Windows NT 3.1 Source Tree

From a modern perspective, the compiling and linking of 32-bit code was still very primitive in 1993 when Windows NT 3.1 was released as the first Windows that’s its own operating system. The 32-bit code for the Windows that ran on DOS had plausibly all been written in assembly language. The Device Driver Kit (DDK) for this variety of Windows was still years from acknowledging that 32-bit code for a Virtual Device Driver (VxD) in ring 0 might be written in C. Though the new Windows had a kernel, drivers and applications all in C from the start, the programming support was surely understood as primitive even from the perspective of the time. Notably, if the 32-bit C compiler was yet capable of doing 64-bit arithmetic, its ability was so recent that the Windows NT 3.1 kernel is written not to use it and the the DDK for Windows NT 3.1 defines LONGLONG and ULONGLONG as double for the i386 processor, presumably for lack of a built-in 64-bit integral type.

Something else that looks to have been relatively new in 1993 is that debugging information could be removed from the executable to a separate symbol file. Pre-release builds of the Windows NT 3.1 kernel, as can be found on the Internet at websites that preserve what they call abandonware, have the debugging information in the executable as described by the Common Object File Format (COFF). Its removal to a separate file in the released Windows NT 3.1 looks to have been new enough that the .DBG files for both NTOSKRNL.EXE and NTKRNLMP.EXE are too primitive for Microsoft’s linker to dump in any detail: feed them to dumpbin /all and the linker faults with an “Internal error during DumpDebugFile”. Among their problems by modern reckoning is that they have zero for the SectionAlignment in the IMAGE_SEPARATE_DEBUG_HEADER and their IMAGE_DEBUG_DIRECTORY for IMAGE_DEBUG_TYPE_MISC is misformed. Still, they are easily enough inspected by sight. They can even be edited so that Microsoft’s linker parses them without faulting.

What inspecting them will get for you most obviously is the matching of Microsoft’s names to the addresses of routines and variables. Of interest here is that the COFF symbol table also has IMAGE_SYM_CLASS_FILE records that name the source files that define these routines and variables. In these particular .DBG files, the names are observed to be fully qualified for source files in C but only relative for assembly-language source files. For both the debugger and the reverse engineer, it is all but mechanical to determine which routines and variables are in which source files and to put it all together for a map of where Microsoft has these source files at the time of compilation.

Thus did Microsoft from the start publish its source tree for the Windows kernel—not the source code or the source files, of course, but the directory structure in which those files were organised. For the tree below, I don’t go as far as showing which routines and variables are in which source files, just the tree of files in directories. If you browse this page with scripts enabled, then you should be able to expand the branches that interest you and collapse those that don’t.

