Geoff Chappell - Software Analyst
As the kernel’s footprint in user mode, NTDLL.DLL is essential to the Windows NT architecture from the start. Major version 4, however, is shared with the 32-bit Windows that runs on DOS. Only in the NT versions of Windows is NTDLL.DLL a substantial executable.
| File Version | Distribution | |
|---|---|---|
| Windows | NT | |
| 3.10 | Windows NT 3.10 | |
| 3.50 | Windows NT 3.50 | |
| 3.51 | Windows NT 3.51 | |
| 4.0 | Windows 95 | Windows NT 4.0 |
| 4.10 | Windows 98 | |
| 4.90 | Windows Me | |
| 5.0 | Windows 2000 | |
| 5.1 | Windows XP | |
| 5.2 | Windows Server 2003 | |
| 6.0 | Windows Vista Windows Server 2008 |
|
| 6.1 | Windows 7 Windows Server 2008 R2 |
|
| 6.2 | Windows 8 | |
| 6.3 | Windows 8.1 | |
| 10.0 | Windows 10 | |
Until version 6.0 reunified client and server editions under different product names, each new name for a Windows package brought at least a change of the minor version number. (Yes, that should be unremarkable, but compare with DLLs from the Windows Shell, some of which kept to one version number for all of Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008.)
The version numbering gets indisputably quirky for Windows Vista, Windows 7, Windows 8 and Windows 8.1. These were each in their time promoted as a significant—even major—release, yet they all have the same major version number which anyway isn’t in any of the names. As if to acknowledge this as unsatisfactory, the major version number for Windows 10 leaps ahead to 10.
The following builds have been inspected for these notes. Most are from MSDN discs. Some, especially since Microsoft greatly reduced its shipment of operating systems on MSDN discs, are from service packs downloaded (typically as self-extracting executables) from a Microsoft website.
Special mention must be made of the very oldest builds. Even among the many discs that I retain from MSDN subscriptions in the mid-1990s, what was then the new Windows that is entirely its own operating system rather than a large DOS program goes no further back than Windows NT 3.51. For all practical effect, Microsoft informally disowned the early versions, even for its so-called Archive editions. For decades I had little choice but to treat Windows NT 3.51 as the dawn of time for these notes. In 2017 someone pointed me to an online collection of earlier builds. The sample is inevitably incomplete. The provenance is unknown. I have since sought more: the WinWorld online museum is notable.
Builds are arranged in increasing order of the file version as recorded in the executable’s resources. This version number is readily visible using Windows Explorer either in a so-called infotip for the file or by accessing the Version tab in the Properties dialog for the file. Programmers know this version number as coming from the so-called root block of the version-information resource, specifically from the dwFileVersionMS and dwFileVersionLS members of a VS_FIXEDFILEINFO structure.
The date stamp shown for each version is more obscure. File dates are easily modified after the executable is built and are anyway liable to be shown differently when read from different time zones. However, there is in each executable’s header a date stamp which is set when the executable is built and which is not commonly changed afterwards. It is readily accessible to anyone with programming knowledge and appropriate tools, e.g., Microsoft’s own DUMPBIN utility.
Any study worth making of Windows—and please remember that the list below exists only as a catalogue of which builds I have obtained for study—is much too intensive to cover pre-release builds, hot fixes and other updates. Access to pre-release builds anyway tends to come with constraints and compromise that other researchers may tolerate (and even be happy with) but which I do not. None of this work is done with any sort of assistance from Microsoft beyond the binaries, as published by the tens and even hundreds of millions, and the same documentation that’s available to all Windows programmers.
For the versions of Windows that runs on MS-DOS, NTDLL exists only as a small collection of stub functions, and might more usefully be considered a different executable.
