Runtime calls and data exports

This page covers all 208 exports outside the Av/Dbg/Ex/Hal/Interlocked/Io/Ke/Kf/Ki call families, including Kd flags, debug memory extensions and data. Kernel calls covers the complementary families. Ordinals come from the public community export definition and mappings from the ordered SpiritBoot source overlays. Scope is SpiritBoot 271495969fecc933ef3c3ff4ad0892f5e99bca2d over Roswell 1569e2e89fb47cc72b9c704a8884f98200432bd4; these are implementation contracts and known gaps, not a claim of exhaustive commercial BIOS equivalence. No commercial BIOS source/disassembly or private runtime evidence is reproduced.

Calling-convention byte counts are decorated argument bytes, not universally stack bytes: fastcall places eligible arguments in ECX/EDX. cdecl has caller cleanup; undecorated printf exports are variadic and a zero decoration count does not mean no arguments. DATA has no calling convention. Prototypes below use backend implementation names when adapters exist; Xbox inputs have the listed ordinal ABI. NTAPI means stdcall in this x86 build. SAL annotations express source intent and do not establish defensive pointer validation.

Generated unmapped functions are nonreturning ABI-shaped stubs: KeBugCheckEx(0xE0000002, ordinal, 0, 0, 0). Unmapped DATA defaults to a four-byte zero word unless explicitly initialized. A mapped name can still be inert or a sized zero placeholder; its status is stated individually. The generator and mapping comments are not a substitute for the actual body: some historical no-op/stub comments are obsolete.

Handles, object pointers, pool allocations, contiguous memory, VM ranges and string buffers have distinct ownership operations. Check NTSTATUS and IO_STATUS_BLOCK; STATUS_PENDING is dispatch acceptance, not final success. Native Nt handle lookup and filesystem paths generally require passive/APC-compatible context. Only entries explicitly discussing DPC-safe behavior provide such an adapter.

Xbox object attributes are a three-field ANSI structure (RootDirectory, ObjectName, Attributes), translated to native Unicode attributes. Names are rewritten for the reconstructed namespace and unrooted named objects are placed under \Xbox; allocated translation buffers are released by adapters. The translator source, not the legacy NT attribute layout, defines accepted input shape. Individual IO/file classes can still expose native layouts where no conversion is implemented.

Public source evidence: export ABI, map and adapters, base Roswell tree. See source overlay ledger for later ordered patches. Local source-only fixture selector changes are excluded from release claims.

Fsc

FscGetCacheSize

ABI: ordinal 35; stdcall; 0 decorated argument bytes. Binding: mapped function; FscGetCacheSize.

PFN_COUNT NTAPI FscGetCacheSize(VOID);

Returns active ordinary cache capacity in pages: active blocks × 4. Reserve buffers used for reentrant writeback are excluded. Query the result after resizing; a requested target is not guaranteed to be reached.

Source: ntoskrnl/xb/mm/cache.c; later overlays in the ledger below.

FscInvalidateIdleBlocks

ABI: ordinal 36; stdcall; 0 decorated argument bytes. Binding: mapped function; FscInvalidateIdleBlocks.

VOID NTAPI FscInvalidateIdleBlocks(VOID);

Under the cache mutex, discards mappings only for clean, unreferenced, nonbusy blocks. Dirty or pinned contents survive; buffers remain allocated and capacity does not decrease. This does not flush dirty data.

Source: ntoskrnl/xb/mm/cache.c; later overlays in the ledger below.

FscSetCacheSize

ABI: ordinal 37; stdcall; 4 decorated argument bytes. Binding: mapped function; FscSetCacheSize.

NTSTATUS NTAPI FscSetCacheSize( IN PFN_COUNT NumberOfCachePages);

Rounds pages up to 4-page/16 KiB blocks, clamps to 4..32 blocks (16..128 pages, or 64..512 KiB), and serializes with the cache mutex. Growth can stop partway with STATUS_INSUFFICIENT_RESOURCES. Shrink skips busy/pinned blocks; dirty blocks must flush successfully before retirement. A flush error is returned and dirty contents retained, while previously retired clean blocks stay retired. Success can leave capacity above target because of pins.

Source: ntoskrnl/xb/mm/cache.c; later overlays in the ledger below.

Kd

KdDebuggerEnabled

ABI: ordinal 88; DATA. Binding: generated DATA scaffold; initializer 1.

Unmapped DATA scaffold with explicit initializer 1: a four-byte generated word whose low byte is true. This compatibility flag does not prove a live remote debugger is attached, nor is it a callable function.

Source: ntoskrnl/xb/gen-exports.py.

KdDebuggerNotPresent

ABI: ordinal 89; DATA. Binding: generated DATA scaffold; initializer 1.

Unmapped DATA scaffold with explicit initializer 1: four-byte generated word, low byte true. Reports the configured no-debugger flag; do not invert the enabled flag into an attachment inference. Storage is generated, not the active native debugger's control object.

Source: ntoskrnl/xb/gen-exports.py.

Mm

MmGlobalData

ABI: ordinal 102; DATA. Binding: mapped DATA; MmGlobalData.

Mapped DATA: 32 aligned zero bytes, a sized placeholder for eight console-shaped internal pointers. It does not expose the NT memory manager's internals; treating zero words as live pointers is unsupported.

Source: ntoskrnl/xb/sizeddata.c.

Launch

LaunchDataPage

ABI: ordinal 164; DATA. Binding: mapped DATA; LaunchDataPage.

Mapped DATA: a pointer to the launch-data page, initially null on a cold boot; warm-launch persistence can restore/adopt it. This is a pointer export, not the page bytes or an allocation function. Consult the launch/persistence source before writing through it.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

Mm

MmAllocateContiguousMemory

ABI: ordinal 165; stdcall; 4 decorated argument bytes. Binding: mapped function; NxMmAllocateContiguousMemory.

PVOID NTAPI NxMmAllocateContiguousMemory(IN SIZE_T NumberOfBytes);

Returns page-rounded contiguous RAM through the KSEG0 alias (PA OR 0x80000000); calls the Ex form with low=0, high=0xffffffff, alignment=0, PAGE_READWRITE. Returns null on failure. Free with MmFreeContiguousMemory, not ExFreePool.

Source: ntoskrnl/xb/mm/contig.c.

MmAllocateContiguousMemoryEx

ABI: ordinal 166; stdcall; 20 decorated argument bytes. Binding: mapped function; NxMmAllocateContiguousMemoryEx.

PVOID NTAPI NxMmAllocateContiguousMemoryEx( IN SIZE_T NumberOfBytes, IN ULONG_PTR LowestAcceptableAddress, IN ULONG_PTR HighestAcceptableAddress, IN ULONG_PTR Alignment, IN ULONG Protect);

Page-rounds size, clamps the high physical address below the 64 MiB title window, excludes the fixed GPU instance region for generic requests, and selects a tracked contiguous run satisfying bounds/alignment. The physical allocator may relocate eligible live pages, reclaim empty pool buckets and retry. Returns null on exhausted runs/tracking. Protect is currently ignored in the physical path; return alias is cached KSEG0. Alignment above a page is converted to whole pages; callers must use meaningful page/power-of-two constraints.

Source: ntoskrnl/xb/mm/contig.c.

Merged update after this page's original baseline: PR #93 independently merged patch 0043. After releasing NxContigLock for empty-bucket reclaim, the contiguous allocator now selects a fresh tracking slot before taking a retry run. Another allocation can occupy the old slot while the lock is released; reusing it would overwrite that allocation's ownership record. Failed slot acquisition returns NULL before taking a run. The production-body fixture has seven passing cases, including competing allocation, table growth and failed growth. This bookkeeping fix changes neither the physical allocation window nor the translation API, and does not establish a native title failure cause.

MmAllocateSystemMemory

ABI: ordinal 167; stdcall; 8 decorated argument bytes. Binding: mapped function; MmAllocateSystemMemory.

PVOID NTAPI MmAllocateSystemMemory(_In_ SIZE_T Size, _In_ ULONG Protect);

Tries the implemented 64 MiB system VA aperture [0xD0000000,0xD4000000) with requested protection. If allocation fails, falls back to tagged nonpaged pool, so the result may lie outside the aperture and fallback does not establish the requested aperture protection. Null denotes failure; release with MmFreeSystemMemory and the original size.

Source: ntoskrnl/xb/mm/api.c; later overlays in the ledger below.

MmClaimGpuInstanceMemory

ABI: ordinal 168; stdcall; 8 decorated argument bytes. Binding: mapped function; NxMmClaimGpuInstanceMemory.

PVOID NTAPI NxMmClaimGpuInstanceMemory( IN SIZE_T NumberOfBytes, OUT SIZE_T *NumberOfPaddingBytes);

Reserves a page-rounded, at-most-64 KiB tail of the fixed GPU instance region beneath PA 0x03ff0000; releases pages on shrink and relocates eligible users on growth. MAXULONG_PTR queries current claim without changing it. Returns fixed KSEG0 heap-ceiling alias 0x83ff0000, plus optional 64 KiB padding count, rather than a normal allocation or claim-dependent base. Failed reclamation is logged and claim still updated, so return alone does not prove all existing owners were reclaimed.

Source: ntoskrnl/xb/mm/contig.c.

MmCreateKernelStack

ABI: ordinal 169; stdcall; 8 decorated argument bytes. Binding: mapped function; NxMmCreateKernelStack.

PVOID NTAPI NxMmCreateKernelStack(_In_ SIZE_T NumberOfBytes, _In_ BOOLEAN DebuggerThread);

Ignores DebuggerThread; zero size returns null. Rounds size to pages and allocates tagged nonpaged pool. Returns the top (base+rounded size) for a downward-growing stack, not its base; increments stack statistics. Delete using both original limits supplied to MmDeleteKernelStack.

Source: ntoskrnl/xb/mm/api.c; later overlays in the ledger below.

MmDeleteKernelStack

ABI: ordinal 170; stdcall; 8 decorated argument bytes. Binding: mapped function; NxMmDeleteKernelStack.

VOID NTAPI NxMmDeleteKernelStack(_In_ PVOID StackBase, _In_ PVOID StackLimit);

Null StackBase or StackLimit>=StackBase is inert. Otherwise rounds StackBase−StackLimit upward to pages, frees StackBase−rounded size with stack pool tag and subtracts stack statistics. There is no DebuggerThread argument. Pass the actual matching stack bounds; incorrect limits can free the wrong pool address.

Source: ntoskrnl/xb/mm/api.c; later overlays in the ledger below.

MmFreeContiguousMemory

ABI: ordinal 171; stdcall; 4 decorated argument bytes. Binding: mapped function; NxMmFreeContiguousMemory.

VOID NTAPI NxMmFreeContiguousMemory(IN PVOID BaseAddress);

Removes a tracked contiguous allocation, or a restored persistent run, and releases its backing ownership. Unknown addresses are diagnosed and do not become pool frees. Pass the allocation's base; freeing an interior alias is unsupported.

Source: ntoskrnl/xb/mm/contig.c.

MmFreeSystemMemory

ABI: ordinal 172; stdcall; 8 decorated argument bytes. Binding: mapped function; MmFreeSystemMemory.

ULONG NTAPI MmFreeSystemMemory(_In_ PVOID Base, _In_ SIZE_T Size);

Null returns zero. Aperture addresses use the aperture free helper; fallback pool addresses use the allocation tag. Return is pages freed, not Boolean: a one-byte pool free reports one page. Caller supplies original allocation size.

Source: ntoskrnl/xb/mm/api.c; later overlays in the ledger below.

MmGetPhysicalAddress

ABI: ordinal 173; stdcall; 4 decorated argument bytes. Binding: mapped function; NxMmGetPhysicalAddress.

ULONG_PTR NTAPI NxMmGetPhysicalAddress(IN PVOID Va);

Release baseline: returns a 32-bit address. For 0x80000000 <= Va < 0x84000000, the adapter returns Va & 0x03ffffff without consulting page tables. For 0xf0000000 <= Va < 0xffc00000, it returns the input address unchanged under the existing WC/device API contract. Other addresses use the maintained page-table walker; the enabled NXK_MM_VM implementation in ntoskrnl/xb/mm/fault.c handles 4 MiB large pages and 4 KiB mappings and returns zero when absent. This does not pin a movable page or establish DMA mapping lifetime. Source: released kernel implementation, with later overlays in the ledger below.

Conditional defect, draft robustness repair: issue #90 concerns the WB mask shortcut when a live mapping is nonidentity or absent. A loader placing System PTE space inside the nominal WB range could expose it. The maintained nxldr instead passes LoaderPagesSpanned = 0x4400, which puts MmSystemPteSpaceStart at 0x84400000 and allows the full 64 MiB WB paint; the old 0x82c00000 painter comment is stale for this loader. This does not establish an actual WB remapping in the current release or a cause of a Forza failure. See Boot-Memory-and-Lifecycle for immutable layout sources.

Draft PR #91, specifically patch 0042 at d0d497ca, removes the WB shortcut and uses live PDE/PTE translation. It preserves the WC/device API return contract; the WC page-table alias still maps low RAM, so the unchanged high API address must not be mistaken for the underlying PTE frame.

The candidate includes an eleven-case host fixture extracting both production bodies. The original ten cases failed six with the prior adapter and passed ten after repair; the candidate also passes the added invalid-PDE case. These are synthetic source-path checks. PR #91 remains draft, native title qualification is pending, and patch 0042 is not part of this page's released main baseline. See Boot-Memory-and-Lifecycle for mapping and lifetime constraints.

MmIsAddressValid

ABI: ordinal 174; stdcall; 4 decorated argument bytes. Binding: mapped function; NxMmIsAddressValid.

BOOLEAN NTAPI NxMmIsAddressValid(IN PVOID Va);

Reports true for configured KSEG0, WC/MMIO and system aperture ranges; otherwise asks NT's page-table validity query. The static-aperture fast path is a range test, so true alone is not an allocation-ownership guarantee or proof that device accesses are meaningful.

Source: ntoskrnl/xb/mm/iospace.c.

MmLockUnlockBufferPages

ABI: ordinal 175; stdcall; 12 decorated argument bytes. Binding: mapped function; MmLockUnlockBufferPages.

VOID NTAPI MmLockUnlockBufferPages(PVOID Base, SIZE_T Size, BOOLEAN Unlock);

Void pin/unpin operation covering every page touched by the byte range. Zero length, arithmetic wrap, invalid VA or rejected PFN/count preflight makes the whole request inert. Alias multiplicity contributes separate pin transitions. Small batches retain translated PFNs; larger ones use bulk scratch cleanup. Count overflow conservatively retains pins. The public ABI supplies no error result; this facility does not make arbitrary pointers safe to dereference.

Source: ntoskrnl/xb/mm/api.c; later overlays in the ledger below.

MmLockUnlockPhysicalPage

ABI: ordinal 176; stdcall; 8 decorated argument bytes. Binding: mapped function; MmLockUnlockPhysicalPage.

VOID NTAPI MmLockUnlockPhysicalPage(ULONG_PTR PhysicalAddress, BOOLEAN Unlock);

Treats input as a byte physical address, shifts to its PFN and applies a nested pin/unpin under the PFN lock. Invalid requests are inert under the physical allocator; public return is void. Pair every successful conceptual pin with an unlock; no separate ownership token is returned.

Source: ntoskrnl/xb/mm/api.c; later overlays in the ledger below.

MmMapIoSpace

ABI: ordinal 177; stdcall; 12 decorated argument bytes. Binding: mapped function; NxMmMapIoSpace.

