Repository navigation
Kernel Calls
This reference describes the public source reconstruction for SpiritBoot release 271495969fecc933ef3c3ff4ad0892f5e99bca2d, using Roswell base 1569e2e89fb47cc72b9c704a8884f98200432bd4 and its ordered patches. It records implementation behavior, not a promise that every title or hardware revision is compatible. No proprietary BIOS source or disassembly is included.
The ordinal and ABI inventory comes from ntoskrnl/xb/xboxkrnl.exe.def and routing from ordinals.map, introduced in Spirit patch 0001; later routes/implementations must be read with patch 0002 and the ordered release manifest.
For stdcall, the byte suffix is the fixed argument area (callee cleanup). For fastcall, bytes count all argument slots, including the first two eligible DWORD arguments in ECX/EDX; they are not all stack bytes. A 64-bit argument can occupy two slots. cdecl 0 here means no decorated fixed-byte count, particularly variadic DbgPrint. DATA entries have no calling convention. Function signatures below name the implementation parameters; the export decoration remains the ABI authority. Caller-owned structures and buffers must stay accessible for every outstanding operation. Assertions and fatal paths are not recoverable error returns.
DbgLoadImageSymbols (7) and DbgUnLoadImageSymbols (11) are unmapped function scaffolds; HalDiskCachePartitionCount is scaffold DATA initialized 3. All other entries in these families are mapped. Mapping alone says nothing about functionality: IoMarkIrpMustComplete is a mapped no-op, AV filtering is unfinished, and hardware/lifecycle limits below remain material. For any unmapped function, the generator emits its exact declared arity/convention and calls KeBugCheckEx(0xE0000002, ordinal, 0, 0, 0); it never returns a useful 0. Unmapped DATA instead gets ULONG_PTR storage initialized 0 or a map override; it is never that callable stub.
163 exports: 147 functions (145 mapped, 2 fatal scaffolds) and 16 DATA entries (15 mapped, 1 initialized scaffold).
| Ordinal | Public name | ABI | Route |
|---|---|---|---|
| 1 | AvGetSavedDataAddress | stdcall 0 bytes | AvGetSavedDataAddress |
| 2 | AvSendTVEncoderOption | stdcall 16 bytes | AvSendTVEncoderOption |
| 3 | AvSetDisplayMode | stdcall 24 bytes | AvSetDisplayMode |
| 4 | AvSetSavedDataAddress | stdcall 4 bytes | AvSetSavedDataAddress |
| 5 | DbgBreakPoint | stdcall 0 bytes | DbgBreakPoint |
| 6 | DbgBreakPointWithStatus | stdcall 4 bytes | DbgBreakPointWithStatus |
| 7 | DbgLoadImageSymbols | stdcall 12 bytes | XbExpStub_7 |
| 8 | DbgPrint | cdecl 0 bytes | DbgPrint |
| 9 | HalReadSMCTrayState | stdcall 8 bytes | HalReadSMCTrayState |
| 10 | DbgPrompt | stdcall 12 bytes | XeDbgPrompt |
| 11 | DbgUnLoadImageSymbols | stdcall 12 bytes | XbExpStub_11 |
| 12 | ExAcquireReadWriteLockExclusive | stdcall 4 bytes | ExAcquireReadWriteLockExclusive |
| 13 | ExAcquireReadWriteLockShared | stdcall 4 bytes | ExAcquireReadWriteLockShared |
| 14 | ExAllocatePool | stdcall 4 bytes | XeExAllocatePool |
| 15 | ExAllocatePoolWithTag | stdcall 8 bytes | XeExAllocatePoolWithTag |
| 16 | ExEventObjectType | DATA | XeExEventObjectType |
| 17 | ExFreePool | stdcall 4 bytes | ExFreePool |
| 18 | ExInitializeReadWriteLock | stdcall 4 bytes | ExInitializeReadWriteLock |
| 19 | ExInterlockedAddLargeInteger | stdcall 16 bytes | ExInterlockedAddLargeInteger |
| 20 | ExInterlockedAddLargeStatistic | fastcall 8 bytes | ExInterlockedAddLargeStatistic |
| 21 | ExInterlockedCompareExchange64 | fastcall 12 bytes | ExfInterlockedCompareExchange64 |
| 22 | ExMutantObjectType | DATA | XeExMutantObjectType |
| 23 | ExQueryPoolBlockSize | stdcall 4 bytes | XeExQueryPoolBlockSize |
| 24 | ExQueryNonVolatileSetting | stdcall 20 bytes | ExQueryNonVolatileSetting |
| 25 | ExReadWriteRefurbInfo | stdcall 12 bytes | ExReadWriteRefurbInfo |
| 26 | ExRaiseException | stdcall 4 bytes | RtlRaiseException |
| 27 | ExRaiseStatus | stdcall 4 bytes | RtlRaiseStatus |
| 28 | ExReleaseReadWriteLock | stdcall 4 bytes | ExReleaseReadWriteLock |
| 29 | ExSaveNonVolatileSetting | stdcall 16 bytes | ExSaveNonVolatileSetting |
| 30 | ExSemaphoreObjectType | DATA | XeExSemaphoreObjectType |
| 31 | ExTimerObjectType | DATA | XeExTimerObjectType |
| 32 | ExfInterlockedInsertHeadList | fastcall 8 bytes | XbExfInterlockedInsertHeadList |
| 33 | ExfInterlockedInsertTailList | fastcall 8 bytes | XbExfInterlockedInsertTailList |
| 34 | ExfInterlockedRemoveHeadList | fastcall 4 bytes | XbExfInterlockedRemoveHeadList |
| 38 | HalClearSoftwareInterrupt | fastcall 4 bytes | HalClearSoftwareInterrupt |
| 39 | HalDisableSystemInterrupt | stdcall 4 bytes | NxHalDisableSystemInterrupt |
| 40 | HalDiskCachePartitionCount | DATA | scaffold DATA 3 |
| 41 | HalDiskModelNumber | DATA | HalDiskModelNumber |
| 42 | HalDiskSerialNumber | DATA | HalDiskSerialNumber |
| 43 | HalEnableSystemInterrupt | stdcall 8 bytes | NxHalEnableSystemInterrupt |
| 44 | HalGetInterruptVector | stdcall 8 bytes | XeHalGetInterruptVector |
| 45 | HalReadSMBusValue | stdcall 16 bytes | HalReadSMBusValue |
| 46 | HalReadWritePCISpace | stdcall 24 bytes | HalReadWritePCISpace |
| 47 | HalRegisterShutdownNotification | stdcall 8 bytes | HalRegisterShutdownNotification |
| 48 | HalRequestSoftwareInterrupt | fastcall 4 bytes | HalRequestSoftwareInterrupt |
| 49 | HalReturnToFirmware | stdcall 4 bytes | XeHalReturnToFirmware |
| 50 | HalWriteSMBusValue | stdcall 16 bytes | HalWriteSMBusValue |
| 51 | InterlockedCompareExchange | fastcall 12 bytes | XeInterlockedCompareExchange |
| 52 | InterlockedDecrement | fastcall 4 bytes | XeInterlockedDecrement |
| 53 | InterlockedIncrement | fastcall 4 bytes | XeInterlockedIncrement |
| 54 | InterlockedExchange | fastcall 8 bytes | XeInterlockedExchange |
| 55 | InterlockedExchangeAdd | fastcall 8 bytes | XeInterlockedExchangeAdd |
| 56 | InterlockedFlushSList | fastcall 4 bytes | ExInterlockedFlushSList |
| 57 | InterlockedPopEntrySList | fastcall 4 bytes | XeInterlockedPopEntrySList |
| 58 | InterlockedPushEntrySList | fastcall 8 bytes | XeInterlockedPushEntrySList |
| 59 | IoAllocateIrp | stdcall 4 bytes | XeIoAllocateIrp |
| 60 | IoBuildAsynchronousFsdRequest | stdcall 24 bytes | IoBuildAsynchronousFsdRequest |
| 61 | IoBuildDeviceIoControlRequest | stdcall 36 bytes | IoBuildDeviceIoControlRequest |
| 62 | IoBuildSynchronousFsdRequest | stdcall 28 bytes | IoBuildSynchronousFsdRequest |
| 63 | IoCheckShareAccess | stdcall 20 bytes | IoCheckShareAccess |
| 64 | IoCompletionObjectType | DATA | XeIoCompletionObjectType |
| 65 | IoCreateDevice | stdcall 24 bytes | XeIoCreateDevice |
| 66 | IoCreateFile | stdcall 40 bytes | XeIoCreateFile |
| 67 | IoCreateSymbolicLink | stdcall 8 bytes | XeIoCreateSymbolicLink |
| 68 | IoDeleteDevice | stdcall 4 bytes | IoDeleteDevice |
| 69 | IoDeleteSymbolicLink | stdcall 4 bytes | XeIoDeleteSymbolicLink |
| 70 | IoDeviceObjectType | DATA | XeIoDeviceObjectType |
| 71 | IoFileObjectType | DATA | XeIoFileObjectType |
| 72 | IoFreeIrp | stdcall 4 bytes | IoFreeIrp |
| 73 | IoInitializeIrp | stdcall 12 bytes | IoInitializeIrp |
| 74 | IoInvalidDeviceRequest | stdcall 8 bytes | IoInvalidDeviceRequest |
| 75 | IoQueryFileInformation | stdcall 20 bytes | XeIoQueryFileInformation |
| 76 | IoQueryVolumeInformation | stdcall 20 bytes | XeIoQueryVolumeInformation |
| 77 | IoQueueThreadIrp | stdcall 4 bytes | IoQueueThreadIrp |
| 78 | IoRemoveShareAccess | stdcall 8 bytes | IoRemoveShareAccess |
| 79 | IoSetIoCompletion | stdcall 20 bytes | XeIoSetIoCompletion |
| 80 | IoSetShareAccess | stdcall 16 bytes | IoSetShareAccess |
| 81 | IoStartNextPacket | stdcall 4 bytes | XeIoStartNextPacket |
| 82 | IoStartNextPacketByKey | stdcall 8 bytes | XeIoStartNextPacketByKey |
| 83 | IoStartPacket | stdcall 12 bytes | XeIoStartPacket |
| 84 | IoSynchronousDeviceIoControlRequest | stdcall 32 bytes | XeIoSynchronousDeviceIoControlRequest |
| 85 | IoSynchronousFsdRequest | stdcall 20 bytes | XeIoSynchronousFsdRequest |
| 86 | IofCallDriver | fastcall 8 bytes | IofCallDriver |
| 87 | IofCompleteRequest | fastcall 8 bytes | IofCompleteRequest |
| 90 | IoDismountVolume | stdcall 4 bytes | XeIoDismountVolume |
| 91 | IoDismountVolumeByName | stdcall 4 bytes | XeIoDismountVolumeByName |
| 92 | KeAlertResumeThread | stdcall 4 bytes | KeAlertResumeThread |
| 93 | KeAlertThread | stdcall 8 bytes | KeAlertThread |
| 94 | KeBoostPriorityThread | stdcall 8 bytes | KeBoostPriorityThread |
| 95 | KeBugCheck | stdcall 4 bytes | KeBugCheck |
| 96 | KeBugCheckEx | stdcall 20 bytes | KeBugCheckEx |
| 97 | KeCancelTimer | stdcall 4 bytes | KeCancelTimer |
| 98 | KeConnectInterrupt | stdcall 4 bytes | XeKeConnectInterrupt |
| 99 | KeDelayExecutionThread | stdcall 12 bytes | KeDelayExecutionThread |
| 100 | KeDisconnectInterrupt | stdcall 4 bytes | XeKeDisconnectInterrupt |
| 101 | KeEnterCriticalRegion | stdcall 0 bytes | KeEnterCriticalRegion |
| 103 | KeGetCurrentIrql | stdcall 0 bytes | KeGetCurrentIrql |
| 104 | KeGetCurrentThread | stdcall 0 bytes | XeKeGetCurrentThread |
| 105 | KeInitializeApc | stdcall 28 bytes | XeKeInitializeApc |
| 106 | KeInitializeDeviceQueue | stdcall 4 bytes | KeInitializeDeviceQueue |
| 107 | KeInitializeDpc | stdcall 12 bytes | KeInitializeDpc |
| 108 | KeInitializeEvent | stdcall 12 bytes | KeInitializeEvent |
| 109 | KeInitializeInterrupt | stdcall 28 bytes | XeKeInitializeInterrupt |
| 110 | KeInitializeMutant | stdcall 8 bytes | KeInitializeMutant |
| 111 | KeInitializeQueue | stdcall 8 bytes | KeInitializeQueue |
| 112 | KeInitializeSemaphore | stdcall 12 bytes | KeInitializeSemaphore |
| 113 | KeInitializeTimerEx | stdcall 8 bytes | KeInitializeTimerEx |
| 114 | KeInsertByKeyDeviceQueue | stdcall 12 bytes | KeInsertByKeyDeviceQueue |
| 115 | KeInsertDeviceQueue | stdcall 8 bytes | KeInsertDeviceQueue |
| 116 | KeInsertHeadQueue | stdcall 8 bytes | KeInsertHeadQueue |
| 117 | KeInsertQueue | stdcall 8 bytes | KeInsertQueue |
| 118 | KeInsertQueueApc | stdcall 16 bytes | XeKeInsertQueueApc |
| 119 | KeInsertQueueDpc | stdcall 12 bytes | KeInsertQueueDpc |
| 120 | KeInterruptTime | DATA | KeInterruptTime |
| 121 | KeIsExecutingDpc | stdcall 0 bytes | KeIsExecutingDpc |
| 122 | KeLeaveCriticalRegion | stdcall 0 bytes | KeLeaveCriticalRegion |
| 123 | KePulseEvent | stdcall 12 bytes | KePulseEvent |
| 124 | KeQueryBasePriorityThread | stdcall 4 bytes | KeQueryBasePriorityThread |
| 125 | KeQueryInterruptTime | stdcall 0 bytes | XeKeQueryInterruptTime |
| 126 | KeQueryPerformanceCounter | stdcall 0 bytes | XeKeQueryPerformanceCounter |
| 127 | KeQueryPerformanceFrequency | stdcall 0 bytes | KeQueryPerformanceFrequency |
| 128 | KeQuerySystemTime | stdcall 4 bytes | KeQuerySystemTime |
| 129 | KeRaiseIrqlToDpcLevel | stdcall 0 bytes | KeRaiseIrqlToDpcLevel |
| 130 | KeRaiseIrqlToSynchLevel | stdcall 0 bytes | KeRaiseIrqlToSynchLevel |
| 131 | KeReleaseMutant | stdcall 16 bytes | KeReleaseMutant |
| 132 | KeReleaseSemaphore | stdcall 16 bytes | KeReleaseSemaphore |
| 133 | KeRemoveByKeyDeviceQueue | stdcall 8 bytes | KeRemoveByKeyDeviceQueue |
| 134 | KeRemoveDeviceQueue | stdcall 4 bytes | KeRemoveDeviceQueue |
| 135 | KeRemoveEntryDeviceQueue | stdcall 8 bytes | KeRemoveEntryDeviceQueue |
| 136 | KeRemoveQueue | stdcall 12 bytes | KeRemoveQueue |
| 137 | KeRemoveQueueDpc | stdcall 4 bytes | KeRemoveQueueDpc |
| 138 | KeResetEvent | stdcall 4 bytes | KeResetEvent |
| 139 | KeRestoreFloatingPointState | stdcall 4 bytes | KeRestoreFloatingPointState |
| 140 | KeResumeThread | stdcall 4 bytes | KeResumeThread |
| 141 | KeRundownQueue | stdcall 4 bytes | KeRundownQueue |
| 142 | KeSaveFloatingPointState | stdcall 4 bytes | KeSaveFloatingPointState |
| 143 | KeSetBasePriorityThread | stdcall 8 bytes | KeSetBasePriorityThread |
| 144 | KeSetDisableBoostThread | stdcall 8 bytes | KeSetDisableBoostThread |
| 145 | KeSetEvent | stdcall 12 bytes | KeSetEvent |
| 146 | KeSetEventBoostPriority | stdcall 8 bytes | KeSetEventBoostPriority |
| 147 | KeSetPriorityProcess | stdcall 8 bytes | KeSetPriorityProcess |
| 148 | KeSetPriorityThread | stdcall 8 bytes | KeSetPriorityThread |
| 149 | KeSetTimer | stdcall 16 bytes | KeSetTimer |
| 150 | KeSetTimerEx | stdcall 20 bytes | KeSetTimerEx |
| 151 | KeStallExecutionProcessor | stdcall 4 bytes | KeStallExecutionProcessor |
| 152 | KeSuspendThread | stdcall 4 bytes | KeSuspendThread |
| 153 | KeSynchronizeExecution | stdcall 12 bytes | XeKeSynchronizeExecution |
| 154 | KeSystemTime | DATA | KeSystemTime |
| 155 | KeTestAlertThread | stdcall 4 bytes | KeTestAlertThread |
| 156 | KeTickCount | DATA | KeTickCount |
| 157 | KeTimeIncrement | DATA | KeTimeIncrement |
| 158 | KeWaitForMultipleObjects | stdcall 32 bytes | KeWaitForMultipleObjects |
| 159 | KeWaitForSingleObject | stdcall 20 bytes | KeWaitForSingleObject |
| 160 | KfRaiseIrql | fastcall 4 bytes | KfRaiseIrql |
| 161 | KfLowerIrql | fastcall 4 bytes | KfLowerIrql |
| 162 | KiBugCheckData | DATA | KiBugCheckData |
| 163 | KiUnlockDispatcherDatabase | fastcall 4 bytes | KiExitDispatcher |
| 356 | HalBootSMCVideoMode | DATA | HalBootSMCVideoMode |
| 358 | HalIsResetOrShutdownPending | stdcall 0 bytes | HalIsResetOrShutdownPending |
| 359 | IoMarkIrpMustComplete | stdcall 4 bytes | IoMarkIrpMustComplete |
| 360 | HalInitiateShutdown | stdcall 0 bytes | HalInitiateShutdown |
| 365 | HalEnableSecureTrayEject | stdcall 0 bytes | HalEnableSecureTrayEject |
| 366 | HalWriteSMCScratchRegister | stdcall 4 bytes | HalWriteSMCScratchRegister |
Ordinal 1; stdcall, 0 ABI argument bytes. Route: AvGetSavedDataAddress.
