j00ru.vexillium.org Open in urlscan Pro
31.133.0.209  Public Scan

Form analysis
0 forms found in the DOM

Text Content

WINDOWS X86-64 SYSTEM CALL TABLE (XP/2003/VISTA/7/8/10/2022/11)

Author: Mateusz "j00ru" Jurczyk (j00ru.vx tech blog)


See also: Windows System Call Tables in CSV/JSON formats on GitHub

Special thanks to: MeMek, Wandering Glitch

Layout by Metasploit Team

Enter the Syscall ID to highlight (hex):






System Call Symbol  Windows XP 
(show)  Windows Server 2003 
(show)  Windows Vista 
(show)  Windows 7 
(show)  Windows 8 
(show)  Windows 10 
(show)  Windows 11 and Server 
(show) NtAcceptConnectPort NtAccessCheck NtAccessCheckAndAuditAlarm
NtAccessCheckByType NtAccessCheckByTypeAndAuditAlarm
NtAccessCheckByTypeResultList NtAccessCheckByTypeResultListAndAuditAlarm
NtAccessCheckByTypeResultListAndAuditAlarmByHandle NtAcquireCMFViewOwnership
NtAcquireCrossVmMutant NtAcquireProcessActivityReference NtAddAtom NtAddAtomEx
NtAddBootEntry NtAddDriverEntry NtAdjustGroupsToken NtAdjustPrivilegesToken
NtAdjustTokenClaimsAndDeviceGroups NtAlertResumeThread NtAlertThread
NtAlertThreadByThreadId NtAlertThreadByThreadIdEx NtAllocateLocallyUniqueId
NtAllocateReserveObject NtAllocateUserPhysicalPages
NtAllocateUserPhysicalPagesEx NtAllocateUuids NtAllocateVirtualMemory
NtAllocateVirtualMemoryEx NtAlpcAcceptConnectPort NtAlpcCancelMessage
NtAlpcConnectPort NtAlpcConnectPortEx NtAlpcCreatePort NtAlpcCreatePortSection
NtAlpcCreateResourceReserve NtAlpcCreateSectionView NtAlpcCreateSecurityContext
NtAlpcDeletePortSection NtAlpcDeleteResourceReserve NtAlpcDeleteSectionView
NtAlpcDeleteSecurityContext NtAlpcDisconnectPort
NtAlpcImpersonateClientContainerOfPort NtAlpcImpersonateClientOfPort
NtAlpcOpenSenderProcess NtAlpcOpenSenderThread NtAlpcQueryInformation
NtAlpcQueryInformationMessage NtAlpcRevokeSecurityContext
NtAlpcSendWaitReceivePort NtAlpcSetInformation NtApphelpCacheControl
NtAreMappedFilesTheSame NtAssignProcessToJobObject
NtAssociateWaitCompletionPacket NtCallEnclave NtCallbackReturn
NtCancelDeviceWakeupRequest NtCancelIoFile NtCancelIoFileEx
NtCancelSynchronousIoFile NtCancelTimer NtCancelTimer2
NtCancelWaitCompletionPacket NtChangeProcessState NtChangeThreadState
NtClearAllSavepointsTransaction NtClearEvent NtClearSavepointTransaction NtClose
NtCloseObjectAuditAlarm NtCommitComplete NtCommitEnlistment
NtCommitRegistryTransaction NtCommitTransaction NtCompactKeys NtCompareObjects
NtCompareSigningLevels NtCompareTokens NtCompleteConnectPort NtCompressKey
NtConnectPort NtContinue NtContinueEx
NtConvertBetweenAuxiliaryCounterAndPerformanceCounter NtCopyFileChunk
NtCreateCpuPartition NtCreateCrossVmEvent NtCreateCrossVmMutant
NtCreateDebugObject NtCreateDirectoryObject NtCreateDirectoryObjectEx
NtCreateEnclave NtCreateEnlistment NtCreateEvent NtCreateEventPair NtCreateFile
