Chore (Windows): removes unnecessary headers

src/common/impl/processing_windows.c

@@ -7,7 +7,6 @@
 #include <stdalign.h>
 #include <windows.h>
 #include <ntstatus.h>
-#include <winternl.h>
 
 enum { FF_PIPE_BUFSIZ = 8192 };
 

src/common/windows/nt.h

@@ -1,5 +1,6 @@
 #pragma once
 
+#include <ntdef.h>
 #include <winternl.h>
 #include <winnt.h>
 #include <stdint.h>
@@ -437,6 +438,12 @@ typedef struct _KSYSTEM_TIME
     LONG High2Time;
 } KSYSTEM_TIME, *PKSYSTEM_TIME;
 
+/**
+ * PROCESSOR_FEATURE_MAX defines the maximum number of processor feature flags
+ * that may be reported by the system.
+ */
+#define PROCESSOR_FEATURE_MAX 64
+
 /**
  * The KUSER_SHARED_DATA structure contains information shared with user-mode.
  *
@@ -489,6 +496,142 @@ typedef struct _KUSER_SHARED_DATA
 
     WCHAR NtSystemRoot[260];
 
+    //
+    // Maximum stack trace depth if tracing enabled.
+    //
+
+    ULONG MaxStackTraceDepth;
+
+    //
+    // Crypto exponent value.
+    //
+
+    ULONG CryptoExponent;
+
+    //
+    // Time zone ID.
+    //
+
+    ULONG TimeZoneId;
+
+    //
+    // Minimum size of a large page on the system, in bytes.
+    //
+    // N.B. Returned by GetLargePageMinimum() function.
+    //
+
+    ULONG LargePageMinimum;
+
+    //
+    // This value controls the Application Impact Telemetry (AIT) Sampling rate.
+    //
+    // This value determines how frequently the system records AIT events,
+    // which are used by the Application Experience and compatibility
+    // subsystems to evaluate application behavior, performance, and
+    // potential compatibility issues.
+    //
+    // Lower values increase sampling frequency, while higher values reduce it.
+    // The kernel updates this field as part of its internal telemetry and
+    // heuristics logic.
+    //
+
+    ULONG AitSamplingValue;
+
+    //
+    // This value controls Application Compatibility (AppCompat) switchback processing.
+    //
+
+    union
+    {
+        ULONG AppCompatFlag;
+        struct
+        {
+            ULONG SwitchbackEnabled : 1;    // Basic switchback processing
+            ULONG ExtendedHeuristics : 1;   // Extended switchback heuristics
+            ULONG TelemetryFallback : 1;    // Telemetry-driven fallback
+            ULONG Reserved : 29;
+        } AppCompatFlags;
+    };
+
+    //
+    // Current Kernel Root RNG state seed version
+    //
+
+    ULONGLONG RNGSeedVersion;
+
+    //
+    // This value controls assertion failure handling.
+    //
+    // Historically (prior to Windows 10), this value was also used by
+    // Code Integrity (CI), AppLocker, and related security components to
+    // determine the minimum validation requirements for executable images,
+    // drivers, and privileged operations.
+    //
+    // In modern Windows versions, this field is used primarily by the kernel's
+    // diagnostic and validation infrastructure to decide how assertion failures
+    // should be handled (e.g., logging, debugger break-in, or bugcheck).
+
+    ULONG GlobalValidationRunlevel;
+
+    //
+    // Monotonic stamp incremented by the kernel whenever the system's
+    // time zone bias value changes.
+    //
+    // N.B. This field must be accessed via the RtlGetSystemTimeAndBias API for
+    //      an accurate result.
+    // This value is read before and after accessing the bias fields to determine
+    // whether the time zone data changed during the read. If the stamp differs,
+    // the caller must re-read the bias values to ensure consistency.
+    //
+
+    volatile LONG TimeZoneBiasStamp;
+
+    //
+    // The shared collective build number undecorated with C or F.
+    // GetVersionEx hides the real number
+    //
+
+    ULONG NtBuildNumber;
+
+    //
+    // Product type.
+    //
+    // N.B. This field must be accessed via the RtlGetNtProductType API for
+    //      an accurate result.
+    //
+
+    NT_PRODUCT_TYPE NtProductType;
+    BOOLEAN ProductTypeIsValid;
+    BOOLEAN Reserved0[1];
+
+    //
+    // Native hardware processor architecture of the running system.
+    //
+    // N.B. User-mode components read this field to determine the true system
+    // architecture, especially in WOW64 scenarios where the process architecture
+    // differs from the native one.
+    //
+
+    USHORT NativeProcessorArchitecture;
+
+    //
+    // The NT Version.
+    //
+    // N. B. Note that each process sees a version from its PEB, but if the
+    //       process is running with an altered view of the system version,
+    //       the following two fields are used to correctly identify the
+    //       version
+    //
+
+    ULONG NtMajorVersion;
+    ULONG NtMinorVersion;
+
+    //
+    // Processor features.
+    //
+
+    BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];
+
     // ... more fields follow, but we don't need them
 } KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;
 

src/detection/battery/battery_windows.c

@@ -11,7 +11,6 @@
 #include <batclass.h>
 #include <devguid.h>
 #include <cfgmgr32.h>
-#include <winternl.h>
 
 static const char* detectWithCmApi(FFBatteryOptions* options, FFlist* results)
 {

src/detection/bootmgr/bootmgr_windows.c

@@ -3,7 +3,6 @@
 #include "common/io.h"
 #include "common/windows/nt.h"
 
-#include <ntdef.h>
 #include <windows.h>
 
 const char* enablePrivilege(const wchar_t* privilege)

src/detection/keyboard/keyboard_windows.c

@@ -5,7 +5,6 @@
 #include "common/mallocHelper.h"
 #include "common/windows/unicode.h"
 
-#include <winternl.h>
 #include <windows.h>
 #include <hidsdi.h>
 #include <cfgmgr32.h>

src/detection/mouse/mouse_windows.c

@@ -5,7 +5,6 @@
 #include "common/mallocHelper.h"
 #include "common/windows/unicode.h"
 
-#include <winternl.h>
 #include <windows.h>
 #include <hidsdi.h>
 #include <cfgmgr32.h>

src/detection/swap/swap_windows.c

@@ -1,5 +1,4 @@
 #include "swap.h"
-#include "common/mallocHelper.h"
 #include "common/windows/unicode.h"
 
 #include <winternl.h>

src/detection/wm/wm_windows.c

@@ -10,7 +10,6 @@
 #include <stdalign.h>
 #include <windows.h>
 #include <ntstatus.h>
-#include <winternl.h>
 #include <shlobj.h>
 #include <softpub.h>