PVOID NTAPI NxMmMapIoSpace( IN ULONG_PTR PhysicalAddress, IN SIZE_T NumberOfBytes, IN ULONG ProtectionType);

Zero size returns null. Device/WC aperture physical addresses map identically; RAM below 64 MiB selects KSEG0 by default or the WC alias for PAGE_WRITECOMBINE or PAGE_NOCACHE. The intervening physical hole returns null. Selection checks the starting address, not overflow/full-range containment; caller must bound the requested extent. Static mapping does not allocate backing pages.

Source: ntoskrnl/xb/mm/iospace.c.

MmPersistContiguousMemory

ABI: ordinal 178; stdcall; 12 decorated argument bytes. Binding: mapped function; NxMmPersistContiguousMemory.

VOID NTAPI NxMmPersistContiguousMemory( IN PVOID BaseAddress, IN SIZE_T NumberOfBytes, IN BOOLEAN Persist);

Marks/unmarks whole pages covering a valid subrange of one tracked allocation or restored persistent run. Zero, overflowing, stale or out-of-allocation ranges are inert; no error is reported. Preservation uses the warm-reboot persistence machinery and does not imply survival of power loss. This implementation is real, despite the obsolete no-op comment in ordinals.map.

Source: ntoskrnl/xb/mm/contig.c.

MmQueryAddressProtect

ABI: ordinal 179; stdcall; 4 decorated argument bytes. Binding: mapped function; MmQueryAddressProtect.

ULONG NTAPI MmQueryAddressProtect(_In_ PVOID Base);

Queries real title VM protection when the VM owns the address. Other regions return PAGE_READWRITE (0x04), including static windows; it is not a universal PTE-protection query or an address-validity check.

Source: ntoskrnl/xb/mm/api.c; later overlays in the ledger below.

MmQueryAllocationSize

ABI: ordinal 180; stdcall; 4 decorated argument bytes. Binding: mapped function; NxMmQueryAllocationSize.

SIZE_T NTAPI NxMmQueryAllocationSize(IN PVOID BaseAddress);

Returns the tracking table's original requested byte Size for an exact contiguous base; if absent, checks restored-run metadata. Unknown/interior addresses yield zero. Does not query arbitrary pool or virtual allocations.

Source: ntoskrnl/xb/mm/contig.c.

MmQueryStatistics

ABI: ordinal 181; stdcall; 4 decorated argument bytes. Binding: mapped function; MmQueryStatistics.

NTSTATUS NTAPI MmQueryStatistics(_Inout_ PMM_STATISTICS Stats);

Requires nonnull pointer and Length exactly 0x24, otherwise STATUS_INVALID_PARAMETER with no output fill. Reports physical/available pages, committed/reserved VM bytes, cache/pool/stack/image pages. Cache and title stacks are subtracted from pool pages to avoid double counting; feature-disabled counters are zero. These are live counters, not an atomic memory snapshot.

Source: ntoskrnl/xb/mm/api.c; later overlays in the ledger below.

MmSetAddressProtect

ABI: ordinal 182; stdcall; 12 decorated argument bytes. Binding: mapped function; NxMmSetAddressProtect.

VOID NTAPI NxMmSetAddressProtect( IN PVOID BaseAddress, IN ULONG NumberOfBytes, IN ULONG NewProtect);

Changes title VM PTE protection when the VM owns the base; for static aliases/windows it is inert because the mapping uses large-page PDEs. Void return hides rejected/no-op requests. Use NtProtectVirtualMemory when old protection/status output is needed.

Source: ntoskrnl/xb/mm/iospace.c.

MmUnmapIoSpace

ABI: ordinal 183; stdcall; 8 decorated argument bytes. Binding: mapped function; NxMmUnmapIoSpace.

VOID NTAPI NxMmUnmapIoSpace( IN PVOID BaseAddress, IN SIZE_T NumberOfBytes);

No-op: KSEG0, WC and MMIO aliases remain mapped for the kernel lifetime. It neither releases RAM ownership nor destroys the static mapping.

Source: ntoskrnl/xb/mm/iospace.c.

Nt

NtAllocateVirtualMemory

ABI: ordinal 184; stdcall; 20 decorated argument bytes. Binding: mapped function; XeNtAllocateVirtualMemory.

NTSTATUS NTAPI XeNtAllocateVirtualMemory(PVOID *Base, ULONG_PTR ZeroBits, PSIZE_T Size, ULONG Type, ULONG Protect);

Xbox ABI omits process handle. Routes to the title VM when enabled, otherwise NT current-process allocation; Base and Size are in/out and may be rounded. Reserve/commit/protect validation belongs to that backend. Caller releases through NtFreeVirtualMemory; allocating address space does not establish a contiguous physical run.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtCancelTimer

ABI: ordinal 185; stdcall; 8 decorated argument bytes. Binding: mapped function; NtCancelTimer.

NTSTATUS NTAPI NtCancelTimer(IN HANDLE TimerHandle, OUT PBOOLEAN CurrentState OPTIONAL);

Direct executive timer cancellation by handle; optionally returns previous signaled state. Cancels scheduled expiration/APC delivery through the native timer implementation; an already executing callback cannot be recalled. Returns handle/type errors and native status.

Source: ntoskrnl/ex/timer.c.

NtClearEvent

ABI: ordinal 186; stdcall; 4 decorated argument bytes. Binding: mapped function; NtClearEvent.

NTSTATUS NTAPI NtClearEvent(IN HANDLE EventHandle);

Direct handle-based event clear, returning NTSTATUS. Resets signaled state without returning its previous value. The ordinary object lookup path requires suitable IRQL; this is not the cached DPC pulse adapter.

Source: ntoskrnl/ex/event.c.

NtClose

ABI: ordinal 187; stdcall; 4 decorated argument bytes. Binding: mapped function; NtClose.

NTSTATUS NTAPI NtClose(IN HANDLE Handle);

Direct native handle close; drops the handle's reference and invokes normal object lifetime rules. The close funnel evicts cached event handles, including handles closed by duplication. Invalid/recycled handle values must not be reused after close.

Source: ntoskrnl/ob/obhandle.c.

NtCreateDirectoryObject

ABI: ordinal 188; stdcall; 8 decorated argument bytes. Binding: mapped function; XeNtCreateDirectoryObject.

NTSTATUS NTAPI XeNtCreateDirectoryObject(PHANDLE Handle, PXBE_OBJECT_ATTRIBUTES XAttr);

Translates Xbox ANSI object attributes and requests DIRECTORY_ALL_ACCESS with no caller access-mask argument. Returns a handle; closing it releases ownership. An unnamed directory can only be reached through the returned handle.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtCreateEvent

ABI: ordinal 189; stdcall; 16 decorated argument bytes. Binding: mapped function; XeNtCreateEvent.

NTSTATUS NTAPI XeNtCreateEvent(PHANDLE Handle, PXBE_OBJECT_ATTRIBUTES XAttr, EVENT_TYPE Type, BOOLEAN InitialState);

Translates ANSI attributes, requests EVENT_ALL_ACCESS and passes type/initial state to the native creator. Successful title-created handles are registered in a 64-slot pulse cache after a temporary reference is released. Cache exhaustion does not fail event creation; a later pulse takes the native path and loses DPC safety.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtCreateFile

ABI: ordinal 190; stdcall; 36 decorated argument bytes. Binding: mapped function; XeNtCreateFile.

NTSTATUS NTAPI XeNtCreateFile(PHANDLE Handle, ACCESS_MASK Access, PXBE_OBJECT_ATTRIBUTES XAttr, PIO_STATUS_BLOCK Iosb, PLARGE_INTEGER AllocSize, ULONG Attributes, ULONG Share, ULONG Disposition, ULONG Options);

Translates ANSI object attributes, preserves desired access/share/disposition/options, and supplies no EA buffer or EA length. IO_STATUS_BLOCK records driver completion, potentially STATUS_PENDING. Namespace conversion is described below; close successful handles even for raw partitions.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtCreateIoCompletion

ABI: ordinal 191; stdcall; 16 decorated argument bytes. Binding: mapped function; XeNtCreateIoCompletion.

NTSTATUS NTAPI XeNtCreateIoCompletion(PHANDLE IoCompletionHandle, ACCESS_MASK DesiredAccess, PXBE_OBJECT_ATTRIBUTES XAttr, ULONG Count);

Translates Xbox attributes and passes desired access and concurrency count to native creation. Kernel-mode callers bypass normal access enforcement, so the supplied mask alone does not restrict title use. Handle owns the completion object until close.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtCreateMutant

ABI: ordinal 192; stdcall; 12 decorated argument bytes. Binding: mapped function; XeNtCreateMutant.

NTSTATUS NTAPI XeNtCreateMutant(PHANDLE MutantHandle, PXBE_OBJECT_ATTRIBUTES XAttr, BOOLEAN InitialOwner);

Builds a native KMUTANT with the real mutant type/delete procedure, initializes ownership and inserts a full-access handle. Relative unrooted names are rooted under \Xbox; same-name creation shares namespace state instead of retrying with anonymous independent locks. Initial ownership belongs to the creating thread.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtCreateSemaphore

ABI: ordinal 193; stdcall; 16 decorated argument bytes. Binding: mapped function; XeNtCreateSemaphore.

NTSTATUS NTAPI XeNtCreateSemaphore(PHANDLE SemaphoreHandle, PXBE_OBJECT_ATTRIBUTES XAttr, LONG InitialCount, LONG MaximumCount);

Translates attributes and uses native semaphore object storage with full-access insertion. Rejects MaximumCount<=0, InitialCount<0 or InitialCount>MaximumCount with STATUS_INVALID_PARAMETER. Named objects use \Xbox translation; no anonymous retry. A successful handle keeps the semaphore alive.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtCreateTimer

ABI: ordinal 194; stdcall; 12 decorated argument bytes. Binding: mapped function; XeNtCreateTimer.

NTSTATUS NTAPI XeNtCreateTimer(PHANDLE TimerHandle, PXBE_OBJECT_ATTRIBUTES XAttr, TIMER_TYPE TimerType);

No access-mask argument: translates attributes and requests TIMER_ALL_ACCESS, preserving notification/synchronization timer type. Use NtSetTimerEx to arm and NtCancelTimer to cancel; close handle for final lifetime release.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtDeleteFile

ABI: ordinal 195; stdcall; 4 decorated argument bytes. Binding: mapped function; XeNtDeleteFile.

NTSTATUS NTAPI XeNtDeleteFile(PXBE_OBJECT_ATTRIBUTES XAttr);

Translates Xbox attributes to native Unicode attributes and returns the native deletion status. Deletion follows the filesystem's sharing/delete-pending rules; a successful call does not guarantee immediate physical space reuse while handles remain open.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtDeviceIoControlFile

ABI: ordinal 196; stdcall; 40 decorated argument bytes. Binding: mapped function; NtDeviceIoControlFile.

NTSTATUS NTAPI NtDeviceIoControlFile(IN HANDLE DeviceHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL, IN PVOID UserApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG IoControlCode, IN PVOID InputBuffer, IN ULONG InputBufferLength OPTIONAL, OUT PVOID OutputBuffer, IN ULONG OutputBufferLength OPTIONAL);

Direct native device-control dispatch with input/output lengths, event/APC and IO_STATUS_BLOCK. Driver selects buffering and support; can return STATUS_PENDING. Caller buffers and completion state must survive asynchronous completion. No general success guarantee for an IOCTL.

Source: ntoskrnl/io/iomgr/iofunc.c.

NtDuplicateObject

ABI: ordinal 197; stdcall; 12 decorated argument bytes. Binding: mapped function; XeNtDuplicateObject.

NTSTATUS NTAPI XeNtDuplicateObject(HANDLE Source, PHANDLE Target, ULONG Options);

Uses current process for source and target, forces DUPLICATE_SAME_ACCESS, and preserves other option bits. DUPLICATE_CLOSE_SOURCE reaches the central handle-close cache eviction. A duplicated event handle is not automatically registered in the title-created pulse cache.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtFlushBuffersFile

ABI: ordinal 198; stdcall; 8 decorated argument bytes. Binding: mapped function; NtFlushBuffersFile.

NTSTATUS NTAPI NtFlushBuffersFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock);

Direct native flush: submits filesystem/device flush, reports IO_STATUS_BLOCK and native status, and may wait for pending completion. Flush failure propagates; opening a file or closing a handle alone does not replace explicit persistence requirements.

Source: ntoskrnl/io/iomgr/iofunc.c.

NtFreeVirtualMemory

ABI: ordinal 199; stdcall; 12 decorated argument bytes. Binding: mapped function; XeNtFreeVirtualMemory.

NTSTATUS NTAPI XeNtFreeVirtualMemory(PVOID *Base, PSIZE_T Size, ULONG FreeType);

Xbox omits process handle; calls title VM backend or native current-process free. Base/Size are in/out; MEM_DECOMMIT and MEM_RELEASE have different reservation/size rules. Does not free pool, contiguous or IO-space aliases.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtFsControlFile

ABI: ordinal 200; stdcall; 40 decorated argument bytes. Binding: mapped function; XeNtFsControlFile.

NTSTATUS NTAPI XeNtFsControlFile(HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE Apc, PVOID ApcCtx, PIO_STATUS_BLOCK Iosb, ULONG FsCtl, PVOID InBuf, ULONG InLen, PVOID OutBuf, ULONG OutLen);

Trace wrapper around native filesystem-control dispatch, passing all ten arguments unchanged and reporting the returned status. Support and completion semantics belong to the filesystem; STATUS_PENDING requires completion ownership. Tracing is not a compatibility implementation for unsupported FSCTLs.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtOpenDirectoryObject

ABI: ordinal 201; stdcall; 8 decorated argument bytes. Binding: mapped function; XeNtOpenDirectoryObject.

NTSTATUS NTAPI XeNtOpenDirectoryObject(PHANDLE Handle, PXBE_OBJECT_ATTRIBUTES XAttr);

Translates ANSI attributes and requests DIRECTORY_QUERY|DIRECTORY_TRAVERSE. Returns native lookup status and a closeable handle; it does not create a missing directory object.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtOpenFile

ABI: ordinal 202; stdcall; 24 decorated argument bytes. Binding: mapped function; XeNtOpenFile.

NTSTATUS NTAPI XeNtOpenFile(PHANDLE Handle, ACCESS_MASK Access, PXBE_OBJECT_ATTRIBUTES XAttr, PIO_STATUS_BLOCK Iosb, ULONG ShareAccess, ULONG OpenOptions);

Translates ANSI attributes and preserves access/share/open-options. Opens an existing namespace target and reports native/driver status via return and IO_STATUS_BLOCK. The conversion does not make a missing partition/path exist.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtOpenSymbolicLinkObject

ABI: ordinal 203; stdcall; 8 decorated argument bytes. Binding: mapped function; XeNtOpenSymbolicLinkObject.

NTSTATUS NTAPI XeNtOpenSymbolicLinkObject(PHANDLE Handle, PXBE_OBJECT_ATTRIBUTES XAttr);

Translates ANSI attributes and requests SYMBOLIC_LINK_QUERY. Returns a closeable handle to the link object, not its target object. Use NtQuerySymbolicLinkObject for the target string.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtProtectVirtualMemory

ABI: ordinal 204; stdcall; 16 decorated argument bytes. Binding: mapped function; XeNtProtectVirtualMemory.

NTSTATUS NTAPI XeNtProtectVirtualMemory(PVOID *Base, PSIZE_T Size, ULONG NewProtect, PULONG OldProtect);

Xbox omits process handle. Routes to title VM or current-process native protection; Base and Size are in/out, OldProtect is output, and backend status exposes failures. This operation applies to VM allocations, not a guaranteed reconfiguration of static KSEG0/MMIO aliases.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtPulseEvent

ABI: ordinal 205; stdcall; 8 decorated argument bytes. Binding: mapped function; XeNtPulseEvent.

