📄 ntcall.htm
字号:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
<title>Windows XP Build 2600 vs Windows 2000 Build 2195 Ntoskrnl Services</title>
<style>
<!--
#BodyCells { font-family: Verdana, Arial; font-size: 12; background-color: rgb(255,255,255); color: rgb(0,0,0); text-align: center; vertical-align: middle }
-->
</style>
</head>
<table border="1" cellspacing="0">
<TR>
<TD colspan="6" align="center"><strong>Windows XP Build 2600 vs Windows 2000 Build 2195 Ntoskrnl Services</strong></TD>
</TR>
<TR>
<TD rowspan="2" align="center">Serivce ID</TD>
<TD colspan="3" align="center">Windows XP Professional Build 2600 Services List</TD>
<TD colspan="2" align="center">Windows 2000 Server Build 2195 Services List</TD>
</TR>
<TR>
<TD align="center">Params (HEX)</TD>
<TD align="center">Name</TD>
<TD align="center">New For XP</TD>
<TD align="center">Params (HEX)</TD>
<TD align="center">Name</TD>
</TR>
<TR>
<TD>0000</TD>
<TD>6</TD>
<TD>NtAcceptConnectPort</TD>
<TD> </TD>
<TD>6</TD>
<TD>NtAcceptConnectPort</TD>
</TR>
<TR>
<TD>1</TD>
<TD>8</TD>
<TD>NtAccessCheck</TD>
<TD> </TD>
<TD>8</TD>
<TD>NtAccessCheck</TD>
</TR>
<TR>
<TD>2</TD>
<TD>0B</TD>
<TD>NtAccessCheckAndAuditAlarm</TD>
<TD> </TD>
<TD>0B</TD>
<TD>NtAccessCheckAndAuditAlarm</TD>
</TR>
<TR>
<TD>3</TD>
<TD>0B</TD>
<TD>NtAccessCheckByType</TD>
<TD> </TD>
<TD>0B</TD>
<TD>NtAccessCheckByType</TD>
</TR>
<TR>
<TD>4</TD>
<TD>10</TD>
<TD>NtAccessCheckByTypeAndAuditAlarm</TD>
<TD> </TD>
<TD>10</TD>
<TD>NtAccessCheckByTypeAndAuditAlarm</TD>
</TR>
<TR>
<TD>5</TD>
<TD>0B</TD>
<TD>NtAccessCheckByTypeResultList</TD>
<TD> </TD>
<TD>0B</TD>
<TD>NtAccessCheckByTypeResultList</TD>
</TR>
<TR>
<TD>6</TD>
<TD>10</TD>
<TD>NtAccessCheckByTypeResultListAndAuditAlarm</TD>
<TD> </TD>
<TD>10</TD>
<TD>NtAccessCheckByTypeResultListAndAuditAlarm</TD>
</TR>
<TR>
<TD>7</TD>
<TD>11</TD>
<TD>NtAccessCheckByTypeResultListAndAuditAlarmByHandle</TD>
<TD> </TD>
<TD>11</TD>
<TD>NtAccessCheckByTypeResultListAndAuditAlarmByHandle</TD>
</TR>
<TR>
<TD>8</TD>
<TD>3</TD>
<TD>NtAddAtom</TD>
<TD> </TD>
<TD>3</TD>
<TD>NtAddAtom</TD>
</TR>
<TR>
<TD>9</TD>
<TD>2</TD>
<TD>NtAddBootEntry</TD>
<TD>v</TD>
<TD>6</TD>
<TD>NtAdjustGroupsToken</TD>
</TR>
<TR>
<TD>9</TD>
<TD>2</TD>
<TD>NtQueryBootOptions</TD>
<TD>v</TD>
<TD>6</TD>
<TD>NtAdjustGroupsToken</TD>
</TR>
<TR>
<TD>9</TD>
<TD>2</TD>
<TD>NtEnumerateBootEntries</TD>
<TD>v</TD>
<TD>6</TD>
<TD>NtAdjustGroupsToken</TD>
</TR>
<TR>
<TD>9</TD>
<TD>2</TD>