NtCreateIRTimer NtCreateIoCompletion NtCreateIoRing NtCreateJobObject
NtCreateJobSet NtCreateKey NtCreateKeyTransacted NtCreateKeyedEvent
NtCreateLowBoxToken NtCreateMailslotFile NtCreateMutant NtCreateNamedPipeFile
NtCreatePagingFile NtCreatePartition NtCreatePort NtCreatePrivateNamespace
NtCreateProcess NtCreateProcessEx NtCreateProcessStateChange NtCreateProfile
NtCreateProfileEx NtCreateRegistryTransaction NtCreateResourceManager
NtCreateSection NtCreateSectionEx NtCreateSemaphore NtCreateSymbolicLinkObject
NtCreateThread NtCreateThreadEx NtCreateThreadStateChange NtCreateTimer
NtCreateTimer2 NtCreateToken NtCreateTokenEx NtCreateTransaction
NtCreateTransactionManager NtCreateUserProcess NtCreateWaitCompletionPacket
NtCreateWaitablePort NtCreateWnfStateName NtCreateWorkerFactory
NtDebugActiveProcess NtDebugContinue NtDelayExecution NtDeleteAtom
NtDeleteBootEntry NtDeleteDriverEntry NtDeleteFile NtDeleteKey
NtDeleteObjectAuditAlarm NtDeletePrivateNamespace NtDeleteValueKey
NtDeleteWnfStateData NtDeleteWnfStateName NtDeviceIoControlFile
NtDirectGraphicsCall NtDisableLastKnownGood NtDisplayString NtDrawText
NtDuplicateObject NtDuplicateToken NtEnableLastKnownGood NtEnumerateBootEntries
NtEnumerateDriverEntries NtEnumerateKey NtEnumerateSystemEnvironmentValuesEx
NtEnumerateTransactionObject NtEnumerateValueKey NtExtendSection
NtFilterBootOption NtFilterToken NtFilterTokenEx NtFindAtom NtFlushBuffersFile
NtFlushBuffersFileEx NtFlushInstallUILanguage NtFlushInstructionCache NtFlushKey
NtFlushProcessWriteBuffers NtFlushVirtualMemory NtFlushWriteBuffer
NtFreeUserPhysicalPages NtFreeVirtualMemory NtFreezeRegistry
NtFreezeTransactions NtFsControlFile NtGetCachedSigningLevel
NtGetCompleteWnfStateSubscription NtGetContextThread NtGetCurrentProcessorNumber
NtGetCurrentProcessorNumberEx NtGetDevicePowerState NtGetMUIRegistryInfo
NtGetNextProcess NtGetNextThread NtGetNlsSectionPtr
NtGetNotificationResourceManager NtGetPlugPlayEvent NtGetWriteWatch
NtImpersonateAnonymousToken NtImpersonateClientOfPort NtImpersonateThread
NtInitializeEnclave NtInitializeNlsFiles NtInitializeRegistry
NtInitiatePowerAction NtIsProcessInJob NtIsSystemResumeAutomatic
NtIsUILanguageComitted NtListTransactions NtListenPort NtLoadDriver
NtLoadEnclaveData NtLoadHotPatch NtLoadKey NtLoadKey2 NtLoadKey3 NtLoadKeyEx
NtLockFile NtLockProductActivationKeys NtLockRegistryKey NtLockVirtualMemory
NtMakePermanentObject NtMakeTemporaryObject NtManageHotPatch NtManagePartition
NtMapCMFModule NtMapUserPhysicalPages NtMapUserPhysicalPagesScatter
NtMapViewOfSection NtMapViewOfSectionEx NtMarshallTransaction NtModifyBootEntry
NtModifyDriverEntry NtNotifyChangeDirectoryFile NtNotifyChangeDirectoryFileEx
NtNotifyChangeKey NtNotifyChangeMultipleKeys NtNotifyChangeSession
