Geoff Chappell - Software Analyst
The public symbol file NTKRPAMP.PDB for the original release of Windows 10 tells that the kernel is built with the WOW64T.H header at
d:\th.public.fre\internal\sdk\inc\minwin
and draws from it the following type definitions:
| Line Number | Type |
|---|---|
| 163 | enum _WOW64_SHARED_INFORMATION |
| 354 | struct _GDI_TEB_BATCH32 |
| 362 | struct _GDI_TEB_BATCH64 |
| 384 | struct _CLIENT_ID32 |
The header WOW64T.H is published in the “minwin” directory of the Windows Driver Kit (WDK) for Windows 10 in the original and Version 1511 editions. This publication was almost certainly an oversight. Most headers in this directory do not compile without error, some for having a #include of a header that is not supplied with the kit (or is known ever to have been published), others for referring to types that are not defined in any other header that is supplied with the kit. Still, published it is. For the original release of Windows 10 in particular, the published WOW64T.H is thus kown to define more types than are revealed in any of the symbol files in the downloadable packages of public symbols for the same release:
| Line Number | Type | Unconventional Type Definition |
|---|---|---|
| 86 | struct _ChildProcessInfo | WOW64_CHILD_PROCESS_INFO |
| 163 | enum _WOW64_SHARED_INFORMATION | |
| 201 | enum _WOW64_TURBO_SERVICE_TYPE | |
| 238 | union _TURBO_THUNK_DESCRIPTION | |
| 239 | anonymous struct in union _TURBO_THUNK_DESCRIPTION |
|
| 275 | union _WOW64_EXECUTE_OPTIONS | |
| 279 | anonymous struct in union _WOW64_EXECUTE_OPTIONS |
|
| 327 | struct _CONTEXT32_RECORD_ENTRY | |
| 335 | struct _CONTEXT32_UPDATE | |
| 342 | struct _PEB_LDR_DATA32 | |
| 354 | struct _GDI_TEB_BATCH32 | |
| 362 | struct _GDI_TEB_BATCH64 | |
| 370 | struct _Wx86ThreadState32 | WX86THREAD32 |
| 377 | struct _Wx86ThreadState64 | WX86THREAD64 |
| 384 | struct _CLIENT_ID32 | |
| 393 | struct _CLIENT_ID64 | |
| 421 | struct _WOW64INFO | |
| 433 | struct _PEB32_WITH_WOW64INFO |
No reason is yet known that of all these types that are defined in WOW64T.H, only the same four show in public symbol files for the kernel and NTDLL and even the private symbols for OLE32.