NTSTATUS NTAPI XeNtPulseEvent(HANDLE Handle, PLONG PreviousState);

Looks up cached title-created event handles and directly invokes KePulseEvent, storing optional previous state and returning success. Unknown or uncached handles fall back to native NtPulseEvent, unsafe above APC_LEVEL. The 64-entry cache is evicted on all central close paths; pulses are transient and waiters can miss them if not waiting at the pulse instant.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtQueueApcThread

ABI: ordinal 206; stdcall; 20 decorated argument bytes. Binding: mapped function; NtQueueApcThread.

NTSTATUS NTAPI NtQueueApcThread(IN HANDLE ThreadHandle, IN PKNORMAL_ROUTINE ApcRoutine, IN PVOID NormalContext, IN PVOID SystemArgument1, IN PVOID SystemArgument2);

Direct native thread-handle APC queueing with routine and three arguments. Delivery depends on the thread/APC state and configured mode; a successful queue does not mean callback has already run. Caller routine/context must remain valid until delivery or rundown.

Source: ntoskrnl/ps/state.c.

NtQueryDirectoryFile

ABI: ordinal 207; stdcall; 40 decorated argument bytes. Binding: mapped function; XeNtQueryDirectoryFile.

NTSTATUS NTAPI XeNtQueryDirectoryFile(HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation, ULONG Length, FILE_INFORMATION_CLASS FileInformationClass, PANSI_STRING FileName, BOOLEAN RestartScan);

Converts optional ANSI mask to Unicode and always requests one entry. Synchronous pending requests with no event/APC wait on the file then fold FileDirectoryInformation names to ANSI in place, adjusting FileNameLength and Information. Async requests return pending with UTF-16 names unchanged; other information classes also remain UTF-16. RestartScan controls enumeration state; buffer sizing and end-of-directory statuses remain filesystem rules.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtQueryDirectoryObject

ABI: ordinal 208; stdcall; 24 decorated argument bytes. Binding: mapped function; XeNtQueryDirectoryObject.

NTSTATUS NTAPI XeNtQueryDirectoryObject(HANDLE Handle, PVOID Buffer, ULONG Length, BOOLEAN RestartScan, PULONG Context, PULONG ReturnLength);

Requires at least one Xbox entry header; allocates a same-size temporary native buffer, requests multiple entries and repacks names as ANSI with an all-zero terminator. Type is always zero, not a decoded console object-type identifier. Returns STATUS_BUFFER_TOO_SMALL or STATUS_INSUFFICIENT_RESOURCES before fill, and updates return length to repacked bytes on success. Context/RestartScan retain native enumeration behavior.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtQueryEvent

ABI: ordinal 209; stdcall; 8 decorated argument bytes. Binding: mapped function; XeNtQueryEvent.

NTSTATUS NTAPI XeNtQueryEvent(HANDLE EventHandle, PVOID EventInformation);

Only EventBasicInformation, with native fixed sizeof and no information-class/length argument. Caller supplies a correctly sized output; handle/type/access errors return native status. Includes event type and signal state.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtQueryFullAttributesFile

ABI: ordinal 210; stdcall; 8 decorated argument bytes. Binding: mapped function; XeNtQueryFullAttributesFile.

NTSTATUS NTAPI XeNtQueryFullAttributesFile(PXBE_OBJECT_ATTRIBUTES XAttr, PVOID Info);

Translates Xbox ANSI object attributes and queries native network-open/full file attributes into the caller's native-shaped buffer. Does not allocate/open a persistent handle. Namespace/filesystem errors propagate.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtQueryInformationFile

ABI: ordinal 211; stdcall; 20 decorated argument bytes. Binding: mapped function; NtQueryInformationFile.

NTSTATUS NTAPI NtQueryInformationFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass);

Direct native per-file information query with class/length and IO_STATUS_BLOCK. Supported classes and output layout follow the native filesystem path; there is no general ANSI conversion wrapper for all classes. Too-small buffers or unsupported classes return backend status.

Source: ntoskrnl/io/iomgr/iofunc.c.

NtQueryIoCompletion

ABI: ordinal 212; stdcall; 8 decorated argument bytes. Binding: mapped function; XeNtQueryIoCompletion.

NTSTATUS NTAPI XeNtQueryIoCompletion(HANDLE IoCompletionHandle, PVOID IoCompletionInformation);

Only IoCompletionBasicInformation with native fixed size; returns queue-depth information through caller storage. Does not dequeue packets; use NtRemoveIoCompletion for that.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtQueryMutant

ABI: ordinal 213; stdcall; 8 decorated argument bytes. Binding: mapped function; XeNtQueryMutant.

NTSTATUS NTAPI XeNtQueryMutant(HANDLE MutantHandle, PVOID MutantInformation);

Only MutantBasicInformation with fixed native size; reports count/ownership/abandonment state. Caller cannot select another class or buffer length. Querying does not acquire or release the mutant.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtQuerySemaphore

ABI: ordinal 214; stdcall; 8 decorated argument bytes. Binding: mapped function; XeNtQuerySemaphore.

NTSTATUS NTAPI XeNtQuerySemaphore(HANDLE SemaphoreHandle, PVOID SemaphoreInformation);

Only SemaphoreBasicInformation with fixed native size; returns current and maximum count. Query does not reserve a unit, so concurrent operations can immediately change the reported count.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtQuerySymbolicLinkObject

ABI: ordinal 215; stdcall; 12 decorated argument bytes. Binding: mapped function; XeNtQuerySymbolicLinkObject.

NTSTATUS NTAPI XeNtQuerySymbolicLinkObject(HANDLE Handle, PANSI_STRING Target, PULONG ReturnedLength);

Queries target into a fixed 128-WCHAR scratch buffer, then converts to caller ANSI_STRING without allocation. Reports character count through optional ReturnedLength before checking MaximumLength; insufficient caller space returns STATUS_BUFFER_TOO_SMALL. Longer native targets can fail in the scratch query even when caller capacity is larger. Updates Target.Length from conversion.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtQueryTimer

ABI: ordinal 216; stdcall; 8 decorated argument bytes. Binding: mapped function; XeNtQueryTimer.

NTSTATUS NTAPI XeNtQueryTimer(HANDLE TimerHandle, PVOID TimerInformation);

Only TimerBasicInformation with fixed native size; reports remaining time and signal state. Query does not arm/cancel a timer and is a live observation.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtQueryVirtualMemory

ABI: ordinal 217; stdcall; 8 decorated argument bytes. Binding: mapped function; XeNtQueryVirtualMemory.

NTSTATUS NTAPI XeNtQueryVirtualMemory(PVOID Base, PVOID Mbi);

Xbox takes only Base and MEMORY_BASIC_INFORMATION output. Uses title VM backend; fallback selects MemoryBasicInformation, current process and 32-byte structure. No caller-selected information class or returned-length output exists.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtQueryVolumeInformationFile

ABI: ordinal 218; stdcall; 20 decorated argument bytes. Binding: mapped function; NtQueryVolumeInformationFile.

NTSTATUS NTAPI NtQueryVolumeInformationFile(IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FsInformation, IN ULONG Length, IN FS_INFORMATION_CLASS FsInformationClass);

Direct native volume information query, preserving class/length/IO_STATUS_BLOCK. Supported volume classes and errors belong to the filesystem; this is not the fixed-class IoQueryVolumeInformation adapter.

Source: ntoskrnl/io/iomgr/iofunc.c.

NtReadFile

ABI: ordinal 219; stdcall; 32 decorated argument bytes. Binding: mapped function; XeNtReadFile.

NTSTATUS NTAPI XeNtReadFile(HANDLE File, HANDLE Event, PIO_APC_ROUTINE Apc, PVOID ApcCtx, PIO_STATUS_BLOCK Iosb, PVOID Buffer, ULONG Length, PLARGE_INTEGER Offset);

Passes eight Xbox arguments to native NtReadFile with Key=null. IO_STATUS_BLOCK, optional event/APC, buffer and offset follow native synchronous/asynchronous lifetime rules; STATUS_PENDING is not final data completion. Offset may be null where handle mode permits current-position IO.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtReadFileScatter

ABI: ordinal 220; stdcall; 32 decorated argument bytes. Binding: mapped function; XeNtReadFileScatter.

NTSTATUS NTAPI XeNtReadFileScatter(HANDLE f, HANDLE e, PIO_APC_ROUTINE a, PVOID c, PIO_STATUS_BLOCK s, PXB_FILE_SEGMENT_ELEMENT p, ULONG n, PLARGE_INTEGER o);

Submits an unbuffered scatter read via pinned page-aligned segment addresses and a protected contiguous bounce allocation. Requires IO_STATUS_BLOCK and segments for nonzero length; rejects buffered handles, async null offset, overflow/invalid offset or unpinnable pages. Read completion scatters only transferred bytes, releases pins/MDL/bounce ownership, then normal completion publishes event/APC. Async dispatch does not wait on a shared file event. Segment addresses are rounded down to page starts; full pages must be valid.

Source: ntoskrnl/xb/scattergather.c; later overlays in the ledger below.

NtReleaseMutant

ABI: ordinal 221; stdcall; 8 decorated argument bytes. Binding: mapped function; XeNtReleaseMutant.

NTSTATUS NTAPI XeNtReleaseMutant(HANDLE MutantHandle, PLONG PreviousCount);

References handle, prechecks native OwnerThread and returns STATUS_MUTANT_NOT_OWNED instead of raising when caller is not owner; optional PreviousCount is populated. Successful release returns prior signal count and drops its reference. Implementation uses an untyped handle lookup, so callers must pass an actual mutant; wrong object type is not defended by this adapter.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtReleaseSemaphore

ABI: ordinal 222; stdcall; 12 decorated argument bytes. Binding: mapped function; NtReleaseSemaphore.

NTSTATUS NTAPI NtReleaseSemaphore(IN HANDLE SemaphoreHandle, IN LONG ReleaseCount, OUT PLONG PreviousCount OPTIONAL);

Direct native semaphore release by handle and positive ReleaseCount, returning optional previous count. Invalid counts/overflow beyond limit return native errors; waiter wakeup and count changes follow the dispatcher. Querying the count first does not eliminate release races.

Source: ntoskrnl/ex/sem.c.

NtRemoveIoCompletion

ABI: ordinal 223; stdcall; 20 decorated argument bytes. Binding: mapped function; NtRemoveIoCompletion.

NTSTATUS NTAPI NtRemoveIoCompletion(IN HANDLE IoCompletionHandle, OUT PVOID *KeyContext, OUT PVOID *ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER Timeout OPTIONAL);

Direct dequeue from completion port, returning key/APC context, status/information and optional timeout behavior. May block and return timeout/alert/APC status; outputs are meaningful only as specified by the returned completion status. Removing a packet transfers its context handling to caller.

Source: ntoskrnl/io/iomgr/iocomp.c.

NtResumeThread

ABI: ordinal 224; stdcall; 8 decorated argument bytes. Binding: mapped function; NtResumeThread.

NTSTATUS NTAPI NtResumeThread(IN HANDLE ThreadHandle, OUT PULONG SuspendCount OPTIONAL);

Direct thread-handle resume; returns optional previous suspend count. Decrements a nonzero count and enables execution when it reaches zero; successful return does not promise immediate scheduling.

Source: ntoskrnl/ps/state.c.

NtSetEvent

ABI: ordinal 225; stdcall; 8 decorated argument bytes. Binding: mapped function; NtSetEvent.

NTSTATUS NTAPI NtSetEvent(IN HANDLE EventHandle, OUT PLONG PreviousState OPTIONAL);

Direct native handle-based event set with optional previous state. Notification events wake eligible waiters until cleared; synchronization events release an eligible waiter/consume the signal. This adapter does not use the DPC pulse cache.

Source: ntoskrnl/ex/event.c.

NtSetInformationFile

ABI: ordinal 226; stdcall; 20 decorated argument bytes. Binding: mapped function; XeNtSetInformationFile.

NTSTATUS NTAPI XeNtSetInformationFile(HANDLE File, PIO_STATUS_BLOCK Iosb, PVOID Info, ULONG Length, FILE_INFORMATION_CLASS Class);

Most classes pass directly to native NtSetInformationFile. FileRenameInformation is rebuilt: parses Xbox ANSI target/root/replace flag, allocates native WCHAR target, checks size and frees temporary storage after dispatch. Invalid/short rename buffers and allocation failures return status. Rename durability/sharing rules remain filesystem responsibilities. Rename additionally prefixes DOS drive targets with ??\ and recognizes DOS-root pseudo-handle -3; prefix total above 0x7ffe returns STATUS_NAME_TOO_LONG.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtSetIoCompletion

ABI: ordinal 227; stdcall; 20 decorated argument bytes. Binding: mapped function; NtSetIoCompletion.

NTSTATUS NTAPI NtSetIoCompletion(IN HANDLE IoCompletionPortHandle, IN PVOID CompletionKey, IN PVOID CompletionContext, IN NTSTATUS CompletionStatus, IN ULONG CompletionInformation);

Direct enqueue of key context, APC context, IO status and information onto a completion port. Packet allocation can fail; caller retains responsibility for context lifetime until dequeue. Does not signal a title callback directly.

Source: ntoskrnl/io/iomgr/iocomp.c.

NtSetSystemTime

ABI: ordinal 228; stdcall; 8 decorated argument bytes. Binding: mapped function; NtSetSystemTime.

NTSTATUS NTAPI NtSetSystemTime(IN PLARGE_INTEGER SystemTime, OUT PLARGE_INTEGER PreviousTime OPTIONAL);

Direct native system-time update with optional previous time. Uses absolute 100 ns time value and updates system clock state; not the performance counter. Backend validates inputs and privileges/mode as configured.

Source: ntoskrnl/ex/time.c.

NtSetTimerEx

ABI: ordinal 229; stdcall; 32 decorated argument bytes. Binding: mapped function; XeNtSetTimerEx.

NTSTATUS NTAPI XeNtSetTimerEx(HANDLE TimerHandle, PLARGE_INTEGER DueTime, PTIMER_APC_ROUTINE TimerApcRoutine, KPROCESSOR_MODE ApcMode, PVOID TimerContext, BOOLEAN WakeTimer, LONG Period, PBOOLEAN PreviousState);

Passes due time, callback/context, wake flag, period and optional previous state to native NtSetTimer. Explicit ApcMode is accepted but ignored: title timer APCs use the kernel APC delivery path because there is no ring-3 return. Negative due times are relative, positive absolute; period selects repeated expiration. Callbacks can remain pending independently of caller stack lifetime.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtSignalAndWaitForSingleObjectEx

ABI: ordinal 230; stdcall; 20 decorated argument bytes. Binding: mapped function; NtSignalAndWaitForSingleObjectEx.

NTSTATUS NTAPI NtSignalAndWaitForSingleObjectEx(HANDLE SignalHandle, HANDLE WaitHandle, CHAR WaitMode, BOOLEAN Alertable, PLARGE_INTEGER Timeout);

Mode-aware wrapper around native combined signal-and-wait operation with explicit wait mode, alertability and optional timeout. Signal object must be an appropriate event/semaphore/mutant and wait handle a waitable object. Invalid handles/types, timeout and alert/APC statuses are backend outcomes; preserve output-state assumptions only after checking status.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtSuspendThread

ABI: ordinal 231; stdcall; 8 decorated argument bytes. Binding: mapped function; NtSuspendThread.

NTSTATUS NTAPI NtSuspendThread(IN HANDLE ThreadHandle, OUT PULONG PreviousSuspendCount OPTIONAL);

Direct thread-handle suspend with optional previous suspend count. Count is nested and limited by the native suspend implementation; does not guarantee that a running thread has already stopped when call returns. Balance resumes against count.