NtOpenCpuPartition NtOpenDirectoryObject NtOpenEnlistment NtOpenEvent
NtOpenEventPair NtOpenFile NtOpenIoCompletion NtOpenJobObject NtOpenKey
NtOpenKeyEx NtOpenKeyTransacted NtOpenKeyTransactedEx NtOpenKeyedEvent
NtOpenMutant NtOpenObjectAuditAlarm NtOpenPartition NtOpenPrivateNamespace
NtOpenProcess NtOpenProcessToken NtOpenProcessTokenEx NtOpenRegistryTransaction
NtOpenResourceManager NtOpenSection NtOpenSemaphore NtOpenSession
NtOpenSymbolicLinkObject NtOpenThread NtOpenThreadToken NtOpenThreadTokenEx
NtOpenTimer NtOpenTransaction NtOpenTransactionManager NtPlugPlayControl
NtPowerInformation NtPrePrepareComplete NtPrePrepareEnlistment NtPrepareComplete
NtPrepareEnlistment NtPrivilegeCheck NtPrivilegeObjectAuditAlarm
NtPrivilegedServiceAuditAlarm NtPropagationComplete NtPropagationFailed
NtProtectVirtualMemory NtPssCaptureVaSpaceBulk NtPullTransaction NtPulseEvent
NtQueryAttributesFile NtQueryAuxiliaryCounterFrequency NtQueryBootEntryOrder
NtQueryBootOptions NtQueryDebugFilterState NtQueryDefaultLocale
NtQueryDefaultUILanguage NtQueryDirectoryFile NtQueryDirectoryFileEx
NtQueryDirectoryObject NtQueryDriverEntryOrder NtQueryEaFile NtQueryEvent
NtQueryFullAttributesFile NtQueryInformationAtom NtQueryInformationByName
NtQueryInformationCpuPartition NtQueryInformationEnlistment
NtQueryInformationFile NtQueryInformationJobObject NtQueryInformationPort
NtQueryInformationProcess NtQueryInformationResourceManager
NtQueryInformationThread NtQueryInformationToken NtQueryInformationTransaction
NtQueryInformationTransactionManager NtQueryInformationWorkerFactory
NtQueryInstallUILanguage NtQueryIntervalProfile NtQueryIoCompletion
NtQueryIoRingCapabilities NtQueryKey NtQueryLicenseValue NtQueryMultipleValueKey
NtQueryMutant NtQueryObject NtQueryOpenSubKeys NtQueryOpenSubKeysEx
NtQueryPerformanceCounter NtQueryPortInformationProcess
NtQueryQuotaInformationFile NtQuerySection NtQuerySecurityAttributesToken
NtQuerySecurityObject NtQuerySecurityPolicy NtQuerySemaphore
NtQuerySymbolicLinkObject NtQuerySystemEnvironmentValue
NtQuerySystemEnvironmentValueEx NtQuerySystemInformation
NtQuerySystemInformationEx NtQuerySystemTime NtQueryTimer NtQueryTimerResolution
NtQueryValueKey NtQueryVirtualMemory NtQueryVolumeInformationFile
NtQueryWnfStateData NtQueryWnfStateNameInformation NtQueueApcThread
NtQueueApcThreadEx NtQueueApcThreadEx2 NtRaiseException NtRaiseHardError
NtReadFile NtReadFileScatter NtReadOnlyEnlistment NtReadRequestData
NtReadVirtualMemory NtReadVirtualMemoryEx NtRecoverEnlistment
NtRecoverResourceManager NtRecoverTransactionManager
NtRegisterProtocolAddressInformation NtRegisterThreadTerminatePort
NtReleaseCMFViewOwnership NtReleaseKeyedEvent NtReleaseMutant NtReleaseSemaphore
NtReleaseWorkerFactoryWorker NtRemoveIoCompletion NtRemoveIoCompletionEx
