 ABI bytes 28 28 21 21 45
252 PhyGetLinkState stdcall, 4 ABI bytes 63 63 63 63 59
253 PhyInitialize stdcall, 8 ABI bytes 423 423 423 423 343
254 PsCreateSystemThread stdcall, 20 ABI bytes 42 42 42 42 83
255 PsCreateSystemThreadEx stdcall, 40 ABI bytes 416 416 416 416 302
256 PsQueryStatistics stdcall, 4 ABI bytes 45 45 45 45 81
257 PsSetCreateThreadNotifyRoutine stdcall, 4 ABI bytes 47 47 47 47 171
258 PsTerminateSystemThread stdcall, 4 ABI bytes 282 282 282 282 57
259 PsThreadObjectType data Unknown Unknown unknown / data unknown / data Unknown
260 RtlAnsiStringToUnicodeString stdcall, 12 ABI bytes 158 158 158 158 218
261 RtlAppendStringToString stdcall, 8 ABI bytes 76 76 76 76 90
262 RtlAppendUnicodeStringToString stdcall, 8 ABI bytes 102 102 102 102 131
263 RtlAppendUnicodeToString stdcall, 8 ABI bytes 113 113 113 113 138
264 RtlAssert stdcall, 16 ABI bytes 158 158 158 158 12
265 RtlCaptureContext stdcall, 4 ABI bytes 96 163 96 163 Unknown
266 RtlCaptureStackBackTrace stdcall, 16 ABI bytes 112 112 112 112 147
267 RtlCharToInteger stdcall, 12 ABI bytes 266 290 266 290 235
268 RtlCompareMemory stdcall, 12 ABI bytes 71 71 71 71 Unknown
269 RtlCompareMemoryUlong stdcall, 12 ABI bytes 33 33 33 33 Unknown
270 RtlCompareString stdcall, 12 ABI bytes 140 140 140 140 161
271 RtlCompareUnicodeString stdcall, 12 ABI bytes 334 334 334 334 173
272 RtlCopyString stdcall, 8 ABI bytes 66 66 66 66 59
273 RtlCopyUnicodeString stdcall, 8 ABI bytes 94 94 94 94 Unknown
274 RtlCreateUnicodeString stdcall, 8 ABI bytes 74 74 74 74 103
275 RtlDowncaseUnicodeChar stdcall, 4 ABI bytes 78 78 78 78 21
276 RtlDowncaseUnicodeString stdcall, 12 ABI bytes 200 200 209 209 163
277 RtlEnterCriticalSection stdcall, 4 ABI bytes 65 69 65 69 86
278 RtlEnterCriticalSectionAndRegion stdcall, 4 ABI bytes 81 101 81 101 27
279 RtlEqualString stdcall, 12 ABI bytes 115 115 115 115 64
280 RtlEqualUnicodeString stdcall, 12 ABI bytes 260 260 260 260 64
281 RtlExtendedIntegerMultiply stdcall, 12 ABI bytes 86 86 86 86 38
282 RtlExtendedLargeIntegerDivide stdcall, 16 ABI bytes 89 90 89 90 93
283 RtlExtendedMagicDivide stdcall, 20 ABI bytes 142 142 142 142 274
284 RtlFillMemory stdcall, 12 ABI bytes 49 49 49 49 Unknown
285 RtlFillMemoryUlong stdcall, 12 ABI bytes 22 22 22 22 Unknown
286 RtlFreeAnsiString stdcall, 4 ABI bytes 26 26 26 26 54
287 RtlFreeUnicodeString stdcall, 4 ABI bytes 26 26 26 26 54
288 RtlGetCallersAddress stdcall, 8 ABI bytes 133 133 133 133 106
289 RtlInitAnsiString stdcall, 8 ABI bytes 43 43 43 43 65
290 RtlInitUnicodeString stdcall, 8 ABI bytes 47 47 47 47 69
291 RtlInitializeCriticalSection stdcall, 4 ABI bytes 37 37 37 37 43
292 RtlIntegerToChar stdcall, 16 ABI bytes 216 240 216 240 150