Returns the saved framebuffer pointer, initially NULL. This is a stored address, with no allocation, validation or reference acquisition.
Implementation: hal/halx86/xbox/av.c (AvGetSavedDataAddress, reconstructed line 103).
PVOID NTAPI
AvGetSavedDataAddress(VOID)Spirit implementation source and subsequent kernel call changes.
Ordinal 2; stdcall, 16 ABI argument bytes. Route: AvSendTVEncoderOption.
RegisterBase is ignored. GET_SETTINGS composes AV pack and video-standard flags from SMC/EEPROM reads, with composite/NTSC defaults on failed reads; NTSC-J is not separately identified. VIDEO_ENABLE uses Param=0 for on and nonzero for off, gates ACPI video, and programs Conexant DACs when detected. Flicker/soften filters do nothing; unknown options only log. Result is optional and written only by GET_SETTINGS. SMBus errors are not returned by this void API; Focus is probed, Xcalibur has no dedicated implementation.
Implementation: hal/halx86/xbox/av.c (AvSendTVEncoderOption, reconstructed line 175).
VOID NTAPI
AvSendTVEncoderOption(
_In_ PVOID RegisterBase,
_In_ ULONG Option,
_In_ ULONG Param,
_Out_opt_ PULONG Result)Spirit implementation source and subsequent kernel call changes.
Ordinal 3; stdcall, 24 ABI argument bytes. Route: AvSetDisplayMode.
Writes NV2A PCRTC_START with FrameBuffer masked to 26 bits and encodes Pitch/8 in VGA CR13/19/25, preserving unrelated bits. Sets CR39=FF to disable GPU interlace. Step, DisplayMode and SourceColorFormat are ignored; returns 0 immediately, indicating completion of one step. RegisterBase must point to accessible GPU registers. There is no pitch/range/format validation or framebuffer allocation.
Implementation: hal/halx86/xbox/av.c (AvSetDisplayMode, reconstructed line 248).
ULONG NTAPI
AvSetDisplayMode(
_In_ PVOID RegisterBase,
_In_ ULONG Step,
_In_ ULONG DisplayMode,
_In_ ULONG SourceColorFormat,
_In_ ULONG Pitch,
_In_ ULONG FrameBuffer)Spirit implementation source and subsequent kernel call changes.
Ordinal 4; stdcall, 4 ABI argument bytes. Route: AvSetSavedDataAddress.
Replaces the saved framebuffer address, including allowing NULL. The kernel neither copies nor frees its storage; the caller controls its lifetime.
Implementation: hal/halx86/xbox/av.c (AvSetSavedDataAddress, reconstructed line 109).
VOID NTAPI
AvSetSavedDataAddress(_In_opt_ PVOID Address)Spirit implementation source and subsequent kernel call changes.
Ordinal 5; stdcall, 0 ABI argument bytes. Route: DbgBreakPoint.
Executes an x86 INT3 breakpoint. It is an exception/debugger entry, not a success-returning diagnostic API; execution after it depends on the exception handler/debugger.
Implementation: hal/halx86/generic/systimer.S (DbgBreakPoint, reconstructed line 1).
/* assembler entry: signature is defined by export ABI */Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 6; stdcall, 4 ABI argument bytes. Route: DbgBreakPointWithStatus.
Executes INT3 with the supplied status in EAX for the debugger. Status does not become an NTSTATUS return value.
Implementation: sdk/lib/rtl/i386/debug_asm.S (DbgBreakPointWithStatus, reconstructed line 1).
/* assembler entry: signature is defined by export ABI */Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 7; stdcall, 12 ABI argument bytes. Route: XbExpStub_7.
Unmapped function: generated stdcall scaffold has three DWORD arguments (12 ABI bytes) and immediately invokes KeBugCheckEx(E0000002, this ordinal, 0, 0, 0). Does not load/unload symbols, return a status, allocate a buffer or establish ownership. Caller never reaches a useful normal return.
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 8; cdecl, 0 ABI argument bytes. Route: DbgPrint.
Formats a variadic debug message and sends it through the kernel debug output path. The cdecl export has no fixed argument byte suffix: callers clean their argument stack. Formatting/output availability follows the selected build and KD transport, so this is not a guarantee that a remote debugger is attached. In the release configuration kd-release-stubs.c silently drops DbgPrint output; traceable KD output requires a debug build.
Implementation: sdk/lib/rtl/debug.c (DbgPrint, reconstructed line 209).
__cdecl
DbgPrint(PCCH Format,
...)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 9; stdcall, 8 ABI argument bytes. Route: HalReadSMCTrayState.
Reads SMC register 03 and masks70: preserves closed/media-present60 and closed/no-media40; all transient states map to open10. On SMBus failure still writes open fallback and returns the bus error. State is required, Count optional. Eject count stays zero because no SMC tray IRQ updates it.
Implementation: hal/halx86/xbox/hal.c (HalReadSMCTrayState, reconstructed line 44).
NTSTATUS NTAPI
HalReadSMCTrayState(_Out_ PULONG State, _Out_opt_ PULONG Count)Spirit implementation source and subsequent kernel call changes.
Ordinal 10; stdcall, 12 ABI argument bytes. Route: XeDbgPrompt.
Returns 0 for NULL response or zero capacity; otherwise first clears Response[0]. Release builds return 0 because input transport is omitted. Debug builds also require available prompt transport, enabled/present debugger and non-NULL prompt. Response capacity and scanned prompt are bounded to USHORT range (FFFF); returns the transport count capped to capacity. No buffer is allocated or retained.
Implementation: ntoskrnl/xb/debugprompt.c (XeDbgPrompt, reconstructed line 5).
ULONG NTAPI XeDbgPrompt(PCCH Prompt, PCH Response, ULONG MaximumResponseLength)Spirit implementation source and subsequent kernel call changes.
Ordinal 11; stdcall, 12 ABI argument bytes. Route: XbExpStub_11.
Unmapped function: generated stdcall scaffold has three DWORD arguments (12 ABI bytes) and immediately invokes KeBugCheckEx(E0000002, this ordinal, 0, 0, 0). Does not load/unload symbols, return a status, allocate a buffer or establish ownership. Caller never reaches a useful normal return.
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 12; stdcall, 4 ABI argument bytes. Route: ExAcquireReadWriteLockExclusive.
Disables interrupts while incrementing LockCount. Zero means immediate ownership; otherwise increments WritersWaitingCount and waits indefinitely, nonalertably in KernelMode, on WriterEvent after restoring interrupts. Returns void only after acquiring. No recursion/owner tracking or timeout exists.
Implementation: ntoskrnl/xb/rwlock.c (ExAcquireReadWriteLockExclusive, reconstructed line 41).
VOID
NTAPI
ExAcquireReadWriteLockExclusive(IN PERWLOCK ReadWriteLock)Spirit implementation source and subsequent kernel call changes.
Ordinal 13; stdcall, 4 ABI argument bytes. Route: ExAcquireReadWriteLockShared.
Increments LockCount under interrupt masking. An occupied lock blocks new readers when no readers are active or a writer waits; records a reader waiter and waits indefinitely/nonalertably on ReaderSemaphore. Otherwise increments ReadersEntryCount. Caller must pair with release; no thread identity validation exists.
Implementation: ntoskrnl/xb/rwlock.c (ExAcquireReadWriteLockShared, reconstructed line 61).
VOID
NTAPI
ExAcquireReadWriteLockShared(IN PERWLOCK ReadWriteLock)Spirit implementation source and subsequent kernel call changes.
Ordinal 14; stdcall, 4 ABI argument bytes. Route: XeExAllocatePool.
Xbox adapters supply NonPagedPool implicitly. Input is byte count (and tag for WithTag); returns pool address or NULL on allocation failure. The caller owns the block and releases it with ExFreePool. This is pool storage, not a contiguous physical allocation. Released Spirit pool sizing changes must be read with the ordered patch chain.
Implementation: ntoskrnl/xb/xbe.c (XeExAllocatePool, reconstructed line 1401).
PVOID NTAPI
XeExAllocatePool(SIZE_T NumberOfBytes)Spirit implementation source and subsequent kernel call changes.
Authoritative pool-run size correction.
Ordinal 15; stdcall, 8 ABI argument bytes. Route: XeExAllocatePoolWithTag.
Xbox adapters supply NonPagedPool implicitly. Input is byte count (and tag for WithTag); returns pool address or NULL on allocation failure. The caller owns the block and releases it with ExFreePool. This is pool storage, not a contiguous physical allocation. Released Spirit pool sizing changes must be read with the ordered patch chain.
Implementation: ntoskrnl/xb/xbe.c (XeExAllocatePoolWithTag, reconstructed line 1406).
PVOID NTAPI
XeExAllocatePoolWithTag(SIZE_T NumberOfBytes, ULONG Tag)Spirit implementation source and subsequent kernel call changes.
Authoritative pool-run size correction.
Ordinal 16; DATA address. Route: XeExEventObjectType.
Address of a 28-byte Xbox-shaped OBJECT_TYPE descriptor, not a pointer variable containing a native NT POBJECT_TYPE. PoolTag is at offset 18(hex); object adapters translate recognized descriptor identity to native internal type. Exported descriptor lifetime is whole boot. Reading it is not object creation or a reference acquisition.
Implementation storage: ntoskrnl/xb/object-types.c.
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 17; stdcall, 4 ABI argument bytes. Route: ExFreePool.
Frees through nxpool ExFreePoolWithTag(P,0) in the release pool configuration. NULL bugchecks BAD_POOL_CALLER/46(hex). Page-aligned blocks return through pool page supply; small blocks validate allocated magic, bugchecking BAD_POOL_HEADER/7 for double free or8 for other bad magic, then return to size-class free list. Caller ownership ends; no status returned. ARM3 expool is an alternate disabled backend when NXK_MM_POOL is enabled.
Implementation: ntoskrnl/xb/mm/pool.c (ExFreePool, reconstructed line 457).
VOID
NTAPI
ExFreePool(PVOID P)Spirit implementation source and subsequent kernel call changes.
Ordinal 18; stdcall, 4 ABI argument bytes. Route: ExInitializeReadWriteLock.
Initializes caller-owned ERWLOCK: LockCount=-1; writer/reader wait counts and active readers=0; writer auto-reset event initially clear; reader semaphore initially zero with MAXLONG limit. No allocation or destruction function is involved. Reinitializing while owned or waited on invalidates that state.
Implementation: ntoskrnl/xb/rwlock.c (ExInitializeReadWriteLock, reconstructed line 29).
VOID
NTAPI
ExInitializeReadWriteLock(IN PERWLOCK ReadWriteLock)Spirit implementation source and subsequent kernel call changes.
