Geoff Chappell, Software Analyst
Each new name for a Windows package brings at least a change of the minor version number for the kernel until contemporaneous client and server editions are reunited for version 6.0:
File Version | Distribution |
---|---|
3.51 | Windows NT 3.51 |
4.0 | Windows NT 4.0 |
5.0 | Windows 2000 |
5.1 | Windows XP |
5.2 | Windows Server 2003 |
6.0 | Windows Vista Windows Server 2008 |
6.1 | Windows 7 Windows Server 2008 R2 |
6.2 | Windows 8 |
6.3 | Windows 8.1 |
10.0 | Windows 10 |
It is not often enough appreciated enough that although Windows XP and Windows Server 2003 were largely contemporaneous, they were significantly different at kernel-level. Just as much under-appreciated is that although Windows Vista and Windows Server 2008 were marketed as very different, being for use as client and server respectively, their kernels are exactly one and the same.
The version numbering gets arguably quirky for Windows Vista, Windows 7, Windows 8 and Windows 8.1. These were each in their time promoted as a significant—even major—release, yet they all have the same major version number which anyway isn’t in any of the names. As if to acknowledge this as unsatisfactory, the major version number for Windows 10 actually is 10.
The NT Operating System Kernel (NTOSKRNL) is distributed with each Windows package in as many as four files:
The difference concerning Physical Address Extension (PAE) applies only to 32-bit (x86) builds. It is mostly a matter of specialising the memory manager to use 32-bit or 64-bit page table entries exclusively. In most versions, users can select the one or the other at boot time, through the /PAE and /NOPAE switches in BOOT.INI or the pae option in the Boot Configuration Data (BCD). Later versions also allow for selection of the PAE kernel to be forced by a /NOEXECUTE switch or nx option.
An installed system has either the single-processor kernels or the multi-processor kernels but not both. If the multi-processor kernels are installed, they are renamed to NTOSKRNL.EXE and NTKRNLPA.EXE as if for a single-processor system. Starting with version 6.2, an installed system has only the multi-processor PAE kernel but renamed to NTOSKRNL.EXE.
Put another way, the kernel’s standard name is NTOSKRNL.EXE, except that where the kernel may be installed both with and without support for PAE, the kernel has the two standard names NTOSKRNL.EXE and NTKRNLPA.EXE. In the versions that install both, the loader has the two standard names hard-coded. All versions can be directed to load an alternative as specified by a /KERNEL switch or kernel option.
The following 32-bit (x86) builds have been inspected for these notes. Most are from MSDN discs. Some, especially since Microsoft greatly reduced its shipment of operating systems on MSDN discs, are from service packs downloaded (typically as self-extracting executables) from a Microsoft website.
Builds are arranged in increasing order of the file version as recorded in the executable’s resources. This version number is readily visible using Windows Explorer either in a so-called infotip for the file or by accessing the Version tab in the Properties dialog for the file. Programmers know this version number as coming from the so-called root block of the version-information resource, specifically from the dwFileVersionMS and dwFileVersionLS members of a VS_FIXEDFILEINFO structure.
The date stamp shown for each version is more obscure. File dates are easily modified after the executable is built and are anyway liable to be shown differently when read from different time zones. However, there is in each executable’s header a date stamp which is set when the executable is built and which is not commonly changed afterwards. It is readily accessible to anyone with programming knowledge and appropriate tools, e.g., Microsoft’s own DUMPBIN utility.
The kernel files for each build are listed in the order: NTOSKRNL.EXE, NTKRNLMP.EXE, NTKRNLPA.EXE, NTKRPAMP.EXE. Not all versions have all four. Versions before 5.0 have only NTOSKRNL.EXE and NTKRNLMP.EXE. Versions from 6.0 onwards are built with both single-processor and multi-processor kernels in the same pattern as for earlier versions, but the installation image on the distribution media has only the multi-processor kernels, and these are already renamed to NTOSKRNL.EXE and NTKRNLPA.EXE. Version 6.2 and higher have only the multi-processor PAE kernel, already renamed to NTOSKRNL.EXE.