D:
- nt
  - private
    - crt32nt
      - convert
        
        atox.c
        
        isctype.c
        
        iswctype.c
        
        mblen.c
        
        mbstowcs.c
        
        mbtowc.c
        
        tolower.c
        
        toupper.c
        
        towlower.c
        
        towupper.c
        
        wcstombs.c
        
        wctomb.c
        
        xtoa.c
      - hack
        
        stubs.c
      - misc
        
        cmiscdat.c
        
        ctype.c
        
        nlsdata1.c
      - startup
        
        crt0fp.c
      - stdio
        
        _flsbuf.c
        
        _flswbuf.c
        
        fputwc.c
        
        output.c
        
        snprintf.c
        
        snwprint.c
        
        sprintf.c
        
        vsnprint.c
        
        woutput.c
      - string
        
        wcscat.c
        
        wcschr.c
        
        wcscmp.c
        
        wcscspn.c
        
        wcsicmp.c
        
        wcslen.c
        
        wcslwr.c
        
        wcsncmp.c
        
        wcsncpy.c
        
        wcsnicmp.c
        
        wcsstr.c
        
        wcsupr.c
    - lsa
      - client
        
        austub.c
    - ntos (but ntosmp for multi-processor build)
      - brtl
        
        i386
        
        debug3.c
        
        divlarge.c
        
        assert.c
        
        bitmap.c
        
        cnvint.c
        
        imagedir.c
        
        ldrreloc.c
        
        nls.c
        
        nlsxlat.c
        
        string.c
        
        time.c
      - cache
        
        cachedat.c
        
        cachesub.c
        
        copysup.c
        
        fssup.c
        
        lazyrite.c
        
        logsup.c
        
        mdlsup.c
        
        pinsup.c
        
        vacbsup.c
      - config
        
        i386
        
        init386.c
        
        cmapi.c
        
        cmapi2.c
        
        cmboot.c
        
        cmchek.c
        
        cmchek2.c
        
        cmclose.c
        
        cmconfig.c
        
        cmcontrl.c
        
        cmdata.c
        
        cmdelete.c
        
        cmgquota.c
        
        cmhvlist.c
        
        cmindex.c
        
        cminit.c
        
        cmnotify.c
        
        cmparse.c
        
        cmparse2.c
        
        cmquery.c
        
        cmsavres.c
        
        cmse.c
        
        cmsubs.c
        
        cmsubs2.c
        
        cmsubs3.c
        
        cmsysini.c
        
        cmtrecpy.c
        
        cmtredel.c
        
        cmtree.c
        
        cmworker.c
        
        cmwrapr.c
        
        cmwrapr2.c
        
        hivebin.c
        
        hivecell.c
        
        hivechek.c
        
        hivefree.c
        
        hiveinit.c
        
        hiveload.c
        
        hivemap.c
        
        hivesum.c
        
        hivesync.c
        
        ntapi.c
      - dbgk
        
        dbgkport.c
        
        dbgkproc.c
      - ex
        
        i386
        
        probe.c
        
        dbgctrl.c
        
        delay.c
        
        event.c
        
        eventpr.c
        
        exinit.c
        
        handle.c
        
        harderr.c
        
        luid.c
        
        mutant.c
        
        pool.c
        
        profile.c
        
        resource.c
        
        semphore.c
        
        sysenv.c
        
        sysinfo.c
        
        systime.c
        
        timer.c
        
        worker.c
        
        zone.c
      - fsrtl
        
        dbcsname.c
        
        fastio.c
        
        faulttol.c
        
        filelock.c
        
        filter.c
        
        fsrtlp.c
        
        largemcb.c
        
        name.c
        
        notify.c
        
        oplock.c
        
        stackovf.c
        
        unc.c
      - init
        
        init.c
        
        ntoskrnl.c
      - io
        
        arcsec.c
        
        create.c
        
        devctrl.c
        
        dir.c
        
        errorlog.c
        
        fsctrl.c
        
        internal.c
        
        iodata.c
        
        ioinit.c
        
        iosubs.c
        
        loadunld.c
        
        lock.c
        
        misc.c
        
        objsup.c
        
        open.c
        
        parse.c
        
        qsea.c
        
        qsfs.c
        
        qsinfo.c
        
        read.c
        
        report.c
        
        write.c
      - kd
        
        i386
        
        kdcmsup.c
        
        kdcpuapi.c
        
        kdreboot.c
        
        kdtrap.c
        
        kdapi.c
        
        kdbreak.c
        
        kdcomio.c
        
        kddbgio.c
        
        kdinit.c
        
        kdlock.c
        
        kdmove.c
      - ke
        
        i386
        
        abiosc.c
        
        allproc.c (only in multi-processor build)
        