Ordinal 19; stdcall, 16 ABI argument bytes. Route: ExInterlockedAddLargeInteger.
Adds the supplied LARGE_INTEGER to the destination under the caller supplied spinlock/interrupt exclusion and returns the previous 64-bit value. Destination and lock storage remain caller-owned. Unlike the adjacent CAS64 export this ABI includes the lock argument.
Implementation: ntoskrnl/ex/interlocked.c (ExInterlockedAddLargeInteger, reconstructed line 61).
LARGE_INTEGER
NTAPI
ExInterlockedAddLargeInteger(
IN OUT PLARGE_INTEGER Addend,
IN LARGE_INTEGER Increment,
IN OUT PKSPIN_LOCK Lock)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 20; fastcall, 8 ABI argument bytes. Route: ExInterlockedAddLargeStatistic.
FASTCALL assembler adds unsigned 32-bit Increment into a 64-bit LARGE_INTEGER with carry. It has no result or spinlock argument; uses two ADD/ADC instructions on the uniprocessor build (LOCK prefixes are only in CONFIG_SMP). It is not a single 64-bit CAS. @8 describes two four-byte arguments, passed in registers.
Implementation: ntoskrnl/ex/interlocked.c (ExInterlockedAddLargeStatistic, reconstructed line 552).
VOID
FASTCALL
ExInterlockedAddLargeStatistic(
IN OUT PLARGE_INTEGER Addend,
IN ULONG Increment)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 21; fastcall, 12 ABI argument bytes. Route: ExfInterlockedCompareExchange64.
Mapped internal ExfInterlockedCompareExchange64 uses three pointers: Destination, Exchange, Comparand. Reads the proposed/comparison 64-bit values through those pointers, atomically replaces Destination only on equality, and returns the old destination. No fourth spinlock argument is present.
Implementation: ntoskrnl/ex/interlocked.c (ExfInterlockedCompareExchange64, reconstructed line 539).
LONGLONG
FASTCALL
ExfInterlockedCompareExchange64(
IN OUT LONGLONG volatile *Destination,
IN PLONGLONG Exchange,
IN PLONGLONG Comparand)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 22; DATA address. Route: XeExMutantObjectType.
Address of a 28-byte Xbox-shaped OBJECT_TYPE descriptor, not a pointer variable containing a native NT POBJECT_TYPE. PoolTag is at offset 18(hex); object adapters translate recognized descriptor identity to native internal type. Exported descriptor lifetime is whole boot. Reading it is not object creation or a reference acquisition.
Implementation storage: ntoskrnl/xb/object-types.c.
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 23; stdcall, 4 ABI argument bytes. Route: XeExQueryPoolBlockSize.
Xbox adapter discards QuotaCharged output. nxpool returns size-class capacity minus8-byte header for small allocation, page-rounded authoritative run bytes for whole pages. NXK_MM_POOLPAGES rejects unowned whole-page addresses and raw bucket page bases with 0. Non-page-aligned pointers are interpreted as header-backed allocation with assertions, not fully validated arbitrary inputs. Released patch 0007 corrects run sizing; output need not equal requested byte length.
Implementation: ntoskrnl/xb/xbe.c (XeExQueryPoolBlockSize, reconstructed line 1108).
ULONG NTAPI XeExQueryPoolBlockSize(_In_ PVOID Block)Spirit implementation source and subsequent kernel call changes.
Authoritative pool-run size correction.
Ordinal 24; stdcall, 20 ABI argument bytes. Route: ExQueryNonVolatileSetting.
Loads the EEPROM cache or returns STATUS_DEVICE_NOT_READY. Unknown index returns STATUS_OBJECT_NAME_NOT_FOUND. NULL/short value returns STATUS_BUFFER_TOO_SMALL; individual setting failures leave Type and ResultLength untouched, while a whole-part query can report required length. Sealed setting opening can fail DEVICE_NOT_READY. Successful ordinary setting queries zero the full caller capacity before copying; sealed queries copy only their field, leaving surplus bytes unchanged. Section queries have their own whole-part zeroing rule. Type/ResultLength are optional outputs.
Implementation: ntoskrnl/xb/eeprom.c (ExQueryNonVolatileSetting, reconstructed line 350).
NTSTATUS NTAPI
ExQueryNonVolatileSetting(ULONG ValueIndex, PULONG Type, PVOID Value,
ULONG ValueLength, PULONG ResultLength)Spirit implementation source and subsequent kernel call changes.
Ordinal 25; stdcall, 12 ABI argument bytes. Route: ExReadWriteRefurbInfo.
Requires exactly 16 bytes or INVALID_PARAMETER. Allocates a 512-byte sector buffer (failure INSUFFICIENT_RESOURCES), reads HDD partition0 sector3 at offset 1536 synchronously, and propagates disk errors. Read copies a BRFR-marked record, otherwise zeroes output. Write copies the caller record but stamps the marker, preserves the rest of the read sector, and writes the whole sector. Temporary buffer and file handle are released on exit.
Implementation: ntoskrnl/xb/refurb.c (ExReadWriteRefurbInfo, reconstructed line 83).
NTSTATUS NTAPI
ExReadWriteRefurbInfo(PXBOX_REFURB_INFO RefurbInfo, ULONG ValueLength,
BOOLEAN DoWrite)Spirit implementation source and subsequent kernel call changes.
Ordinal 26; stdcall, 4 ABI argument bytes. Route: RtlRaiseException.
Ordinal aliases RtlRaiseException: raises the caller-built exception record through native exception dispatch/unwind. It is not a status-returning API; continuation depends on exception flags and handlers.
Implementation: sdk/lib/rtl/exception.c (RtlRaiseException, reconstructed line 31).
VOID
NTAPI
RtlRaiseException(IN PEXCEPTION_RECORD ExceptionRecord)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 27; stdcall, 4 ABI argument bytes. Route: RtlRaiseStatus.
Ordinal aliases RtlRaiseStatus: constructs and raises a noncontinuable exception from NTSTATUS. Return is not a normal success path; handler/unwind controls the destination.
Implementation: sdk/lib/rtl/exception.c (RtlRaiseStatus, reconstructed line 84).
VOID
NTAPI
RtlRaiseStatus(IN NTSTATUS Status)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 28; stdcall, 4 ABI argument bytes. Route: ExReleaseReadWriteLock.
Decrements LockCount under interrupt masking. -1 frees the lock and clears reader ownership. A departing writer releases all pending readers as a semaphore batch; intermediate readers only reduce ReadersEntryCount; the last reader, or writer with no readers waiting, signals one waiting writer. No ownership check protects an unmatched release, which can underflow counters.
Implementation: ntoskrnl/xb/rwlock.c (ExReleaseReadWriteLock, reconstructed line 86).
VOID
NTAPI
ExReleaseReadWriteLock(IN PERWLOCK ReadWriteLock)Spirit implementation source and subsequent kernel call changes.
Ordinal 29; stdcall, 16 ABI argument bytes. Route: ExSaveNonVolatileSetting.
Only user settings/user-section index 00FF are writable. Factory/sealed fields return OBJECT_NAME_NOT_FOUND; recognized other whole sections return INVALID_PARAMETER. NULL value or oversized length returns INVALID_PARAMETER, unknown index OBJECT_NAME_NOT_FOUND. Type is ignored. Short writes zero-fill the entire setting, then update cached image and checksum. Writes checksum before value via SMBus; errors propagate and no rollback transaction is supplied. EEPROM load failure returns DEVICE_NOT_READY.
Implementation: ntoskrnl/xb/eeprom.c (ExSaveNonVolatileSetting, reconstructed line 285).
NTSTATUS NTAPI
ExSaveNonVolatileSetting(ULONG ValueIndex, ULONG Type, PVOID Value,
ULONG ValueLength)Spirit implementation source and subsequent kernel call changes.
Ordinal 30; DATA address. Route: XeExSemaphoreObjectType.
Address of a 28-byte Xbox-shaped OBJECT_TYPE descriptor, not a pointer variable containing a native NT POBJECT_TYPE. PoolTag is at offset 18(hex); object adapters translate recognized descriptor identity to native internal type. Exported descriptor lifetime is whole boot. Reading it is not object creation or a reference acquisition.
Implementation storage: ntoskrnl/xb/object-types.c.
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 31; DATA address. Route: XeExTimerObjectType.
Address of a 28-byte Xbox-shaped OBJECT_TYPE descriptor, not a pointer variable containing a native NT POBJECT_TYPE. PoolTag is at offset 18(hex); object adapters translate recognized descriptor identity to native internal type. Exported descriptor lifetime is whole boot. Reading it is not object creation or a reference acquisition.
Implementation storage: ntoskrnl/xb/object-types.c.
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 32; fastcall, 8 ABI argument bytes. Route: XbExfInterlockedInsertHeadList.
Masks interrupts, inserts caller-owned LIST_ENTRY at head, restores interrupt state and returns the previous first entry, NULL if empty. No spinlock argument; list must already be initialized and entry not concurrently linked elsewhere.
Implementation: ntoskrnl/xb/exflist.c (XbExfInterlockedInsertHeadList, reconstructed line 21).
PLIST_ENTRY
FASTCALL
XbExfInterlockedInsertHeadList(IN OUT PLIST_ENTRY ListHead,
IN PLIST_ENTRY ListEntry)Spirit implementation source and subsequent kernel call changes.
Ordinal 33; fastcall, 8 ABI argument bytes. Route: XbExfInterlockedInsertTailList.
Masks interrupts, inserts caller-owned LIST_ENTRY at tail, restores interrupt state and returns previous last entry, NULL if empty. No allocation or wait; caller maintains entry lifetime.
Implementation: ntoskrnl/xb/exflist.c (XbExfInterlockedInsertTailList, reconstructed line 35).
PLIST_ENTRY
FASTCALL
XbExfInterlockedInsertTailList(IN OUT PLIST_ENTRY ListHead,
IN PLIST_ENTRY ListEntry)Spirit implementation source and subsequent kernel call changes.
Ordinal 34; fastcall, 4 ABI argument bytes. Route: XbExfInterlockedRemoveHeadList.
Masks interrupts and removes/returns the first LIST_ENTRY, or NULL for empty. Restores prior interrupt state. Removed storage is not freed.
Implementation: ntoskrnl/xb/exflist.c (XbExfInterlockedRemoveHeadList, reconstructed line 49).
PLIST_ENTRY
FASTCALL
XbExfInterlockedRemoveHeadList(IN OUT PLIST_ENTRY ListHead)Spirit implementation source and subsequent kernel call changes.
Ordinal 38; fastcall, 4 ABI argument bytes. Route: HalClearSoftwareInterrupt.
Clears the pending software interrupt request at the supplied IRQL in the HAL pending-request state. This changes APC/DPC delivery bookkeeping; it does not acknowledge an external hardware IRQ.
Implementation: hal/halx86/mp/mpsirql.c (HalClearSoftwareInterrupt, reconstructed line 353).
VOID FASTCALL
HalClearSoftwareInterrupt(
IN KIRQL Request)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 39; stdcall, 4 ABI argument bytes. Route: NxHalDisableSystemInterrupt.
Adapter accepts bus-relative IRQ level; levels0..15 become IDT vector30+level with PASSIVE_LEVEL supplied to native HAL. Invalid levels are ignored. Enable passes the interrupt mode. Mask state lives in HAL software IDR and is applied during IRQL transitions; directly writing PIC masks does not establish durable HAL state. Void Xbox adapter discards native result.
Implementation: ntoskrnl/xb/xbe.c (NxHalDisableSystemInterrupt, reconstructed line 2550).
VOID NTAPI
NxHalDisableSystemInterrupt(ULONG BusInterruptLevel)Spirit implementation source and subsequent kernel call changes.
Ordinal 40; DATA address. Route: scaffold ULONG_PTR = 3.
Scaffold ULONG_PTR initialized 3 for X/Y/Z cache count. This is data, not a callable count query; its initializer is a compatibility value, not evidence that all three partitions are mounted.
Implementation storage: ntoskrnl/xb/gen-exports.py and ntoskrnl/xb/ordinals.map.
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 41; DATA address. Route: HalDiskModelNumber.
Mapped counted8-byte STRING descriptor backed by kernel storage. Export is the descriptor address, not a C-string pointer; Length/MaximumLength determine valid buffer range. Device initialization supplies contents; do not free descriptor/buffer.
Implementation storage: hal/halx86/xbox/hal.c.
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 42; DATA address. Route: HalDiskSerialNumber.
Mapped counted8-byte STRING descriptor backed by kernel storage. Export is the descriptor address, not a C-string pointer; Length/MaximumLength determine valid buffer range. Device initialization supplies contents; do not free descriptor/buffer.
Implementation storage: hal/halx86/xbox/hal.c.
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 43; stdcall, 8 ABI argument bytes. Route: NxHalEnableSystemInterrupt.
Adapter accepts bus-relative IRQ level; levels0..15 become IDT vector30+level with PASSIVE_LEVEL supplied to native HAL. Invalid levels are ignored. Enable passes the interrupt mode. Mask state lives in HAL software IDR and is applied during IRQL transitions; directly writing PIC masks does not establish durable HAL state. Void Xbox adapter discards native result.
Implementation: ntoskrnl/xb/xbe.c (NxHalEnableSystemInterrupt, reconstructed line 2558).
VOID NTAPI
NxHalEnableSystemInterrupt(ULONG BusInterruptLevel,
KINTERRUPT_MODE InterruptMode)Spirit implementation source and subsequent kernel call changes.
Ordinal 44; stdcall, 8 ABI argument bytes. Route: XeHalGetInterruptVector.
Adapter fixes interface to Isa/bus0 and uses BusInterruptLevel as both level and vector. Returns mapped vector and writes IRQL; native affinity output is discarded. This does not connect an interrupt object.
Implementation: ntoskrnl/xb/xbe.c (XeHalGetInterruptVector, reconstructed line 2809).
ULONG NTAPI
XeHalGetInterruptVector(ULONG BusInterruptLevel, PKIRQL Irql)Spirit implementation source and subsequent kernel call changes.
Ordinal 45; stdcall, 16 ABI argument bytes. Route: HalReadSMBusValue.
Address is an eight-bit write slave address shifted right once for the HAL seven-bit address. NULL DataValue returns INVALID_PARAMETER. Byte/word operation writes low8/16 bits zero-extended to ULONG only on success; failure preserves caller output. Returns bus transaction NTSTATUS.
Implementation: ntoskrnl/xb/xbe.c (HalReadSMBusValue, reconstructed line 2824).