293 RtlIntegerToUnicodeString stdcall, 12 ABI bytes 76 76 73 73 102
294 RtlLeaveCriticalSection stdcall, 4 ABI bytes 41 54 41 54 56
295 RtlLeaveCriticalSectionAndRegion stdcall, 4 ABI bytes 74 86 74 86 27
296 RtlLowerChar stdcall, 4 ABI bytes 95 95 92 92 22
297 RtlMapGenericMask stdcall, 8 ABI bytes 80 80 80 80 66
298 RtlMoveMemory stdcall, 12 ABI bytes 67 67 67 67 Unknown
299 RtlMultiByteToUnicodeN stdcall, 20 ABI bytes 61 61 61 61 67
300 RtlMultiByteToUnicodeSize stdcall, 12 ABI bytes 17 17 17 17 17
301 RtlNtStatusToDosError stdcall, 4 ABI bytes 208 208 215 215 130
302 RtlRaiseException stdcall, 4 ABI bytes 154 154 154 154 Unknown
303 RtlRaiseStatus stdcall, 4 ABI bytes 40 40 40 40 Unknown
304 RtlTimeFieldsToTime stdcall, 8 ABI bytes 399 399 399 399 411
305 RtlTimeToTimeFields stdcall, 8 ABI bytes 301 301 310 310 375
306 RtlTryEnterCriticalSection stdcall, 4 ABI bytes 72 72 72 72 63
307 RtlUlongByteSwap fastcall, 4 ABI bytes 5 5 5 5 5
308 RtlUnicodeStringToAnsiString stdcall, 12 ABI bytes 179 179 179 179 208
309 RtlUnicodeStringToInteger stdcall, 12 ABI bytes 360 384 360 384 329
310 RtlUnicodeToMultiByteN stdcall, 20 ABI bytes 68 68 68 68 75
311 RtlUnicodeToMultiByteSize stdcall, 12 ABI bytes 17 17 17 17 17
312 RtlUnwind stdcall, 16 ABI bytes 420 420 420 420 563
313 RtlUpcaseUnicodeChar stdcall, 4 ABI bytes 75 75 75 75 21
314 RtlUpcaseUnicodeString stdcall, 12 ABI bytes 197 197 211 211 148
315 RtlUpcaseUnicodeToMultiByteN stdcall, 20 ABI bytes 180 180 180 180 84
316 RtlUpperChar stdcall, 4 ABI bytes 92 92 92 92 22
317 RtlUpperString stdcall, 8 ABI bytes 64 64 64 64 79
318 RtlUshortByteSwap fastcall, 4 ABI bytes 5 5 5 5 5
319 RtlWalkFrameChain stdcall, 12 ABI bytes 161 168 161 168 383
320 RtlZeroMemory stdcall, 8 ABI bytes 36 36 36 36 Unknown
321 XboxEEPROMKey data Unknown Unknown unknown / data unknown / data Unknown
322 XboxHardwareInfo data Unknown Unknown unknown / data unknown / data Unknown
323 XboxHDKey data Unknown Unknown unknown / data unknown / data Unknown
324 XboxKrnlVersion data Unknown Unknown unknown / data unknown / data Unknown
325 XboxSignatureKey data Unknown Unknown unknown / data unknown / data Unknown
326 XeImageFileName data Unknown Unknown unknown / data unknown / data Unknown
327 XeLoadSection stdcall, 4 ABI bytes 111 111 111 111 324
328 XeUnloadSection stdcall, 4 ABI bytes 60 60 58 58 201
329 READ_PORT_BUFFER_UCHAR stdcall, 12 ABI bytes 21 21 21 21 19
330 READ_PORT_BUFFER_USHORT stdcall, 12 ABI bytes 22 22 22 22 20
331 READ_PORT_BUFFER_ULONG stdcall, 12 ABI bytes 21 21 21 21 19
332 WRITE_PORT_BUFFER_UCHAR stdcall, 12 ABI bytes 21 21 21 21 19
333 WRITE_PORT_BUFFER_USHORT stdcall, 12 ABI bytes 22 22 22 22 20
