6.7 KiB
CI API compatibility matrix
This matrix records named export presence in 13 exact ci.dll files,
with architecture stated separately for each sample.
Yes means the complete PE export directory contains the name; No means
it does not. Neither result is inferred from a header, import library or PDB.
Export presence alone does not establish a compatible ABI or successful verification.
Versions in the tables are CI file versions, not necessarily the kernel version. In particular, the Windows 10 22H2 consumer ISO contains CI 19041.1865. Do not extrapolate a cell to every servicing revision of that Windows release.
Machine-readable matrix includes exact SHA-256 identities, all per-API results and hashes of the retained source inventories.
Windows 10 1507–1803 x64 samples
| API | 10240.16463 | 10586.0 | 14393.2189 | 15063.0 | 16299.125 | 17134.1130 |
|---|---|---|---|---|---|---|
CiCheckSignedFile |
Yes | Yes | Yes | Yes | Yes | Yes |
CiFindPageHashesInCatalog |
Yes | Yes | Yes | Yes | Yes | Yes |
CiFindPageHashesInSignedFile |
Yes | Yes | Yes | Yes | Yes | Yes |
CiFreePolicyInfo |
Yes | Yes | Yes | Yes | Yes | Yes |
CiGetCertPublisherName |
No | No | No | No | No | No |
CiGetPEInformation |
Yes | Yes | Yes | Yes | Yes | Yes |
CiInitialize |
Yes | Yes | Yes | Yes | Yes | Yes |
CiSetTrustedOriginClaimId |
No | No | No | Yes | Yes | Yes |
CiValidateFileObject |
Yes | Yes | Yes | Yes | Yes | Yes |
CiVerifyHashInCatalog |
Yes | Yes | Yes | Yes | Yes | Yes |
Later Windows 10 and Windows 11 x64 samples
| API | 19041.1 | 19041.1865 | 22000.318 | 22621.2792 | 26100.8328 |
|---|---|---|---|---|---|
CiCheckSignedFile |
Yes | Yes | Yes | Yes | Yes |
CiFindPageHashesInCatalog |
Yes | Yes | Yes | Yes | Yes |
CiFindPageHashesInSignedFile |
Yes | Yes | Yes | Yes | Yes |
CiFreePolicyInfo |
Yes | Yes | Yes | Yes | Yes |
CiGetCertPublisherName |
No | Yes | Yes | Yes | Yes |
CiGetPEInformation |
Yes | Yes | Yes | Yes | Yes |
CiInitialize |
Yes | Yes | Yes | Yes | Yes |
CiSetTrustedOriginClaimId |
Yes | Yes | Yes | Yes | Yes |
CiValidateFileObject |
Yes | Yes | Yes | Yes | Yes |
CiVerifyHashInCatalog |
Yes | Yes | Yes | Yes | Yes |
Windows 11 ARM64 samples
| API | 22621.1702 | 26100.1591 |
|---|---|---|
CiCheckSignedFile |
Yes | Yes |
CiFindPageHashesInCatalog |
Yes | Yes |
CiFindPageHashesInSignedFile |
Yes | Yes |
CiFreePolicyInfo |
Yes | Yes |
CiGetCertPublisherName |
Yes | Yes |
CiGetPEInformation |
Yes | Yes |
CiInitialize |
Yes | Yes |
CiSetTrustedOriginClaimId |
Yes | Yes |
CiValidateFileObject |
Yes | Yes |
CiVerifyHashInCatalog |
Yes | Yes |
Exact sample identities
- Windows 10 1507: 10.0.10240.16463 x64, SHA-256
e83d900f4675c6e6ffc3fb7dcd3074610876a1398e495796769988df810fd3bc. - Windows 10 1511: 10.0.10586.0 x64, SHA-256
f949bfa614addea6174b28c3818c56b327c9290fd41bd91dfc545414b3df6783. - Windows 10 1607: 10.0.14393.2189 x64, SHA-256
ef0c02ecbd0818e84be9f61421f919825f96a3c59199460cab08548eee2881df. - Windows 10 1703: 10.0.15063.0 x64, SHA-256
3705aaf408f05326e028621380aa5c96a1f3583a2de8a139b188da4b82577863. - Windows 10 1709: 10.0.16299.125 x64, SHA-256
1db7ae5a08bd2361fc7fcdd373fb980e8d680035e67b02e5967095db0443effd. - Windows 10 1803: 10.0.17134.1130 x64, SHA-256