NTSTATUS NTAPI
HalReadSMBusValue(UCHAR Address, UCHAR Command, BOOLEAN ReadWord,
PULONG DataValue)Spirit implementation source and subsequent kernel call changes.
Ordinal 46; stdcall, 24 ABI argument bytes. Route: HalReadWritePCISpace.
Uses PCIConfiguration Type1 HAL access with bus, slot, register offset, buffer and length, serializing in HAL config lock. WritePCISpace selects read/write. The void ABI discards native transferred-byte result, so caller does not receive a short-transfer count.
Implementation: ntoskrnl/xb/xbe.c (HalReadWritePCISpace, reconstructed line 2569).
VOID NTAPI
HalReadWritePCISpace(ULONG BusNumber, ULONG SlotNumber, ULONG RegisterNumber,
PVOID Buffer, ULONG Length, BOOLEAN WritePCISpace)Spirit implementation source and subsequent kernel call changes.
Ordinal 47; stdcall, 8 ABI argument bytes. Route: HalRegisterShutdownNotification.
Caller supplies a 16-byte registration (callback, signed priority, LIST_ENTRY) which must remain alive until removed or callback finishes. NULL storage/NULL registration callback ignored; duplicate registrations ignored without trusting initial links. Higher priorities execute first, ties preserve order. Unregister removes pending callbacks but cannot cancel an active one. Registrations after drain begins ignored; callbacks execute without list lock, with normal kernel APCs suppressed. Nested reset in callback unwinds to drain boundary; other reset request threads park until reset. Callbacks must not await normal APCs.
Implementation: ntoskrnl/xb/shutdown.c (HalRegisterShutdownNotification, reconstructed line 40).
VOID NTAPI HalRegisterShutdownNotification(PVOID Storage, BOOLEAN Register)Spirit implementation source and subsequent kernel call changes.
Ordinal 48; fastcall, 4 ABI argument bytes. Route: HalRequestSoftwareInterrupt.
Sets the pending APC/DPC software interrupt request for supplied IRQL and follows the HAL delivery path. Delivery timing depends on current IRQL; this API does not execute a supplied callback itself.
Implementation: hal/halx86/mp/mpsirql.c (HalRequestSoftwareInterrupt, reconstructed line 335).
VOID FASTCALL
HalRequestSoftwareInterrupt(IN KIRQL Request)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 49; stdcall, 4 ABI argument bytes. Route: XeHalReturnToFirmware.
At PASSIVE_LEVEL with interrupts enabled, quick reboot stashes persistent title launch intent; halt selects HalHaltRoutine and every reboot variant/unknown value selects HalRebootRoutine. Flushes filesystems via IoShutdownSystem(1), except fatal-error reboot. During existing shutdown uses abort/park protocol. At elevated IRQL or interrupts disabled immediately takes emergency HAL halt/reboot path, skipping normal flush and launch reconstruction. HAL hardware action is nonreturning; firmware reentry flavor is not a normal status result.
Implementation: ntoskrnl/xb/xbe.c (XeHalReturnToFirmware, reconstructed line 631).
VOID NTAPI
XeHalReturnToFirmware(_In_ XBE_FIRMWARE_REENTRY Routine)Spirit implementation source and subsequent kernel call changes.
Ordinal 50; stdcall, 16 ABI argument bytes. Route: HalWriteSMBusValue.
Shifts eight-bit slave address right once and chooses byte/word SMBus write. DataValue is truncated to8 or16 bits. Returns bus error/status, with no allocation or persistent buffer ownership.
Implementation: ntoskrnl/xb/xbe.c (HalWriteSMBusValue, reconstructed line 2851).
NTSTATUS NTAPI
HalWriteSMBusValue(UCHAR Address, UCHAR Command, BOOLEAN WriteWord,
ULONG DataValue)Spirit implementation source and subsequent kernel call changes.
Ordinal 51; fastcall, 12 ABI argument bytes. Route: XeInterlockedCompareExchange.
Atomically compares *Destination with Comparand, stores Exchange only if equal, and returns the previous LONG. Xbox FASTCALL: first two arguments in ECX/EDX, third on stack.
Implementation: ntoskrnl/xb/xbe.c (XeInterlockedCompareExchange, reconstructed line 3230).
LONG FASTCALL XeInterlockedCompareExchange(_Inout_ LONG volatile *Destination, _In_ LONG Exchange, _In_ LONG Comperand)Spirit implementation source and subsequent kernel call changes.
Ordinal 52; fastcall, 4 ABI argument bytes. Route: XeInterlockedDecrement.
Atomically decrements caller LONG and returns the new value. No timeout, lock object or allocation.
Implementation: ntoskrnl/xb/xbe.c (XeInterlockedDecrement, reconstructed line 3234).
LONG FASTCALL XeInterlockedDecrement(_Inout_ LONG volatile *V)Spirit implementation source and subsequent kernel call changes.
Ordinal 53; fastcall, 4 ABI argument bytes. Route: XeInterlockedIncrement.
Atomically increments caller LONG and returns the new value. Overflow follows fixed-width LONG machine arithmetic.
Implementation: ntoskrnl/xb/xbe.c (XeInterlockedIncrement, reconstructed line 3232).
LONG FASTCALL XeInterlockedIncrement(_Inout_ LONG volatile *V)Spirit implementation source and subsequent kernel call changes.
Ordinal 54; fastcall, 8 ABI argument bytes. Route: XeInterlockedExchange.
Atomically replaces caller LONG and returns previous value. Storage must remain valid through operation.
Implementation: ntoskrnl/xb/xbe.c (XeInterlockedExchange, reconstructed line 3236).
LONG FASTCALL XeInterlockedExchange(_Inout_ LONG volatile *V, _In_ LONG N)Spirit implementation source and subsequent kernel call changes.
Ordinal 55; fastcall, 8 ABI argument bytes. Route: XeInterlockedExchangeAdd.
Atomically adds Value to Addend and returns the old value, not the sum.
Implementation: ntoskrnl/xb/xbe.c (XeInterlockedExchangeAdd, reconstructed line 3238).
LONG FASTCALL XeInterlockedExchangeAdd(_Inout_ LONG volatile *Addend, _In_ LONG Value)Spirit implementation source and subsequent kernel call changes.
Ordinal 56; fastcall, 4 ABI argument bytes. Route: ExInterlockedFlushSList.
Native FASTCALL flush atomically resets the eight-byte SLIST header and returns the former first entry, NULL when empty. Entries are not individually freed; caller owns detached chain.
Implementation: ntoskrnl/ex/i386/fastinterlck_asm.S (ExInterlockedFlushSList, reconstructed line 1).
/* assembler entry: signature is defined by export ABI */Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 57; fastcall, 4 ABI argument bytes. Route: XeInterlockedPopEntrySList.
CMPXCHG8B retry loop on eight-byte SLIST_HEADER. Empty returns NULL; successful pop installs entry->Next, decrements16-bit depth and increments16-bit sequence. Returns detached entry without freeing it. Header and linked entries must remain valid; no separate spinlock argument.
Implementation: ntoskrnl/xb/xbe.c (XeInterlockedPopEntrySList, reconstructed line 1440).
PSLIST_ENTRY __fastcall
XeInterlockedPopEntrySList(PSLIST_HEADER ListHead)Spirit implementation source and subsequent kernel call changes.
Ordinal 58; fastcall, 8 ABI argument bytes. Route: XeInterlockedPushEntrySList.
CAS loop links Entry->Next to observed first, increments16-bit depth while preserving sequence, and returns previous first. Retries rewrite Entry->Next. Caller supplies storage and owns list lifetime; counter width is16 bits.
Implementation: ntoskrnl/xb/xbe.c (XeInterlockedPushEntrySList, reconstructed line 1461).
PSLIST_ENTRY __fastcall
XeInterlockedPushEntrySList(PSLIST_HEADER ListHead, PSLIST_ENTRY Entry)Spirit implementation source and subsequent kernel call changes.
Ordinal 59; stdcall, 4 ABI argument bytes. Route: XeIoAllocateIrp.
Supplies ChargeQuota=FALSE to native allocation. StackSize selects IRP stack slots; returns IRP or NULL. Caller must dispatch it with an appropriate completion ownership contract or free it with IoFreeIrp. It is not queued or sent by allocation.
Implementation: ntoskrnl/xb/xbe.c (XeIoAllocateIrp, reconstructed line 964).
PVOID NTAPI
XeIoAllocateIrp(_In_ CCHAR StackSize)Spirit implementation source and subsequent kernel call changes.
Ordinal 60; stdcall, 24 ABI argument bytes. Route: IoBuildAsynchronousFsdRequest.
Builds an IRP for requested FSD major function/device/buffer/length/offset and caller status block. Native builder chooses buffered/direct I/O handling from device flags, can allocate/copy a system buffer or MDL, and returns NULL on resource failure. It does not dispatch or wait; supplied buffers/status must survive completion.
Implementation: ntoskrnl/io/iomgr/irp.c (IoBuildAsynchronousFsdRequest, reconstructed line 782).
PIRP
NTAPI
IoBuildAsynchronousFsdRequest(IN ULONG MajorFunction,
IN PDEVICE_OBJECT DeviceObject,
IN PVOID Buffer,
IN ULONG Length,
IN PLARGE_INTEGER StartingOffset,
IN PIO_STATUS_BLOCK IoStatusBlock)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 61; stdcall, 36 ABI argument bytes. Route: IoBuildDeviceIoControlRequest.
Builds a device/internal control IRP with input/output buffers, lengths, event and IOSB. IOCTL method determines system-buffer/MDL/direct-pointer use; InternalDeviceIoControl selects major function. Returns NULL on allocation failure. Dispatch/completion must occur before caller event/IOSB/buffers expire.
Implementation: ntoskrnl/io/iomgr/irp.c (IoBuildDeviceIoControlRequest, reconstructed line 913).
PIRP
NTAPI
IoBuildDeviceIoControlRequest(IN ULONG IoControlCode,
IN PDEVICE_OBJECT DeviceObject,
IN PVOID InputBuffer,
IN ULONG InputBufferLength,
IN PVOID OutputBuffer,
IN ULONG OutputBufferLength,
IN BOOLEAN InternalDeviceIoControl,
IN PKEVENT Event,
IN PIO_STATUS_BLOCK IoStatusBlock)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 62; stdcall, 28 ABI argument bytes. Route: IoBuildSynchronousFsdRequest.
Calls asynchronous builder, attaches caller event, marks synchronous API state and queues IRP on current thread. Returns NULL if builder failed. This function builds only; caller dispatches and waits on pending completion.
Implementation: ntoskrnl/io/iomgr/irp.c (IoBuildSynchronousFsdRequest, reconstructed line 1101).
PIRP
NTAPI
IoBuildSynchronousFsdRequest(IN ULONG MajorFunction,
IN PDEVICE_OBJECT DeviceObject,
IN PVOID Buffer,
IN ULONG Length,
IN PLARGE_INTEGER StartingOffset,
IN PKEVENT Event,
IN PIO_STATUS_BLOCK IoStatusBlock)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 63; stdcall, 20 ABI argument bytes. Route: IoCheckShareAccess.
Checks desired read/write/delete access against existing opens and share flags; returns SHARING_VIOLATION for conflicts, otherwise SUCCESS. Update controls whether it commits counters. Does not itself open a file or provide global serialization; callers protect shared state.
Implementation: ntoskrnl/io/iomgr/file.c (IoCheckShareAccess, reconstructed line 3519).
NTSTATUS
NTAPI
IoCheckShareAccess(IN ACCESS_MASK DesiredAccess,
IN ULONG DesiredShareAccess,
IN PFILE_OBJECT FileObject,
IN PSHARE_ACCESS ShareAccess,
IN BOOLEAN Update)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 64; DATA address. Route: XeIoCompletionObjectType.
Address of a 28-byte Xbox-shaped OBJECT_TYPE descriptor, not a pointer variable containing a native NT POBJECT_TYPE. PoolTag is at offset 18(hex); object adapters translate recognized descriptor identity to native internal type. Exported descriptor lifetime is whole boot. Reading it is not object creation or a reference acquisition.
Implementation storage: ntoskrnl/xb/object-types.c.
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 65; stdcall, 24 ABI argument bytes. Route: XeIoCreateDevice.
Converts optional ANSI device name to temporary Unicode and invokes internal IopCreateDevice with characteristics0 and TitleOwnedDriver=TRUE. Frees conversion. Successful device output is stored only if non-NULL device returned. Conversion failure silently leaves name absent rather than returning conversion error. Device/extension allocation ownership belongs to I/O manager and is later removed through IoDeleteDevice.
Implementation: ntoskrnl/xb/xbe.c (XeIoCreateDevice, reconstructed line 911).
NTSTATUS NTAPI
XeIoCreateDevice(_In_ PVOID DriverObject,
_In_ ULONG DeviceExtensionSize,
_In_opt_ PSTRING DeviceName,
_In_ DEVICE_TYPE DeviceType,
_In_ BOOLEAN Exclusive,
_Out_ PVOID *DeviceObject)Spirit implementation source and subsequent kernel call changes.
Ordinal 66; stdcall, 40 ABI argument bytes. Route: XeIoCreateFile.
Translates Xbox object attributes/ANSI name and forwards to native IoCreateFile with no EA buffer, no EA length, normal create type and no extra create parameters. Frees converted name after call; returns conversion/create NTSTATUS. Output handle represents an owned reference requiring NtClose; disposition/options govern create/open and sync behavior.
Implementation: ntoskrnl/xb/xbe.c (XeIoCreateFile, reconstructed line 1672).
NTSTATUS NTAPI
XeIoCreateFile(PHANDLE Handle, ACCESS_MASK Access, PXBE_OBJECT_ATTRIBUTES XAttr,
PIO_STATUS_BLOCK Iosb, PLARGE_INTEGER AllocSize,
ULONG Attributes, ULONG Share, ULONG Disposition,
ULONG CreateOptions, ULONG Options)Spirit implementation source and subsequent kernel call changes.
Ordinal 67; stdcall, 8 ABI argument bytes. Route: XeIoCreateSymbolicLink.
Converts ANSI counted name(s) to temporary Unicode, returns conversion failures, invokes native symbolic-link create/delete, then frees temporary strings. Create retains the named object rather than these buffers; delete removes namespace link, not target device.
Implementation: ntoskrnl/xb/xbe.c (XeIoCreateSymbolicLink, reconstructed line 2361).