<TD>NtSetBootEntryOrder</TD>
<TD>v</TD>
<TD>6</TD>
<TD>NtAdjustGroupsToken</TD>
</TR>
<TR>
<TD>9</TD>
<TD>2</TD>
<TD>NtSetBootOptions</TD>
<TD>v</TD>
<TD>6</TD>
<TD>NtAdjustGroupsToken</TD>
</TR>
<TR>
<TD>9</TD>
<TD>2</TD>
<TD>NtQueryBootEntryOrder</TD>
<TD>v</TD>
<TD>6</TD>
<TD>NtAdjustGroupsToken</TD>
</TR>
<TR>
<TD>000A</TD>
<TD>6</TD>
<TD>NtAdjustGroupsToken</TD>
<TD> </TD>
<TD>6</TD>
<TD>NtAdjustPrivilegesToken</TD>
</TR>
<TR>
<TD>000B</TD>
<TD>6</TD>
<TD>NtAdjustPrivilegesToken</TD>
<TD> </TD>
<TD>2</TD>
<TD>NtAlertResumeThread</TD>
</TR>
<TR>
<TD>000C</TD>
<TD>2</TD>
<TD>NtAlertResumeThread</TD>
<TD> </TD>
<TD>1</TD>
<TD>NtAlertThread</TD>
</TR>
<TR>
<TD>000D</TD>
<TD>1</TD>
<TD>NtAlertThread</TD>
<TD> </TD>
<TD>1</TD>
<TD>NtAllocateLocallyUniqueId</TD>
</TR>
<TR>
<TD>000E</TD>
<TD>1</TD>
<TD>NtAllocateLocallyUniqueId</TD>
<TD> </TD>
<TD>3</TD>
<TD>NtAllocateUserPhysicalPages</TD>
</TR>
<TR>
<TD>000F</TD>
<TD>3</TD>
<TD>NtAllocateUserPhysicalPages</TD>
<TD> </TD>
<TD>4</TD>
<TD>NtAllocateUuids</TD>
</TR>
<TR>
<TD>10</TD>
<TD>4</TD>
<TD>NtAllocateUuids</TD>
<TD> </TD>
<TD>6</TD>
<TD>NtAllocateVirtualMemory</TD>
</TR>
<TR>
<TD>11</TD>
<TD>6</TD>
<TD>NtAllocateVirtualMemory</TD>
<TD> </TD>
<TD>2</TD>
<TD>NtAreMappedFilesTheSame</TD>
</TR>
<TR>
<TD>12</TD>
<TD>2</TD>
<TD>NtAreMappedFilesTheSame</TD>
<TD> </TD>
<TD>2</TD>
<TD>NtAssignProcessToJobObject</TD>
</TR>
<TR>
<TD>13</TD>
<TD>2</TD>
<TD>NtAssignProcessToJobObject</TD>
<TD> </TD>
<TD>3</TD>
<TD>NtCallbackReturn</TD>
</TR>
<TR>
<TD>14</TD>
<TD>3</TD>
<TD>NtCallbackReturn</TD>
<TD> </TD>
<TD>2</TD>
<TD>NtCancelIoFile</TD>
</TR>
<TR>
<TD>15</TD>
<TD>1</TD>
<TD>NtModifyBootEntry</TD>
<TD>v</TD>
<TD>2</TD>
<TD>NtCancelTimer</TD>
</TR>
<TR>
<TD>15</TD>
<TD>1</TD>
<TD>NtDeleteBootEntry</TD>
<TD>v</TD>
<TD>2</TD>
<TD>NtCancelTimer</TD>
</TR>
<TR>
<TD>15</TD>
<TD>1</TD>
<TD>NtCancelDeviceWakeupRequest</TD>
<TD> </TD>
<TD>2</TD>
<TD>NtCancelTimer</TD>
</TR>
<TR>
<TD>16</TD>
<TD>2</TD>
<TD>NtCancelIoFile</TD>
<TD> </TD>
<TD>1</TD>
<TD>NtCancelDeviceWakeupRequest</TD>
</TR>
<TR>
<TD>17</TD>
<TD>2</TD>
<TD>NtCancelTimer</TD>
<TD> </TD>
<TD>1</TD>
<TD>NtClearEvent</TD>
</TR>
<TR>
<TD>18</TD>
<TD>1</TD>
<TD>NtClearEvent</TD>
<TD> </TD>
<TD>1</TD>
<TD>NtClose</TD>
</TR>
<TR>
<TD>19</TD>
<TD>1</TD>
<TD>NtClose</TD>
<TD> </TD>
<TD>3</TD>
<TD>NtCloseObjectAuditAlarm</TD>
</TR>
<TR>
<TD>001A</TD>
<TD>3</TD>
<TD>NtCloseObjectAuditAlarm</TD>
<TD> </TD>
<TD>1</TD>
<TD>NtCompleteConnectPort</TD>