Source: ntoskrnl/ps/state.c.

NtUserIoApcDispatcher

ABI: ordinal 232; stdcall; 12 decorated argument bytes. Binding: mapped function; NtUserIoApcDispatcher.

VOID NTAPI NtUserIoApcDispatcher(_In_ PVOID ApcContext, _In_ PVOID IosbPtr, _In_ ULONG Reserved);

Treats ApcContext as Win32-style completion routine and IosbPtr as both IO_STATUS_BLOCK and OVERLAPPED. Null routine/IOSB returns immediately; Reserved is ignored. Success invokes routine(0, Information, IosbPtr); failure maps NTSTATUS to DOS error and invokes routine(error, 0, IosbPtr). Delivery occurs via alertable title waits; caller callback/IOSB must remain alive.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtWaitForSingleObject

ABI: ordinal 233; stdcall; 12 decorated argument bytes. Binding: mapped function; NtWaitForSingleObject.

NTSTATUS NTAPI NtWaitForSingleObject(IN HANDLE ObjectHandle, IN BOOLEAN Alertable, IN PLARGE_INTEGER TimeOut OPTIONAL);

Direct native handle wait with Alertable and optional timeout; derives wait mode from PreviousMode (KernelMode for ordinary title execution). Timeout is 100 ns absolute/relative, null indefinite and zero poll. Explicit title UserMode APC wake semantics require the Ex entry. Check success, abandoned mutant, timeout and alert outcomes; wait can consume/acquire object state.

Source: ntoskrnl/ob/obwait.c.

NtWaitForSingleObjectEx

ABI: ordinal 234; stdcall; 16 decorated argument bytes. Binding: mapped function; NtWaitForSingleObjectEx.

NTSTATUS NTAPI NtWaitForSingleObjectEx(HANDLE Handle, CHAR WaitMode, BOOLEAN Alertable, PLARGE_INTEGER Timeout);

Explicit wait mode and Alertable are passed to NxkWaitForSingleObjectMode. UserMode waits can be interrupted for title IO completion APCs despite title code running in ring 0. Check success, timeout, alerted and user-APC statuses; a wake does not always mean the object was acquired.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtWaitForMultipleObjectsEx

ABI: ordinal 235; stdcall; 24 decorated argument bytes. Binding: mapped function; NtWaitForMultipleObjectsEx.

NTSTATUS NTAPI NtWaitForMultipleObjectsEx(ULONG Count, PHANDLE Handles, WAIT_TYPE Type, CHAR WaitMode, BOOLEAN Alertable, PLARGE_INTEGER Timeout);

Explicit mode/alertability route to the mode-aware native helper with WaitAny/WaitAll and caller handle array. Count and invalid/duplicate-object restrictions come from backend validation; wait blocks are expanded for title multiple waits. Return must distinguish acquired index, abandoned mutant, timeout and APC/alert outcomes.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtWriteFile

ABI: ordinal 236; stdcall; 32 decorated argument bytes. Binding: mapped function; XeNtWriteFile.

NTSTATUS NTAPI XeNtWriteFile(HANDLE File, HANDLE Event, PIO_APC_ROUTINE Apc, PVOID ApcCtx, PIO_STATUS_BLOCK Iosb, PVOID Buffer, ULONG Length, PLARGE_INTEGER Offset);

Passes Xbox arguments to native NtWriteFile with Key=null. Preserves optional event/APC and IO_STATUS_BLOCK. Synchronous current-position and append semantics are native; asynchronous caller buffer/context must remain alive until completion. A successful write is not a disk flush.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

NtWriteFileGather

ABI: ordinal 237; stdcall; 32 decorated argument bytes. Binding: mapped function; XeNtWriteFileGather.

NTSTATUS NTAPI XeNtWriteFileGather(HANDLE f, HANDLE e, PIO_APC_ROUTINE a, PVOID c, PIO_STATUS_BLOCK s, PXB_FILE_SEGMENT_ELEMENT p, ULONG n, PLARGE_INTEGER o);

Unbuffered gather write using pinned page-aligned segments and a protected bounce allocation copied before dispatch. Same validation as scatter; append offset -1 is allowed for writes, current-position -2 only on synchronous handles. Completion frees pins/MDL/bounce after driver use and preserves ordinary status/event/APC ordering. Caller sees driver status and Information; short writes are possible.

Source: ntoskrnl/xb/scattergather.c; later overlays in the ledger below.

NtYieldExecution

ABI: ordinal 238; stdcall; 0 decorated argument bytes. Binding: mapped function; NtYieldExecution.

NTSTATUS NTAPI NtYieldExecution(VOID);

Direct scheduler yield. Gives runnable peers a scheduling opportunity and can return STATUS_NO_YIELD_PERFORMED when none is eligible; it is not a sleep interval or a guarantee another particular thread ran.

Source: ntoskrnl/ke/thrdschd.c.

Ob

ObCreateObject

ABI: ordinal 239; stdcall; 16 decorated argument bytes. Binding: mapped function; XeObCreateObject.

NTSTATUS NTAPI XeObCreateObject(PVOID Type, PVOID Attributes, ULONG BodySize, PVOID *Object);

Creates title-owned storage using the supplied 28-byte Xbox OBJECT_TYPE allocate/free procedures and a four-word Xbox header before the body. Named objects also carry name metadata; tracking distinguishes title types from native types. Allocation/attribute errors return status; object body reference is caller-owned until insertion/reference release. Null Type or missing AllocateProcedure/FreeProcedure returns STATUS_INVALID_PARAMETER and clears output pointer. Built-in exported type markers have null procedures and cannot serve as caller allocation types. The new body is not automatically zeroed or inserted; release an uninserted object with ObfDereferenceObject.

Source: ntoskrnl/xb/obcreate.c.

ObDirectoryObjectType

ABI: ordinal 240; DATA. Binding: mapped DATA; ObDirectoryObjectType (assembly symbol XeObDirectoryObjectType).

Mapped DATA: 28-byte Xbox-shaped type record, not the native NT OBJECT_TYPE pointer. The adapter recognizes its address and substitutes native directory type. PoolTag is at +0x18; callers should treat callbacks/fields as the published object-type interface, not NT internals. Published procedure fields are null; this is a type marker/shape with PoolTag, not a functional caller allocation type.

Source: ntoskrnl/xb/object-types.c.

ObInsertObject

ABI: ordinal 241; stdcall; 16 decorated argument bytes. Binding: mapped function; XeObInsertObject.

NTSTATUS NTAPI XeObInsertObject(PVOID Object, PVOID Attributes, ULONG PointerBias, PHANDLE Handle);

Bridges a created title object into native handle table/namespace through a shim retaining its body reference. Same-name resolution may return the existing object according to insertion attributes. Consumes the supplied creation reference on both success and failure; successful handle must be closed. PointerBias adds references to the final target, including an existing same-name object, and must be balanced separately. Allocation/name collision/handle errors propagate and failure clears output handle.

Source: ntoskrnl/xb/obcreate.c.

ObMakeTemporaryObject

ABI: ordinal 242; stdcall; 4 decorated argument bytes. Binding: mapped function; XeObMakeTemporaryObject.

VOID NTAPI XeObMakeTemporaryObject(PVOID Object);

Dispatches title-owned objects to title metadata and native objects to ObMakeTemporaryObject. Clears permanence, allowing eventual namespace/lifetime teardown; does not forcibly remove live references/handles. Requires a valid object pointer.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

ObOpenObjectByName

ABI: ordinal 243; stdcall; 16 decorated argument bytes. Binding: mapped function; XeObOpenObjectByName.

NTSTATUS NTAPI XeObOpenObjectByName(PXBE_OBJECT_ATTRIBUTES XAttr, PVOID Type, PVOID ParseContext, PHANDLE Handle);

Translates Xbox attributes and type markers, using shim type for title objects, GENERIC_ALL and KernelMode. ParseContext goes to native lookup. Temporary Unicode name is released after lookup; success yields a closeable handle rather than a new body allocation.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

ObOpenObjectByPointer

ABI: ordinal 244; stdcall; 12 decorated argument bytes. Binding: mapped function; XeObOpenObjectByPointer.

NTSTATUS NTAPI XeObOpenObjectByPointer(PVOID Object, PVOID Type, PHANDLE Handle);

Checks requested type explicitly even in KernelMode; null type is advisory/any. Title objects use shim-aware open; native mismatches clear output handle and return STATUS_OBJECT_TYPE_MISMATCH. Native success requests GENERIC_ALL. Caller must already hold a valid object reference.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

ObpObjectHandleTable

ABI: ordinal 245; DATA. Binding: mapped DATA; ObpObjectHandleTable.

Mapped DATA: 48 aligned zero bytes, sized placeholder. It is not the native handle table and does not support walking/modifying live title handles. Its existence only supplies the public ordinal and storage shape.

Source: ntoskrnl/xb/sizeddata.c.

ObReferenceObjectByHandle

ABI: ordinal 246; stdcall; 12 decorated argument bytes. Binding: mapped function; XeObReferenceObjectByHandle.

NTSTATUS NTAPI XeObReferenceObjectByHandle(HANDLE Handle, POBJECT_TYPE Type, PVOID *Object);

Tries title-object shim lookup when title objects exist, unwraps and validates requested title type; otherwise translates public type markers and performs native KernelMode lookup with access=0. Successful reference must be dereferenced. Type mismatch returns STATUS_OBJECT_TYPE_MISMATCH; handle is not closed by this call.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

ObReferenceObjectByName

ABI: ordinal 247; stdcall; 20 decorated argument bytes. Binding: mapped function; XeObReferenceObjectByName.

NTSTATUS NTAPI XeObReferenceObjectByName(PANSI_STRING ObjectName, ULONG Attributes, PVOID Type, PVOID ParseContext, PVOID *Object);

Translates ANSI name without a root handle; missing/null translated name returns STATUS_OBJECT_NAME_INVALID. Lookup substitutes a real native type even for requested any-type, then enforces caller type and unwraps title shims. Returns a retained body reference. Unrooted names follow translator rules; there is no caller-supplied root directory.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

ObReferenceObjectByPointer

ABI: ordinal 248; stdcall; 8 decorated argument bytes. Binding: mapped function; XeObReferenceObjectByPointer.

NTSTATUS NTAPI XeObReferenceObjectByPointer(PVOID Object, PVOID Type);

Explicitly validates title/native requested type (null accepts any), then increments reference count. Mismatch returns STATUS_OBJECT_TYPE_MISMATCH without acquiring a reference. The type guard cannot validate arbitrary invalid pointers; object must already be live.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

ObSymbolicLinkObjectType

ABI: ordinal 249; DATA. Binding: mapped DATA; ObSymbolicLinkObjectType (assembly symbol XeObSymbolicLinkObjectType).

Mapped DATA: 28-byte Xbox-shaped symbolic-link type marker recognized by object adapters. This is distinct from native NT type storage; do not cast its bytes to the native type structure. Published procedure fields are null; this is a type marker/shape with PoolTag, not a functional caller allocation type.

Source: ntoskrnl/xb/object-types.c.

ObfDereferenceObject

ABI: ordinal 250; fastcall; 4 decorated argument bytes. Binding: mapped function; XeObfDereferenceObject.

VOID FASTCALL XeObfDereferenceObject(PVOID Object);

Fastcall pointer operation selects title header or native header. Title final reference invokes optional DeleteProcedure on body, then mandatory FreeProcedure on whole allocation, including name metadata. Using the body after final release is invalid; handle close is a separate ownership operation.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

ObfReferenceObject

ABI: ordinal 251; fastcall; 4 decorated argument bytes. Binding: mapped function; XeObfReferenceObject.

VOID FASTCALL XeObfReferenceObject(PVOID Object);

Fastcall increment selects title-owned or native object accounting. Returns void and does no handle/type validation; use only a live referenced object. Must be balanced by ObfDereferenceObject.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

Phy

PhyGetLinkState

ABI: ordinal 252; stdcall; 4 decorated argument bytes. Binding: mapped function; NxPhyGetLinkState.

ULONG NTAPI NxPhyGetLinkState(_In_ BOOLEAN Mode);

Returns cached XNET link flags; a nonzero Mode or empty cache triggers MII repoll if try-lock succeeds. Lock contention silently returns existing cache, including zero/stale state. Query failure is not separately returned; use initialization status to diagnose hardware setup.

Source: hal/halx86/xbox/phy.c.

PhyInitialize

ABI: ordinal 253; stdcall; 8 decorated argument bytes. Binding: mapped function; NxPhyInitialize.

NTSTATUS NTAPI NxPhyInitialize(_In_ BOOLEAN ForceReset, _In_opt_ PVOID Parameter2);

Try-lock returns 0x800700aa on concurrent access. ForceReset clears cached initialization/link state, resets PHY and polls bounded 500 µs steps; second parameter ignored. Initializes/refreshes autonegotiation and link cache; MII/reset/capability failure returns 0x801f0001. Polling stalls CPU, so this is not a cheap per-frame query.

Source: hal/halx86/xbox/phy.c.

Ps

PsCreateSystemThread

ABI: ordinal 254; stdcall; 20 decorated argument bytes. Binding: mapped function; XePsCreateSystemThread.

NTSTATUS NTAPI XePsCreateSystemThread(_Out_ PHANDLE ThreadHandle, _Out_opt_ PHANDLE ThreadId, _In_ PKSTART_ROUTINE StartRoutine, _In_ PVOID StartContext, _In_ BOOLEAN DebuggerThread);

Five Xbox arguments: creates native system-process thread with THREAD_ALL_ACCESS/default stack, no attributes/process/access-mask argument. DebuggerThread ignored; optional thread ID filled only on success. Returned handle must be closed; worker must terminate or return through its appropriate start convention.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

PsCreateSystemThreadEx

ABI: ordinal 255; stdcall; 40 decorated argument bytes. Binding: mapped function; XePsCreateSystemThreadEx.

NTSTATUS NTAPI XePsCreateSystemThreadEx( _Out_ PHANDLE ThreadHandle, _In_ SIZE_T ThreadExtensionSize, _In_ SIZE_T KernelStackSize, _In_ SIZE_T TlsDataSize, _Out_opt_ PHANDLE ThreadId, _In_ PVOID StartRoutine, _In_ PVOID StartContext, _In_ BOOLEAN CreateSuspended, _In_ BOOLEAN DebuggerThread, _In_opt_ PVOID SystemRoutine);

Ten arguments: ignores extension size/debugger flag, allocates trampoline context, optionally allocates/zeros TLS, honors requested kernel stack size and CreateSuspended. Optional SystemRoutine wraps StartRoutine/StartContext; optional thread ID filled on success. Context allocation failure returns STATUS_INSUFFICIENT_RESOURCES. Native creation failure frees context but currently leaks a previously allocated TLS block; TLS allocation failure is not separately converted into a failing status.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

PsQueryStatistics

ABI: ordinal 256; stdcall; 4 decorated argument bytes. Binding: mapped function; XePsQueryStatistics.

NTSTATUS NTAPI XePsQueryStatistics(IN OUT PXBE_PS_STATISTICS Statistics);

Requires Length exactly sizeof {Length,ThreadCount,HandleCount}=12; mismatch returns STATUS_INVALID_PARAMETER before changing counters. Counts belong to current process. Unlike MmQueryStatistics, there is no null-pointer guard; pointer must be valid. Counts are live observations, not an atomic snapshot.

Source: ntoskrnl/xb/psstats.c.

PsSetCreateThreadNotifyRoutine

ABI: ordinal 257; stdcall; 4 decorated argument bytes. Binding: mapped function; PsSetCreateThreadNotifyRoutine.

