The Windows NT 4.0 Kernel’s Source Tree

Windows NT 4.0 is the last major Windows version for which the publicly available symbol files for the kernel give pathnames for the source files. Windows 2000 moved its debugging support to the Program Database (PDB) format and although it supplied .DBG files also, these do not have IMAGE_SYM_CLASS_FILE records in the COFF symbol table and therefore do not name source files. Though the PDB files for Windows 2000 have an early format, they do have a stream of section contributions. Then, as now, these provide only for associating addresses of routines and variables to object files and libraries. This is not so very different in practice, especially in later versions which give full pathnames, but it is not quite the same as naming the source files. In this sense then, Windows NT 4.0 ended a relative bounty of detail about how the kernel gets built. A bonus, possibly not intended, is that the .DBG files for the Windows NT 4.0 kernel also give line numbers!

As with the Windows NT 3.1 Source Tree, the pathnames as recorded in the .DBG files for Windows NT 4.0 are observed to be fully qualified for source files in C but only relative for assembly-language source files. The ordering of records in the COFF symbol table is much more plain for version 4.0, so that many assembly-language source files can be placed in the source tree with very high confidence. If you browse this page with scripts enabled, then you should be able to expand the branches that interest you and collapse those that don’t.

W:
- NT
  - PRIVATE
    - SDKTOOLS
      - vctools
        
        crt
        
        crtw32
        
        convert
        
        atox.c
        
        isctype.c
        
        iswctype.c
        
        mblen.c
        
        mbstowcs.c
        
        mbtowc.c
        
        tolower.c
        
        toupper.c
        
        towlower.c
        
        towupper.c
        
        wcstombs.c
        
        wctomb.c
        
        xtoa.c
        
        _ctype.c
        
        _mbslen.c
        
        hack
        
        stubs.c
        
        misc
        
        cmiscdat.c
        
        ctype.c
        
        nlsdata1.c
        
        nlsdata2.c
        
        qsort.c
        
        rand.c
        
        startup
        
        crt0fp.c
        
        stdio
        
        _flsbuf.c
        
        _flswbuf.c
        
        fputwc.c
        
        output.c
        
        snprintf.c
        
        snwprintf.c
        
        sprintf.c
        
        swprintf.c
        
        vsnprintf.c
        
        vsprintf.c
        
        woutput.c
        
        string
        
        strlwr.c
        
        strupr.c
        
        wcscat.c
        
        wcschr.c
        
        wcscmp.c
        
        wcscspn.c
        
        wcsicmp.c
        
        wcslen.c
        
        wcslwr.c
        
        wcsncat.c
        
        wcsncmp.c
        
        wcsncpy.c
        
        wcsnicmp.c
        
        wcsnset.c
        
        wcsrchr.c
        
        wcsrev.c
        
        wcsspn.c
        
        wcsstr.c
        
        wcsupr.c
    - lsa
      - client
        
        austub.c
    - ntos
      - cache
        
        cachedat.c
        
        cachesub.c
        
        copysup.c
        
        fssup.c
        
        lazyrite.c
        
        logsup.c
        
        mdlsup.c
        
        pinsup.c
        
        vacbsup.c (NTOS)
      - config
        
        i386
        
        init386.c
        
        cmapi.c
        
        cmapi2.c
        
        cmboot.c
        
        cmchek.c
        
        cmchek2.c
        
        cmclose.c
        
        cmconfig.c
        
        cmcontrl.c
        
        cmdat.c
        
        cmdat2.c
        
        cmdat3.c (NTOS)
        
        cmdatini.c
        
        cmdelete.c
        
        cmgquota.c
        
        cmhvlist.c
        
        cmindex.c
        
        cminit.c
        
        cmname.c
        
        cmnotify.c
        
        cmparse.c
        
        cmparse2.c
        
        cmquery.c
        
        cmsavres.c
        
        cmse.c
        
        cmsubs.c
        
        cmsubs2.c
        
        cmsubs3.c
        
        cmsysini.c
        
        cmtrecpy.c
        
        cmtredel.c
        
        cmtree.c
        
        cmworker.c
        
        cmwrapr.c
        
        cmwrapr2.c
        
        hivebin.c
        
        hivecell.c
        
        hivechek.c
        
        hivefree.c
        
        hiveinit.c
        
        hiveload.c
        
        hivemap.c
        
        hivesum.c
        
        hivesync.c (NTOS)
        