File Version | File Header Date Stamp | File Size | Package |
---|---|---|---|
3.51.1025.1 | 2FC653BC (27th May 1995) 2FC653E6 |
804,864 816,592 |
Windows NT 3.51 |
3.51.1057.6 | 321A03D2 (21st August 1996) 321A03F0 |
809,488 821,296 |
Windows NT 3.51 SP5 |
4.0.1381.1 | 3255A915 (5th October 1996) 3255A937 |
868,288 884,928 |
Windows NT 4.0 |
4.0.1381.4 | 337546BF (11th May 1997) 337546EF |
914,688 934,016 |
Windows NT 4.0 SP3 |
4.0.1381.133 | 36224CDA (13th October 1998) 36224D24 |
927,552 947,584 |
Windows NT 4.0 SP4 |
4.0.1381.204 | 371CD681 (21st April 1999) 371CD6A1 |
928,576 948,544 |
Windows NT 4.0 SP5 |
4.0.1381.335 | 37E8005B (22nd September 1999) 37E80077 |
931,584 951,808 |
Windows NT 4.0 SP6 |
5.0.2195.1 | 384D9B17 (8th December 1999) 384D5A76 384D5A86 384D5A97 |
1,640,976 1,611,712 1,611,840 1,632,000 |
Windows 2000 |
5.0.2195.1620 | 39760637 (20th July 2000) 3975DFDF 3975DFFA 3975DFFA |
1,702,800 1,677,696 1,677,760 1,698,304 |
Windows 2000 SP1 |
5.0.2195.5438 | 3D366B8B (18th July 2002) 3D362A77 3D362A90 3D362A99 |
1,712,720 1,687,552 1,687,360 1,707,904 |
Windows 2000 SP3 |
5.0.2195.6717 | 3EE6C002 (11th June 2003) 3EE650B3 3EE650C9 3EE650CD |
1,719,056 1,694,976 1,694,080 1,715,008 |
Windows 2000 SP4 |
5.1.2600.0 | 3B7DE38F (18th August 2001) 3B7DC674 3B7D82F5 3B7D82F9 |
1,982,208 1,897,984 1,896,704 1,869,824 |
Windows XP |
5.1.2600.1106 | 3D6DE35C (29th August 2002) 3D6DD59C 3D6DD59C 3D6DD59C |
2,042,240 1,891,840 1,947,904 1,920,512 |
Windows XP SP1 |
5.1.2600.2180 | 41108004 (4th August 2004) 41107FAA 41107B0C 41107B0D |
2,180,992 2,148,352 2,056,832 2,015,232 |
Windows XP SP2 |
5.1.2600.5512 | 48025EAB (14th April 2008) 48025DE7 4802516A 4802516A |
2,188,928 2,145,280 2,065,792 2,023,936 |
Windows XP SP3 |
5.2.3790.0 | 3E800A79 (25th March 2003) 3E8015C6 3E800012 3E800013 |
2,201,600 2,401,792 2,062,848 2,105,344 |
Windows Server 2003 |
5.2.3790.1830 | 42435E33 (25th March 2005) 42435E60 42435B14 42435B14 |
2,414,592 2,452,480 2,266,624 2,306,560 |
Windows Server 2003 SP1 |
5.2.3790.3959 | 45D6A072 (17th February 2007) 45D6A0AF 45D69710 45D69710 |
2,430,464 2,469,888 2,280,960 2,321,408 |
Windows Server 2003 SP2 |
6.0.6000.16386 | 4549AD6C (2nd November 2006) 4549AE00 |
3,467,880 3,502,184 |
Windows Vista |
6.0.6001.18000 | 47918B0A (19th January 2008) 47918B12 |
3,548,728 3,600,440 |
Windows Vista SP1, Windows Server 2008 |
6.0.6002.18005 | 49E01996 (11th April 2009) 49E0199E |
3,549,672 3,601,896 |
Windows Vista SP2 |
6.1.7600.16385 | 4A5BBFFC (14th July 2009) 4A5BC007 |
3,899,472 3,954,768 |
Windows 7 |
6.1.7601.17514 | 4CE78A06 (20th November 2010) 4CE78A09 |
3,911,040 3,966,848 |
Windows 7 SP1 |
6.2.9200.16384 | 5010ADF0 (25th July 2012) | 5,563,120 | Windows 8 |
6.3.9600.16384 | 52157309 (21st August 2013) | 5,757,792 | Windows 8.1 |
6.3.9600.17031 | 53085A16 (22nd February 2014) | 5,786,968 | Windows 8.1 With Update |
10.0.10240.16384 | 559F3E62 (9th July 2015) | 6,263,648 | Windows 10 |
A self-extracting executable for Windows 2000 SP2 has been inspected for these notes but no kernels were found.