NTSTATUS NTAPI PsSetCreateThreadNotifyRoutine(IN PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine);

Registers callback into a fixed native notify slot; modified title thread path calls it with ETHREAD and create/delete Boolean. Allocation or slot exhaustion returns STATUS_INSUFFICIENT_RESOURCES. Implementation does not explicitly reject duplicate/null callbacks before allocation; caller must provide a live valid routine. There is no paired Xbox remove export.

Source: ntoskrnl/ps/psnotify.c.

PsTerminateSystemThread

ABI: ordinal 258; stdcall; 4 decorated argument bytes. Binding: mapped function; PsTerminateSystemThread.

NTSTATUS NTAPI PsTerminateSystemThread(IN NTSTATUS ExitStatus);

Direct native termination of calling system thread with ExitStatus. Releases thread execution resources and sends delete notifications; successful termination does not return normally. Close any external handle separately; it may keep terminated object storage alive.

Source: ntoskrnl/ps/kill.c.

PsThreadObjectType

ABI: ordinal 259; DATA. Binding: mapped DATA; PsThreadType (assembly symbol XePsThreadObjectType).

Mapped DATA: 28-byte Xbox-shaped thread type (backend XePsThreadObjectType). PoolTag is at +0x18. Object adapters translate its address to native PsThreadType; it is not an ETHREAD or a native type-pointer variable. Published procedure fields are null; this is a type marker/shape with PoolTag, not a functional caller allocation type.

Source: ntoskrnl/xb/object-types.c.

Rtl

RtlAnsiStringToUnicodeString

ABI: ordinal 260; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlAnsiStringToUnicodeString.

NTSTATUS NTAPI RtlAnsiStringToUnicodeString( IN OUT PUNICODE_STRING UniDest, IN PANSI_STRING AnsiSource, IN BOOLEAN AllocateDestinationString);

Converts length-delimited ANSI bytes using the runtime's loaded codepage tables. AllocateDestinationString=true allocates a buffer released with RtlFreeUnicodeString; false uses caller MaximumLength and can return STATUS_BUFFER_OVERFLOW. Counts are bytes, Unicode Length excludes terminator. Does not assume UTF-8 or preserve ownership of allocated storage on arbitrary caller reuse.

Source: sdk/lib/rtl/unicode.c.

RtlAppendStringToString

ABI: ordinal 261; stdcall; 8 decorated argument bytes. Binding: mapped function; RtlAppendStringToString.

NTSTATUS NTAPI RtlAppendStringToString(IN PSTRING Destination, IN const STRING *Source);

Appends Source.Length bytes to destination without allocating; returns STATUS_BUFFER_TOO_SMALL if combined length exceeds MaximumLength. Updates Length only on success and does not guarantee a trailing NUL. Source/destination are length-delimited STRINGs.

Source: sdk/lib/rtl/unicode.c.

RtlAppendUnicodeStringToString

ABI: ordinal 262; stdcall; 8 decorated argument bytes. Binding: mapped function; RtlAppendUnicodeStringToString.

NTSTATUS NTAPI RtlAppendUnicodeStringToString( IN OUT PUNICODE_STRING Destination, IN PCUNICODE_STRING Source);

Appends Source.Length bytes of WCHAR data, checks destination capacity and updates Length. Writes trailing WCHAR NUL only when room remains. No allocation; odd byte lengths/caller-buffer overlaps are not a safe string-normalization API.

Source: sdk/lib/rtl/unicode.c.

RtlAppendUnicodeToString

ABI: ordinal 263; stdcall; 8 decorated argument bytes. Binding: mapped function; RtlAppendUnicodeToString.

NTSTATUS NTAPI RtlAppendUnicodeToString(IN OUT PUNICODE_STRING Destination, IN PCWSTR Source);

Appends a NUL-terminated WCHAR source to a UNICODE_STRING after measuring source; null source succeeds without change. Destination uses byte capacity, optional terminator only if room. Returns STATUS_BUFFER_TOO_SMALL when appended payload does not fit.

Source: sdk/lib/rtl/unicode.c.

RtlAssert

ABI: ordinal 264; stdcall; 16 decorated argument bytes. Binding: mapped function; XeRtlAssert.

VOID NTAPI XeRtlAssert(PVOID FailedAssertion, PVOID FileName, ULONG LineNumber, PCHAR Message);

Mapped adapter prints expression/file/line/optional message through debug output, breaks via debugger breakpoint and returns if breakpoint handling resumes. Avoids native interactive assertion prompt. Does not return a failure status or unwind caller resources automatically.

Source: ntoskrnl/xb/rtlassert.c.

RtlCaptureContext

ABI: ordinal 265; stdcall; 4 decorated argument bytes. Binding: mapped function; XeRtlCaptureContext.

VOID NTAPI XeRtlCaptureContext(PVOID Context);

Mapped x86 assembly writes the Xbox CONTEXT layout with 0x204-byte float area and saved integer/control registers at Xbox offsets. Captured return address/stack correspond to calling context; caller must supply complete structure. Does not use native NT CONTEXT byte layout interchangeably.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

RtlCaptureStackBackTrace

ABI: ordinal 266; stdcall; 16 decorated argument bytes. Binding: mapped function; RtlCaptureStackBackTrace.

USHORT NTAPI RtlCaptureStackBackTrace(IN ULONG FramesToSkip, IN ULONG FramesToCapture, OUT PVOID *BackTrace, OUT PULONG BackTraceHash OPTIONAL);

Skips requested frames and captures up to requested count through the EBP-chain walker; adds one internal skipped frame and returns zero when capture+adjusted skip >=128. Returns actual count and optional address-sum hash. Frames depend on valid frame pointers and stack bounds; optimized/frameless code can truncate the trace, and user-mode gate is removed for flat title execution.

Source: sdk/lib/rtl/exception.c.

RtlCharToInteger

ABI: ordinal 267; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlCharToInteger.

NTSTATUS NTAPI RtlCharToInteger( PCSZ str, ULONG base, PULONG value);

Parses optional whitespace/sign and optional base prefix from NUL-terminated ANSI text. Base zero selects prefix/default decimal; explicit supported bases are 2/8/10/16. Invalid base returns STATUS_INVALID_PARAMETER; arithmetic wraps ULONG rather than reporting numeric overflow. Parsing stops on first nondigit; it is not a strict whole-string validator.

Source: sdk/lib/rtl/unicode.c.

RtlCompareMemory

ABI: ordinal 268; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlCompareMemory.

SIZE_T NTAPI RtlCompareMemory(IN const VOID *Source1, IN const VOID *Source2, IN SIZE_T Length);

Returns count of equal leading bytes, stopping at first mismatch, rather than Boolean or memcmp ordering. Zero length returns zero; does not validate either memory range or guarantee constant timing.

Source: sdk/lib/rtl/i386/rtlmem.s.

RtlCompareMemoryUlong

ABI: ordinal 269; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlCompareMemoryUlong.

SIZE_T NTAPI RtlCompareMemoryUlong(IN PVOID Source, IN SIZE_T Length, IN ULONG Value);

Compares consecutive ULONGs against supplied pattern and returns matching prefix in bytes. x86 implementation examines Length/4 whole words and ignores any trailing partial word. Caller buffer must cover those words; result is not the number of matching words.

Source: sdk/lib/rtl/i386/rtlmem.s.

RtlCompareString

ABI: ordinal 270; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlCompareString.

LONG NTAPI RtlCompareString( IN const STRING *s1, IN const STRING *s2, IN BOOLEAN CaseInsensitive);

Lexicographically compares length-delimited ANSI strings, optionally uppercasing bytes using runtime mapping; returns signed ordering or length difference. Embedded NUL is ordinary data within Length. It is not locale-aware collation or a constant-time comparison.

Source: sdk/lib/rtl/unicode.c.

RtlCompareUnicodeString

ABI: ordinal 271; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlCompareUnicodeString.

LONG NTAPI RtlCompareUnicodeString( IN PCUNICODE_STRING s1, IN PCUNICODE_STRING s2, IN BOOLEAN CaseInsensitive);

Compares WCHAR code units with optional runtime upcase mapping, then byte-length difference. Lengths are bytes; embedded NUL does not end comparison. Does not perform Unicode normalization, grapheme comparison or locale collation.

Source: sdk/lib/rtl/unicode.c.

RtlCopyString

ABI: ordinal 272; stdcall; 8 decorated argument bytes. Binding: mapped function; RtlCopyString.

VOID NTAPI RtlCopyString( IN OUT PSTRING DestinationString, IN const STRING *SourceString OPTIONAL);

Copies up to destination MaximumLength bytes, truncating silently and setting Length to copied bytes. Null Source resets Length; destination Buffer remains caller-owned. Does not allocate or promise NUL termination.

Source: sdk/lib/rtl/unicode.c.

RtlCopyUnicodeString

ABI: ordinal 273; stdcall; 8 decorated argument bytes. Binding: mapped function; RtlCopyUnicodeString.

VOID NTAPI RtlCopyUnicodeString( IN OUT PUNICODE_STRING DestinationString, IN PCUNICODE_STRING SourceString);

Copies min(Source.Length, MaximumLength) bytes directly, updates Length and emits NUL if extra capacity remains. Null Source resets Length. Truncation is silent; caller must separately decide whether lost suffix is acceptable.

Source: sdk/lib/rtl/unicode.c.

RtlCreateUnicodeString

ABI: ordinal 274; stdcall; 8 decorated argument bytes. Binding: mapped function; RtlCreateUnicodeString.

BOOLEAN NTAPI RtlCreateUnicodeString( IN OUT PUNICODE_STRING UniDest, IN PCWSTR Source);

Allocates and copies a NUL-terminated WCHAR string including terminator, fills Length/MaximumLength and returns Boolean. Oversized allocation/length failure returns false; caller releases successful storage with RtlFreeUnicodeString. Source must be a valid terminated string.

Source: sdk/lib/rtl/unicode.c.

RtlDowncaseUnicodeChar

ABI: ordinal 275; stdcall; 4 decorated argument bytes. Binding: mapped function; RtlDowncaseUnicodeChar.

WCHAR NTAPI RtlDowncaseUnicodeChar(IN WCHAR Source);

Maps one WCHAR through runtime lowercase mapping and returns it. No allocation, normalization or multichar expansion; mappings depend on compiled/loaded NLS tables.

Source: ntoskrnl/xb/nls-stubs.c.

RtlDowncaseUnicodeString

ABI: ordinal 276; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlDowncaseUnicodeString.

NTSTATUS NTAPI RtlDowncaseUnicodeString( IN OUT PUNICODE_STRING UniDest, IN PCUNICODE_STRING UniSource, IN BOOLEAN AllocateDestinationString);

Converts length-delimited WCHARs to lowercase, optionally allocating destination. Caller-capacity mode returns STATUS_BUFFER_OVERFLOW if insufficient; successful allocation is released with RtlFreeUnicodeString. Conversion changes code units through runtime NLS mapping, not Unicode normalization.

Source: sdk/lib/rtl/unicode.c.

RtlEnterCriticalSection

ABI: ordinal 277; stdcall; 4 decorated argument bytes. Binding: mapped function; XeRtlEnterCriticalSection.

VOID NTAPI XeRtlEnterCriticalSection(_Inout_ PVOID Cs);

Interlocked increments LockCount; recursive owner increments RecursionCount without waiting. Contender selects auto-reset event semantics and waits indefinitely nonalertably; final acquisition sets owner/recursion. May block, so do not enter a contended lock at IRQL where waits are forbidden. No timeout/status return.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

RtlEnterCriticalSectionAndRegion

ABI: ordinal 278; stdcall; 4 decorated argument bytes. Binding: mapped function; XeRtlEnterCriticalSectionAndRegion.

VOID NTAPI XeRtlEnterCriticalSectionAndRegion(_Inout_ PVOID Cs);

Enters kernel critical region before ordinary recursive CS acquisition, disabling kernel APC delivery while held. Each recursive entry also nests a region entry; must pair with AndRegion leave even if acquisition waited.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

RtlEqualString

ABI: ordinal 279; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlEqualString.

BOOLEAN NTAPI RtlEqualString( IN const STRING *s1, IN const STRING *s2, IN BOOLEAN CaseInsensitive);

Checks equal Length then compares ANSI bytes with optional upcase mapping. Returns Boolean; unequal lengths fail even when NUL-terminated visible prefixes match. Timing and codepage behavior are not suitable as an implicit cryptographic comparison contract.

Source: sdk/lib/rtl/unicode.c.

RtlEqualUnicodeString

ABI: ordinal 280; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlEqualUnicodeString.

BOOLEAN NTAPI RtlEqualUnicodeString( IN CONST UNICODE_STRING *s1, IN CONST UNICODE_STRING *s2, IN BOOLEAN CaseInsensitive);

Boolean equality of equal-byte-length WCHAR strings with optional upcase mapping. Embedded NUL remains data. Does not normalize equivalent Unicode sequences or allocate temporary strings.

Source: sdk/lib/rtl/unicode.c.

RtlExtendedIntegerMultiply

ABI: ordinal 281; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlExtendedIntegerMultiply.

LARGE_INTEGER NTAPI RtlExtendedIntegerMultiply ( LARGE_INTEGER Multiplicand, LONG Multiplier );

Multiplies signed LARGE_INTEGER by signed LONG and returns low 64-bit product. No overflow status/exception is promised; fixed-width arithmetic is the interface.

Source: sdk/lib/rtl/largeint.c.

RtlExtendedLargeIntegerDivide

ABI: ordinal 282; stdcall; 16 decorated argument bytes. Binding: mapped function; RtlExtendedLargeIntegerDivide.

LARGE_INTEGER NTAPI RtlExtendedLargeIntegerDivide ( LARGE_INTEGER Dividend, ULONG Divisor, PULONG Remainder );

The inspected C backend divides signed Dividend.QuadPart by positive ULONG Divisor using signed 64-bit C arithmetic, returns LARGE_INTEGER quotient and optional remainder truncated to ULONG. Zero divisor can fault; there is no status output. Do not assume unsigned 64-bit behavior solely from the historical routine name.

Source: sdk/lib/rtl/largeint.c.

RtlExtendedMagicDivide

ABI: ordinal 283; stdcall; 20 decorated argument bytes. Binding: mapped function; RtlExtendedMagicDivide.

LARGE_INTEGER NTAPI RtlExtendedMagicDivide (LARGE_INTEGER Dividend, LARGE_INTEGER MagicDivisor, CCHAR ShiftCount);

Uses signed large integer, reciprocal/magic divisor and shift to produce scaled division result through architecture helper. Caller must calculate a valid magic/shift pair; this routine does not validate it or compute a divisor reciprocal. Return is arithmetic result, not status.

Source: sdk/lib/rtl/largeint.c.

RtlFillMemory

ABI: ordinal 284; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlFillMemory.

VOID NTAPI RtlFillMemory(PVOID Destination, SIZE_T Length, UCHAR Fill);

Fills Length bytes with low byte of Fill. No capacity/protection validation; zero length does no writes. Overwriting an object does not run its destructor or release referenced resources.

Source: sdk/lib/rtl/i386/rtlmem.s.

RtlFillMemoryUlong

ABI: ordinal 285; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlFillMemoryUlong.

VOID NTAPI RtlFillMemoryUlong(PVOID Destination, SIZE_T Length, ULONG Fill);

Repeats 32-bit Fill for Length/4 words on x86; trailing 1–3 bytes are not filled. Length is bytes, not elements. Destination must be valid for the rounded-down extent.

Source: sdk/lib/rtl/i386/rtlmem.s.

RtlFreeAnsiString

ABI: ordinal 286; stdcall; 4 decorated argument bytes. Binding: mapped function; RtlFreeAnsiString.

