Where the layouts come from
Every layout comes from material Microsoft itself published: its symbol server, its
DDKs and SDKs, its debuggers and its OS media (or archive.org copies of them, pinned by
hash). Nothing comes from leaked source, and nothing is inferred.
Public PDBs
Most builds: the kernel's and ntdll's PDBs from Microsoft's symbol server, which carry
the full type records. These have no tag. Public PDBs carry types from Windows 2000 SP3
on; XP SP2's carry none.
Before public PDBs had types
The NT 3.x and 4.0 debug symbols carry no type records. For those builds, and for the
1991-93 pre-releases, layouts come from other published files. Each layout is tagged
with the kind of source it came from; a build's listing has its full sources, behind
Sources.
- records
- Type records (CodeView) the compiler left in a DDK or SDK library, or in a binary.
Exact, but only for the types that file was compiled with.
- debugger
- The 1991 kernel debuggers carry CodeView 3 types for what they decode. They were
compiled 1-byte packed for their 16-bit host, so the offsets are recomputed with
32-bit alignment.
- The DDK's or SDK's C headers, compiled with Microsoft's layout rules (clang targeting
MSVC, with each architecture's macros) into a PDB that is read like any other.
Checked against NT 4.0's type records on x86, MIPS, Alpha and PowerPC, every offset
matched. A header is the public view: private members can be missing, and kernel
internals are often only declared.
- offsets
- NT 3.51's kernel debugger extensions print
_EPROCESS,
_ETHREAD and _TOKEN members with their offsets. No types,
no sizes. - names
- A checked (debug) build keeps the source text of each
ASSERT. There,
sizeof(X), FIELD_OFFSET(X, m) and a pointer cast
(PX) name a type for certain, so the page shows the name with the
expression as evidence, but no layout. NT declares typedef struct _X {…} X,
so where the text says X the page is _X. - partial
- A build with a gap the other tags don't say, named in one line (hover it).
Opaque
A name a source declares or mentions but never defines (a forward declaration, a
pointer target, a name in a mangled symbol). Its page shows the declaration and the
builds where it does have a layout.
Build numbers
Read from the binaries (the image's build, else the kernel's version), or from a DDK's
version header. Pre-releases without one say no build number.