</TR>
<TR>
<TD>001B</TD>
<TD>2</TD>
<TD>NtCompactKeys</TD>
<TD>v</TD>
<TD>8</TD>
<TD>NtConnectPort</TD>
</TR>
<TR>
<TD>001C</TD>
<TD>3</TD>
<TD>NtCompareTokens</TD>
<TD>v</TD>
<TD>2</TD>
<TD>NtContinue</TD>
</TR>
<TR>
<TD>001D</TD>
<TD>1</TD>
<TD>NtCompleteConnectPort</TD>
<TD> </TD>
<TD>3</TD>
<TD>NtCreateDirectoryObject</TD>
</TR>
<TR>
<TD>001E</TD>
<TD>1</TD>
<TD>NtCompressKey</TD>
<TD>v</TD>
<TD>5</TD>
<TD>NtCreateEvent</TD>
</TR>
<TR>
<TD>001F</TD>
<TD>8</TD>
<TD>NtConnectPort</TD>
<TD> </TD>
<TD>3</TD>
<TD>NtCreateEventPair</TD>
</TR>
<TR>
<TD>20</TD>
<TD>2</TD>
<TD>NtContinue</TD>
<TD> </TD>
<TD>0B</TD>
<TD>NtCreateFile</TD>
</TR>
<TR>
<TD>21</TD>
<TD>4</TD>
<TD>NtCreateDebugObject</TD>
<TD>v</TD>
<TD>4</TD>
<TD>NtCreateIoCompletion</TD>
</TR>
<TR>
<TD>22</TD>
<TD>3</TD>
<TD>NtCreateDirectoryObject</TD>
<TD> </TD>
<TD>3</TD>
<TD>NtCreateJobObject</TD>
</TR>
<TR>
<TD>23</TD>
<TD>5</TD>
<TD>NtCreateEvent</TD>
<TD> </TD>
<TD>7</TD>
<TD>NtCreateKey</TD>
</TR>
<TR>
<TD>24</TD>
<TD>3</TD>
<TD>NtCreateEventPair</TD>
<TD> </TD>
<TD>8</TD>
<TD>NtCreateMailslotFile</TD>
</TR>
<TR>
<TD>25</TD>
<TD>0B</TD>
<TD>NtCreateFile</TD>
<TD> </TD>
<TD>4</TD>
<TD>NtCreateMutant</TD>
</TR>
<TR>
<TD>26</TD>
<TD>4</TD>
<TD>NtCreateIoCompletion</TD>
<TD> </TD>
<TD>0E</TD>
<TD>NtCreateNamedPipeFile</TD>
</TR>
<TR>
<TD>27</TD>
<TD>3</TD>
<TD>NtCreateJobObject</TD>
<TD> </TD>
<TD>4</TD>
<TD>NtCreatePagingFile</TD>
</TR>
<TR>
<TD>28</TD>
<TD>3</TD>
<TD>NtCreateJobSet</TD>
<TD>v</TD>
<TD>5</TD>
<TD>NtCreatePort</TD>
</TR>
<TR>
<TD>29</TD>
<TD>7</TD>
<TD>NtCreateKey</TD>
<TD> </TD>
<TD>8</TD>
<TD>NtCreateProcess</TD>
</TR>
<TR>
<TD>002A</TD>
<TD>8</TD>
<TD>NtCreateMailslotFile</TD>
<TD> </TD>
<TD>9</TD>
<TD>NtCreateProfile</TD>
</TR>
<TR>
<TD>002B</TD>
<TD>4</TD>
<TD>NtCreateMutant</TD>
<TD> </TD>
<TD>7</TD>
<TD>NtCreateSection</TD>
</TR>
<TR>
<TD>002C</TD>
<TD>0E</TD>
<TD>NtCreateNamedPipeFile</TD>
<TD> </TD>
<TD>5</TD>
<TD>NtCreateSemaphore</TD>
</TR>
<TR>
<TD>002D</TD>
<TD>4</TD>
<TD>NtCreatePagingFile</TD>
<TD> </TD>
<TD>4</TD>
<TD>NtCreateSymbolicLinkObject</TD>
</TR>
<TR>
<TD>002E</TD>
<TD>5</TD>
<TD>NtCreatePort</TD>
<TD> </TD>
<TD>8</TD>
<TD>NtCreateThread</TD>
</TR>
<TR>
<TD>002F</TD>
<TD>8</TD>
<TD>NtCreateProcess</TD>
<TD> </TD>
<TD>4</TD>
<TD>NtCreateTimer</TD>
</TR>
<TR>
<TD>30</TD>
<TD>9</TD>
<TD>NtCreateProcessEx</TD>
<TD>v</TD>
<TD>0D</TD>
<TD>NtCreateToken</TD>
</TR>
<TR>
<TD>31</TD>
<TD>9</TD>
<TD>NtCreateProfile</TD>