| File Version | File Header Date Stamp | File Size | Package |
|---|---|---|---|
| 3.10.497.1 | 2C4F15D7 (22nd July 1993) | 264,676 | Windows NT 3.10 Advanced Server Windows NT 3.10 Workstation |
| 3.10.511.1 | 2DA1DF9B (5th April 1994) | 264,660 | Windows NT 3.10 SP3 |
| 3.50.800.1 | 2E67E68D (2nd September 1994) | 269,120 | Windows NT 3.50 |
| 3.50.807.1 | 2FCE52C7 (1st June 1995) | 267,072 | Windows NT 3.50 SP3 |
| 3.51.1025.1 | 2FC3AE99 (25th May 1995) | 307,088 | Windows NT 3.51 |
| 3.51.1057.3 | 3061C531 (21st September 1995) | 307,088 | Windows NT 3.51 SP2 Windows NT 3.51 SP3 |
| 3.51.1057.4 | 30D0DB93 (14th December 1995) | 307,088 | Windows NT 3.51 SP4 |
| 3.51.1057.6 | 3214F49D (17th August 1996) | 307,088 | Windows NT 3.51 SP5 |
| 4.0.0.950 | 2FF36CC2 (30th June 1995) | 5,632 | Windows 95 Windows 95 OSR2 |
| 4.0.1376.1 | 31F3C73E (23rd July 1996) | 353,552 | Windows NT 4.0 |
| 4.0.1381.3 | 329F4942 (29th November 1996) | 355,088 | Windows NT 4.0 SP2 |
| 4.0.1381.4 | 334EA15A (12th April 1997) | 355,088 | Windows NT 4.0 SP3 |
| 4.0.1381.130 | 361D3EA2 (9th October 1998) | 355,600 | Windows NT 4.0 SP4 |
| 4.0.1381.174 | 36D5E9A4 (26th February 1999) | 363,792 | Windows NT 4.0 SP5 |
| 4.0.1381.298 | 3786600B (10th July 1999) | 366,864 | Windows NT 4.0 SP6 |
| 4.10.0.1998 | 3546AB93 (29th April 1998) | 20,480 | Windows 98 Windows 98 SE |
| 4.90.0.3000 | 39403BE1 (9th June 2000) | 20,480 | Windows Me |
| 5.0.2163.1 | 38175B30 (28th October 1999) | 481,040 | Windows 2000 |
| 5.0.2195.1600 | 394193D2 (10th June 2000) | 486,672 | Windows 2000 SP1 |
| 5.0.2195.5400 | 3D3D0209 (23rd July 2002) | 490,768 | Windows 2000 SP3 |
| 5.0.2195.6685 | 3EF274DC (20th June 2003) | 491,792 | Windows 2000 SP4 |
| 5.1.2600.0 | 3B7DE01E (18th August 2001) | 674,304 | Windows XP |
| 5.1.2600.1106 | 3D6DFA28 (29th August 2002) | 668,672 | Windows XP SP1 |
| 5.1.2600.2180 | 411096B4 (4th August 2004) | 708,096 | Windows XP SP2 |
| 5.1.2600.5512 | 4802A12C (14th April 2008) | 706,048 | Windows XP SP3 |
| 5.2.3790.0 | 3E802494 (25th March 2003) | 739,840 | Windows Server 2003 |
| 5.2.3790.1830 | 424377D2 (25th March 2005) | 766,464 | Windows Server 2003 SP1 |
| 5.2.3790.3959 | 45D70AD8 (18th February 2007) | 765,440 | Windows Server 2003 SP2 |
| 6.0.6000.16386 | 4549BDC9 (2nd November 2006) | 1,162,656 | Windows Vista |
| 6.0.6001.18000 | 4791A7A6 (19th January 2008) | 1,203,792 | Windows Vista SP1 Windows Server 2008 |
| 6.0.6002.18005 | 49E03821 (11th April 2009) | 1,202,168 | Windows Vista SP2 |
| 6.1.7600.16385 | 4A5BDADB (14th July 2009) | 1,286,144 | Windows 7 |
| 6.1.7601.17514 | 4CE7B96E (20th November 2010) | 1,288,488 | Windows 7 SP1 |
| 6.2.9200.16384 | 5010AEB6 (25th July 2012) | 1,472,896 | Windows 8 |
| 6.3.9600.16384 | 52159006 (22nd August 2013) | 1,445,728 | Windows 8.1 |
| 6.3.9600.17031 | 53088928 (22nd February 2014) | 1,451,392 | Windows 8.1 With Update |
| 10.0.10240.16384 | 559F3AAC (9th July 2015) | 1,535,576 | Windows 10 |
Where packages are listed on the same row, the binaries are exactly identical, except as noted in the next two paragraphs which anyway apply only to the Windows that runs on DOS.
For the two Windows 95 versions (original and OSR2) and the two Windows 98 versions (original and SE), the only difference between the binaries in each pair is that the later is built with newer import libraries for some DLLs, so that each executable has a slightly different Import Address Table and a different checksum in the executable’s header.
The build for Windows Me differs from the two for Windows 98 only by a change of version number and by rebasing, both for the executable itself and for imported addresses, with a corresponding change in the file header’s date stamp and checksum.
