The public symbol file NTKRPAMP.PDB for the original release of Windows 10 tells that the kernel is built with the NTKEAPI_X.H header at


and draws from it the type definitions that are shown in the table below.

The header NTKEAPI_X.H is not known in any Device Driver Kit (DDK) or Windows Driver Kit (WDK), but all the types that the kernel is known to pick up from NTKEAPI_X.H are defined in the standard header WDM.H. The line numbers on the left are from the unseen NTKEAPI_X.H but are known from the symbol file. Those on the right are from the WDM.H that is readily available in the WDK for Windows 10.

Line Number Type WDM.H
47 struct _KSYSTEM_TIME 259
147 struct _KSPIN_LOCK_QUEUE 357
152 struct _KLOCK_QUEUE_HANDLE 362
178 enum _KPROFILE_SOURCE 370
214 struct _M128A 404
223 struct _XSAVE_FORMAT 413
255 struct _XSAVE_AREA_HEADER 445
261 struct _XSAVE_AREA 451
266 struct _XSTATE_CONTEXT 456

It is not known whether NTKEAPI_X.H is the source of definitions in WDM.H or whether both pick them up from yet another header, but the former inference is the simpler. If it’s true, then NTKEAPI_X.H is the first known input for generating WDM.H.

Whatever the means of construction, WDM.H is a consistent loser of lines. NTKEAPI_X.H, which Microsoft keeps to itself, has a little more of this material than does WDM.H. What the extra is, let alone whether it’s important, is not easily assessed without an NTKEAPI_X.H for inspection.

Anti-Trust Settlement Forensics

For the record, Microsoft’s possibly accidental inclusion of private symbol files for URLMON.DLL in downloadable packages of public symbol files shows that two more types were accessible to the source code for URLMON.DLL from including NTKEAPI_X.H when building for the original release of 32-bit Windows 10:

Line Number Type
296 struct _CONTEXT_CHUNK
326 struct _CONTEXT_EX

Neither of these types is known from headers that Microsoft publishes for either kernel-mode or user-mode programming by programmers outside Microsoft.