InternalBootFlags in the LOADER_PARAMETER_EXTENSION

When Windows 8 introduced a set of InternalBootFlags to the LOADER_PARAMETER_EXTENSION, the interpretation in bits was not explicit. The InternalBootFlags were just a ULONGLONG. The meaningful bits were at first defined by macro. For the 1703 release of Windows 10, Microsoft formalised the interpretation by defining InternalBootFlags in union with a set of ULONGLONG bit fields:

ULONGLONG DbgUtcBootTime : 1;

ULONGLONG DbgRtcBootTime : 1;

ULONGLONG DbgNoLegacyServices : 1;

Microsoft’s macro definitions for these masks are known from the arc.h which Microsoft published with the Windows Driver Kit (WDK) for the original and 1511 releases of Windows 10:

• 0x00000000 as INTERNAL_BOOT_FLAGS_NONE;
• 0x00000001 as INTERNAL_BOOT_FLAGS_UTC_BOOT_TIME;
• 0x00000002 as INTERNAL_BOOT_FLAGS_RTC_BOOT_TIME;
• 0x00000004 as INTERNAL_BOOT_FLAGS_NO_LEGACY_SERVICES.

Curiously, this ARC.H has no definitions of this sort for the otherwise similar BootFlags that were introduced concurrently. Against this, the BootFlags were formalised as bit fields one release earlier, i.e., for Version 1607.