NTDLL Versions

Only in the NT versions of Windows is NTDLL.DLL a substantial executable. Until version 6.0 reunified client and server editions under different product names, each new name for a Windows package brought at least a change of the minor version number. (Yes, that should be unremarkable, but compare with DLLs from the Windows Shell, some of which kept to one version number for all of Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008.)

File Version Distribution
Windows NT
3.51   Windows NT 3.51
4.0 Windows 95 Windows NT 4.0
4.10 Windows 98  
4.90 Windows Me  
5.0   Windows 2000
5.1   Windows XP
5.2   Windows Server 2003
6.0   Windows Vista
Windows Server 2008
6.1   Windows 7
Windows Server 2008 R2
6.2   Windows 8
6.3   Windows 8.1
10.0   Windows 10

The version numbering gets arguably quirky for Windows Vista, Windows 7, Windows 8 and Windows 8.1. These were each in their time promoted as a significant—even major—release, yet they all have the same major version number which anyway isn’t in any of the names. As if to acknowledge this as unsatisfactory, the major version number for Windows 10 actually is 10.

Builds

The following builds have been inspected for these notes. Most are from MSDN discs. Some, especially since Microsoft greatly reduced its shipment of operating systems on MSDN discs, are from service packs downloaded (typically as self-extracting executables) from a Microsoft website.

Builds are arranged in increasing order of the file version as recorded in the executable’s resources. This version number is readily visible using Windows Explorer either in a so-called infotip for the file or by accessing the Version tab in the Properties dialog for the file. Programmers know this version number as coming from the so-called root block of the version-information resource, specifically from the dwFileVersionMS and dwFileVersionLS members of a VS_FIXEDFILEINFO structure.

The date stamp shown for each version is more obscure. File dates are easily modified after the executable is built and are anyway liable to be shown differently when read from different time zones. However, there is in each executable’s header a date stamp which is set when the executable is built and which is not commonly changed afterwards. It is readily accessible to anyone with programming knowledge and appropriate tools, e.g., Microsoft’s own DUMPBIN utility.

32-Bit Windows (x86)

For the versions of Windows that run on MS-DOS, NTDLL exists only as a small collection of stub functions, and might more usefully be considered a different executable.

File Version File Header Date Stamp File Size Package
3.51.1025.1 2FC3AE99 (25th May 1995) 307,088 Windows NT 3.51
3.51.1057.6 3214F49D (17th August 1996) 307,088 Windows NT 3.51 SP5
4.0.0.950 2FF36CC2 (30th June 1995) 5,632 Windows 95
Windows 95 OSR2
4.0.1376.1 31F3C73E (23rd July 1996) 353,552 Windows NT 4.0
4.0.1381.4 334EA15A (12th April 1997) 355,088 Windows NT 4.0 SP3
4.0.1381.130 361D3EA2 (9th October 1998) 355,600 Windows NT 4.0 SP4
4.0.1381.174 36D5E9A4 (26th February 1999) 363,792 Windows NT 4.0 SP5
4.0.1381.298 3786600B (10th July 1999) 366,864 Windows NT 4.0 SP6
4.10.0.1998 3546AB93 (29th April 1998) 20,480 Windows 98
Windows 98 SE
4.90.0.3000 39403BE1 (9th June 2000) 20,480 Windows Me
5.0.2163.1 38175B30 (28th October 1999) 481,040 Windows 2000
5.0.2195.1600 394193D2 (10th June 2000) 486,672 Windows 2000 SP1
5.0.2195.5400 3D3D0209 (23rd July 2002) 490,768 Windows 2000 SP3
5.0.2195.6685 3EF274DC (20th June 2003) 491,792 Windows 2000 SP4
5.1.2600.0 3B7DE01E (18th August 2001) 674,304 Windows XP
5.1.2600.1106 3D6DFA28 (29th August 2002) 668,672 Windows XP SP1
5.1.2600.2180 411096B4 (4th August 2004) 708,096 Windows XP SP2
5.1.2600.5512 4802A12C (14th April 2008) 706,048 Windows XP SP3
5.2.3790.0 3E802494 (25th March 2003) 739,840 Windows Server 2003
5.2.3790.1830 424377D2 (25th March 2005) 766,464 Windows Server 2003 SP1
5.2.3790.3959 45D70AD8 (18th February 2007) 765,440 Windows Server 2003 SP2
6.0.6000.16386 4549BDC9 (2nd November 2006) 1,162,656 Windows Vista
6.0.6001.18000 4791A7A6 (19th January 2008) 1,203,792 Windows Vista SP1
Windows Server 2008
6.0.6002.18005 49E03821 (11th April 2009) 1,202,168 Windows Vista SP2
6.1.7600.16385 4A5BDADB (14th July 2009) 1,286,144 Windows 7
6.1.7601.17514 4CE7B96E (20th November 2010) 1,288,488 Windows 7 SP1
6.2.9200.16384 5010AEB6 (25th July 2012) 1,472,896 Windows 8
6.3.9600.16384 52159006 (22nd August 2013) 1,445,728 Windows 8.1
6.3.9600.17031 53088928 (22nd February 2014) 1,451,392 Windows 8.1 With Update
10.0.10240.16384 559F3AAC (9th July 2015) 1,535,576 Windows 10