        initdat.c
        
        ntapi.c (NTOS)
      - dbgkd
        
        dbgkport.c
        
        dbgkproc.c
      - ex
        
        i386
        
        evpair.asm
        
        fmutex.asm
        
        intrlfst.asm
        
        intrlock.asm
        
        probe.c
        
        raisests.asm
        
        resoura.asm (only in single-processor build)
        
        splocks.asm
        
        callback.c
        
        dbgctrl.c
        
        ddkresrc.c
        
        delay.c
        
        event.c
        
        eventpr.c
        
        exatom.c
        
        exinit.c (NTOS)
        
        handle.c
        
        harderr.c
        
        lookasid.c
        
        luid.c
        
        mutant.c (NTOS)
        
        pool.c
        
        profile.c
        
        raise.c
        
        resource.c
        
        semphore.c
        
        sysenv.c
        
        sysevent.c
        
        sysinfo.c
        
        systime.c (NTOS)
        
        timer.c
        
        uuid.c
        
        win32.c
        
        worker.c
        
        zone.c
      - fsrtl
        
        dbcsname.c
        
        fastio.c
        
        faulttol.c
        
        filelock.c
        
        filter.c
        
        fsrtlpc.c
        
        largemcb.c
        
        name.c
        
        notify.c
        
        oplock.c
        
        stackovf.c
        
        tunnel.c
        
        unc.c
      - fstub
        
        drivesup.c
        
        halfnc.c
      - init (w:\nt\private\ntos)
        
        init.c
        
        ntkrnlmp.c (only in multi-process build)
        
        ntoskrnl.c
      - io
        
        arcsec.c
        
        assign.c
        
        complete.c
        
        create.c
        
        devctrl.c
        
        dir.c
        
        dumpctl.c
        
        errorlog.c
        
        fsctrl.c
        
        internal.c
        
        iodata.c
        
        ioinit.c
        
        iosubs.c
        
        loadunld.c
        
        lock.c
        
        misc.c
        
        objsup.c
        
        open.c
        
        parse.c
        
        pnpdata.c
        
        pnpinit.c
        
        pnpioapi.c
        
        pnpsubs.c
        
        qsea.c
        
        qsfs.c
        
        qsinfo.c
        
        query.c
        
        read.c
        
        report.c
        
        write.c
      - kd
        
        i386
        
        kdcmsup.c
        
        kdcpuapi.c
        
        kdreboot.c
        
        kdstr.asm
        
        kdtrap.c
        
        kdapi.c
        
        kdbreak.c
        
        kdcomio.c
        
        kddata.c
        
        kddbgio.c
        
        kdinit.c
        
        kdlock.c
        
        kdmove.c
      - ke
        
        i386
        
        abiosa.asm
        
        abiosc.c
        
        allproc.c (only in multi-processor build)
        