Among the gaps in service packs for early versions, note for definiteness that a Windows NT 4.0 SP1 and a Windows 2000 SP2 have been obtained for inspection but do not contain an NTDLL.DLL.
Microsoft’s distribution of 64-bit Windows on MSDN discs in the early years was even less reliable than was my renewal of subscriptions. I seem never to have received a 64-bit edition of Windows XP, which is therefore not included in this study. (I suspect anyway that it was a build of version 5.2, i.e., of Windows Server 2003, rebadged for better marketing.) Though correspondents tell me that 64-bit Windows Vista was readily available the moment that Windows Vista was released, my experience is instead that a year-long MSDN subscription in 2007 produced no x64 build of the original Windows Vista. The copy inspected of that is instead from an OEM disc.
Though all service-pack builds that have been inspected for this study have been available through MSDN subscriptions, some of the copies studied have instead been downloaded as self-extracting executables from Microsoft’s free websites since, for who knows what reason, it frequently happened that the MSDN site that I paid to access was intolerably slow—not that my tolerance was high, especially while Microsoft was at the time not just leaving me to the tedium of burning disks and labelling them, but telling me that their purpose was to be environmentally friendly.
| File Version | File Header Date Stamp | File Size | Package |
|---|---|---|---|
| 5.2.3790.1830 | 42438B79 (25th March 2005) | 1,257,472 | Windows Server 2003 SP1 |
| 5.2.3790.3959 | 45D6CC72 (17th February 2007) | 1,254,400 | Windows Server 2003 SP2 |
| 6.0.6000.16386 | 4549D372 (2nd November 2006) | 1,533,992 | Windows Vista |
| 6.0.6001.18000 | 4791ADEC (19th January 2008) | 1,559,696 | Windows Vista SP1 Windows Server 2008 |
| 6.0.6002.18005 | 49E0421D (11th April 2009) | 1,582,792 | Windows Vista SP2 |
| 6.1.7600.16385 | 4A5BE02B (14th July 2009) | 1,736,792 | Windows 7 Windows Server 2008 R2 |
| 6.1.7601.17514 | 4CE7C8F9 (20th November 2010) | 1,731,936 | Windows 7 SP1 Windows Server 2008 R2 SP1 |
| 6.2.9200.16384 | 5010ACD2 (25th July 2012) | 1,825,216 | Windows 8 |
| 6.3.9600.16384 | 5215F938 (22nd August 2013) | 1,722,608 | Windows 8.1 |
| 6.3.9600.17031 | 530895AF (22nd February 2014) | 1,727,760 | Windows 8.1 With Update |
| 10.0.10240.16384 | 559F384F (9th July 2015) | 1,822,832 | Windows 10 |
Where two packages are shown for the same build, the executables are identical. This identity is formalised for Windows 7 SP1 and Windows Server 2008 R2 SP1 since Microsoft provides the one self-extracting executable for both product names.
NTDLL is sufficiently low-level that its 32-bit executables for 64-bit Windows differ from those of the corresponding 32-bit Windows versions.
| File Version | File Header Date Stamp | File Size | Package |
|---|---|---|---|
| 5.2.3790.1830 | 42437794 (25th March 2005) | 762,880 | Windows Server 2003 SP1 |
| 5.2.3790.3959 | 45D709FF (17th February 2007) | 766,464 | Windows Server 2003 SP2 |
| 6.0.6000.16386 | 4549BDF8 (2nd November 2006) | 1,145,664 | Windows Vista |
| 6.0.6001.18000 | 4791A783 (19th January 2008) | 1,165,688 | Windows Vista SP1 Windows Server 2008 |
| 6.0.6002.18005 | 49E03824 (11th April 2009) | 1,165,088 | Windows Vista SP2 |
| 6.1.7600.16385 | 4A5BDB3B (14th July 2009) | 1,289,712 | Windows 7 Windows Server 2008 R2 |
| 6.1.7601.17514 | 4CE7BA58 (20th November 2010) | 1,292,096 | Windows 7 Windows Server 2008 R2 SP1 |
| 6.2.9200.16384 | 5010AE7A (25th July 2012) | 1,409,384 | Windows 8 |
| 6.3.9600.16384 | 52159015 (22nd August 2013) | 1,471,544 | Windows 8.1 |
| 6.3.9600.17031 | 5308893D (22nd February 2014) | 1,474,104 | Windows 8.1 With Update |
| 10.0.10240.16384 | 559F3AAB (9th July 2015) | 1,533,496 | Windows 10 |
Where two packages are shown for the same build, the executables are identical.