For the two Windows 95 versions (original and OSR2) and the two Windows 98 versions (original and SE), the only difference between the binaries in each pair is that the later is built with newer import libraries for some DLLs, so that the two have slightly different Import Address Tables and a different checksum in the executable’s header.

The build for Windows Me differs from the two for Windows 98 only by a change of version number and by rebasing, both for the executable itself and for imported addresses, with a corresponding change in the file header’s date stamp and checksum.

The executables for Windows Vista SP1 and Windows Server 2008 are exactly identical.

64-Bit Windows (amd64)

Microsoft’s distribution of early 64-bit Windows on MSDN discs is even less reliable than is my renewal of subscriptions. I seem never to have received a 64-bit edition of Windows XP. Since a subscription in 2007 produced no x64 build of the original Windows Vista, the copy inspected of that is from an OEM disc. The builds inspected for service packs are from self-extracting executables that have been downloaded from a free Microsoft website (which is, curiously, an order of magnitude faster than downloading disc images from the paid MSDN website).

File Version File Header Date Stamp File Size Package
5.2.3790.1830 42438B79 (25th March 2005) 1,257,472 Windows Server 2003 SP1
5.2.3790.3959 45D6CC72 (17th February 2007) 1,254,400 Windows Server 2003 SP2
6.0.6000.16386 4549D372 (2nd November 2006) 1,533,992 Windows Vista
6.0.6001.18000 4791ADEC (19th January 2008) 1,559,696 Windows Vista SP1
Windows Server 2008
6.0.6002.18005 49E0421D (11th April 2009) 1,582,792 Windows Vista SP2
6.1.7600.16385 4A5BE02B (14th July 2009) 1,736,792 Windows 7
Windows Server 2008 R2
6.1.7601.17514 4CE7C8F9 (20th November 2010) 1,731,936 Windows 7 SP1
Windows Server 2008 R2 SP1
6.2.9200.16384 5010ACD2 (25th July 2012) 1,825,216 Windows 8
6.3.9600.16384 5215F938 (22nd August 2013) 1,722,608 Windows 8.1
6.3.9600.17031 530895AF (22nd February 2014) 1,727,760 Windows 8.1 With Update
10.0.10240.16384 559F384F (9th July 2015) 1,822,832 Windows 10

Where two packages are shown for the same build, the executables are identical. This identity is formalised for Windows 7 SP1 and Windows Server 2008 R2 SP1 since Microsoft provides the one self-extracting executable for both product names.

32-Bit Windows on 64-Bit Windows (wow64)

NTDLL is sufficiently low-level that its 32-bit executables for 64-bit Windows differ from those of the corresponding 32-bit Windows versions.

File Version File Header Date Stamp File Size Package
5.2.3790.1830 42437794 (25th March 2005) 762,880 Windows Server 2003 SP1
5.2.3790.3959 45D709FF (17th February 2007) 766,464 Windows Server 2003 SP2
6.0.6000.16386 4549BDF8 (2nd November 2006) 1,145,664 Windows Vista
6.0.6001.18000 4791A783 (19th January 2008) 1,165,688 Windows Vista SP1
Windows Server 2008
6.0.6002.18005 49E03824 (11th April 2009) 1,165,088 Windows Vista SP2
6.1.7600.16385 4A5BDB3B (14th July 2009) 1,289,712 Windows 7
Windows Server 2008 R2
6.1.7601.17514 4CE7BA58 (20th November 2010) 1,292,096 Windows 7
Windows Server 2008 R2 SP1
6.2.9200.16384 5010AE7A (25th July 2012) 1,409,384 Windows 8
6.3.9600.16384 52159015 (22nd August 2013) 1,471,544 Windows 8.1
6.3.9600.17031 5308893D (22nd February 2014) 1,474,104 Windows 8.1 With Update
10.0.10240.16384 559F3AAB (9th July 2015) 1,533,496 Windows 10

Where two packages are shown for the same build, the executables are identical.