Each kernel in Windows Server 2008 is the same as in Windows Vista SP1, byte for byte.
Microsoft’s distribution of 64-bit Windows on MSDN discs is even less reliable than is my renewal of subscriptions. I seem never to have received a 64-bit edition of Windows XP, which is therefore not included in this study. Though correspondents tell me that 64-bit Windows Vista was readily available the moment that Windows Vista was released, my experience is instead that an MSDN subscription in 2007 produced no x64 build of the original Windows Vista. The copy inspected of that is from an OEM disc. Though all service-pack builds that have been inspected for this study are available through an MSDN subscription, the copies studied have instead been downloaded as self-extracting executables from Microsoft’s free websites since, for who knows what reason, the MSDN site that I pay for is intolerably slow—not that my tolerance is high, given that Microsoft leaves me to the tedium of burning disks and labelling them and has the nerve to tell me that doing so is environmentally friendly.
The kernels for each build are listed in the order: NTOSKRNL.EXE, NTKRNLMP.EXE. Not all versions have both. Versions from 6.0 onwards are built with both single-processor and multi-processor kernels, but the installation image on the distribution media has only a multi-processor kernel, which is already renamed to NTOSKRNL.EXE.
File Version | File Header Date Stamp | File Size | Package |
---|---|---|---|
5.2.3790.1830 | 42436096 (25th March 2005) 42436123 |
4,443,648 4,416,000 |
Windows Server 2003 SP1 |
5.2.3790.3959 | 45D69A26 (17th February 2007) 45D69AB4 |
4,496,896 4,566,528 |
Windows Server 2003 SP2 |
6.0.6000.16386 | 4549B6C6 (2nd November 2006) | 4,420,712 | Windows Vista |
6.0.6001.18000 | 479192B7 (19th January 2008) | 4,694,072 | Windows Vista SP1, Windows Server 2008 |
6.0.6002.18005 | 49E0237F (11th April 2009) | 4,699,608 | Windows Vista SP2 |
6.1.7600.16385 | 4A5BC600 (14th July 2009) | 5,511,248 | Windows 7, Windows Server 2008 R2 |
6.1.7601.17514 | 4CE7951A (20th November 2010) | 5,563,776 | Windows 7 SP1, Windows Server 2008 R2 SP1 |
6.2.9200.16384 | 5010AC4B (25th July 2012) | 6,969,584 | Windows 8 |
6.3.9600.16384 | 5215D156 (22nd August 2013) | 7,416,160 | Windows 8.1 |
6.3.9600.17031 | 53085AF2 (22nd February 2014) | 7,425,368 | Windows 8.1 With Update |
10.0.10240.16384 | 559F3C1A (9th July 2015) | 8,020,832 | Windows 10 |
Where two packages are shown for the same build, the executables are identical. This identity is formalised for Windows 7 SP1 and Windows Server 2008 R2 SP1 since Microsoft provides the one self-extracting executable for both product names.
Some Microsoft documentation, e.g., of the KeAcquireSpinLockRaiseToDpc function in the Windows Driver Kit (WDK) version 7600.16385.0 for Windows 7, talks of “64-bit versions of Windows 2000” but I don’t believe the MSDN site has ever listed such things even as being available to download.