I use implib /s /noi ntdll.lib c:\windows\system32\ntdll.dll to get ntdll.lib.

---------------------------------
module  KeServiceDescriptorTable;

import tango.util.log.Trace;
import tango.io.Stdout;
import tango.text.Util;
import tango.sys.win32.Types;
import tango.sys.SharedLib;

struct SERVICE_DESCRIPTOR_TABLE
{
	PVOID ServiceTableBase;
	PULONG ServiceCounterTableBase;
	ULONG NumberOfService;
	ULONG ParamTableBase;
};

alias SERVICE_DESCRIPTOR_TABLE*  PSERVICE_DESCRIPTOR_TABLE;

extern(Windows){
	PSERVICE_DESCRIPTOR_TABLE function() KeServiceDescriptorTable;
}




int main(){
	auto lib = SharedLib.load(`ntdll.dll`);
	if( ! lib ){
		Trace.formatln("load ntdll.dll faild");
		return 0;
	}
	void* ptr = lib.getSymbol("KeServiceDescriptorTable");  // can't get ptr

	return 0;
}

------------------------------------------------------