Geoff Chappell, Software Analyst
The public symbol file NTKRPAMP.PDB for the original release of Windows 10 tells that the kernel is built with the NTIMAGE.H header at
d:\th.public.fre\ddk\inc
and draws from it the following type definitions:
Line Number | Type |
---|---|
67 | struct _IMAGE_DOS_HEADER |
184 | struct _IMAGE_FILE_HEADER |
248 | struct _IMAGE_DATA_DIRECTORY |
259 | struct _IMAGE_OPTIONAL_HEADER |
302 | struct _IMAGE_ROM_OPTIONAL_HEADER |
371 | struct _IMAGE_NT_HEADERS |
517 | struct _IMAGE_SECTION_HEADER |
519 | unnamed union Misc in _IMAGE_SECTION_HEADER |
1843 | struct _IMAGE_DEBUG_DIRECTORY |
1979 | struct _NON_PAGED_DEBUG_INFO |
2083 | enum ReplacesCorHdrNumericDefines |
The header NTIMAGE.H has long been supplied with the publicly available Device Driver Kit (DDK) and Windows Driver Kit (WDK).