NtRemoveProcessDebug NtRenameKey NtRenameTransactionManager NtReplaceKey
NtReplacePartitionUnit NtReplyPort NtReplyWaitReceivePort
NtReplyWaitReceivePortEx NtReplyWaitReplyPort NtRequestDeviceWakeup
NtRequestPort NtRequestWaitReplyPort NtRequestWakeupLatency NtResetEvent
NtResetWriteWatch NtRestoreKey NtResumeProcess NtResumeThread
NtRevertContainerImpersonation NtRollbackComplete NtRollbackEnlistment
NtRollbackRegistryTransaction NtRollbackSavepointTransaction
NtRollbackTransaction NtRollforwardTransactionManager NtSaveKey NtSaveKeyEx
NtSaveMergedKeys NtSavepointComplete NtSavepointTransaction NtSecureConnectPort
NtSerializeBoot NtSetBootEntryOrder NtSetBootOptions NtSetCachedSigningLevel
NtSetCachedSigningLevel2 NtSetContextThread NtSetDebugFilterState
NtSetDefaultHardErrorPort NtSetDefaultLocale NtSetDefaultUILanguage
NtSetDriverEntryOrder NtSetEaFile NtSetEvent NtSetEventBoostPriority
NtSetEventEx NtSetHighEventPair NtSetHighWaitLowEventPair NtSetIRTimer
NtSetInformationCpuPartition NtSetInformationDebugObject
NtSetInformationEnlistment NtSetInformationFile NtSetInformationIoRing
NtSetInformationJobObject NtSetInformationKey NtSetInformationObject
NtSetInformationProcess NtSetInformationResourceManager
NtSetInformationSymbolicLink NtSetInformationThread NtSetInformationToken
NtSetInformationTransaction NtSetInformationTransactionManager
NtSetInformationVirtualMemory NtSetInformationWorkerFactory NtSetIntervalProfile
NtSetIoCompletion NtSetIoCompletionEx NtSetLdtEntries NtSetLowEventPair
NtSetLowWaitHighEventPair NtSetQuotaInformationFile NtSetSecurityObject
NtSetSystemEnvironmentValue NtSetSystemEnvironmentValueEx NtSetSystemInformation
NtSetSystemPowerState NtSetSystemTime NtSetThreadExecutionState NtSetTimer
NtSetTimer2 NtSetTimerEx NtSetTimerResolution NtSetUuidSeed NtSetValueKey
NtSetVolumeInformationFile NtSetWnfProcessNotificationEvent NtShutdownSystem
NtShutdownWorkerFactory NtSignalAndWaitForSingleObject NtSinglePhaseReject
NtStartProfile NtStartTm NtStopProfile NtSubmitIoRing NtSubscribeWnfStateChange
NtSuspendProcess NtSuspendThread NtSystemDebugControl NtTerminateEnclave
NtTerminateJobObject NtTerminateProcess NtTerminateThread NtTestAlert
NtThawRegistry NtThawTransactions NtTraceControl NtTraceEvent
NtTranslateFilePath NtUmsThreadYield NtUnloadDriver NtUnloadKey NtUnloadKey2
NtUnloadKeyEx NtUnlockFile NtUnlockVirtualMemory NtUnmapViewOfSection
NtUnmapViewOfSectionEx NtUnsubscribeWnfStateChange NtUpdateWnfStateData
NtVdmControl NtWaitForAlertByThreadId NtWaitForDebugEvent NtWaitForKeyedEvent
NtWaitForMultipleObjects NtWaitForMultipleObjects32 NtWaitForSingleObject
NtWaitForWnfNotifications NtWaitForWorkViaWorkerFactory NtWaitHighEventPair
NtWaitLowEventPair NtWorkerFactoryWorkerReady NtWriteFile NtWriteFileGather
NtWriteRequestData NtWriteVirtualMemory NtYieldExecution