        apcuser.c
        
        biosa.asm
        
        biosc.c
        
        callback.c
        
        callout.asm
        
        clockint.asm
        
        cpu.asm
        
        ctxswap.asm
        
        cyrix.c
        
        dmpstate.c
        
        emcxptn.asm
        
        emv86.asm
        
        exceptn.c
        
        flushtb.c
        
        gdtsup.c
        
        i386init.c
        
        i386pcr.asm
        
        instemul.asm
        
        int.asm
        
        intobj.c
        
        intsup.asm
        
        iopm.c
        
        largepag.c
        
        ldtsup.c
        
        ldtsup2.asm
        
        misc.c
        
        mpipia.asm
        
        mtrr.c
        
        newsysbg.asm
        
        procstat.asm
        
        spindbg.asm
        
        spinlock.asm
        
        sysstubs.asm
        
        systable.asm
        
        threadbg.asm
        
        thredini.c
        
        timindex.asm
        
        trap.asm
        
        trapc.c
        
        vdm.c
        
        vmdint21.c
        
        apcobj.c
        
        apcsup.c
        
        balmgr.c
        
        bugcheck.c
        
        channel.c
        
        config.c
        
        debug.c
        
        devquobj.c
        
        dpcobj.c
        
        dpcsup.c
        
        eventobj.c
        
        kernldat.c
        
        kernlini.c
        
        kiinit.c
        
        miscc.c
        
        mutntobj.c
        
        procobj.c
        
        profobj.c
        
        queueobj.c
        
        raisecxp.c
        
        semphobj.c
        
        thredobj.c
        
        thredsup.c
        
        timerobj.c
        
        timersup.c
        
        wait.c
        
        waitsup.c
        
        xipi.c
        
        yield.c
      - lpc
        
        i386
        
        lpcmove.asm
        
        lpccompl.c
        
        lpcconn.c
        
        lpccreat.c
        
        lpclose.c
        
        lpcinit.c
        
        lpclistn.c
        
        lpcpriv.c
        
        lpcquery.c
        
        lpcqueue.c
        
        lpcrecv.c
        
        lpcreply.c
        
        lpcsend.c
      - mm (w:\nt\private\ntos)
        
        i386
        
        data386.c
        
        debugsup.c
        
        hypermap.c
        
        init386.c
        
        setmodfy.c
        
        acceschk.c
        
        addrsup.c
        
        allocpag.c
        
        allocvm.c
        
        creasect.c
        
        deleteva.c
        
        dmpaddr.c
        
        extsect.c
        
        flushbuf.c
        
        flushsec.c
        
        forksup.c
        
        freevm.c
        
        iosup.c
        
        lockvm.c
        
        mapcache.c
        
        mapview.c
        
        miglobal.c
        
        mmfault.c
        
        mminit.c
        
        mmquota.c
        
        mmsup.c
        
        modwrite.c
        
        pagfault.c
        
        pfndec.c
        
        pfnlist.c
        
        procsup.c
        
        protect.c
        
        querysec.c
        
        queryvm.c
        
        readwrt.c
        
        sectsup.c
        
        shutdown.c
        
        sysload.c
        
        sysptes.c
        
        umapview.c
        
        vadtree.c
        
        wrtfault.c
        
        wslist.c
        
        wsmanage.c
        
        wstree.c
        
        zeropage.c
      - ob
        
        obclose.c (NTOS)
        
        obcreate.c
        
        obdir.c
        
        obhandle.c
        
        obinit.c
        
        obinsert.c
        
        oblink.c
        
        obquery.c
        
        obref.c
        
        obsdata.c
        
        obse.c
        
        obtype.c
        
        obwait.c
      - pnp
        
        control.c
        
        devices.c
        
        internal.c
        
        pnpdata.c
        
        pnpevent.c
        
        pnpinit.c
      - po
        
        idle.c
        
        misc.c
        
        postate.c
        
        suspend.c
      - ps
        
        i386
        
        psctx386.c
        
        psldt.c
        
        psvdm.c
        
        create.c
        
        kulookup.c
        
        pscid.c
        
        psctx.c (NTOS)
        
        psdelete.c
        
        psimpers.c
        
        psinit.c
        
        psopen.c
        
        psquery.c
        
        psquota.c
        
        psspnd.c
        
        security.c
      - raw
        
        cleanup.c
        
        close.c
        
        create.c
        
        fileinfo.c
        
        fsctrl.c
        
        rawdisp.c
        
        rawinit.c
        
        readwrit.c
        
        strucsup.c
        
        volinfo.c
      - rtl
        
        i386
        
        context.c
        
        debug2.asm
        
        debug3.c
        
        divlarge.c
        
        exdsptch.c
        
        ioaccess.asm
        
        largeint.asm
        
        lzntx86.asm
        
        movemem.asm
        
        raise.asm
        
        raisests.c
        
        stkwalk.asm
        
        stringsp.asm
        
        xcptmisc.asm
        
        acledit.c
        
        assert.c
        
        atom.c
        
        bitmap.c
        
        checksum.c
        
        cnvint.c
        
        compress.c
        
        debug.c
        
        eballoc.c
        
        environ.c
        
        error.c
        
        excptdbg.c
        
        gen8dot3.c
        
        gentable.c
        
        heap.c
        
        imagedir.c
        
        ldrreloc.c
        
        ldrrsrc.c
        
        lznt1.c
        
        message.c
        
        nls.c
        
        nlsxlat.c
        
        prefix.c
        
        random.c
        
        regutil.c (NTOS)
        
        rtlassig.c
        
        rtldata.c
        
        rtlexec.c
        
        sertl.c
        
        splay.c
        
        stktrace.c
        
        string.c
        
        time.c
      - se
        
        accessck.c
        
        adtinit.c
        
        adtlog.c
        
        adtvars.c
        
        capture.c
        
        privileg.c
        
        rmaudit.c
        
        rmlogon.c
        
        rmmain.c
        
        rmvars.c
        
        seassign.c
        
        seastate.c
        
        seaudit.c
        
        seclient.c
        
        seglobal.c
        
        seinit.c
        
        semethod.c
        
        sep.c
        
        sepaudit.c
        
        subject.c
        
        token.c
        
        tokenadj.c
        
        tokendup.c
        
        tokenopn.c
        
        tokenqry.c
        
        tokenset.c
      - vdm
        
        i386
        
        rdwr.c
        
        strtexec.c
        
        vdmentry.c
        
        vdmfault.c
        
        vdminit.c
        
        vdmints.c
        
        vdmmisc.asm
        
        vdmnpx.c
        
        vdmop0f.asm
        
        vdmoprnd.asm
        
        vdmprint.c
        
        vdm.c
i386
- exsup.asm
- exsup2.asm
- exsup3.asm
- lldiv.asm
- llmul.asm
- llrem.asm
- llshl.asm
- llshr.asm
- memchr.asm
- memcpy.asm
- memmove.asm
- memset.asm
- strcat.asm
- strchr.asm
- strcmp.asm
- stricmp.asm
- strlen.asm
- strncat.asm
- strncmp.asm
- strncpy.asm
- strnicmp.asm
- strnset.asm
- strrchr.asm
- strrev.asm
- strset.asm
- strspn.asm
- strstr.asm
- ulldiv.asm
- ullrem.asm
- ullshr.asm

All the assembly-language source files that are not placed in the tree plainly belong somewhere under W:\NT\PRIVATE\SDKTOOLS\vctools\crt\crtw32, but I see in the symbol files no reasonably sure indication of exactly which subdirectory, and so I leave them unassigned.

For no known reason, the case-independent pathnames are recorded in the symbol files with several variations of case. What’s shown in the tree above is the most common: paths are in upper case as far as the SDKTOOLS subdirectory but not as far as ntos. Exceptions are noted in parentheses. Several files have NTOS in upper case. For several whole directories, all pathnames are wholly in lower case.

Not shown in the tree are 11 source files that are named just as obj\i386\pch_hdr.src. These look to be for the cache, config, ex, fsrtl, io, ke, lpc, mm, ob, pnp and ps subdirectories.

No source files for the kernel are compiled in place. This is because they are all intended to be compiled differently for different purposes. For the source files that the kernel draws from the C Run-Time (CRT), compilation occurs not in the directory that holds the source file but in a subdirectory named nt. For the one source file of material for the Local Security Authority (LSA), the compilation is in a subdirectory named kernel. Each subdirectory of ntos has in turn subdirectories named um and mp for single-processor and multi-processor builds, respectively, and these are the current directories at the time of compilation. This shows in the pathnames as actually recorded in the symbol files: for instance, what the tree above presents as path\source.c is path\up\..\source.c or path\mp\..\source.c in the symbol file.