Kernel Versions
Each new name for a Windows package bringsat least a change of the minor version number until contemporaneous client andserver editions are reunited for version 6.0:
File Version | Distribution |
3.51 | Windows NT 3.51 |
4.0 | Windows NT 4.0 |
5.0 | Windows 2000 |
5.1 | Windows XP |
5.2 | Windows Server 2003 |
6.0 | Windows Vista |
6.1 | Windows 7 |
After version 6.0, the next change in theminor version number is a change of name in client ediitions but is just an epithetfor the contemporaneous server edition.
Files
The NT kernel is distributed with eachWindows package in as many as four files:
- NTOSKRNL.EXE, single-processor without PAE;
- NTKRNLMP.EXE, multi-processor without PAE;
- NTKRNLPA.EXE, single-processor with PAE (version 5.0 and higher);
- NTKRPAMP.EXE, multi-processor with PAE (version 5.0 and higher).
An installed system has either thesingle-processor kernels or the multi-processor kernels but not both. If themulti-processor kernels are installed, they are renamed as if for asingle-processor system. Put another way, the single-processor kernels have thestandard names.
The difference concerning Physical AddressExtension (PAE) is mostly a matter of specialising the memory manager to use32-bit or 64-bit page table entries exclusively. Users can select the one orthe other at boot time, through the /PAE and /NOPAE switchesin BOOT.INI or the pae optionin the Boot Configuration Data (BCD). Later versions also allow for selectionof the PAE kernel to be forced by a /NOEXECUTE switch or nx option.
The loader has the standard nameshard-coded. Unless an alternative is specified by a /KERNEL switchor kernel option,the kernel that is loaded is whatever file is named NTOSKRNL.EXE ordinarily orNTKRNLPA.EXE if PAE is wanted.
Builds
The following builds have been inspectedfor these notes. Most are from MSDN discs. Some, especially since Microsoftgreatly reduced its shipment of operating systems on MSDN discs, are fromservice packs downloaded (typically as self-extracting executables) from aMicrosoft website.
Builds are arranged in increasing order ofthe file version as recorded in the executable’s resources. This version numberis readily visible using Windows Explorer either in a so-called infotip for thefile or by accessing the Version tab in the Properties dialog for the file.Programmers know this version number as coming from the so-called root block ofthe version-information resource, specifically from the dwFileVersionMS and dwFileVersionLS membersof a VS_FIXEDFILEINFO structure.
The date stamp shown for each version ismore obscure. File dates are easily modified after the executable is built andare anyway liable to be shown differently when read from different time zones.However, there is in each executable’s header a date stamp which is set whenthe executable is built and which is not commonly changed afterwards. It isreadily accessible to anyone with programming knowledge and appropriate tools,e.g., Microsoft’s own DUMPBIN utility.
File Version | File Header Date Stamp | File Size | Package |
3.51.1025.1 | 2FC653BC (27th May 1995) | 804,864 | Windows NT 3.51 |
3.51.1057.6 | 321A03D2 (21st August 1996) | 809,488 | Windows NT 3.51 SP5 |
4.0.1381.1 | 3255A915 (5th October 1996) | 868,288 | Windows NT 4.0 |
4.0.1381.4 | 337546BF (11th May 1997) | 914,688 | Windows NT 4.0 SP3 |
4.0.1381.133 | 36224CDA (13th October 1998) | 927,552 | Windows NT 4.0 SP4 |
4.0.1381.204 | 371CD681 (21st April 1999) | 928,576 | Windows NT 4.0 SP5 |
4.0.1381.335 | 37E8005B (22nd September 1999) | 931,584 | Windows NT 4.0 SP6 |
5.0.2195.1 | 384D9B17 (8th December 1999) | 1,640,976 | Windows 2000 |
5.0.2195.1620 | 39760637 (20th July 2000) | 1,702,800 | Windows 2000 SP1 |
5.0.2195.5438 | 3D366B8B (18th July 2002) | 1,712,720 | Windows 2000 SP3 |
5.0.2195.6717 | 3EE6C002 (11th June 2003) | 1,719,056 | Windows 2000 SP4 |
5.1.2600.0 | 3B7DE38F (18th August 2001) | 1,982,208 | Windows XP |
5.1.2600.1106 | 3D6DE35C (29th August 2002) | 2,042,240 | Windows XP SP1 |
