ARC.H

The public symbol file NTKRPAMP.PDB for the original release of Windows 10 tells that the kernel is built with the ARC.H header at

d:\th.public.fre\halkit\inc

and draws from it the following type definitions:

Line Number Type
105 enum _TYPE_OF_MEMORY
142 struct _MEMORY_ALLOCATION_DESCRIPTOR

The header ARC.H is published in the “minwin” directory of the Windows Driver Kit (WDK) for Windows 10 in the original and Version 1511 editions. This was a significant new disclosure. The header as published defines many more structures, but the public symbol files for the kernel in the same versions do not have type information for these.

Indeed, many types that are defined in ARC.H had never or only rarely appeared in any public symbol files for any version. Starting with the 1803 release of Windows 10, however, the public symbol files for the kernel have very many more types that are defined in ARC.H. That these many types that were for so long relatively unknown to programmers outside Microsoft are known to the kernel through this one header is surely worth cataloguing:

Line Number (1803) Type Line Number (Original)
58 enum _CONFIGURATION_CLASS same
69 struct _CONFIGURATION_COMPONENT same
92 struct _CONFIGURATION_COMPONENT_DATA same
105 enum _TYPE_OF_MEMORY same
142 struct _MEMORY_ALLOCATION_DESCRIPTOR same
156 struct _NLS_DATA_BLOCK 153
180 struct _ARC_DISK_INFORMATION 177
184 struct _I386_LOADER_BLOCK 181
200 struct _ARM_LOADER_BLOCK 197
217 struct _LOADER_PERFORMANCE_DATA 214
284 struct _BOOT_ENTROPY_SOURCE_LDR_RESULT 280
302 struct _OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2 298
337 struct _BOOT_ENTROPY_LDR_RESULT 333
349 struct _LOADER_PARAMETER_HYPERVISOR_EXTENSION 344
374 struct _LOADER_PARAMETER_CI_EXTENSION 369
464 struct _LOADER_BUGCHECK_PARAMETERS 431
477 struct _LOADER_HIVE_RECOVERY_INFO none
534 struct _LOADER_RESET_REASON none
536 unnamed union Basic in struct _LOADER_RESET_REASON none
537 unnamed struct Component in Basic in _LOADER_RESET_REASON none
632 struct _LOADER_PARAMETER_EXTENSION 453
1116 struct _NETWORK_LOADER_BLOCK 808
1130 struct _VIRTUAL_EFI_RUNTIME_SERVICES 822
1153 struct _EFI_FIRMWARE_INFORMATION 845
1187 struct _PCAT_FIRMWARE_INFORMATION 879
1192 struct _FIRMWARE_INFORMATION_LOADER_BLOCK 884
1237 unnamed union u in _FIRMWARE_INFORMATION_LOADER_BLOCK 936
1274 struct _LOADER_PARAMETER_BLOCK 971
1326 unnamed union u in _LOADER_PARAMETER_BLOCK 1023

The line numbers in the left column are for the unseen ARC.H for Windows 10 Version 1803, as known from the public symbol files for the kernel in this version. The line numbers to the right are from the published header in the original Windows 10 release. As only to be expected, the header has grown in the years since its (accidental) disclosure.

The ARC.H that is compiled for the kernel’s public symbol files is not Microsoft’s only ARC.H. It may be an incomplete copy or extract for inclusion with a HAL development kit. Where ARC.H is named in a handful of private symbol files that Microsoft has distributed with otherwise public symbols, it is placed elsewhere. For instance, in the downloadable package of public symbols for the original release of Windows 10, appxdeploymentclient.pdb names ARC.H in

d:\th.public.fre\internal\sdk\inc\minwin

which is indeed where the kernel gets many of its headers. More study is required.