<TD> </TD>
<TD>5</TD>
<TD>NtCreateWaitablePort</TD>
</TR>
<TR>
<TD>32</TD>
<TD>7</TD>
<TD>NtCreateSection</TD>
<TD> </TD>
<TD>2</TD>
<TD>NtDelayExecution</TD>
</TR>
<TR>
<TD>33</TD>
<TD>5</TD>
<TD>NtCreateSemaphore</TD>
<TD> </TD>
<TD>1</TD>
<TD>NtDeleteAtom</TD>
</TR>
<TR>
<TD>34</TD>
<TD>4</TD>
<TD>NtCreateSymbolicLinkObject</TD>
<TD> </TD>
<TD>1</TD>
<TD>NtDeleteFile</TD>
</TR>
<TR>
<TD>35</TD>
<TD>8</TD>
<TD>NtCreateThread</TD>
<TD> </TD>
<TD>1</TD>
<TD>NtDeleteKey</TD>
</TR>
<TR>
<TD>36</TD>
<TD>4</TD>
<TD>NtCreateTimer</TD>
<TD> </TD>
<TD>3</TD>
<TD>NtDeleteObjectAuditAlarm</TD>
</TR>
<TR>
<TD>37</TD>
<TD>0D</TD>
<TD>NtCreateToken</TD>
<TD> </TD>
<TD>2</TD>
<TD>NtDeleteValueKey</TD>
</TR>
<TR>
<TD>38</TD>
<TD>5</TD>
<TD>NtCreateWaitablePort</TD>
<TD> </TD>
<TD>0A</TD>
<TD>NtDeviceIoControlFile</TD>
</TR>
<TR>
<TD>39</TD>
<TD>2</TD>
<TD>NtDebugActiveProcess</TD>
<TD>v</TD>
<TD>1</TD>
<TD>NtDisplayString</TD>
</TR>
<TR>
<TD>003A</TD>
<TD>3</TD>
<TD>NtDebugContinue</TD>
<TD>v</TD>
<TD>7</TD>
<TD>NtDuplicateObject</TD>
</TR>
<TR>
<TD>003B</TD>
<TD>2</TD>
<TD>NtDelayExecution</TD>
<TD> </TD>
<TD>6</TD>
<TD>NtDuplicateToken</TD>
</TR>
<TR>
<TD>003C</TD>
<TD>1</TD>
<TD>NtDeleteAtom</TD>
<TD> </TD>
<TD>6</TD>
<TD>NtEnumerateKey</TD>
</TR>
<TR>
<TD>003D</TD>
<TD>1</TD>
<TD>NtCancelDeviceWakeupRequest</TD>
<TD> </TD>
<TD>6</TD>
<TD>NtEnumerateValueKey</TD>
</TR>
<TR>
<TD>003D</TD>
<TD>1</TD>
<TD>NtModifyBootEntry</TD>
<TD>v</TD>
<TD>6</TD>
<TD>NtEnumerateValueKey</TD>
</TR>
<TR>
<TD>003D</TD>
<TD>1</TD>
<TD>NtDeleteBootEntry</TD>
<TD>v</TD>
<TD>6</TD>
<TD>NtEnumerateValueKey</TD>
</TR>
<TR>
<TD>003E</TD>
<TD>1</TD>
<TD>NtDeleteFile</TD>
<TD> </TD>
<TD>2</TD>
<TD>NtExtendSection</TD>
</TR>
<TR>
<TD>003F</TD>
<TD>1</TD>
<TD>NtDeleteKey</TD>
<TD> </TD>
<TD>6</TD>
<TD>NtFilterToken</TD>
</TR>
<TR>
<TD>40</TD>
<TD>3</TD>
<TD>NtDeleteObjectAuditAlarm</TD>
<TD> </TD>
<TD>3</TD>
<TD>NtFindAtom</TD>
</TR>
<TR>
<TD>41</TD>
<TD>2</TD>
<TD>NtDeleteValueKey</TD>
<TD> </TD>
<TD>2</TD>
<TD>NtFlushBuffersFile</TD>
</TR>
<TR>
<TD>42</TD>
<TD>0A</TD>
<TD>NtDeviceIoControlFile</TD>
<TD> </TD>
<TD>3</TD>
<TD>NtFlushInstructionCache</TD>
</TR>
<TR>
<TD>43</TD>
<TD>1</TD>
<TD>NtDisplayString</TD>
<TD> </TD>
<TD>1</TD>
<TD>NtFlushKey</TD>
</TR>
<TR>
<TD>44</TD>
<TD>7</TD>
<TD>NtDuplicateObject</TD>
<TD> </TD>
<TD>4</TD>
<TD>NtFlushVirtualMemory</TD>
</TR>
<TR>
<TD>45</TD>
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -