NTLDR.H

The public symbol file NTKRPAMP.PDB for the original release of Windows 10 tells that the kernel is built with the NTLDR.H header at

d:\th.public.fre\internal\sdk\inc

and draws from it the type definitions that are tabulated below. The header NTLDR.H is not known in any Device Driver Kit (DDK) or Windows Driver Kit (WDK).

Line Number Type
100 struct _LDR_SERVICE_TAG_RECORD
105 enum _LDR_DDAG_STATE
127 struct _LDRP_CSLIST
135 struct _LDR_DDAG_NODE
152 enum _LDR_DLL_LOAD_REASON
167 struct _LDR_DATA_TABLE_ENTRY
248 struct _KLDR_DATA_TABLE_ENTRY
263 unnamed union u1 in _KLDR_DATA_TABLE_ENTRY

Note that several of these structures are shared with—indeed, used more by—NTDLL in user mode. Though it’s plain as day that the LDR_DATA_TABLE_ENTRY and KLDR_DATA_TABLE_ENTRY have a common origin, confirmation that they are defined in the same header is welcome: guessing it would never have been safe.

More types from NTLDR.H show in the public symbol files for other modules. Some of these others are kernel-mode drivers, especially for processor power management. Some are user-mode DLLs. Among these are some that are very far removed from system programming, e.g., URLMON.DLL from Internet Explorer. Though the symbol files in question are in effect private symbol files, Microsoft has published them freely in downloadable packages of all the public symbol files for all of Windows, starting with Windows 8. If inclusion of these unusually detailed symbol files in these packages was at first an oversight, it has been left to stand for years, though not for all modules. For instance, it ceased for URLMON.DLL after the 1709 edition of Windows 10.

For the record, here are the types that Microsoft’s freely published URLMON.PDB reveals were accessible to the source code for URLMON.DLL from including NTLDR.H when building for the original release of 32-bit Windows 10:

Line Number Type
100 struct _LDR_SERVICE_TAG_RECORD
105 enum _LDR_DDAG_STATE
127 struct _LDRP_CSLIST
135 struct _LDR_DDAG_NODE
152 enum _LDR_DLL_LOAD_REASON
167 struct _LDR_DATA_TABLE_ENTRY
248 struct _KLDR_DATA_TABLE_ENTRY
263 unnamed union u1 in _KLDR_DATA_TABLE_ENTRY
282 struct _LDR_DATA_TABLE_ENTRY32
317 struct _LDR_DATA_TABLE_ENTRY64
352 struct _KLDR_DATA_TABLE_ENTRY32
377 struct _KLDR_DATA_TABLE_ENTRY64
622 struct _LDR_IMPORT_CALLBACK_INFO
627 struct _LDR_SECTION_INFO
639 struct _LDR_VERIFY_IMAGE_INFO
776 struct _COVERAGE_SECTION_HEADER
832 struct _LDR_ENUM_RESOURCE_ENTRY
833 unnamed union for Path in _LDR_ENUM_RESOURCE_ENTRY
894 struct _RTL_MODULE_BASIC_INFO
898 struct _RTL_MODULE_EXTENDED_INFO
916 struct _RTL_PROCESS_MODULE_INFORMATION
929 struct _RTL_PROCESS_MODULE_INFORMATION_EX
937 struct _RTL_PROCESS_MODULES
1069 struct _LOAD_ASDATA_TABLE
1198 struct _LDR_DLL_LOADED_NOTIFICATION_DATA
1210 struct _LDR_DLL_UNLOADED_NOTIFICATION_DATA
1220 union _LDR_DLL_NOTIFICATION_DATA
1429 struct _LDR_FAILURE_DATA
1442 unnamed enum