This should be possible with a simple python script that loads ntdll.dll, iterates the exports and generates ntdll.def. A (potentially) better idea could be to reuse parse_phnt.py from dumpulator and generate the DEF file from the imports actually exposed with that OS version.