NTURTL.H

The public symbol file NTKRPAMP.PDB for the original release of Windows 10 tells that the kernel is built with the NTURTL.H header at

d:\th.public.fre\internal\sdk\inc

and draws from it the type definitions that are shown in the table below.

The header NTURTL.H is not known in any Device Driver Kit (DDK) or Windows Driver Kit (WDK), but most of the types that the kernel is known to pick up from NTRTL_X.H are defined in WINNT.H.

Line Number Type WINNT.H
60 struct _RTL_CRITICAL_SECTION_DEBUG 18731
90 struct _RTL_CRITICAL_SECTION 18761
432 struct _RTL_SRWLOCK 18778
3258 struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME  

Anti-Trust Settlement Forensics

For the record, here are the many more types that Microsoft’s freely published URLMON.PDB reveals were accessible to the source code for URLMON.DLL from including this same NTRTL_X.H when building Internet Explorer for the original release of 32-bit Windows 10:

Line Number Type
60 struct _RTL_CRITICAL_SECTION_DEBUG
90 struct _RTL_CRITICAL_SECTION
113 struct _RTL_CRITICAL_SECTION_DEBUG32
123 struct _RTL_CRITICAL_SECTION_DEBUG64
133 struct _RTL_CRITICAL_SECTION32
142 struct _RTL_CRITICAL_SECTION64
160 struct _RTL_RESOURCE
432 struct _RTL_SRWLOCK_INTERNAL
559 struct _RTL_CONDITION_VARIABLE_INTERNAL
637 struct _RTL_UNLOAD_EVENT_TRACE
647 struct _RTL_UNLOAD_EVENT_TRACE64
657 struct _RTL_UNLOAD_EVENT_TRACE32
710 enum _RTL_RXACT_OPERATION
718 struct _RTL_RXACT_LOG
736 struct _RTL_RXACT_CONTEXT
962 struct _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION
969 struct _RTLP_PROCESS_REFLECTION_CONTEXT
1087 struct _RTL_RELATIVE_NAME
1093 enum _RTL_PATH_TYPE
1348 struct RTL_ACE_DATA
1523 struct _RTL_PERTHREAD_CURDIR
1605 struct _RTL_HEAP_TAG_INFO
1699 struct _RTL_HEAP_WALK_ENTRY
1706 unnamed struct for Block in unnamed union in _RTL_HEAP_WALK_ENTRY
1712 unnamed struct for Segment in unnamed union in _RTL_HEAP_WALK_ENTRY
1729 struct _RTL_HEAP_ENTRY
1733 unnamed union for u in _RTL_HEAP_ENTRY
1734 unnamed struct for s1 in u in _RTL_HEAP_ENTRY
1738 unnamed struct for s2 in u in _RTL_HEAP_ENTRY
1764 struct _RTL_HEAP_TAG
1773 struct _RTL_HEAP_INFORMATION
1789 struct _RTL_PROCESS_HEAPS
1800 enum _HEAP_INFORMATION_CLASS
1859 struct _RTLP_VIRTUALIZED_HEAP
1865 struct _RTLP_VIRTUALIZED_HEAPS_INFO
1894 struct _PROCESS_HEAP_INFORMATION
1907 struct _HEAP_INFORMATION
1918 struct _HEAP_REGION_INFORMATION
1931 struct _HEAP_RANGE_INFORMATION
1959 struct _HEAP_BLOCK_EXTRA_INFORMATION
1969 struct _HEAP_BLOCK_INFORMATION
1981 struct _HEAP_BLOCK_SETTABLE_INFORMATION
1989 struct _SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION
2001 struct _HEAP_PERFORMANCE_COUNTERS_INFORMATION
2030 struct _HEAP_INFORMATION_ITEM
2057 struct _HEAP_EXTENDED_INFORMATION
2126 struct _RTL_DEBUG_INFORMATION
2155 struct _RTL_DEBUG_INFORMATION32
2184 struct _RTL_QUERY_DEBUG_INFORMATION_INFO
2208 struct _RTL_QUERY_DEBUG_VIRTUAL_PROCESS
2326 struct _RTL_HANDLE_TABLE_ENTRY
2335 struct _RTL_HANDLE_TABLE
2561 struct _FLS_DATA
2942 struct _FINDFIRSTACTIVATIONCONTEXTSECTION
3013 struct _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING
3032 struct _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT
3040 struct _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL
3045 struct _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING
3049 union _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA
3097 struct _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600
3112 struct _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA
3121 struct _ACTIVATION_CONTEXT_SECTION_KEYED_DATA
3170 struct _ACTIVATION_CONTEXT_ASSEMBLY_DATA
3258 struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME
3268 struct _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC
3274 struct _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
3403 enum _WOW64_FUNCTION_CODE64

The names _RTL_SRWLOCK_INTERNAL and _RTL_CONDITION_VARIALE_INTERNAL look to be created by macros so that URLMON.DLL has both the full definitions of _RTL_SRWLOCK and _RTL_CONDITION_VARIABLE from NTURTL.H and the reduced definitions from WINNT.H.