VOID NTAPI RtlFreeAnsiString(IN PANSI_STRING AnsiString);

Releases Buffer through runtime string allocation path when nonnull and clears structure fields as implemented. Only free buffers allocated by compatible Rtl conversion/allocation functions; caller-owned/static buffers are not implicitly safe to free.

Source: sdk/lib/rtl/unicode.c.

RtlFreeUnicodeString

ABI: ordinal 287; stdcall; 4 decorated argument bytes. Binding: mapped function; RtlFreeUnicodeString.

VOID NTAPI RtlFreeUnicodeString(IN PUNICODE_STRING UnicodeString);

Releases nonnull runtime-allocated Unicode Buffer and clears structure fields. Pair with allocating Rtl conversion/create functions; do not call on a view initialized by RtlInitUnicodeString over static/caller-owned storage.

Source: sdk/lib/rtl/unicode.c.

RtlGetCallersAddress

ABI: ordinal 288; stdcall; 8 decorated argument bytes. Binding: mapped function; RtlGetCallersAddress.

VOID NTAPI RtlGetCallersAddress(OUT PVOID *CallersAddress, OUT PVOID *CallersCaller);

Captures up to two callers using RtlCaptureStackBackTrace skipping its internal frames. Missing frames produce null outputs; depends on frame pointers/walkable stack. Optional outputs are populated independently, not references to live frame objects.

Source: sdk/lib/rtl/i386/except.c.

RtlInitAnsiString

ABI: ordinal 289; stdcall; 8 decorated argument bytes. Binding: mapped function; RtlInitAnsiString.

VOID NTAPI RtlInitAnsiString(IN OUT PANSI_STRING DestinationString, IN PCSZ SourceString);

Creates a nonowning STRING view of NUL-terminated bytes; null source sets zero lengths/null Buffer. Length excludes terminator, MaximumLength includes one, with USHORT limits/clamping. No allocation/copy; source must outlive every use of the view.

Source: sdk/lib/rtl/unicode.c.

RtlInitUnicodeString

ABI: ordinal 290; stdcall; 8 decorated argument bytes. Binding: mapped function; RtlInitUnicodeString.

VOID NTAPI RtlInitUnicodeString( IN OUT PUNICODE_STRING DestinationString, IN PCWSTR SourceString);

Creates a nonowning WCHAR string view; Length excludes WCHAR NUL and MaximumLength includes it, capped to representable USHORT bytes. Null source clears view. Do not free this Buffer with RtlFreeUnicodeString unless it separately owns a compatible allocation.

Source: sdk/lib/rtl/unicode.c.

RtlInitializeCriticalSection

ABI: ordinal 291; stdcall; 4 decorated argument bytes. Binding: mapped function; XeRtlInitializeCriticalSection.

VOID NTAPI XeRtlInitializeCriticalSection(_Out_ PVOID Cs);

Initializes Xbox recursive lock as a synchronization-event header, LockCount=-1, RecursionCount=0, Owner=null, with console-sized header. No allocation/destructor. Must initialize live writable storage before shared use unless using the recognized static-header form.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

RtlIntegerToChar

ABI: ordinal 292; stdcall; 16 decorated argument bytes. Binding: mapped function; RtlIntegerToChar.

NTSTATUS NTAPI RtlIntegerToChar( ULONG value, ULONG base, ULONG length, PCHAR str);

Formats ULONG in base 2/8/10/16 (zero defaults decimal), uppercase digit letters. Invalid base returns STATUS_INVALID_PARAMETER; insufficient capacity returns STATUS_BUFFER_OVERFLOW. A terminator is written only when capacity exceeds digit count; exact-fit output can be unterminated.

Source: sdk/lib/rtl/unicode.c.

RtlIntegerToUnicodeString

ABI: ordinal 293; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlIntegerToUnicodeString.

NTSTATUS NTAPI RtlIntegerToUnicodeString( IN ULONG Value, IN ULONG Base OPTIONAL, IN OUT PUNICODE_STRING String);

Formats ULONG through ANSI integer helper then widens into caller UNICODE_STRING. Base zero defaults decimal and supported bases follow helper. Capacity failure returns status; destination length is bytes and terminator needs extra WCHAR capacity.

Source: sdk/lib/rtl/unicode.c.

RtlLeaveCriticalSection

ABI: ordinal 294; stdcall; 4 decorated argument bytes. Binding: mapped function; XeRtlLeaveCriticalSection.

VOID NTAPI XeRtlLeaveCriticalSection(_Inout_ PVOID Cs);

Decrements recursion; final release clears owner and signals one waiter when decremented LockCount>=0. Intermediate recursive releases decrement LockCount only. No ownership/underflow validation; release only locks held by current thread and balance every entry.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

RtlLeaveCriticalSectionAndRegion

ABI: ordinal 295; stdcall; 4 decorated argument bytes. Binding: mapped function; XeRtlLeaveCriticalSectionAndRegion.

VOID NTAPI XeRtlLeaveCriticalSectionAndRegion(_Inout_ PVOID Cs);

Releases CS first, then leaves kernel critical region to reenable delivery when nesting permits. Pair one-for-one with AndRegion entry; mixing leave variants can leave APC nesting unbalanced.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

RtlLowerChar

ABI: ordinal 296; stdcall; 4 decorated argument bytes. Binding: mapped function; RtlLowerChar.

CHAR NTAPI RtlLowerChar(IN CHAR Source);

Returns lowercase mapping of one ANSI byte through runtime codepage/NLS behavior. No multibyte character expansion; signed CHAR input must be interpreted through implementation mapping rather than locale-sensitive libc assumptions.

Source: ntoskrnl/xb/nls-stubs.c.

RtlMapGenericMask

ABI: ordinal 297; stdcall; 8 decorated argument bytes. Binding: mapped function; RtlMapGenericMask.

VOID NTAPI RtlMapGenericMask(IN OUT PACCESS_MASK AccessMask, IN PGENERIC_MAPPING GenericMapping);

Expands GENERIC_READ/WRITE/EXECUTE/ALL bits using supplied GENERIC_MAPPING, mutates mask in place and clears generic bits. Does not validate object permission/access or open a handle; caller mapping must correspond to actual object type.

Source: sdk/lib/rtl/access.c.

RtlMoveMemory

ABI: ordinal 298; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlMoveMemory.

VOID NTAPI RtlMoveMemory(PVOID Destination, CONST VOID *Source, SIZE_T Length);

Copies Length bytes with memmove overlap semantics, choosing direction as needed. Caller supplies valid readable/writable ranges; no allocation or page pin. It does not synchronize racing writers/readers.

Source: sdk/lib/rtl/i386/rtlmem.s.

RtlMultiByteToUnicodeN

ABI: ordinal 299; stdcall; 20 decorated argument bytes. Binding: mapped function; RtlMultiByteToUnicodeN.

NTSTATUS NTAPI RtlMultiByteToUnicodeN(OUT PWCHAR UnicodeString, IN ULONG UnicodeSize, OUT PULONG ResultSize OPTIONAL, IN PCSTR MbString, IN ULONG MbSize);

Converts counted ANSI/codepage bytes into bounded WCHAR output; optional result reports output bytes. Uses NLS tables rather than UTF-8; truncates at capacity as its implementation specifies. Caller owns output, no terminator/allocation guarantee.

Source: ntoskrnl/xb/nls-stubs.c.

RtlMultiByteToUnicodeSize

ABI: ordinal 300; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlMultiByteToUnicodeSize.

NTSTATUS NTAPI RtlMultiByteToUnicodeSize(OUT PULONG UnicodeSize, IN PCSTR MbString, IN ULONG MbSize);

Calculates byte size required by the same ANSI-to-Unicode codepage conversion without writing destination. Optional conversion peculiarities follow NLS state; result is bytes, not character count or terminator-inclusive storage requirement.

Source: ntoskrnl/xb/nls-stubs.c.

RtlNtStatusToDosError

ABI: ordinal 301; stdcall; 4 decorated argument bytes. Binding: mapped function; RtlNtStatusToDosError.

ULONG NTAPI RtlNtStatusToDosError(IN NTSTATUS Status);

Maps NTSTATUS through runtime status tables to DOS/Win32 error. Unknown statuses produce ERROR_MR_MID_NOT_FOUND; success/customer/encoded Win32 cases follow implementation rules. Also records status where a TEB exists; this is not a reverse mapping or an IO completion itself.

Source: sdk/lib/rtl/error.c.

RtlRaiseException

ABI: ordinal 302; stdcall; 4 decorated argument bytes. Binding: mapped function; RtlRaiseException.

VOID NTAPI RtlRaiseException(IN PEXCEPTION_RECORD ExceptionRecord);

Raises caller EXCEPTION_RECORD through Xbox-aware x86 exception dispatch, capturing execution context; first-chance handlers can continue if legal. Record/context layouts must match configured Xbox runtime. Unhandled/noncontinuable exceptions escalate; caller cannot assume normal return.

Source: sdk/lib/rtl/exception.c.

RtlRaiseStatus

ABI: ordinal 303; stdcall; 4 decorated argument bytes. Binding: mapped function; RtlRaiseStatus.

VOID NTAPI RtlRaiseStatus(IN NTSTATUS Status);

Builds a noncontinuable exception record for NTSTATUS and raises through exception machinery. No graceful failure return; unhandled status is a kernel failure path. Resources are only unwound according to active handlers/unwind conventions.

Source: sdk/lib/rtl/exception.c.

RtlTimeFieldsToTime

ABI: ordinal 304; stdcall; 8 decorated argument bytes. Binding: mapped function; RtlTimeFieldsToTime.

BOOLEAN NTAPI RtlTimeFieldsToTime(IN PTIME_FIELDS TimeFields, OUT PLARGE_INTEGER Time);

Converts calendar fields to 100 ns time since 1601 and returns Boolean validity. Rejects out-of-range month/day/time and invalid calendar dates; output is caller LARGE_INTEGER. It does not apply timezone/DST conversion.

Source: sdk/lib/rtl/time.c.

RtlTimeToTimeFields

ABI: ordinal 305; stdcall; 8 decorated argument bytes. Binding: mapped function; RtlTimeToTimeFields.

VOID NTAPI RtlTimeToTimeFields(IN PLARGE_INTEGER Time, OUT PTIME_FIELDS TimeFields);

Converts 100 ns system-time value to TIME_FIELDS calendar including weekday/milliseconds. No timezone conversion or allocation; caller provides complete output. Fractional submillisecond precision is lost.

Source: sdk/lib/rtl/time.c.

RtlTryEnterCriticalSection

ABI: ordinal 306; stdcall; 4 decorated argument bytes. Binding: mapped function; XeRtlTryEnterCriticalSection.

ULONG NTAPI XeRtlTryEnterCriticalSection(_Inout_ PVOID Cs);

CAS from -1 to zero acquires uncontended lock; recursive current owner increments lock/recursion and succeeds; other-owner contention returns false without waiting. Uses ULONG Boolean result and no timeout.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

RtlUlongByteSwap

ABI: ordinal 307; fastcall; 4 decorated argument bytes. Binding: mapped function; RtlUlongByteSwap.

ULONG FASTCALL RtlUlongByteSwap(_In_ ULONG Source);

Fastcall byte-swaps 32-bit value; pure value result, no pointer/length operation. Argument is in ECX under x86 fastcall.

Source: ntoskrnl/xb/rtlbyteswap.c.

RtlUnicodeStringToAnsiString

ABI: ordinal 308; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlUnicodeStringToAnsiString.

NTSTATUS NTAPI RtlUnicodeStringToAnsiString( IN OUT PANSI_STRING AnsiDest, IN PCUNICODE_STRING UniSource, IN BOOLEAN AllocateDestinationString);

Converts length-delimited WCHARs using runtime ANSI codepage, optionally allocating destination. False allocation flag uses caller MaximumLength, with STATUS_BUFFER_OVERFLOW for insufficient storage. Allocated Buffer must be freed with RtlFreeAnsiString. Nonrepresentable characters follow NLS fallback, not UTF-8 encoding.

Source: sdk/lib/rtl/unicode.c.

RtlUnicodeStringToInteger

ABI: ordinal 309; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlUnicodeStringToInteger.

NTSTATUS NTAPI RtlUnicodeStringToInteger( const UNICODE_STRING *str, ULONG base, ULONG *value);

Parses counted WCHAR text with optional sign and base-prefix selection. Supports base 0/2/8/10/16; invalid base returns STATUS_INVALID_PARAMETER. Stops at first nondigit and wraps ULONG arithmetic rather than reporting overflow; it is not strict whole-string validation.

Source: sdk/lib/rtl/unicode.c.

RtlUnicodeToMultiByteN

ABI: ordinal 310; stdcall; 20 decorated argument bytes. Binding: mapped function; RtlUnicodeToMultiByteN.

NTSTATUS NTAPI RtlUnicodeToMultiByteN(OUT PCHAR MbString, IN ULONG MbSize, OUT PULONG ResultSize OPTIONAL, IN PCWCH UnicodeString, IN ULONG UnicodeSize);

Bounded WCHAR-to-ANSI/codepage conversion, reports optional bytes written. No allocation/terminator promise; fallback characters and multibyte counts depend on NLS tables. Input UnicodeSize is bytes and should describe whole WCHARs.

Source: ntoskrnl/xb/nls-stubs.c.

RtlUnicodeToMultiByteSize

ABI: ordinal 311; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlUnicodeToMultiByteSize.

NTSTATUS NTAPI RtlUnicodeToMultiByteSize(OUT PULONG MbSize, IN PCWCH UnicodeString, IN ULONG UnicodeSize);

Computes output byte count for counted WCHAR input under current runtime codepage, no destination writes. Count excludes a synthetic terminator; do not equate bytes with Unicode characters on multibyte codepages.

Source: ntoskrnl/xb/nls-stubs.c.

RtlUnwind

ABI: ordinal 312; stdcall; 16 decorated argument bytes. Binding: mapped function; RtlUnwind.

VOID NTAPI RtlUnwind(IN PVOID TargetFrame OPTIONAL, IN PVOID TargetIp OPTIONAL, IN PEXCEPTION_RECORD ExceptionRecord OPTIONAL, IN PVOID ReturnValue);

Xbox-aware x86 SEH unwind walks registration records, invokes unwind handlers and resumes at requested target or exits chain. Uses Xbox CONTEXT shape and exception flags. Invalid target/frame/stack raises failure; not a C++ destructor engine for arbitrary objects and cannot be called with invented stack frames.

Source: sdk/lib/rtl/i386/except.c.

RtlUpcaseUnicodeChar

ABI: ordinal 313; stdcall; 4 decorated argument bytes. Binding: mapped function; RtlUpcaseUnicodeChar.

WCHAR NTAPI RtlUpcaseUnicodeChar(IN WCHAR Source);

Uppercases one WCHAR through runtime table; returns same code unit when no mapping. No allocation or multichar expansion, and no normalization.

Source: ntoskrnl/xb/nls-stubs.c.

RtlUpcaseUnicodeString

ABI: ordinal 314; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlUpcaseUnicodeString.

NTSTATUS NTAPI RtlUpcaseUnicodeString( IN OUT PUNICODE_STRING UniDest, IN PCUNICODE_STRING UniSource, IN BOOLEAN AllocateDestinationString);

Uppercases counted WCHAR string with optional allocation. Caller-capacity mode can return STATUS_BUFFER_OVERFLOW; allocating result is released with RtlFreeUnicodeString. Byte lengths/embedded NUL semantics remain length-delimited.

Source: sdk/lib/rtl/unicode.c.

RtlUpcaseUnicodeToMultiByteN

ABI: ordinal 315; stdcall; 20 decorated argument bytes. Binding: mapped function; RtlUpcaseUnicodeToMultiByteN.