NTSTATUS NTAPI
XeIoCreateSymbolicLink(PANSI_STRING LinkName, PANSI_STRING DeviceName)Spirit implementation source and subsequent kernel call changes.
Ordinal 68; stdcall, 4 ABI argument bytes. Route: IoDeleteDevice.
Marks/removes an I/O-manager device according to outstanding references and unload/delete state. Outstanding references can defer final destruction; callers cannot immediately reclaim manager-owned object storage. Device deletion is not an IRP cancellation protocol.
Implementation: ntoskrnl/io/iomgr/device.c (IoDeleteDevice, reconstructed line 1352).
VOID
NTAPI
IoDeleteDevice(IN PDEVICE_OBJECT DeviceObject)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 69; stdcall, 4 ABI argument bytes. Route: XeIoDeleteSymbolicLink.
Converts ANSI counted name(s) to temporary Unicode, returns conversion failures, invokes native symbolic-link create/delete, then frees temporary strings. Create retains the named object rather than these buffers; delete removes namespace link, not target device.
Implementation: ntoskrnl/xb/xbe.c (XeIoDeleteSymbolicLink, reconstructed line 2381).
NTSTATUS NTAPI
XeIoDeleteSymbolicLink(PANSI_STRING LinkName)Spirit implementation source and subsequent kernel call changes.
Ordinal 70; DATA address. Route: XeIoDeviceObjectType.
Address of a 28-byte Xbox-shaped OBJECT_TYPE descriptor, not a pointer variable containing a native NT POBJECT_TYPE. PoolTag is at offset 18(hex); object adapters translate recognized descriptor identity to native internal type. Exported descriptor lifetime is whole boot. Reading it is not object creation or a reference acquisition.
Implementation storage: ntoskrnl/xb/object-types.c.
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 71; DATA address. Route: XeIoFileObjectType.
Address of a 28-byte Xbox-shaped OBJECT_TYPE descriptor, not a pointer variable containing a native NT POBJECT_TYPE. PoolTag is at offset 18(hex); object adapters translate recognized descriptor identity to native internal type. Exported descriptor lifetime is whole boot. Reading it is not object creation or a reference acquisition.
Implementation storage: ntoskrnl/xb/object-types.c.
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 72; stdcall, 4 ABI argument bytes. Route: IoFreeIrp.
Releases the IRP packet through its native allocator/associated allocation flags. Caller must own the IRP and ensure no completion/driver still uses it; this routine does not implicitly release every caller-owned auxiliary buffer.
Implementation: ntoskrnl/io/iomgr/irp.c (IoFreeIrp, reconstructed line 1698).
VOID
NTAPI
IoFreeIrp(IN PIRP Irp)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 73; stdcall, 12 ABI argument bytes. Route: IoInitializeIrp.
Initializes caller-provided packet storage of PacketSize and StackSize, zeroes state and sets stack traversal metadata. Does not allocate packet memory; caller is responsible for sufficient size and lifetime.
Implementation: ntoskrnl/io/iomgr/irp.c (IoInitializeIrp, reconstructed line 1886).
VOID
NTAPI
IoInitializeIrp(IN PIRP Irp,
IN USHORT PacketSize,
IN CCHAR StackSize)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 74; stdcall, 8 ABI argument bytes. Route: IoInvalidDeviceRequest.
Ignores device and IRP arguments and returns STATUS_INVALID_DEVICE_REQUEST. The wrapper does not write IRP status or complete it; dispatch code owns that decision.
Implementation: ntoskrnl/xb/xbe.c (IoInvalidDeviceRequest, reconstructed line 941).
NTSTATUS NTAPI
IoInvalidDeviceRequest(_In_ PVOID DeviceObject, _In_ PVOID Irp)Spirit implementation source and subsequent kernel call changes.
Ordinal 75; stdcall, 20 ABI argument bytes. Route: XeIoQueryFileInformation.
Only FileInternalInformation, FilePositionInformation and FileNetworkOpenInformation accepted; all other classes INVALID_PARAMETER. Ignores caller Length and passes fixed class size to native query, which builds/dispatches query IRP and waits as required. Caller must actually provide class-sized output even when Length is shorter. ReturnedLength follows native completion output.
Implementation: ntoskrnl/xb/xbe.c (XeIoQueryFileInformation, reconstructed line 842).
NTSTATUS NTAPI
XeIoQueryFileInformation(PFILE_OBJECT FileObject,
FILE_INFORMATION_CLASS FileInformationClass,
ULONG Length,
PVOID FileInformation,
PULONG ReturnedLength)Spirit implementation source and subsequent kernel call changes.
Ordinal 76; stdcall, 20 ABI argument bytes. Route: XeIoQueryVolumeInformation.
Only volume,size,device,attribute filesystem classes accepted; others INVALID_PARAMETER. Passes caller Length unchanged to native volume query (including attribute truncation semantics), returning filesystem/completion status and length. No allocation ownership escapes the adapter.
Implementation: ntoskrnl/xb/xbe.c (XeIoQueryVolumeInformation, reconstructed line 876).
NTSTATUS NTAPI
XeIoQueryVolumeInformation(PFILE_OBJECT FileObject,
FS_INFORMATION_CLASS FsInformationClass,
ULONG Length,
PVOID FsInformation,
PULONG ReturnedLength)Spirit implementation source and subsequent kernel call changes.
Ordinal 77; stdcall, 4 ABI argument bytes. Route: IoQueueThreadIrp.
Links the IRP to its owning/current thread tracking list for cancellation/termination handling. Caller must not concurrently queue/free the same IRP; tracking does not itself dispatch it.
Implementation: ntoskrnl/io/iomgr/irp.c (IoQueueThreadIrp, reconstructed line 1986).
VOID
NTAPI
IoQueueThreadIrp(IN PIRP Irp)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 78; stdcall, 8 ABI argument bytes. Route: IoRemoveShareAccess.
Subtracts file object read/write/delete/share contributions and open count from SHARE_ACCESS. Must correspond to a successful share-access accounting insertion; no underflow/identity lookup protects mismatched removal.
Implementation: ntoskrnl/io/iomgr/file.c (IoRemoveShareAccess, reconstructed line 3607).
VOID
NTAPI
IoRemoveShareAccess(IN PFILE_OBJECT FileObject,
IN PSHARE_ACCESS ShareAccess)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 79; stdcall, 20 ABI argument bytes. Route: XeIoSetIoCompletion.
Xbox adapter supplies ChargeQuota=FALSE to native completion packet insertion. Inputs are completion object,key,APC context,status and information; returns native allocation/queue status. Successful packet belongs to completion queue until removal; caller contexts are stored values, not copied pointed-to data.
Implementation: ntoskrnl/xb/xbe.c (XeIoSetIoCompletion, reconstructed line 2798).
NTSTATUS NTAPI
XeIoSetIoCompletion(PVOID IoCompletion, PVOID KeyContext, PVOID ApcContext,
NTSTATUS IoStatus, ULONG_PTR IoStatusInformation)Spirit implementation source and subsequent kernel call changes.
Ordinal 80; stdcall, 16 ABI argument bytes. Route: IoSetShareAccess.
Initializes SHARE_ACCESS counters for first open from DesiredAccess and DesiredShareAccess and records per-file access/share flags. This is initialization, not a conflict check against an established set of opens.
Implementation: ntoskrnl/io/iomgr/file.c (IoSetShareAccess, reconstructed line 3646).
VOID
NTAPI
IoSetShareAccess(IN ACCESS_MASK DesiredAccess,
IN ULONG DesiredShareAccess,
IN PFILE_OBJECT FileObject,
OUT PSHARE_ACCESS ShareAccess)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 81; stdcall, 4 ABI argument bytes. Route: XeIoStartNextPacket.
Starts next queued device packet with Cancelable=FALSE supplied. Empty queue transitions device queue idle. Caller uses matching StartIo/device-queue protocol; no status returned.
Implementation: ntoskrnl/xb/xbe.c (XeIoStartNextPacket, reconstructed line 950).
VOID NTAPI
XeIoStartNextPacket(_In_ PVOID DeviceObject)Spirit implementation source and subsequent kernel call changes.
Ordinal 82; stdcall, 8 ABI argument bytes. Route: XeIoStartNextPacketByKey.
Native keyed dequeue/start with Cancelable=FALSE; Key guides ordering. Caller retains StartIo sequencing obligations; does not allocate or wait.
Implementation: ntoskrnl/xb/xbe.c (XeIoStartNextPacketByKey, reconstructed line 957).
VOID NTAPI
XeIoStartNextPacketByKey(_In_ PVOID DeviceObject, _In_ ULONG Key)Spirit implementation source and subsequent kernel call changes.
Ordinal 83; stdcall, 12 ABI argument bytes. Route: XeIoStartPacket.
Passes DeviceObject,Irp and optional sort Key with NULL cancel routine. Native path starts immediately when queue idle or queues for later StartIo. It does not give Xbox callers a cancellation callback argument.
Implementation: ntoskrnl/xb/xbe.c (XeIoStartPacket, reconstructed line 971).
VOID NTAPI
XeIoStartPacket(_In_ PVOID DeviceObject, _In_ PVOID Irp,
_In_opt_ PULONG Key)Spirit implementation source and subsequent kernel call changes.
Ordinal 84; stdcall, 32 ABI argument bytes. Route: XeIoSynchronousDeviceIoControlRequest.
Owns stack notification event and IOSB, builds requested IRP and returns INSUFFICIENT_RESOURCES on NULL builder result. Dispatches through IofCallDriver; only STATUS_PENDING triggers indefinite nonalertable KernelMode event wait, then returns IOSB.Status. Immediate path returns dispatch status. Device-control variant optionally copies IOSB.Information to ReturnedOutputBufferLength. Caller buffers must remain valid through return; no IRP is exposed to caller.
Implementation: ntoskrnl/xb/xbe.c (XeIoSynchronousDeviceIoControlRequest, reconstructed line 1019).
NTSTATUS NTAPI
XeIoSynchronousDeviceIoControlRequest(_In_ ULONG IoControlCode,
_In_ PVOID DeviceObject,
_In_opt_ PVOID InputBuffer,
_In_ ULONG InputBufferLength,
_Out_opt_ PVOID OutputBuffer,
_In_ ULONG OutputBufferLength,
_Out_opt_ PULONG ReturnedOutputBufferLength,
_In_ BOOLEAN InternalDeviceIoControl)Spirit implementation source and subsequent kernel call changes.
Ordinal 85; stdcall, 20 ABI argument bytes. Route: XeIoSynchronousFsdRequest.
Owns stack notification event and IOSB, builds requested IRP and returns INSUFFICIENT_RESOURCES on NULL builder result. Dispatches through IofCallDriver; only STATUS_PENDING triggers indefinite nonalertable KernelMode event wait, then returns IOSB.Status. Immediate path returns dispatch status. Device-control variant optionally copies IOSB.Information to ReturnedOutputBufferLength. Caller buffers must remain valid through return; no IRP is exposed to caller.
Implementation: ntoskrnl/xb/xbe.c (XeIoSynchronousFsdRequest, reconstructed line 998).
NTSTATUS NTAPI
XeIoSynchronousFsdRequest(_In_ ULONG MajorFunction,
_In_ PVOID DeviceObject,
_Inout_opt_ PVOID Buffer,
_In_ ULONG Length,
_In_opt_ PLARGE_INTEGER StartingOffset)Spirit implementation source and subsequent kernel call changes.
Ordinal 86; fastcall, 8 ABI argument bytes. Route: IofCallDriver.
FASTCALL advances CurrentLocation/current stack and invokes target driver major-function dispatch. Returns dispatch NTSTATUS, possibly PENDING; invalid stack traversal bugchecks rather than yielding a recoverable error. Driver/completion retains IRP ownership until completion protocol finishes.
Implementation: ntoskrnl/io/iomgr/irp.c (IofCallDriver, reconstructed line 1290).
NTSTATUS
FASTCALL
IofCallDriver(IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 87; fastcall, 8 ABI argument bytes. Route: IofCompleteRequest.
FASTCALL unwinds IRP stack completion routines and buffer/MDL/status/event/APC handling. A completion routine returning MORE_PROCESSING_REQUIRED stops manager unwind and transfers responsibility to that routine. Released Spirit patch 0014 establishes title completion ordering. Caller must not complete an already-completed packet; Increment is the scheduling boost, not byte count.
Implementation: ntoskrnl/io/iomgr/irp.c (IofCompleteRequest, reconstructed line 1340).
VOID
FASTCALL
IofCompleteRequest(IN PIRP Irp,
IN CCHAR PriorityBoost)Native source and Spirit kernel changes, call/lifecycle changes.
Title I/O completion ordering correction.
Ordinal 90; stdcall, 4 ABI argument bytes. Route: XeIoDismountVolume.
Calls owning DriverDismountVolume when provided and returns that callback result. Otherwise unmounted/missing-VPB devices return SUCCESS. Native volumes resolve VPB real-device name in fixed128-WCHAR scratch buffer and use named FSCTL helper; name-query failure/empty name also returns SUCCESS. No title DRIVER_OBJECT tail outside public dispatch layout is inspected.
Implementation: ntoskrnl/xb/xbe.c (XeIoDismountVolume, reconstructed line 2643).
NTSTATUS NTAPI
XeIoDismountVolume(PDEVICE_OBJECT DeviceObject)Spirit implementation source and subsequent kernel call changes.
Ordinal 91; stdcall, 4 ABI argument bytes. Route: XeIoDismountVolumeByName.
Converts ANSI path then opens named device synchronously with read-attributes/synchronize and full sharing. Open/conversion errors propagate. After open, issues FSCTL_DISMOUNT_VOLUME but discards its result, closes handle and returns SUCCESS. Thus busy or raw partitions can succeed; this does not prove filesystem flush/unmount completed.
Implementation: ntoskrnl/xb/xbe.c (XeIoDismountVolumeByName, reconstructed line 2615).
NTSTATUS NTAPI
XeIoDismountVolumeByName(PANSI_STRING DeviceName)Spirit implementation source and subsequent kernel call changes.
Ordinal 92; stdcall, 4 ABI argument bytes. Route: KeAlertResumeThread.
Alerts target in KernelMode (aborting compatible alertable wait with STATUS_ALERTED or setting alert latch), then decreases suspend count when nonzero; wakes only when suspend and freeze counts both reach zero. Returns previous suspend count, not alert state. Native dispatcher/APC locking; caller supplies a valid native thread object.
Implementation: ntoskrnl/ke/thrdobj.c (KeAlertResumeThread, reconstructed line 123).