334 WRITE_PORT_BUFFER_ULONG stdcall, 12 ABI bytes 21 21 21 21 19
335 XcSHAInit stdcall, 4 ABI bytes 6 6 6 6 23
336 XcSHAUpdate stdcall, 12 ABI bytes 6 6 6 6 39
337 XcSHAFinal stdcall, 8 ABI bytes 6 6 6 6 31
338 XcRC4Key stdcall, 12 ABI bytes 6 6 6 6 39
339 XcRC4Crypt stdcall, 12 ABI bytes 6 6 6 6 39
340 XcHMAC stdcall, 28 ABI bytes 34 34 10 10 67
341 XcPKEncPublic stdcall, 12 ABI bytes 6 6 6 6 39
342 XcPKDecPrivate stdcall, 12 ABI bytes 6 6 6 6 39
343 XcPKGetKeyLen stdcall, 4 ABI bytes 6 6 6 6 23
344 XcVerifyPKCS1Signature stdcall, 12 ABI bytes 6 6 6 6 39
345 XcModExp stdcall, 20 ABI bytes 28 28 10 10 53
346 XcDESKeyParity stdcall, 8 ABI bytes 6 6 6 6 31
347 XcKeyTable stdcall, 12 ABI bytes 6 6 6 6 39
348 XcBlockCrypt stdcall, 20 ABI bytes 28 28 10 10 53
349 XcBlockCryptCBC stdcall, 28 ABI bytes 34 34 10 10 67
350 XcCryptService stdcall, 8 ABI bytes 6 6 6 6 31
351 XcUpdateCrypto stdcall, 8 ABI bytes 235 235 235 235 55
352 RtlRip stdcall, 12 ABI bytes 151 151 151 151 12
353 XboxLANKey data Unknown Unknown unknown / data unknown / data Unknown
354 XboxAlternateSignatureKeys data Unknown Unknown unknown / data unknown / data Unknown
355 XePublicKeyData data Unknown Unknown unknown / data unknown / data Unknown
356 HalBootSMCVideoMode data Unknown Unknown unknown / data unknown / data Unknown
357 IdexChannelObject data Unknown Unknown unknown / data unknown / data Unknown
358 HalIsResetOrShutdownPending stdcall, 0 ABI bytes 11 11 11 11 6
359 IoMarkIrpMustComplete stdcall, 4 ABI bytes 28 28 28 28 3
360 HalInitiateShutdown stdcall, 0 ABI bytes 113 26664 113 25278 8
361 RtlSnprintf cdecl, 0 ABI bytes 87 87 87 87 43
362 RtlSprintf cdecl, 0 ABI bytes 88 88 88 88 44
363 RtlVsnprintf cdecl, 0 ABI bytes 86 86 86 86 40
364 RtlVsprintf cdecl, 0 ABI bytes 87 87 87 87 41
365 HalEnableSecureTrayEject stdcall, 0 ABI bytes 34 34 34 34 8
366 HalWriteSMCScratchRegister stdcall, 4 ABI bytes 24 24 24 24 26

How to use a suspicious row

  1. Confirm the entry is a body rather than a thunk or ABI adapter.
  2. Identify the corresponding owned helper closure, including shared callees and data.
  3. Locate those contents on physical pages; do not add overlapping entry walks.
  4. Establish all runtime consumers, including callbacks, interrupts, failures, reset and returning frames.
  5. Implement an independent bounded change using owned source and public behavior.
  6. Rebuild and measure the actual released backing, successful title allocation capacity and complete operation cost.

Reference instruction bodies, pseudocode, private strings and recovered call graphs are not published or used as a product implementation template. These are original numeric observations and public names.

Full inventories and decisions