8ce3b8fe38c23b699f30b045383640019a429d3a9d513285c655bffe03a796d9. - Windows 10 2004 ISO: 10.0.19041.1 x64, SHA-256
2955710d34db26e352e62b20861ba338f0216cc36b378d128057be955e184282. - Windows 10 22H2 consumer ISO: 10.0.19041.1865 x64, SHA-256
d0408a9f64eafb72e8aa1cf127d07d919f0cab38a6bdf2b406255909c85e3a8d. - Windows 11 English x64 v1 ISO: 10.0.22000.318 x64, SHA-256
301ae49ac5b87cf1cbe07d9d3c6486a066d045b6bf55fc8eb392d52951ec69ff. - Windows 11 23H2 English ISO: 10.0.22621.2792 x64, SHA-256
9ed77b8a53946ced8c3540edb26a765060dff908544634e7b069aa49f2b41559. - Windows 11 24H2 sample: 10.0.26100.8328 x64, SHA-256
c7d23814f3202c51fb23e3ca3d4328855787383cee5d14c4a986a13ec2aeda0b. - Windows 11 22H2.9 ARM64 ISO: 10.0.22621.1702 ARM64, SHA-256
4164ac08fd19628c5ab6cbca6234265ac2bf7f39d5149f57d3845646d8a8ad60. - Windows 11 24H2 ARM64 ISO: 10.0.26100.1591 ARM64, SHA-256
a0eba64a9a3f2006d5832079412eca42cc1b9ed66d19b9b0adb7e59ea354415d.
What callers can rely on
CiValidateFileObjectis already exported in the sampled Windows 10 1507 file.CiSetTrustedOriginClaimIdis present in the sampled 1703 file and absent in the three earlier samples. This does not prove its first introduction build.CiGetCertPublisherNameis absent in 19041.1 and present in 19041.1865. Its first Windows 10 servicing update remains unknown. It is also present in the sampled 22000.318 and 26100.8328 files.- CI entry points currently use static imports from
ci.lib. An unavailable import can prevent driver loading; this matrix does not add an automaticSTATUS_NOT_IMPLEMENTEDfallback. Supporting these older samples requires avoiding unavailable imports or implementing optional resolution. - Choose structures using a verified runtime profile. The sampled x64 chain
headers differ: 1507 uses 56 bytes, 1511 uses 72, and 1607–1803 use 104.
Export presence, compile-target
NTDDI_VERSIONand total allocationSizedo not select a compatible layout. See mincrypt contracts.
Coverage gaps and evidence
Unknown / not sampled: x86 export availability; Windows 10 ARM64; pre-Windows-10; Windows 10 1809/1903/1909; and other servicing revisions or architecture/release combinations absent from these tables. These are gaps, not negative export results. No interval between two samples is certified. Runtime verification and cross-version ABI checks remain in the implementation ledger.
The tables cover every named export found in these samples, including
CiInitialize; inclusion is not a recommendation to call initialization or
global-policy routines. Each sample also has three ordinal-only exports,
which are outside this named-API matrix. Private Mincrypt* PDB symbols are
not automatically callable exports.
Source inventories are retained in the companion
CodeIntegrity-RE repository:
corpus-index.json (VM samples), iso-corpus-index.json (ISO samples), and
ci-26100.8328-evidence.json with manifest.json (original 26100 sample).
Regenerate with its generate_compatibility_matrix.py --output <Domito/docs>.
ARM64 cells establish export presence only; the historical x64 layout views
must not be selected for ARM64 solely because the same API name is exported.
No Windows binary or PDB is distributed with the matrix.