ULONG
NTAPI
KeAlertResumeThread(IN PKTHREAD Thread)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 93; stdcall, 8 ABI argument bytes. Route: KeAlertThread.
Returns previous Alerted[AlertMode]. If newly alerted target waits alertably in compatible mode, aborts its wait with STATUS_ALERTED; otherwise sets alert latch. No thread reference is taken for caller lifetime.
Implementation: ntoskrnl/ke/thrdobj.c (KeAlertThread, reconstructed line 175).
BOOLEAN
NTAPI
KeAlertThread(IN PKTHREAD Thread,
IN KPROCESSOR_MODE AlertMode)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 94; stdcall, 8 ABI argument bytes. Route: KeBoostPriorityThread.
For dynamic-priority thread without existing priority decrement, considers BasePriority+Increment; raises only if above current, caps at one below LOW_REALTIME_PRIORITY and resets quantum. Real-time threads and ineffective requests unchanged. Void, with dispatcher/thread locking.
Implementation: ntoskrnl/ke/thrdobj.c (KeBoostPriorityThread, reconstructed line 219).
VOID
NTAPI
KeBoostPriorityThread(IN PKTHREAD Thread,
IN KPRIORITY Increment)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 95; stdcall, 4 ABI argument bytes. Route: KeBugCheck.
Fatal stop with supplied bugcheck code and zero additional parameters. Does not return; invokes native crash path.
Implementation: ntoskrnl/ke/bug.c (KeBugCheck, reconstructed line 1476).
VOID
NTAPI
KeBugCheck(ULONG BugCheckCode)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 96; stdcall, 20 ABI argument bytes. Route: KeBugCheckEx.
Fatal stop with code plus four ULONG_PTR parameters. Stores five words in KiBugCheckData before crash handling. Does not return or unwind as a normal exception; this is also target of unmapped export scaffold E0000002.
Implementation: ntoskrnl/ke/bug.c (KeBugCheckEx, reconstructed line 1455).
VOID
NTAPI
KeBugCheckEx(IN ULONG BugCheckCode,
IN ULONG_PTR BugCheckParameter1,
IN ULONG_PTR BugCheckParameter2,
IN ULONG_PTR BugCheckParameter3,
IN ULONG_PTR BugCheckParameter4)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 97; stdcall, 4 ABI argument bytes. Route: KeCancelTimer.
Under dispatcher lock removes timer if inserted and returns whether it was queued. Does not by itself cancel an already queued/running DPC, nor free caller timer storage.
Implementation: ntoskrnl/ke/timerobj.c (KeCancelTimer, reconstructed line 205).
BOOLEAN
NTAPI
KeCancelTimer(IN OUT PKTIMER Timer)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 98; stdcall, 4 ABI argument bytes. Route: XeKeConnectInterrupt.
Finds previously initialized shadow; missing returns FALSE. Driver-owned binding only reports active borrowed native object Connected state under DISPATCH_LEVEL protection; ordinary shadow invokes native connect. Caller storage address is lookup identity, so moving it changes identity.
Implementation: ntoskrnl/xb/interrupt.c (XeKeConnectInterrupt, reconstructed line 160).
BOOLEAN NTAPI
XeKeConnectInterrupt(PKINTERRUPT Interrupt)Spirit implementation source and subsequent kernel call changes.
Ordinal 99; stdcall, 12 ABI argument bytes. Route: KeDelayExecutionThread.
Waits on current thread delay timer with selected wait mode/alertability. Timeout uses NT100ns convention (negative relative, nonnegative absolute); zero is immediate scheduling case. Returns wait status, including success, alert or user APC interruption. May release CPU and must be called at a wait-permitted IRQL.
Implementation: ntoskrnl/ke/wait.c (KeDelayExecutionThread, reconstructed line 305).
NTSTATUS
NTAPI
KeDelayExecutionThread(IN KPROCESSOR_MODE WaitMode,
IN BOOLEAN Alertable,
IN PLARGE_INTEGER Interval OPTIONAL)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 100; stdcall, 4 ABI argument bytes. Route: XeKeDisconnectInterrupt.
Missing shadow returns FALSE. Driver-owned binding always refuses FALSE, including after detached tombstone; native shadow invokes native disconnect. It neither frees shadow slot nor transfers driver lifecycle ownership.
Implementation: ntoskrnl/xb/interrupt.c (XeKeDisconnectInterrupt, reconstructed line 180).
BOOLEAN NTAPI
XeKeDisconnectInterrupt(PKINTERRUPT Interrupt)Spirit implementation source and subsequent kernel call changes.
Ordinal 101; stdcall, 0 ABI argument bytes. Route: KeEnterCriticalRegion.
Decrements current thread KernelApcDisable to suppress normal kernel APC delivery; does not mask interrupts or prevent DPCs/special APCs. Nesting requires balanced leave.
Implementation: ntoskrnl/ke/apc.c (KeEnterCriticalRegion, reconstructed line 635).
VOID
NTAPI
KeEnterCriticalRegion(VOID)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 103; stdcall, 0 ABI argument bytes. Route: KeGetCurrentIrql.
Returns current CPU IRQL. No raise/lower or lock side effect; this is not a thread priority.
Implementation: hal/halx86/mp/mpsirql.c (KeGetCurrentIrql, reconstructed line 24).
KIRQL NTAPI KeGetCurrentIrql (VOID)
/*
* PURPOSE: Returns the current irq level
* RETURNS: The current irq level
*/Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 104; stdcall, 0 ABI argument bytes. Route: XeKeGetCurrentThread.
Returns Xbox-shaped shadow embedded in current native KTHREAD rather than raw native object. No reference is acquired. APC adapter resolves shadow back to native; direct native Ke thread functions do not all share that translation, so a shadow is not automatically interchangeable with every native PKTHREAD input.
Implementation: ntoskrnl/xb/xbe.c (XeKeGetCurrentThread, reconstructed line 301).
PVOID NTAPI
XeKeGetCurrentThread(VOID)Spirit implementation source and subsequent kernel call changes.
Ordinal 105; stdcall, 28 ABI argument bytes. Route: XeKeInitializeApc.
Pure write of caller 40-byte Xbox KAPC: type,inserted FALSE,thread,routines,mode/context. List linkage and system arguments remain untouched. NULL NormalRoutine forces KernelMode and NULL NormalContext. No shadow allocation until insertion. Caller retains KAPC storage.
Implementation: ntoskrnl/xb/xbe.c (XeKeInitializeApc, reconstructed line 2896).
VOID NTAPI
XeKeInitializeApc(PXBE_KAPC Apc,
PVOID Thread,
PVOID KernelRoutine,
PVOID RundownRoutine,
PVOID NormalRoutine,
CHAR ApcMode,
PVOID NormalContext)Spirit implementation source and subsequent kernel call changes.
Ordinal 106; stdcall, 4 ABI argument bytes. Route: KeInitializeDeviceQueue.
Writes12-byte console device queue type,size,empty list and Busy=FALSE. Xbox path omits NT embedded spinlock. Caller storage must persist while entries queued; no allocation.
Implementation: ntoskrnl/ke/devqueue.c (KeInitializeDeviceQueue, reconstructed line 21).
VOID
NTAPI
KeInitializeDeviceQueue(IN PKDEVICE_QUEUE DeviceQueue)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 107; stdcall, 12 ABI argument bytes. Route: KeInitializeDpc.
Initializes native 28-byte KDPC (routine,context,type,default target/importance and not-inserted state). Caller owns storage through queued callback lifetime; init alone schedules nothing.
Implementation: ntoskrnl/ke/dpc.c (KeInitializeDpc, reconstructed line 724).
VOID
NTAPI
KeInitializeDpc(IN PKDPC Dpc,
IN PKDEFERRED_ROUTINE DeferredRoutine,
IN PVOID DeferredContext)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 108; stdcall, 12 ABI argument bytes. Route: KeInitializeEvent.
Writes caller dispatcher event header,size,state,empty wait list. NotificationEvent stays signaled until reset; SynchronizationEvent consumes signal for one satisfied waiter. Invalid type is asserted; no allocation/reference.
Implementation: ntoskrnl/ke/eventobj.c (KeInitializeEvent, reconstructed line 34).
VOID
NTAPI
KeInitializeEvent(OUT PKEVENT Event,
IN EVENT_TYPE Type,
IN BOOLEAN State)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 109; stdcall, 28 ABI argument bytes. Route: XeKeInitializeInterrupt.
Title112-byte KINTERRUPT is keyed to one of eight static512-byte NT shadows; caller buffer is not overwritten with 484-byte native layout. Native init uses built-in spinlock, same IRQL/synchronize IRQL, CPU0, no floating save. Full table logs and returns void without initialization; driver-owned interrupt cannot be replaced. Slots are static and not reclaimed by disconnect.
Implementation: ntoskrnl/xb/interrupt.c (XeKeInitializeInterrupt, reconstructed line 100).
VOID NTAPI
XeKeInitializeInterrupt(PKINTERRUPT Interrupt,
PKSERVICE_ROUTINE ServiceRoutine,
PVOID ServiceContext,
ULONG Vector,
KIRQL Irql,
KINTERRUPT_MODE InterruptMode,
BOOLEAN ShareVector)Spirit implementation source and subsequent kernel call changes.
Ordinal 110; stdcall, 8 ABI argument bytes. Route: KeInitializeMutant.
Initializes caller mutant with recursion state and optional current-thread ownership, links into owner mutant list when initially owned. Abandoned=FALSE and empty wait list; no allocation. Release/wait uses same storage until no users remain.
Implementation: ntoskrnl/ke/mutex.c (KeInitializeMutant, reconstructed line 21).
VOID
NTAPI
KeInitializeMutant(IN PKMUTANT Mutant,
IN BOOLEAN InitialOwner)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 111; stdcall, 8 ABI argument bytes. Route: KeInitializeQueue.
Initializes dispatcher queue, empty entry/thread lists, zero current count and maximum concurrent-worker count; Count=0 selects processor count. Storage caller-owned, queue entries are caller LIST_ENTRY objects.
Implementation: ntoskrnl/ke/queue.c (KeInitializeQueue, reconstructed line 147).
VOID
NTAPI
KeInitializeQueue(IN PKQUEUE Queue,
IN ULONG Count OPTIONAL)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 112; stdcall, 12 ABI argument bytes. Route: KeInitializeSemaphore.
Initializes caller semaphore count and limit/dispatcher wait list. Count/limit constraints are asserted; no heap allocation. Acquires occur by dispatcher waits consuming count.
Implementation: ntoskrnl/ke/semphobj.c (KeInitializeSemaphore, reconstructed line 21).
VOID
NTAPI
KeInitializeSemaphore(IN PKSEMAPHORE Semaphore,
IN LONG Count,
IN LONG Limit)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 113; stdcall, 8 ABI argument bytes. Route: KeInitializeTimerEx.
Initializes caller KTIMER header/type (notification or synchronization), list, due time/period state and not-inserted state. Timer is native console layout; no shadow/allocation and nothing armed until set.
Implementation: ntoskrnl/ke/timerobj.c (KeInitializeTimerEx, reconstructed line 243).
VOID
NTAPI
KeInitializeTimerEx(OUT PKTIMER Timer,
IN TIMER_TYPE Type)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 114; stdcall, 12 ABI argument bytes. Route: KeInsertByKeyDeviceQueue.
Stores SortKey and, when busy, inserts in ascending order with equal-key insertion after existing equals; returns TRUE. Idle becomes Busy and returns FALSE without queuing. Source does not mirror Inserted assignment made by unkeyed variant; callers should not infer that flag update from the other routine.
Implementation: ntoskrnl/ke/devqueue.c (KeInsertByKeyDeviceQueue, reconstructed line 84).
BOOLEAN
NTAPI
KeInsertByKeyDeviceQueue(IN PKDEVICE_QUEUE DeviceQueue,
IN PKDEVICE_QUEUE_ENTRY DeviceQueueEntry,
IN ULONG SortKey)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 115; stdcall, 8 ABI argument bytes. Route: KeInsertDeviceQueue.
Idle queue becomes Busy and returns FALSE without linking entry, allowing immediate service. Busy queue appends entry, sets entry Inserted=TRUE and returns TRUE. This return is queued state, not a success/failure status.
Implementation: ntoskrnl/ke/devqueue.c (KeInsertDeviceQueue, reconstructed line 42).
BOOLEAN
NTAPI
KeInsertDeviceQueue(IN PKDEVICE_QUEUE DeviceQueue,
IN PKDEVICE_QUEUE_ENTRY DeviceQueueEntry)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 116; stdcall, 8 ABI argument bytes. Route: KeInsertHeadQueue.
Same worker wake/concurrency protocol as KeInsertQueue, but inserts at head for priority when queued. Returns previous count; caller supplies valid detached LIST_ENTRY.
Implementation: ntoskrnl/ke/queue.c (KeInsertHeadQueue, reconstructed line 171).
LONG
NTAPI
KeInsertHeadQueue(IN PKQUEUE Queue,
IN PLIST_ENTRY Entry)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 117; stdcall, 8 ABI argument bytes. Route: KeInsertQueue.
Appends entry or satisfies eligible blocked queue worker, respecting maximum concurrency. Returns prior queue signal count. Entry is retained until removed/rundown; not copied or freed.
Implementation: ntoskrnl/ke/queue.c (KeInsertQueue, reconstructed line 197).
LONG
NTAPI
KeInsertQueue(IN PKQUEUE Queue,
IN PLIST_ENTRY Entry)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 118; stdcall, 16 ABI argument bytes. Route: XeKeInsertQueueApc.
NULL APC/invalid resolved thread/shadow allocation failure returns FALSE. System arguments stamped before decision. Duplicate insertion returns FALSE but updates queued shadow arguments. Successful insertion allocates native shadow, stores pointer in title list links and marks before native insertion because current-thread kernel APC can run immediately. Delivery/rundown clears Inserted/links and frees shadow before title callback, allowing requeue. Title storage survives through delivery/rundown; native refusal cleans shadow.
Implementation: ntoskrnl/xb/xbe.c (XeKeInsertQueueApc, reconstructed line 3046).
BOOLEAN NTAPI
XeKeInsertQueueApc(PXBE_KAPC Apc,
PVOID SystemArgument1,
PVOID SystemArgument2,
KPRIORITY Increment)Spirit implementation source and subsequent kernel call changes.
Ordinal 119; stdcall, 12 ABI argument bytes. Route: KeInsertQueueDpc.
Queues initialized DPC with two system arguments if not already inserted and returns TRUE; duplicate returns FALSE. Dispatcher uses native console Inserted protocol and requests DPC processing. Callback receives stored context/arguments later at DISPATCH_LEVEL; caller retains storage.
Implementation: ntoskrnl/ke/dpc.c (KeInsertQueueDpc, reconstructed line 737).
BOOLEAN
NTAPI
KeInsertQueueDpc(IN PKDPC Dpc,
IN PVOID SystemArgument1,
IN PVOID SystemArgument2)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 120; DATA address. Route: KeInterruptTime.
Mapped live native time counter storage advanced by clock path, in100ns units. Interrupt time and system time have different meanings; system time may be set. Multiword direct reads need native consistent-read protocol rather than assuming a single atomic64-bit load.
Implementation storage: ntoskrnl/ke/clock.c and ntoskrnl/ke/time.c (clock state and readers).
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 121; stdcall, 0 ABI argument bytes. Route: KeIsExecutingDpc.
Returns current CPU DpcRoutineActive state. Does not report whether some DPC is pending.
Implementation: ntoskrnl/ke/dpc.c (KeIsExecutingDpc, reconstructed line 1029).
BOOLEAN
NTAPI
KeIsExecutingDpc(VOID)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 122; stdcall, 0 ABI argument bytes. Route: KeLeaveCriticalRegion.
Increments KernelApcDisable; when normal APCs become enabled native path checks/delivers pending work. Caller must balance enters; leaving can trigger callbacks before returning.
Implementation: ntoskrnl/ke/apc.c (KeLeaveCriticalRegion, reconstructed line 661).
VOID
NTAPI
KeLeaveCriticalRegion(VOID)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 123; stdcall, 12 ABI argument bytes. Route: KePulseEvent.
Returns pre-pulse signal state. If initially clear with waiters, transiently signals/tests waiters, then always resets0. Wait=TRUE retains dispatcher lock/WaitNext until immediately following wait; FALSE unlocks. A pulse is not stored for later waiters.
Implementation: ntoskrnl/ke/eventobj.c (KePulseEvent, reconstructed line 68).
LONG
NTAPI
KePulseEvent(IN PKEVENT Event,
IN KPRIORITY Increment,
IN BOOLEAN Wait)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 124; stdcall, 4 ABI argument bytes. Route: KeQueryBasePriorityThread.
Returns native thread base priority minus owning process base. Saturated thread substitutes signed saturation increment. Takes thread lock at synchronization IRQL; valid native thread object required.
Implementation: ntoskrnl/ke/thrdobj.c (KeQueryBasePriorityThread, reconstructed line 51).
KPRIORITY
NTAPI
KeQueryBasePriorityThread(IN PKTHREAD Thread)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 125; stdcall, 0 ABI argument bytes. Route: XeKeQueryInterruptTime.
Returns live interrupt counter in100ns units as EDX:EAX64-bit result. Clock ticks advance same KeInterruptTime DATA. No pointer output or performance-frequency scale.
Implementation: ntoskrnl/xb/xbe.c (XeKeQueryInterruptTime, reconstructed line 1053).
ULONGLONG NTAPI XeKeQueryInterruptTime(VOID)Spirit implementation source and subsequent kernel call changes.
Ordinal 126; stdcall, 0 ABI argument bytes. Route: XeKeQueryPerformanceCounter.
Reads24-bit ACPI PM timer port8008 and extends by one wrap when current low<previous low, serialized at DISPATCH_LEVEL. Returns64-bit EDX:EAX count. If callers do not sample for multiple full wraps (~5 s each), algorithm cannot recover skipped wraps; no wall-clock guarantee.
Implementation: ntoskrnl/xb/xbe.c (XeKeQueryPerformanceCounter, reconstructed line 1097).
ULONGLONG NTAPI XeKeQueryPerformanceCounter(VOID)Spirit implementation source and subsequent kernel call changes.
Ordinal 127; stdcall, 0 ABI argument bytes. Route: KeQueryPerformanceFrequency.
Returns constant3374488 Hz as64-bit EDX:EAX. No output-pointer parameter; use with performance counter, not system/interrupt100ns times.
Implementation: ntoskrnl/xb/xbe.c (KeQueryPerformanceFrequency, reconstructed line 1102).
ULONGLONG NTAPI KeQueryPerformanceFrequency(VOID)Spirit implementation source and subsequent kernel call changes.
Ordinal 128; stdcall, 4 ABI argument bytes. Route: KeQuerySystemTime.
Writes caller LARGE_INTEGER from live system-time counter, using native stable high/low read. Returns void; counter can be changed by system-time setting, so not monotonic elapsed-time source.
Implementation: ntoskrnl/ke/clock.c (KeQuerySystemTime, reconstructed line 176).
VOID
NTAPI
KeQuerySystemTime(OUT PLARGE_INTEGER CurrentTime)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 129; stdcall, 0 ABI argument bytes. Route: KeRaiseIrqlToDpcLevel.
Raises current CPU to DISPATCH_LEVEL and returns old IRQL. Caller must restore old IRQL; wait/pageable operations are constrained until lower.
Implementation: hal/halx86/mp/mpsirql.c (KeRaiseIrqlToDpcLevel, reconstructed line 212).
KIRQL NTAPI
KeRaiseIrqlToDpcLevel (VOID)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 130; stdcall, 0 ABI argument bytes. Route: KeRaiseIrqlToSynchLevel.
Raises to kernel synchronization level and returns old IRQL. Paired lower required; stronger exclusion than ordinary thread priority change.
Implementation: hal/halx86/mp/mpsirql.c (KeRaiseIrqlToSynchLevel, reconstructed line 236).
KIRQL NTAPI
KeRaiseIrqlToSynchLevel (VOID)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 131; stdcall, 16 ABI argument bytes. Route: KeReleaseMutant.
Returns previous signal state; normal release requires ownership and can raise STATUS_MUTANT_NOT_OWNED. Releases recursion level; when available unlinks owner, adjusts APC disable and wakes waiters. Abandoned release sets abandoned state. Wait=TRUE retains dispatcher state for following wait; does not free mutant.
Implementation: ntoskrnl/ke/mutex.c (KeReleaseMutant, reconstructed line 97).
LONG
NTAPI
KeReleaseMutant(IN PKMUTANT Mutant,
IN KPRIORITY Increment,
IN BOOLEAN Abandon,
IN BOOLEAN Wait)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 132; stdcall, 16 ABI argument bytes. Route: KeReleaseSemaphore.
Adds Adjustment under dispatcher lock; invalid increase above Limit or wrap raises STATUS_SEMAPHORE_LIMIT_EXCEEDED. Returns prior count; wakes eligible waiters when count becomes available. Wait=TRUE retains dispatcher lock for immediate paired wait. Caller keeps semaphore alive.
Implementation: ntoskrnl/ke/semphobj.c (KeReleaseSemaphore, reconstructed line 53).
LONG
NTAPI
KeReleaseSemaphore(IN PKSEMAPHORE Semaphore,
IN KPRIORITY Increment,
IN LONG Adjustment,
IN BOOLEAN Wait)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 133; stdcall, 8 ABI argument bytes. Route: KeRemoveByKeyDeviceQueue.
Requires Busy queue. Empty clears Busy and returns NULL. If requested key is at/above last key, removes first; otherwise removes first entry with key>=requested. Clears returned entry Inserted. This is elevator ordering, not exact-key matching.
Implementation: ntoskrnl/ke/devqueue.c (KeRemoveByKeyDeviceQueue, reconstructed line 198).
PKDEVICE_QUEUE_ENTRY
NTAPI
KeRemoveByKeyDeviceQueue(IN PKDEVICE_QUEUE DeviceQueue,
IN ULONG SortKey)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 134; stdcall, 4 ABI argument bytes. Route: KeRemoveDeviceQueue.
Requires Busy queue. Empty list clears Busy and returns NULL; otherwise removes first, clears its Inserted and returns entry. Neither frees entry nor starts a request.
Implementation: ntoskrnl/ke/devqueue.c (KeRemoveDeviceQueue, reconstructed line 154).
PKDEVICE_QUEUE_ENTRY
NTAPI
KeRemoveDeviceQueue(IN PKDEVICE_QUEUE DeviceQueue)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 135; stdcall, 8 ABI argument bytes. Route: KeRemoveEntryDeviceQueue.
Reads entry Inserted flag under queue lock; when set unlinks and clears it, returning prior flag. Requires Busy and correctly linked entry; no scan validates membership.
Implementation: ntoskrnl/ke/devqueue.c (KeRemoveEntryDeviceQueue, reconstructed line 349).
BOOLEAN
NTAPI
KeRemoveEntryDeviceQueue(IN PKDEVICE_QUEUE DeviceQueue,
IN PKDEVICE_QUEUE_ENTRY DeviceQueueEntry)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 136; stdcall, 12 ABI argument bytes. Route: KeRemoveQueue.
Associates current thread with queue, manages active worker count and removes/returns entry; waits when none available or concurrency limit reached. Timeout/mode can return pointer-encoded status rather than entry. Caller must distinguish status results before dereferencing. Normal APC/alertable interruption follows queue wait protocol.
Implementation: ntoskrnl/ke/queue.c (KeRemoveQueue, reconstructed line 237).
PLIST_ENTRY
NTAPI
KeRemoveQueue(IN PKQUEUE Queue,
IN KPROCESSOR_MODE WaitMode,
IN PLARGE_INTEGER Timeout OPTIONAL)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 137; stdcall, 4 ABI argument bytes. Route: KeRemoveQueueDpc.
Attempts to unlink queued DPC and clear inserted state; returns whether removed. Cannot retract a callback already dequeued/running. Does not free DPC or synchronize callback completion.
Implementation: ntoskrnl/ke/dpc.c (KeRemoveQueueDpc, reconstructed line 924).
BOOLEAN
NTAPI
KeRemoveQueueDpc(IN PKDPC Dpc)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 138; stdcall, 4 ABI argument bytes. Route: KeResetEvent.
Under dispatcher lock changes signal state to0 and returns previous LONG state. Does not wait for existing awakened threads or destroy event.
Implementation: ntoskrnl/ke/eventobj.c (KeResetEvent, reconstructed line 133).
LONG
NTAPI
KeResetEvent(IN PKEVENT Event)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 139; stdcall, 4 ABI argument bytes. Route: KeRestoreFloatingPointState.
Restores saved x86 FX/NPX state and metadata and frees save allocations. Requires valid successfully saved state and matching context/IRQL assumptions. Save storage cannot be reused after restore without another save; native status returned. Wrong saving thread bugchecks INVALID_FLOATING_POINT_STATE parameter 1=2; changed NPX IRQL bugchecks same code parameter 1=1. Returns STATUS_SUCCESS after valid restoration.
Implementation: ntoskrnl/ke/i386/cpu.c (KeRestoreFloatingPointState, reconstructed line 1531).
NTSTATUS
NTAPI
KeRestoreFloatingPointState(
_In_ PKFLOATING_SAVE Save)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 140; stdcall, 4 ABI argument bytes. Route: KeResumeThread.
Returns previous suspend count; decrements only when nonzero and signals suspend semaphore only when suspend and freeze counts both reach0. Does not necessarily run target immediately.
Implementation: ntoskrnl/ke/thrdobj.c (KeResumeThread, reconstructed line 387).
ULONG
NTAPI
KeResumeThread(IN PKTHREAD Thread)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 141; stdcall, 4 ABI argument bytes. Route: KeRundownQueue.
Requires empty dispatcher wait list (assertion). Detaches entry list and clears Queue association of all threads in queue thread list, returning detached circular list or NULL if no entries. Does not wake blocked waiters as teardown protocol or free entries; callers must finish waits before rundown.
Implementation: ntoskrnl/ke/queue.c (KeRundownQueue, reconstructed line 437).
PLIST_ENTRY
NTAPI
KeRundownQueue(IN PKQUEUE Queue)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 142; stdcall, 4 ABI argument bytes. Route: KeSaveFloatingPointState.
Allocates save context and aligned FX buffer from nonpaged pool; failures INSUFFICIENT_RESOURCES. Captures current x86 FPU state/NPX metadata into caller save handle and installs kernel working state. Requires IRQL<=DISPATCH_LEVEL and valid hardware/save storage. Balance successful save with restore; failure creates no usable save.
Implementation: ntoskrnl/ke/i386/cpu.c (KeSaveFloatingPointState, reconstructed line 1405).
NTSTATUS
NTAPI
KeSaveFloatingPointState(
_Out_ PKFLOATING_SAVE Save)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 143; stdcall, 8 ABI argument bytes. Route: KeSetBasePriorityThread.
Changes native thread base increment relative to process base, applying dynamic/real-time bounds and saturation rules, and schedules priority change. Returns prior base increment. This affects base and derived current priority, unlike a transient boost.
Implementation: ntoskrnl/ke/thrdobj.c (KeSetBasePriorityThread, reconstructed line 1167).
LONG
NTAPI
KeSetBasePriorityThread(IN PKTHREAD Thread,
IN LONG Increment)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 144; stdcall, 8 ABI argument bytes. Route: KeSetDisableBoostThread.
Atomically sets/resets ThreadFlags bit 1 according to Disable and returns previous bit. No all-thread or process-wide effect.
Implementation: ntoskrnl/ke/thrdobj.c (KeSetDisableBoostThread, reconstructed line 85).
BOOLEAN
NTAPI
KeSetDisableBoostThread(IN OUT PKTHREAD Thread,
IN BOOLEAN Disable)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 145; stdcall, 12 ABI argument bytes. Route: KeSetEvent.
Signals and returns previous LONG state; wakes notification waiters or one synchronization waiter. Already signaled notification event with Wait=FALSE has fast return. Wait=TRUE keeps dispatcher lock and marks current WaitNext, requiring immediate paired wait; Increment is scheduling boost.
Implementation: ntoskrnl/ke/eventobj.c (KeSetEvent, reconstructed line 159).
LONG
NTAPI
KeSetEvent(IN PKEVENT Event,
IN KPRIORITY Increment,
IN BOOLEAN Wait)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 146; stdcall, 8 ABI argument bytes. Route: KeSetEventBoostPriority.
Requires synchronization event. No waiter sets signal and leaves optional WaitingThread untouched. WaitAll path uses normal event wake; ordinary first waiter is unlinked/readied with boost based on calling thread priority and optionally returned. Output is not guaranteed written on every path.
Implementation: ntoskrnl/ke/eventobj.c (KeSetEventBoostPriority, reconstructed line 229).
VOID
NTAPI
KeSetEventBoostPriority(IN PKEVENT Event,
IN PKTHREAD *WaitingThread OPTIONAL)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 147; stdcall, 8 ABI argument bytes. Route: KeSetPriorityProcess.
Accepts Xbox-shaped process pointer; NULL returns 0. Returns previous signed-char BasePriority and stores new value narrowed to CHAR without validation. Only requested1..15 also changes calling native thread and shadow priority/base fields. Other title threads remain unchanged; out-of-range request updates process field but leaves calling thread priority unchanged. This is a documented partial implementation, not native KPROCESS sweeping.
Implementation: ntoskrnl/xb/procobj.c (KeSetPriorityProcess, reconstructed line 149).
LONG NTAPI
KeSetPriorityProcess(PVOID Process, LONG BasePriority)Spirit implementation source and subsequent kernel call changes.
Ordinal 148; stdcall, 8 ABI argument bytes. Route: KeSetPriorityThread.
Under dispatcher/thread locking changes native thread current scheduling priority and quantum/boost accounting; returns old priority. Range/IRQL/type requirements are assertions, not ordinary NTSTATUS validation. Rescheduling may follow priority change.
Implementation: ntoskrnl/ke/thrdobj.c (KeSetPriorityThread, reconstructed line 1310).
KPRIORITY
NTAPI
KeSetPriorityThread(IN PKTHREAD Thread,
IN KPRIORITY Priority)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 149; stdcall, 16 ABI argument bytes. Route: KeSetTimer.
Delegates to KeSetTimerEx with Period=0. DueTime100ns signed NT convention; optional native KDPC queued on expiration. Returns previous inserted state. Re-arming removes prior schedule; does not cancel a separately queued callback.
Implementation: ntoskrnl/ke/timerobj.c (KeSetTimer, reconstructed line 281).
BOOLEAN
NTAPI
KeSetTimer(IN OUT PKTIMER Timer,
IN LARGE_INTEGER DueTime,
IN PKDPC Dpc OPTIONAL)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 150; stdcall, 20 ABI argument bytes. Route: KeSetTimerEx.
Arms/rearms caller timer with due time, millisecond Period and optional native DPC. Returns whether previously inserted. Immediate expiration may signal/queue DPC synchronously with scheduling path. Periodic timers reinsert on expiration; storage must outlive pending timer and any DPC.
Implementation: ntoskrnl/ke/timerobj.c (KeSetTimerEx, reconstructed line 294).
BOOLEAN
NTAPI
KeSetTimerEx(IN OUT PKTIMER Timer,
IN LARGE_INTEGER DueTime,
IN LONG Period,
IN PKDPC Dpc OPTIONAL)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 151; stdcall, 4 ABI argument bytes. Route: KeStallExecutionProcessor.
Busy-waits requested microseconds through calibrated HAL stall path, retaining CPU rather than a scheduler wait. No timeout status or cancellation; avoid treating it as an alertable delay.
Linked Xbox implementation: hal/halx86/generic/systimer.S, selected by hal/halx86/xbox.cmake. The calibrated runtime multiplies the requested microseconds by the PCR stall-loop scale and executes the subtraction loop. hal/halx86/apic/tsc.c is a different HAL implementation and is not the route selected by the inspected Xbox release; its timestamp frequency must not be confused with the Xbox loop-iteration scale.
The calibrated request is a busy stall, not a scheduler wait. Zero returns without the subtraction loop. Timing depends on calibration and execution conditions; neither one debugger interval nor a sampled loop count proves accurate microseconds. Preserve the caller's interrupt/IRQL contract and hardware-sensitive minimum waits. Early/unready calibration, multiplication boundaries and reset behavior require qualification before changing the implementation.
Issue #157 records the current PGR2 short-stall investigation. Two bounded captures establish repeated direct title requests for1 microsecond, alongside ordinary ATA setup requests. Existing NVNET traces in one capture repeatedly report an offline/not-negotiated PHY. These are diagnostic observations, not an FPS gain, natural call-frequency census or permission to remove the waits.
VOID
NTAPI
KeStallExecutionProcessor(ULONG MicroSeconds)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 152; stdcall, 4 ABI argument bytes. Route: KeSuspendThread.
Returns previous suspend count and increments it, scheduling suspend APC where permitted. Raises STATUS_SUSPEND_COUNT_EXCEEDED at maximum count. APC delivery means suspended state need not occur before caller returns; no reference is acquired.
Implementation: ntoskrnl/ke/thrdobj.c (KeSuspendThread, reconstructed line 600).
ULONG
NTAPI
KeSuspendThread(PKTHREAD Thread)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 153; stdcall, 12 ABI argument bytes. Route: XeKeSynchronizeExecution.
Ordinary shadow uses native interrupt synchronization. Missing shadow calls callback directly, with no lock/IRQL adjustment. Driver-owned binding raises to DISPATCH_LEVEL if needed then synchronizes borrowed native object, or returns FALSE after unbind. Callback BOOLEAN is returned. No lock held across adapter callback lookup permits nested synchronization, but missing-shadow fallback gives no interrupt exclusion guarantee.
Implementation: ntoskrnl/xb/interrupt.c (XeKeSynchronizeExecution, reconstructed line 129).
BOOLEAN NTAPI
XeKeSynchronizeExecution(_In_ PKINTERRUPT Interrupt,
_In_ PKSYNCHRONIZE_ROUTINE SynchronizeRoutine,
_In_opt_ PVOID SynchronizeContext)Spirit implementation source and subsequent kernel call changes.
Ordinal 154; DATA address. Route: KeSystemTime.
Mapped live native time counter storage advanced by clock path, in100ns units. Interrupt time and system time have different meanings; system time may be set. Multiword direct reads need native consistent-read protocol rather than assuming a single atomic64-bit load.
Implementation storage: ntoskrnl/ke/clock.c and ntoskrnl/ke/time.c (clock state and readers).
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 155; stdcall, 4 ABI argument bytes. Route: KeTestAlertThread.
For current thread returns and clears Alerted[AlertMode]; UserMode also tests pending user APC queue and sets UserApcPending when appropriate. This consumes alert latch, unlike querying a persistent flag.
Implementation: ntoskrnl/ke/thrdobj.c (KeTestAlertThread, reconstructed line 721).
BOOLEAN
NTAPI
KeTestAlertThread(IN KPROCESSOR_MODE AlertMode)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 156; DATA address. Route: KeTickCount.
Mapped native tick counter DATA; low DWORD aliases are exposed by console ABI. Tick count is ticks rather than100ns time, and low-width reads wrap; use KeTimeIncrement for nominal conversion.
Implementation storage: ntoskrnl/ke/clock.c and ntoskrnl/ke/time.c (clock state and readers).
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 157; DATA address. Route: KeTimeIncrement.
Mapped ULONG nominal100ns clock-tick increment,10000 for1 ms configuration. It is data, not a function, and not the PM timer performance frequency.
Implementation storage: ntoskrnl/ke/clock.c and ntoskrnl/ke/time.c (clock state and readers).
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 158; stdcall, 32 ABI argument bytes. Route: KeWaitForMultipleObjects.
Count/Object array,WaitAny/WaitAll,reason,mode,alertable,timeout and optional caller wait blocks follow dispatcher protocol. WaitAny success encodes selected index; WaitAll satisfies all objects together, including consumption/ownership. Timeout/alerts/APCs are separate statuses; abandoned mutants use abandoned-index range. Released patch 0011 supplies console-sized wait-block handling. Native maximum/count and caller-buffer constraints apply; do not assume an unbounded array or native NT wait-block size.
Implementation: ntoskrnl/ke/wait.c (KeWaitForMultipleObjects, reconstructed line 614).
NTSTATUS
NTAPI
KeWaitForMultipleObjects(IN ULONG Count,
IN PVOID Object[],
IN WAIT_TYPE WaitType,
IN KWAIT_REASON WaitReason,
IN KPROCESSOR_MODE WaitMode,
IN BOOLEAN Alertable,
IN PLARGE_INTEGER Timeout OPTIONAL,
OUT PKWAIT_BLOCK WaitBlockArray OPTIONAL)Native source and Spirit kernel changes, call/lifecycle changes.
Title multiple wait-block correction.
Ordinal 159; stdcall, 20 ABI argument bytes. Route: KeWaitForSingleObject.
Waits on valid dispatcher object with WaitReason,WaitMode,Alertable and optional100ns timeout. NULL timeout indefinite; zero polls; negative relative/nonnegative absolute. Returns SUCCESS/timeout/alert/user APC/abandoned-mutant statuses as applicable and consumes synchronization signals or ownership according to object type. Wait=TRUE producer operations require immediate paired wait. Blocking requires permitted IRQL; no object reference is taken for lifetime.
Implementation: ntoskrnl/ke/wait.c (KeWaitForSingleObject, reconstructed line 440).
NTSTATUS
NTAPI
KeWaitForSingleObject(IN PVOID Object,
IN KWAIT_REASON WaitReason,
IN KPROCESSOR_MODE WaitMode,
IN BOOLEAN Alertable,
IN PLARGE_INTEGER Timeout OPTIONAL)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 160; fastcall, 4 ABI argument bytes. Route: KfRaiseIrql.
FASTCALL raises to requested NewIrql and returns previous KIRQL. Requests below current violate raise contract and can bugcheck under checked HAL. First argument in ECX; caller balances with lower.
Implementation: hal/halx86/mp/mpsirql.c (KfRaiseIrql, reconstructed line 164).
KIRQL FASTCALL
KfRaiseIrql (KIRQL NewIrql)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 161; fastcall, 4 ABI argument bytes. Route: KfLowerIrql.
FASTCALL lowers to requested prior IRQL and permits newly unmasked pending interrupts/APC/DPC delivery. Raising via this operation violates lower contract. Returns void; newly eligible callbacks can run before return.
Implementation: hal/halx86/mp/mpsirql.c (KfLowerIrql, reconstructed line 134).
VOID FASTCALL
KfLowerIrql (KIRQL NewIrql)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 162; DATA address. Route: KiBugCheckData.
Mapped live five-word native record: bugcheck code followed by four arguments, zero before first bugcheck. Readable DATA address, not an invocation or historical crash-log service.
Implementation storage: ntoskrnl/ke/bug.c.
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 163; fastcall, 4 ABI argument bytes. Route: KiExitDispatcher.
Ordinal aliases KiExitDispatcher, taking old IRQL to release dispatcher scheduling state and perform needed dispatch/lowering. Caller must already hold appropriate dispatcher state at DISPATCH_LEVEL; this is not a public acquisition API or arbitrary unlock.
Implementation: ntoskrnl/ke/wait.c (KiExitDispatcher, reconstructed line 221).
VOID
FASTCALL
KiExitDispatcher(IN KIRQL OldIrql)Native source and Spirit kernel changes, call/lifecycle changes.
Ordinal 356; DATA address. Route: HalBootSMCVideoMode.
Mapped boot video-mode datum initialized 1 (HDTV). It is not a callable function or a dynamic encoder-setting query.
Implementation storage: hal/halx86/xbox/hal.c.
Ordinal routing and datum/implementation source; subsequent call changes.
Ordinal 358; stdcall, 0 ABI argument bytes. Route: HalIsResetOrShutdownPending.
Returns the boot-local Boolean latched by HalInitiateShutdown. This reports software intent, not a live hardware power-state query.
Implementation: hal/halx86/xbox/hal.c (HalIsResetOrShutdownPending, reconstructed line 93).
BOOLEAN NTAPI HalIsResetOrShutdownPending(VOID)Spirit implementation source and subsequent kernel call changes.
Ordinal 359; stdcall, 4 ABI argument bytes. Route: IoMarkIrpMustComplete.
Mapped no-op: argument ignored and no IRP flag/state changed. It is mapped but does not implement a must-complete guarantee.
Implementation: ntoskrnl/xb/xbe.c (IoMarkIrpMustComplete, reconstructed line 1114).
VOID NTAPI IoMarkIrpMustComplete(_In_ PVOID Irp)Spirit implementation source and subsequent kernel call changes.
Ordinal 360; stdcall, 0 ABI argument bytes. Route: HalInitiateShutdown.
Sets the shutdown-pending Boolean TRUE. Returns normally; actual power-off is requested later through HalReturnToFirmware. It does not itself drain callbacks or power down.
Implementation: hal/halx86/xbox/hal.c (HalInitiateShutdown, reconstructed line 95).
VOID NTAPI HalInitiateShutdown(VOID)Spirit implementation source and subsequent kernel call changes.
Ordinal 365; stdcall, 0 ABI argument bytes. Route: HalEnableSecureTrayEject.
Latches secure-eject TRUE. There is no wired SMC eject-driven dashboard reboot to disable in this implementation; no status or immediate tray action is produced.
Implementation: hal/halx86/xbox/hal.c (HalEnableSecureTrayEject, reconstructed line 86).
VOID NTAPI HalEnableSecureTrayEject(VOID)Spirit implementation source and subsequent kernel call changes.
Ordinal 366; stdcall, 4 ABI argument bytes. Route: HalWriteSMCScratchRegister.
Writes only low byte of ScratchRegister to SMC address20/register 1B; returns SMBus status. No readback or verification is provided by the wrapper.
Implementation: ntoskrnl/xb/xbe.c (HalWriteSMCScratchRegister, reconstructed line 2531).
NTSTATUS NTAPI
HalWriteSMCScratchRegister(ULONG ScratchRegister)Spirit implementation source and subsequent kernel call changes.
Source baseline: SpiritBoot 27149596, Roswell 1569e2e8 plus ordered patches. See Clean-Room-and-Validation for evidence boundaries and Export-Index for complete export coverage.
- Retail-5838-BIOS-Size-and-Layout
- Retail-5838-Function-Ledger
- Retail-5838-Public-API-Comparison
- Retail-5838-Data-and-Physical-Atlas
- Retail-5838-Unclassified-Image-Ranges
- SpiritBoot-Main-Emitted-Extent-Ledger
- SpiritBoot-Main-Physical-Ownership
- SpiritBoot-Latest-Candidate-Extent-Ledger
- Memory-Reduction-Targets
- Memory-Comparison-and-Removal-Guide
- Memory-Three-BIOS-Public-API-Comparison
- Memory-Reduction-Workbook — physical-owner challenge ledger, game headroom, allocation pressure and removal decisions.
- Memory-Pool-Reuse-Cost-and-Attribution — current 64 KiB candidate saving, eight-run allocator costs and Conker attribution limits.
- Kernel-Overhaul-Size-and-Performance — lower-level subsystem specialization, runtime roots, performance work and focused PR delivery.