BLDR_DATA_TABLE_ENTRY

The BLDR_DATA_TABLE_ENTRY (formally _BLDR_DATA_TABLE_ENTRY) is the boot loader’s description of a binary that it loaded in advance of the kernel’s execution. It is here thought to date from version 6.2. In earlier versions, the boot loader uses the same KLDR_DATA_TABLE_ENTRY as does the kernel. Go far enough back and both the boot loader and kernel use the same LDR_DATA_TABLE_ENTRY as does NTDLL.

Documentation Status

Though Microsoft is not known ever to have documented the BLDR_DATA_TABLE_ENTRY, Microsoft has published a C-language definition. This was in a header named arc.h in the Windows Driver Kit (WDK) for the original and 1511 releases of Windows 10. It must be noted, however, that this publication looks for all the world like an accidental disclosure. The header is in a subdirectory (named “minwin”) of a directory named “um” as if for user-mode programming, but the BLDR_DATA_TABLE_ENTRY, if not everything else in the header, is long gone by the time any user-mode code gets to execute. Mistake or not, the header then disappeared from the WDK.

Even while its C-language definitions were published, the BLDR_DATA_TABLE_ENTRY did not appear in public symbol files—not for the kernel, nor in any other symbol files in the downloadable packages of public symbols.

Layout

The BLDR_DATA_TABLE_ENTRY seems not to have changed at all, in terms of its members and definitions, since version 6.2 introduced it by appending members to the KLDR_DATA_TABLE_ENTRY. It is 0x8C and 0xE8 bytes in 32-bit and 64-bit Windows, respectively, at least to the 2004 release of WIndows 10.

Offsets and Microsoft’s definitions are known from the published ARC.H for two releases of Windows. Confirmation for other versions, starting from Windows 8 but ending with the 1903 release of Windows 10, is given by type information in a statically linked library named CLFSMGMT.LIB which Microsoft publishes with the Software Development Kit (SDK).

KLDR_DATA_TABLE_ENTRY KldrEntry;

UNICODE_STRING CertificatePublisher;

UNICODE_STRING CertificateIssuer;

PVOID ImageHash;

PVOID CertificateThumbprint;

ULONG ImageHashAlgorithm;

ULONG ThumbprintHashAlgorithm;

ULONG ImageHashLength;

ULONG CertificateThumbprintLength;

ULONG LoadInformation;

ULONG Flags;

That the following bits are defined for the Flags is known from the published ARC.H:

As for which versions have which flags, this is from inspection of binaries. For whether later releases of Windows 10 define more flags (or even use more), further study is required.