Geoff Chappell - Software Analyst
The public symbol file NTKRPAMP.PDB for the original release of Windows 10 tells that the kernel is built with the EX.H header at
d:\th\minkernel\ntos\inc
and draws from it the following type definitions:
| Line Number | Type |
|---|---|
| 36 | struct _CALL_HASH_ENTRY |
| 43 | struct _CALL_PERFORMANCE_DATA |
| 273 | enum _PP_NPAGED_LOOKASIDE_NUMBER |
| 510 | enum _EXQUEUEINDEX |
| 518 | struct _EX_WORK_QUEUE |
| 588 | enum _EX_BALANCE_OBJECT |
| 595 | struct _ENODE |
| 744 | struct _HANDLE_TABLE_ENTRY_INFO |
| 833 | union _HANDLE_TABLE_ENTRY |
| 969 | struct _HANDLE_TRACE_DB_ENTRY |
| 981 | struct _HANDLE_TRACE_DEBUG_INFO |
| 1051 | struct _HANDLE_TABLE_FREE_LIST |
| 1071 | struct _HANDLE_TABLE |
| 1948 | struct _EX_FAST_REF |
| 3365 | enum _EX_GEN_RANDOM_DOMAIN |
The header EX.H is not known in any Device Driver Kit (DDK) or Windows Driver Kit (WDK).