Geoff Chappell - Software Analyst
The public symbol file HALMACPI.PDB for the original release of Windows 10 tells that the HAL is built with the INTRUPTP.H header at
d:\th\minkernel\hals\inc
and draws from it the type definitions that are tabulated below. No header named NTSOC.H is known in any Device Driver Kit (DDK) or Windows Driver Kit (WDK).
Line numbers in the left column are from the unseen NTSOC.H for the original Windows 10, as read from the HAL’s public symbols.
| Line Number | Type |
|---|---|
| 241 | enum _KNOWN_CONTROLLER_TYPE |
| 277 | enum _INTERRUPT_TARGET_TYPE |
| 300 | enum _INTERRUPT_RESULT |
| 1139 | struct _INTERRUPT_FUNCTION_TABLE |
| 1354 | struct _INTERRUPT_LINE |
| 1462 | struct _INTERRUPT_TARGET |
| 1472 | unnamed struct HypervisorTarget in struct _INTERRUPT_TARGET |
| 1512 | struct _INTERRUPT_LINE_STATE |
That this is a complete account of types that are defined in NTSOC.H looks unlikely. Much more plausible is that the public symbols would have nothing at all from NTSOC.H except that these types are selected because of _REGISTERED_INTERRUPT_CONTROLLER in intruptp.h. Put aside what gets this structure into the public symbols. It’s enough to bring in all the above. The _INTERRUPT_FUNCTION_TABLE and the _KNOWN_CONTROLLER_TYPE are directly nested. The first of these then brings in _INTERRUPT_TARGET, _INTERRUPT_RESULT, _INTERRUPT_LINE and _INTERRUPT_LINE_STATE, and the first of those brings in _INTERRUPT_TARGET_TYPE. Thus is the whole selection explained as incidental and possibly as unintended.