NTSTATUS NTAPI RtlUpcaseUnicodeToMultiByteN(OUT PCHAR MbString, IN ULONG MbSize, OUT PULONG ResultSize OPTIONAL, IN PCWCH UnicodeString, IN ULONG UnicodeSize);

Uppercases WCHAR input then converts to bounded ANSI/codepage output; optional result is bytes written. No terminator or allocation guarantee. Behavior derives from NLS mapping and can substitute unrepresentable characters.

Source: ntoskrnl/xb/nls-stubs.c.

RtlUpperChar

ABI: ordinal 316; stdcall; 4 decorated argument bytes. Binding: mapped function; RtlUpperChar.

CHAR NTAPI RtlUpperChar(IN CHAR Source);

Uppercases one ANSI CHAR through runtime NLS table. Does not recognize an arbitrary multibyte sequence in isolation; returns single byte only.

Source: ntoskrnl/xb/nls-stubs.c.

RtlUpperString

ABI: ordinal 317; stdcall; 8 decorated argument bytes. Binding: mapped function; RtlUpperString.

VOID NTAPI RtlUpperString(PSTRING DestinationString, const STRING *SourceString);

Copies uppercase ANSI bytes into caller STRING up to MaximumLength, sets copied Length and silently truncates excess. Does not allocate or promise terminator; source and destination buffers remain caller-owned.

Source: sdk/lib/rtl/unicode.c.

RtlUshortByteSwap

ABI: ordinal 318; fastcall; 4 decorated argument bytes. Binding: mapped function; RtlUshortByteSwap.

USHORT FASTCALL RtlUshortByteSwap(_In_ USHORT Source);

Fastcall reverses two bytes of 16-bit value and returns USHORT. Decorated @4 reflects ABI argument slot width even though semantic operand is 16 bits.

Source: ntoskrnl/xb/rtlbyteswap.c.

RtlWalkFrameChain

ABI: ordinal 319; stdcall; 12 decorated argument bytes. Binding: mapped function; RtlWalkFrameChain.

ULONG NTAPI RtlWalkFrameChain(OUT PVOID *Callers, IN ULONG Count, IN ULONG Flags);

Captures return addresses by EBP-chain walk with stack/order checks and requested count/flags. Flat ring-0 title build removes user-mode separation gate; malformed/frameless/unreadable chains stop or trigger protected failure handling. Return is number of captured frames, not a guarantee of a complete stack.

Source: ntoskrnl/rtl/libsupp.c.

RtlZeroMemory

ABI: ordinal 320; stdcall; 8 decorated argument bytes. Binding: mapped function; RtlZeroMemory.

VOID NTAPI RtlZeroMemory(PVOID Destination, SIZE_T Length);

Zeros Length bytes. No allocation, validity check, page pin or destructor; callers must own writable storage and use separate resource cleanup for pointers/handles it contains.

Source: sdk/lib/rtl/i386/rtlmem.s.

Xbox

XboxEEPROMKey

ABI: ordinal 321; DATA. Binding: mapped DATA; XboxEEPROMKey.

Mapped DATA: 16 aligned zero bytes, sized key placeholder. Does not publish a real console EEPROM sealing key. Consumers requiring a nonzero system secret cannot infer one from this export.

Source: ntoskrnl/xb/sizeddata.c.

XboxHardwareInfo

ABI: ordinal 322; DATA. Binding: mapped DATA; XboxHardwareInfo.

Mapped DATA: 8-byte structure {ULONG Flags; UCHAR GpuRevision; UCHAR McpRevision; UCHAR Reserved[2]}. Current initializer is Flags=1 (internal USB hub), GPU=0xa1, MCP=0xb1, reserved zero. Values advertise the modeled topology; they are constants, not dynamically probed revisions.

Source: hal/halx86/xbox/hal.c.

XboxHDKey

ABI: ordinal 323; DATA. Binding: mapped DATA; XboxHDKey.

Mapped DATA: 16-byte HDD key storage populated by EEPROM initialization from the reconstructed sealed-section path. Lifetime is kernel-global; absence/failure of valid EEPROM content must not be interpreted as a proven external-console key. No key bytes are published in this documentation.

Source: ntoskrnl/xb/eeprom.c.

XboxKrnlVersion

ABI: ordinal 324; DATA. Binding: mapped DATA; XboxKrnlVersion.

Mapped DATA: 8-byte {USHORT Major,Minor,Build,Qfe} initialized to 1.0.5530.0 in HAL source. Advertised compatibility version is independent of resident build metadata and does not prove every historical BIOS behavior is implemented.

Source: hal/halx86/xbox/hal.c.

XboxSignatureKey

ABI: ordinal 325; DATA. Binding: mapped DATA; XboxSignatureKey.

Mapped DATA: 16 bytes derived before thunk resolution from certificate field at +0xc0, using HMAC-SHA1 under the implementation's all-zero derivation key and retaining first 16 digest bytes. Null certificate leaves zeros. This is a title-derived compatibility key, not a retail system secret.

Source: ntoskrnl/xb/titlekeys.c.

Xe

XeImageFileName

ABI: ordinal 326; DATA. Binding: mapped DATA; XeImageFileName.

Mapped DATA: ANSI_STRING naming the running image, maintained by loader. The export is the structure, whose Buffer points to loader-owned characters; callers must honor Length/MaximumLength and must not free the buffer.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

XeLoadSection

ABI: ordinal 327; stdcall; 4 decorated argument bytes. Binding: mapped function; XeLoadSection.

NTSTATUS NTAPI XeLoadSection(_Inout_ PXBE_SECTION Section);

Null section returns STATUS_INVALID_PARAMETER. Under section mutex, zero reference count commits pages, rereads raw bytes through retained image handle, zero-fills virtual tail and increments shared boundary-page counters. Further loads only increment SectionRefCount. Digests are not verified; read failure can leave committed pages without successful reference-count increment. Input section header/counter pointers must remain valid.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

XeUnloadSection

ABI: ordinal 328; stdcall; 4 decorated argument bytes. Binding: mapped function; XeUnloadSection.

NTSTATUS NTAPI XeUnloadSection(_Inout_ PXBE_SECTION Section);

Null or zero-reference section returns STATUS_INVALID_PARAMETER. Under mutex, decrements SectionRefCount; only final unload decommits pages whose shared-page counters permit it, retaining pages held by neighbors. Uses title header shared counters, not a private section object. Caller must balance loads and avoid using decommitted bytes.

Source: ntoskrnl/xb/xbe.c; later overlays in the ledger below.

READ

READ_PORT_BUFFER_UCHAR

ABI: ordinal 329; stdcall; 12 decorated argument bytes. Binding: mapped function; READ_PORT_BUFFER_UCHAR.

VOID NTAPI READ_PORT_BUFFER_UCHAR(IN PUCHAR Port, OUT PUCHAR Buffer, IN ULONG Count);

Direct x86 repeated byte port reads into caller buffer. Count is elements, port address is IO-port number truncated to 16 bits rather than MMIO pointer. Does not validate pointer/count or acquire device-level locks; hardware read side effects occur once per element.

Source: hal/halx86/generic/portio.c.

READ_PORT_BUFFER_USHORT

ABI: ordinal 330; stdcall; 12 decorated argument bytes. Binding: mapped function; READ_PORT_BUFFER_USHORT.

VOID NTAPI READ_PORT_BUFFER_USHORT(IN PUSHORT Port, OUT PUSHORT Buffer, IN ULONG Count);

Direct x86 repeated 16-bit port reads. Count counts USHORT elements, so output capacity must cover 2×Count bytes. Port IO is hardware access; valid device sequencing and buffer lifetime belong to caller.

Source: hal/halx86/generic/portio.c.

READ_PORT_BUFFER_ULONG

ABI: ordinal 331; stdcall; 12 decorated argument bytes. Binding: mapped function; READ_PORT_BUFFER_ULONG.

VOID NTAPI READ_PORT_BUFFER_ULONG(IN PULONG Port, OUT PULONG Buffer, IN ULONG Count);

Direct x86 repeated 32-bit port reads. Count counts ULONG elements and output requires 4×Count bytes; no filesystem/DMA buffering or device transaction lock is supplied.

Source: hal/halx86/generic/portio.c.

WRITE

WRITE_PORT_BUFFER_UCHAR

ABI: ordinal 332; stdcall; 12 decorated argument bytes. Binding: mapped function; WRITE_PORT_BUFFER_UCHAR.

VOID NTAPI WRITE_PORT_BUFFER_UCHAR(IN PUCHAR Port, IN PUCHAR Buffer, IN ULONG Count);

Direct x86 repeated byte port writes from caller buffer. Count counts bytes; the port value is truncated to 16 bits by the HAL helper. Every element can produce a hardware side effect. It is not a memcpy to MMIO memory, and call does not validate device state.

Source: hal/halx86/generic/portio.c.

WRITE_PORT_BUFFER_USHORT

ABI: ordinal 333; stdcall; 12 decorated argument bytes. Binding: mapped function; WRITE_PORT_BUFFER_USHORT.

VOID NTAPI WRITE_PORT_BUFFER_USHORT(IN PUSHORT Port, IN PUSHORT Buffer, IN ULONG Count);

Direct x86 repeated 16-bit port writes. Caller source must cover Count USHORTs and use proper device protocol. No automatic serialization with other drivers or accesses is provided.

Source: hal/halx86/generic/portio.c.

WRITE_PORT_BUFFER_ULONG

ABI: ordinal 334; stdcall; 12 decorated argument bytes. Binding: mapped function; WRITE_PORT_BUFFER_ULONG.

VOID NTAPI WRITE_PORT_BUFFER_ULONG(IN PULONG Port, IN PULONG Buffer, IN ULONG Count);

Direct x86 repeated 32-bit port writes. Caller source covers Count ULONGs; IO-port number is passed through. Buffer validation and hardware ownership are caller responsibilities.

Source: hal/halx86/generic/portio.c.

Xc

XcSHAInit

ABI: ordinal 335; stdcall; 4 decorated argument bytes. Binding: mapped function; XcSHAInit.

VOID NTAPI XcSHAInit(_In_ PVOID Ctx);

Default vector initializes 116-byte caller SHA context with 24 reserved bytes before state/count/buffer. Reserved bytes are untouched. Reinitialize before starting an independent SHA-1 stream; all Xc exports can be replaced by XcUpdateCrypto.

Source: ntoskrnl/xb/crypto.c.

XcSHAUpdate

ABI: ordinal 336; stdcall; 12 decorated argument bytes. Binding: mapped function; XcSHAUpdate.

VOID NTAPI XcSHAUpdate(_In_ PVOID Ctx, _In_ PVOID Data, _In_ ULONG Len);

Default vector translates Xbox SHA context to cryptlib, hashes Len bytes and stores state/count plus only active buffered bytes; does not overwrite the full inactive block tail. Caller owns context and input; no status return or pointer validation.

Source: ntoskrnl/xb/crypto.c.

XcSHAFinal

ABI: ordinal 337; stdcall; 8 decorated argument bytes. Binding: mapped function; XcSHAFinal.

VOID NTAPI XcSHAFinal(_In_ PVOID Ctx, _Out_writes_(20) PVOID Digest);

Default vector pads/finalizes SHA-1 and writes 20-byte digest, then resets state/count to the initial SHA state and clears the full block buffer, preserving the reserved prefix. The context is ready for a new independent digest after finalization; earlier stream contents are consumed.

Source: ntoskrnl/xb/crypto.c.

XcRC4Key

ABI: ordinal 338; stdcall; 12 decorated argument bytes. Binding: mapped function; XcRC4Key.

VOID NTAPI XcRC4Key(_Out_ PVOID KeyStruct, _In_ ULONG KeyLen, _In_ PVOID KeyData);

Default vector schedules cryptlib RC4 into caller key state. Caller supplies 258 bytes of RC4 context. KeyLen/key bytes must describe usable key material; zero KeyLen is not rejected and still reads key[0], so it is not a safe empty-key operation. No error return is available. Key state is mutable and must not be shared concurrently without caller synchronization.

Source: ntoskrnl/xb/crypto.c.

XcRC4Crypt

ABI: ordinal 339; stdcall; 12 decorated argument bytes. Binding: mapped function; XcRC4Crypt.

VOID NTAPI XcRC4Crypt(_In_ PVOID KeyStruct, _In_ ULONG Len, _Inout_ PVOID Data);

Default vector encrypts/decrypts Len bytes in place while advancing RC4 state. Reusing an initialized state resumes the stream; restarting requires XcRC4Key. Caller owns mutable data/context and receives no validation status.

Source: ntoskrnl/xb/crypto.c.

XcHMAC

ABI: ordinal 340; stdcall; 28 decorated argument bytes. Binding: mapped function; XcHMAC.

VOID NTAPI XcHMAC(_In_ PVOID K, _In_ ULONG Kl, _In_ PVOID I1, _In_ ULONG L1, _In_ PVOID I2, _In_ ULONG L2, _Out_writes_(20) PVOID Out);

Default vector computes 20-byte HMAC-SHA1 over concatenation of two input spans. Key and both spans are caller memory; result buffer must fit 20 bytes. Uses internal SHA helpers rather than public replaceable SHA entry points; replacement of HMAC itself changes this behavior.

Source: ntoskrnl/xb/crypto.c.

XcPKEncPublic

ABI: ordinal 341; stdcall; 12 decorated argument bytes. Binding: mapped function; XcPKEncPublic.

ULONG NTAPI XcPKEncPublic(_In_ PVOID PubKey, _In_ PVOID In, _Out_ PVOID Out);

Default vector performs raw RSA public operation with RSA1 key magic, little-endian big integers and input/output eight bytes wider than modulus. Rejects unsupported/non-word-sized widths, allocation failure, nonzero high input bytes or input >= modulus by returning zero; success writes modulus-width result plus eight zero bytes and returns one. It does not add PKCS padding.

Source: ntoskrnl/xb/crypto.c.

XcPKDecPrivate

ABI: ordinal 342; stdcall; 12 decorated argument bytes. Binding: mapped function; XcPKDecPrivate.

ULONG NTAPI XcPKDecPrivate(_In_ PVOID PrivKey, _In_ PVOID In, _Out_ PVOID Out);

Default vector performs raw RSA CRT operation with RSA2 private blob. Fields stride by blob length and each includes extra padding bytes; rejects invalid magic, dimensions, stride and zero CRT moduli. Reads modulus-width input plus one ULONG and reduces it modulo each prime rather than refusing input >= the full modulus. Zero indicates invalid dimensions/allocation/modular failure; success writes modulus-width result plus eight zero bytes. Caller must provide readable blob/CRT fields and adequately sized output; this does not decode PKCS padding or manage key secrecy.

Source: ntoskrnl/xb/crypto.c.

XcPKGetKeyLen

ABI: ordinal 343; stdcall; 4 decorated argument bytes. Binding: mapped function; XcPKGetKeyLen.

ULONG NTAPI XcPKGetKeyLen(_In_ PVOID PubKey);

Default returns the blob's own length field verbatim. Does not validate magic, modulus length or accessible extent; caller must supply a readable key blob. Reported blob field is not a guarantee other RSA operations accept it.

Source: ntoskrnl/xb/crypto.c.

XcVerifyPKCS1Signature

ABI: ordinal 344; stdcall; 12 decorated argument bytes. Binding: mapped function; XcVerifyPKCS1Signature.

BOOLEAN NTAPI XcVerifyPKCS1Signature(_In_ PVOID Signature, _In_ PVOID PubKey, _In_ PVOID Digest);

Default verifies RSASSA-PKCS1-v1_5 over caller's 20-byte SHA-1 digest after raw public operation, accepting the implemented SHA-1 DigestInfo prefixes and strict padding layout. Returns Boolean false on malformed signature/key/allocation or mismatch; does not hash input data itself.

