KE.H

The public symbol file NTKRPAMP.PDB for the original release of Windows 10 tells that the kernel is built with the KE.H header at

d:\th\minkernel\ntos\inc

and draws from it the following type definitions:

Line Number Type
214 enum _KOBJECTS
311 struct _KTHREAD_COUNTERS
283 enum _KPROCESS_STATE
298 enum _KTHREAD_STATE
641 struct _KSCB
692 struct _KSCHEDULING_GROUP_POLICY
713 struct _KSCHEDULING_GROUP
751 struct _KHETERO_PROCESSOR_SET
764 struct _KNODE
814 struct _flags
852 union _KEXECUTE_OPTIONS
871 union _KSTACK_COUNT
884 struct _KPROCESS
1134 enum _KWAIT_BLOCK_STATE
1145 enum _KWAIT_STATE
1160 union _KWAIT_STATUS_REGISTER
1270 struct _KLOCK_ENTRY_LOCK_STATE
1295 struct _KLOCK_ENTRY
1630 struct _KTHREAD
3432 enum _KERNEL_STACK_LIMITS

The _flags structure is the type of the _KNODE member named Flags. That _KNODE is defined first implies that _flags is defined within _KNODE. That _flags is not scoped to _KNODE is indirect evidence of compilation as C, not C++, in versions (such as 6.1) for which the public symbol files have no record of the -TC compiler option.

The header KE.H is not known in any Device Driver Kit (DDK) or Windows Driver Kit (WDK).