        apcuser.c
        
        biosc.c
        
        dmpstate.c
        
        exceptn.c
        
        flushtb.c
        
        gdtsup.c
        
        i386init.c
        
        intobj.c
        
        iopm.c
        
        kernlini.c
        
        ldtsup.c
        
        mpipi.c
        
        thredini.c
        
        trapc.c
        
        vdm.c
        
        apcobj.c
        
        apcsup.c
        
        balmgr.c
        
        bugcheck.c
        
        config.c
        
        debug.c
        
        devquobj.c
        
        dpcobj.c
        
        dpcsup.c
        
        eventobj.c
        
        kernldat.c
        
        kiinit.c
        
        miscc.c
        
        mutexobj.c
        
        mutntobj.c
        
        procobj.c
        
        profobj.c
        
        raisexcp.c
        
        reqint.c
        
        semphobj.c
        
        statsobj.c
        
        thredobj.c
        
        thredsup.c
        
        timerobj.c
        
        timersup.c
        
        wait.c
        
        waitsup.c
      - krtl
        
        i386
        
        context.c
        
        exdsptch.c
        
        raisests.c
        
        acledit.c
        
        eballoc.c
        
        environ.c
        
        error.c
        
        gen8dot3.c
        
        gentable.c
        
        heap.c
        
        ldrdebug.c
        
        ldrrsrc.c
        
        message.c
        
        prefix.c
        
        random.c
        
        regutil.c
        
        rtlassig.c
        
        rtlexec.c
        
        sertl.c
        
        splay.c
        
        stktrace.c
      - lpc
        
        lpcclose.c
        
        lpccompl.c
        
        lpcconn.c
        
        lpccreat.c
        
        lpcinit.c
        
        lpclistn.c
        
        lpcpriv.c
        
        lpcquery.c
        
        lpcqueue.c
        
        lpcrecv.c
        
        lpcreply.c
        
        lpcsend.c
      - mm
        
        i386
        
        data386.c
        
        debugsup.c
        
        hypermap.c
        
        init386.c
        
        probewrt.c
        
        acceschk.c
        
        addrsup.c
        
        allocpag.c
        
        allocvm.c
        
        creasect.c
        
        deleteva.c
        
        extsect.c
        
        flushbuf.c
        
        flushsec.c
        
        forksup.c
        
        freevm.c
        
        iosup.c
        
        lockvm.c
        
        mapcache.c
        
        mapview.c
        
        miglobal.c
        
        mmfault.c
        
        mminit.c
        
        mmquota.c
        
        mmsup.c
        
        modwrite.c
        
        pagfault.c
        
        pfndec.c
        
        pfnlist.c
        
        procsup.c
        
        protect.c
        
        querysec.c
        
        queryvm.c
        
        readwrt.c
        
        sectsup.c
        
        shutdown.c
        
        sysload.c
        
        sysptes.c
        
        umapview.c
        
        vadtree.c
        
        wrtfault.c
        
        wslist.c
        
        wsmanage.c
        
        wstree.c
        
        zeropage.c
      - ob
        
        obclose.c
        
        obcreate.c
        
        obdir.c
        
        obhandle.c
        
        obinit.c
        
        obinsert.c
        
        oblink.c
        
        obquery.c
        
        obref.c
        
        obse.c
        
        obtype.c
        
        obwait.c
      - ps
        
        i386
        
        kulookup.c
        
        psctx386.c
        
        psldt.c
        
        psvdm.c
        
        create.c
        
        pscid.c
        
        psctx.c
        
        psdelete.c
        
        psimpers.c
        
        psinit.c
        
        psopen.c
        
        psquery.c
        
        psquota.c
        
        psspnd.c
        
        security.c
      - raw
        
        cleanup.c
        
        close.c
        
        create.c
        
        fileinfo.c
        
        fsctrl.c
        
        rawdisp.c
        
        rawinit.c
        
        readwrit.c
        
        structsup.c
        
        volinfo.c
      - se
        
        accessck.c
        
        adtinit.c
        
        adtlog.c
        
        adtvars.c
        
        capture.c
        
        privileg.c
        
        rmaudit.c
        
        rmlogon.c
        
        rmmain.c
        
        rmvars.c
        
        seassign.c
        
        seastate.c
        
        seaudit.c
        
        seclient.c
        
        seglobal.c
        
        seinit.c
        
        semethod.c
        
        sep.c
        
        sepaudit.c
        
        subject.c
        
        token.c
        
        tokenadj.c
        
        tokendup.c
        
        tokenopn.c
        
        tokenqry.c
        
        tokenset.c
      - vdm
        
        i386
        
        rdwr.c
        
        strtexec.c
        
        vdmentry.c
        
        vdmfault.c
        
        vdminit.c
        
        vdmnpx.c
        
        vdmprint.c
        
        vdm.c
i386
- abiosa.asm
- biosa.asm
- clockint.asm
- cpu.asm
- cpuid.asm
- ctxswap.asm
- debug2.asm
- emv86.asm
- emxcptn.asm
- evpair.asm
- exsup.asm
- i386pcr.asm
- instemul.asm
- int.asm
- intrlock.asm
- intsup.asm
- ioaccess.asm
- kdstr.asm
- largeint.asm
- ldtsup2.asm
- lpcmove.asm
- memmove.asm
- memset.asm
- movemem.asm
- newsysbg.asm
- procstat.asm
- raise.asm (see note)
- spindbg.asm
- spinlock.asm
- splocks.asm
- stkwalk.asm
- stricmp.asm
- strlwr.asm
- strncpy.asm
- strnicmp.asm
- strstr.asm
- strupr.asm
- sysstubs.asm
- systable.asm
- threadbg.asm
- timindex.asm
- trap.asm
- vdmmisc.asm
- vdmop0f.asm
- vdmoprnd.asm
- xcptmisc.asm

Presumably, the i386 is in each case a subdirectory of one of the many subdirectories of D:\nt\private\ntos, but although the particular subdirectories for some can be inferred confidently, I don’t think it can be for all.

Two files are named only as “i386\raise.asm”. They are distinct. They each define only one routine: ExRaiseException and RtlRaiseException. These do eventually become exported functions but in version 3.10 they are internal routines. Almost certainly, these assembly-language source files are in the ex and krtl subdirectories.