Source: ntoskrnl/xb/crypto.c.

XcModExp

ABI: ordinal 345; stdcall; 20 decorated argument bytes. Binding: mapped function; XcModExp.

ULONG NTAPI XcModExp(_Out_ PULONG Result, _In_ PULONG Base, _In_ PULONG Exponent, _In_ PULONG Modulus, _In_ ULONG Words);

Default computes modular exponentiation on little-endian caller ULONG arrays; Words must be 1..512 words and modulus nonzero. Zero indicates invalid dimensions/modulus or allocation failure; success returns one and fills result. Supports odd modulus via Montgomery arithmetic and even modulus via ordinary reduction. Base is reduced; exponent zero follows arithmetic path. Caller supplies full-width valid arrays.

Source: ntoskrnl/xb/crypto.c.

XcDESKeyParity

ABI: ordinal 346; stdcall; 8 decorated argument bytes. Binding: mapped function; XcDESKeyParity.

VOID NTAPI XcDESKeyParity(_Inout_ PVOID Key, _In_ ULONG KeyLen);

Default rewrites each key byte's low parity bit to odd parity, preserving upper seven key bits. Zero length touches nothing. No weak-key rejection or cryptographic policy validation is performed.

Source: ntoskrnl/xb/crypto.c.

XcKeyTable

ABI: ordinal 347; stdcall; 12 decorated argument bytes. Binding: mapped function; XcKeyTable.

VOID NTAPI XcKeyTable(_In_ ULONG Cipher, _Out_ PVOID KeyTable, _In_ PVOID Key);

Default Cipher==0 builds one 128-byte DES schedule from an 8-byte key; every nonzero Cipher selects three 128-byte schedules (384 bytes) from 24 key bytes. Caller supplies schedule storage and key material. There is no unsupported-cipher error return: nonzero values all select triple-DES.

Source: ntoskrnl/xb/crypto.c.

XcBlockCrypt

ABI: ordinal 348; stdcall; 20 decorated argument bytes. Binding: mapped function; XcBlockCrypt.

VOID NTAPI XcBlockCrypt(_In_ ULONG Cipher, _Out_ PVOID Out, _In_ PVOID In, _In_ PVOID KeyTable, _In_ ULONG Op);

Default processes one 8-byte block using supplied DES/triple-DES schedule. Op==0 decrypts, every other value encrypts. Caller buffers/schedule must fit; no length/padding/error result exists.

Source: ntoskrnl/xb/crypto.c.

XcBlockCryptCBC

ABI: ordinal 349; stdcall; 28 decorated argument bytes. Binding: mapped function; XcBlockCryptCBC.

VOID NTAPI XcBlockCryptCBC(_In_ ULONG Cipher, _In_ ULONG Len, _Out_ PVOID Out, _In_ PVOID In, _In_ PVOID KeyTable, _In_ ULONG Op, _Inout_ PVOID Feedback);

Default processes complete 8-byte blocks only; Len<8 is inert and trailing partial bytes remain untouched. Feedback is caller's 8-byte chaining value and ends as last ciphertext block for either direction. Op==0 decrypts, otherwise encrypts. Handles in-place decryption by saving ciphertext first; no automatic padding.

Source: ntoskrnl/xb/crypto.c.

XcCryptService

ABI: ordinal 350; stdcall; 8 decorated argument bytes. Binding: mapped function; XcCryptService.

ULONG NTAPI XcCryptService(_In_ ULONG Op, _In_ PVOID Args);

Mapped function with intentionally inert default: returns zero for every Op and does not touch Args. This is not a generated bugcheck stub and not evidence an arbitrary crypto service was executed. Replacement vector can change it.

Source: ntoskrnl/xb/crypto.c.

XcUpdateCrypto

ABI: ordinal 351; stdcall; 8 decorated argument bytes. Binding: mapped function; XcUpdateCrypto.

VOID NTAPI XcUpdateCrypto(_In_ PVOID NewVector, _Out_opt_ PVOID RomVector);

Updates the global dispatch vector used by every public Xc entry: nonnull entries replace that routine and null entries retain the current routine. Optional output receives the original built-in vector, not the previous replacement. Caller supplies a complete correctly ordered table; sparse replacement is supported through null entries. No per-call version negotiation or general synchronization protects concurrent replacement; invalid function pointers fail when invoked.

Source: ntoskrnl/xb/crypto.c.

Rtl

RtlRip

ABI: ordinal 352; stdcall; 12 decorated argument bytes. Binding: mapped function; XeRtlRip.

VOID NTAPI XeRtlRip(PVOID ApiName, PVOID Expression, PVOID Message);

Mapped failure-reporting adapter prints supplied strings and breaks like RtlAssert. Debug output/breakpoint behavior depends on configured debugger/exception handling; this is not a graceful error-return function.

Source: ntoskrnl/xb/rtlassert.c.

Xbox

XboxLANKey

ABI: ordinal 353; DATA. Binding: mapped DATA; XboxLANKey.

Mapped DATA: 16 bytes derived from certificate field +0xb0 before thunk resolution using HMAC-SHA1 under the implementation's zero derivation key, truncated to 16 bytes. Null certificate leaves zero storage; zero certificate fields derive repeated keys rather than per-console secrets. This is not evidence of network interoperability with an external console.

Source: ntoskrnl/xb/titlekeys.c.

XboxAlternateSignatureKeys

ABI: ordinal 354; DATA. Binding: mapped DATA; XboxAlternateSignatureKeys.

Mapped DATA: sixteen 16-byte keys (256 bytes total), derived from certificate fields at +0xd0+i×16 when declared certificate Size reaches the complete alternate area. Smaller/null certificate leaves alternate storage zero. Uses same HMAC/truncation and zero derivation key as primary title keys; caller does not own/free the array.

Source: ntoskrnl/xb/titlekeys.c.

Xe

XePublicKeyData

ABI: ordinal 355; DATA. Binding: mapped DATA; XePublicKeyData.

Mapped DATA: 284 aligned zero bytes, a sized public-key placeholder. It does not contain a signing/verification key, so code expecting a usable RSA blob must provide one independently.

Source: ntoskrnl/xb/sizeddata.c.

Idex

IdexChannelObject

ABI: ordinal 357; DATA. Binding: mapped DATA; IdexChannelObject.

Mapped DATA: 264-byte aligned live channel bridge, initialized with mutable console-shaped callbacks, device queue, timer and DPCs. Hooks replace primary ATAPI start/finish/next/timeout/reset-poll/interrupt operations and may chain saved originals once; guards prevent duplicate command/IRQ chaining. PCIIDEX retains native IRQ ownership and the console interrupt is borrowed. Request-generation checks protect completion requeue of the same IRP; unrelated secondary-channel work bypasses hooks. Teardown cancels timer work and clears borrowed context/callback operation state before native disconnect. It is not a zero placeholder, despite obsolete inventory comments.

Source: ntoskrnl/xb/ide.c.

Rtl

RtlSnprintf

ABI: ordinal 361; cdecl; 0 decorated argument bytes. Binding: mapped function; RtlSnprintf.

int __cdecl RtlSnprintf(char *Buffer, size_t Count, const char *Format, ...);

cdecl variadic formatting through runtime _vsnprintf with supplied Count. Return/truncation/null-termination follow that runtime, not an invented ISO C99 guarantee; buffer ownership remains caller's. Count bounds writes, not argument validity.

Source: ntoskrnl/xb/rtlprintf.c.

RtlSprintf

ABI: ordinal 362; cdecl; 0 decorated argument bytes. Binding: mapped function; RtlSprintf.

int __cdecl RtlSprintf(char *Buffer, const char *Format, ...);

cdecl variadic formatting through _vsnprintf with size_t(-1), effectively unbounded. Caller must allocate enough buffer for complete output; there is no capacity parameter.

Source: ntoskrnl/xb/rtlprintf.c.

RtlVsnprintf

ABI: ordinal 363; cdecl; 0 decorated argument bytes. Binding: mapped function; RtlVsnprintf.

int __cdecl RtlVsnprintf(char *Buffer, size_t Count, const char *Format, va_list Args);

cdecl va_list formatting directly forwards Count/Format/Args to _vsnprintf. Truncation/termination/negative return behavior follows runtime implementation. va_list is an ABI value, not a pointer to an arbitrary argument array.

Source: ntoskrnl/xb/rtlprintf.c.

RtlVsprintf

ABI: ordinal 364; cdecl; 0 decorated argument bytes. Binding: mapped function; RtlVsprintf.

int __cdecl RtlVsprintf(char *Buffer, const char *Format, va_list Args);

cdecl va_list formatting calls _vsnprintf with size_t(-1), effectively unbounded. Caller controls buffer capacity and argument/format correctness.

Source: ntoskrnl/xb/rtlprintf.c.

Mm

MmDbgAllocateMemory

ABI: ordinal 374; stdcall; 8 decorated argument bytes. Binding: generated bugcheck stub; XbExpStub_374.

Unmapped function: generated stdcall ABI stub (8 argument bytes) bugchecks 0xe0000002 with ordinal 374 in parameter 1; parameters 2–4 zero. No debug memory allocation occurs and it never returns. Semantic parameter types/return ownership are unimplemented; argument width does not establish a working allocator contract.

Source: ntoskrnl/xb/gen-exports.py.

MmDbgFreeMemory

ABI: ordinal 375; stdcall; 8 decorated argument bytes. Binding: generated bugcheck stub; XbExpStub_375.

Unmapped function: generated stdcall ABI stub (8 argument bytes) bugchecks 0xe0000002 with ordinal 375. It does not release debug memory and never returns. Pairing this with any allocator is not implemented; semantic prototype remains unverified here.

Source: ntoskrnl/xb/gen-exports.py.

MmDbgQueryAvailablePages

ABI: ordinal 376; stdcall; 0 decorated argument bytes. Binding: generated bugcheck stub; XbExpStub_376.

Unmapped zero-argument stdcall stub bugchecks 0xe0000002 with ordinal 376. Does not return an available-page count; use implemented MmQueryStatistics for that implementation's counters.

Source: ntoskrnl/xb/gen-exports.py.

MmDbgReleaseAddress

ABI: ordinal 377; stdcall; 8 decorated argument bytes. Binding: generated bugcheck stub; XbExpStub_377.

Unmapped stdcall stub (8 argument bytes) bugchecks 0xe0000002 with ordinal 377. No address-release/restoration operation is implemented and it never returns. Byte count is an ABI boundary only, not evidence of parameter meaning.

Source: ntoskrnl/xb/gen-exports.py.

MmDbgWriteCheck

ABI: ordinal 378; stdcall; 8 decorated argument bytes. Binding: generated bugcheck stub; XbExpStub_378.

Unmapped stdcall stub (8 argument bytes) bugchecks 0xe0000002 with ordinal 378. No write-check/protection probe is performed and it never returns; do not use this as a safe validity predicate.

Source: ntoskrnl/xb/gen-exports.py.

Source overlay ledger

Each row names a reconstructed implementation path and every SpiritBoot patch touching that path, in application order. Added files exist in the patches, not the upstream Roswell base tree. Base links in entries identify upstream implementations; apply the listed overlays to inspect the released implementation. Source snippets/prototypes above are from the reconstructed x86 build.

Implementation path	Ordered SpiritBoot overlays
hal/halx86/generic/portio.c	Unmodified base implementation.
hal/halx86/xbox/hal.c	Unmodified base implementation.
hal/halx86/xbox/phy.c	Unmodified base implementation.
ntoskrnl/ex/event.c	Unmodified base implementation.
ntoskrnl/ex/sem.c	Unmodified base implementation.
ntoskrnl/ex/time.c	Unmodified base implementation.
ntoskrnl/ex/timer.c	Unmodified base implementation.
ntoskrnl/io/iomgr/iocomp.c	Unmodified base implementation.
ntoskrnl/io/iomgr/iofunc.c	Unmodified base implementation.
ntoskrnl/ke/thrdschd.c	Unmodified base implementation.
ntoskrnl/ob/obhandle.c	Unmodified base implementation.
ntoskrnl/ob/obwait.c	0011-title-multiple-wait-blocks.patch
ntoskrnl/ps/kill.c	Unmodified base implementation.
ntoskrnl/ps/psnotify.c	Unmodified base implementation.
ntoskrnl/ps/state.c	Unmodified base implementation.
ntoskrnl/rtl/libsupp.c	Unmodified base implementation.
ntoskrnl/xb/crypto.c	0002-kernel-call-optimization.patch
ntoskrnl/xb/eeprom.c	Unmodified base implementation.
ntoskrnl/xb/gen-exports.py	Unmodified base implementation.
ntoskrnl/xb/ide.c	0001-clean-room-kernel.patch
ntoskrnl/xb/mm/api.c	0001-clean-room-kernel.patch, 0002-kernel-call-optimization.patch, 0006-bounded-pin-vector.patch
ntoskrnl/xb/mm/cache.c	0008-cache-writeback-failure.patch, 0015-dma-bounce-lifetime.patch, 0020-cache-shrink-write-error.patch, 0027-cache-pin-arguments.patch, 0028-cache-pin-handle-reuse.patch
ntoskrnl/xb/mm/contig.c	0001-clean-room-kernel.patch
ntoskrnl/xb/mm/iospace.c	Unmodified base implementation.
ntoskrnl/xb/nls-stubs.c	Unmodified base implementation.
ntoskrnl/xb/obcreate.c	0002-kernel-call-optimization.patch
ntoskrnl/xb/object-types.c	Unmodified base implementation.
ntoskrnl/xb/ordinals.map	0001-clean-room-kernel.patch
ntoskrnl/xb/psstats.c	Unmodified base implementation.
ntoskrnl/xb/rtlassert.c	Unmodified base implementation.
ntoskrnl/xb/rtlbyteswap.c	Unmodified base implementation.
ntoskrnl/xb/rtlprintf.c	Unmodified base implementation.
ntoskrnl/xb/scattergather.c	0001-clean-room-kernel.patch, 0015-dma-bounce-lifetime.patch
ntoskrnl/xb/sizeddata.c	0001-clean-room-kernel.patch
ntoskrnl/xb/titlekeys.c	Unmodified base implementation.
ntoskrnl/xb/xbe.c	0001-clean-room-kernel.patch, 0013-title-critical-section-blocking.patch, 0014-title-io-completion-order.patch, 0024-xbox-rename-dos-root.patch
ntoskrnl/xb/xboxkrnl.exe.def	Unmodified base implementation.
sdk/lib/rtl/access.c	Unmodified base implementation.
sdk/lib/rtl/error.c	Unmodified base implementation.
sdk/lib/rtl/exception.c	Unmodified base implementation.
sdk/lib/rtl/i386/except.c	Unmodified base implementation.
sdk/lib/rtl/i386/rtlmem.s	Unmodified base implementation.
sdk/lib/rtl/largeint.c	Unmodified base implementation.
sdk/lib/rtl/time.c	Unmodified base implementation.
sdk/lib/rtl/unicode.c	Unmodified base implementation.

Coverage and limits

Inventory reconciliation: 208 exact ordinal/name entries on this page, with five generated function stubs (374–378), two explicitly initialized generated DATA flags (88–89), and all remaining entries mapped. The definition has no exports at 367–373; do not infer callable holes. Runtime behavior can depend on enabled NXK_MM_* features, actual device/filesystem state, and user-replaced crypto callbacks.

Per-call edge cases here are those demonstrated by the cited open-source implementation and its ordered patches. Unverified parameter semantics for absent MmDbg backends remain explicit gaps. Native prototypes do not prove all caller pointers are probed: titles execute in kernel mode. Export presence, advertised version and successful mapping do not guarantee full historical BIOS behavior.