5.1.2600.2180 | 41108004 (4th August 2004) | 2,180,992 | Windows XP SP2 |
5.1.2600.5512 | 48025EAB (14th April 2008) | 2,188,928 | Windows XP SP3 |
5.2.3790.0 | 3E800A79 (25th March 2003) | 2,201,600 | Windows Server 2003 |
5.2.3790.1830 | 42435E33 (25th March 2005) | 2,414,592 | Windows Server 2003 SP1 |
5.2.3790.3959 | 45D6A072 (17th February 2007) | 2,430,464 | Windows Server 2003 SP2 |
6.0.6000.16386 | 4549AD6C (2nd November 2006) | 3,467,880 | Windows Vista |
6.0.6001.18000 | 47918B0A (19th January 2008) | 3,548,728 | Windows Vista SP1, Windows Server 2008 |
6.0.6002.18005 | 49E01996 (11th April 2009) | 3,549,672 | Windows Vista SP2 |
6.1.7600.16385 | 4A5BBFFC (14th July 2009) | 3,899,472 | Windows 7 |
6.1.7601.17514 | 4CE78A06 (20th November 2010) | 3,911,040 | Windows 7 SP1 |
The kernel files for each build are listedin the order: NTOSKRNL.EXE, NTKRNLMP.EXE, NTKRNLPA.EXE, NTKRPAMP.EXE. Versionsbefore 5.0 have only NTOSKRNL.EXE and NTKRNLMP.EXE. Versions from 6.0 onwardsare built with both single-processor and multi-processor kernels in the samepattern as for earlier versions, but the installation image on the distributionmedia has only the multi-processor kernels, and these are already renamed toNTOSKRNL.EXE and NTKRNLPA.EXE.
A self-extracting executable for Windows2000 SP2 has been inspected for these notes but no kernels were found.
Each kernel in Windows Server 2008 is thesame as in Windows Vista SP1, byte for byte.
64-Bit Windows
Microsoft’s distribution of 64-bit Windowson MSDN discs is even less reliable than is my renewal of subscriptions. I seemnever to have received a 64-bit edition of Windows XP, which is therefore notincluded in this study. Though correspondents tell me that 64-bit Windows Vistawas readily available the moment that Windows Vista was released, my experienceis instead that an MSDN subscription in 2007 produced no x64 build of theoriginal Windows Vista. The copy inspected of that is from an OEM disc. Thoughall service-pack builds that have been inspected for this study are availablethrough an MSDN subscription, the copies studied have instead been downloadedas self-extracting executables from Microsoft’s free websites since, for whoknows what reason, the MSDN site that I pay for is intolerably slow—not that mytolerance is high, given that Microsoft leaves me to the tedium of burningdisks and labelling them and has the nerve to tell me that doing so isenvironmentally friendly.
File Version | File Header Date Stamp | File Size | Package |
5.2.3790.1830 | 42436096 (25th March 2005) | 4,443,648 | Windows Server 2003 SP1 |
5.2.3790.3959 | 45D69A26 (17th February 2007) | 4,496,896 | Windows Server 2003 SP2 |
6.0.6000.16386 | 4549B6C6 (2nd November 2006) | 4,420,712 | Windows Vista |
6.0.6001.18000 | 479192B7 (19th January 2008) | 4,694,072 | Windows Vista SP1, Windows Server 2008 |
6.0.6002.18005 | 49E0237F (11th April 2009) | 4,699,608 | Windows Vista SP2 |
6.1.7600.16385 | 4A5BC600 (14th July 2009) | 5,511,248 | Windows 7, Windows Server 2008 R2 |
6.1.7601.17514 | 4CE7951A (20th November 2010) | 5,563,776 | Windows 7 SP1, Windows Server 2008 R2 SP1 |
The kernels for each build are listed inthe order: NTOSKRNL.EXE, NTKRNLMP.EXE. Versions from 6.0 onwards are built withboth single-processor and multi-processor kernels, but the installation imageon the distribution media has only a multi-processor kernel, which is alreadyrenamed to NTOSKRNL.EXE.
Where two packages are shown for the samebuild, the executables are identical. This identity is formalised for Windows 7SP1 and Windows Server 2008 R2 SP1 since Microsoft provides the oneself-extracting executable for both product names.
Some Microsoft documentation, e.g., ofthe KeAcquireSpinLockRaiseToDpc function in the Windows DriverKit (WDK) version 7600.16385.0 for Windows 7, talks of “64-bit versions ofWindows 2000” but Idon’t believe the MSDN site has ever listed such things even as being availableto download.
http://www.geoffchappell.com/studies/windows/km/ntoskrnl/history/index.htm