Kernel Versions

Each new Windows package brings at least a change of the minor version number until contemporaneous client and server editions are reunited for version 6.0:

After version 6.0, the next change in the minor version number is a change of name in client ediitions but is just an epithet for the contemporaneous server edition.

Files

The NT kernel is distributed with each Windows package in as many as four files:

• NTOSKRNL.EXE, single-processor without PAE;
• NTKRNLMP.EXE, multi-processor without PAE;
• NTKRNLPA.EXE, single-processor with PAE (version 5.0 and higher);
• NTKRPAMP.EXE, multi-processor with PAE (version 5.0 and higher).

An installed system has either the single-processor kernels or the multi-processor kernels but not both. If the multi-processor kernels are installed, they are renamed as if for a single-processor system. Put another way, the single-processor kernels have the standard names.

The difference concerning Physical Address Extension (PAE) is mostly a matter of specialising the memory manager to use 32-bit or 64-bit page table entries exclusively. Users can select the one or the other at boot time, through the /PAE and /NOPAE switches in BOOT.INI or the pae option in the Boot Configuration Data (BCD). Later versions also allow for selection of the PAE kernel to be forced by a /NOEXECUTE switch or nx option.

The loader has the standard names hard-coded. Unless an alternative is specified by a /KERNEL switch or kernel option, the kernel that is loaded is whatever file is named NTOSKRNL.EXE ordinarily or NTKRNLPA.EXE if PAE is wanted.

Builds

The following builds have been inspected for these notes. Most are from MSDN discs. Some, especially since Microsoft greatly reduced its shipment of operating systems on MSDN discs, are from service packs downloaded (typically as self-extracting executables) from a Microsoft website.

Builds are arranged in increasing order of the file version as recorded in the executable’s resources. This version number is readily visible using Windows Explorer either in a so-called infotip for the file or by accessing the Version tab in the Properties dialog for the file. Programmers know this version number as coming from the so-called root block of the version-information resource, specifically from the dwFileVersionMS and dwFileVersionLS members of a VS_FIXEDFILEINFO structure.

The date stamp shown for each version is more obscure. File dates are easily modified after the executable is built and are anyway liable to be shown differently when read from different time zones. However, there is in each executable’s header a date stamp which is set when the executable is built and which is not commonly changed afterwards. It is readily accessible to anyone with programming knowledge and appropriate tools, e.g., Microsoft’s own DUMPBIN utility.

The kernel files for each build are listed in the order: NTOSKRNL.EXE, NTKRNLMP.EXE, NTKRNLPA.EXE, NTKRPAMP.EXE. Versions before 5.0 have only NTOSKRNL.EXE and NTKRNLMP.EXE. Versions from 6.0 onwards are built with both single-processor and multi-processor kernels in the same pattern as for earlier versions, but the installation image on the distribution media has only the multi-processor kernels, and these are already renamed to NTOSKRNL.EXE and NTKRNLPA.EXE.

A self-extracting executable for Windows 2000 SP2 has been inspected for these notes but no kernels were found.

Each kernel in Windows Server 2008 is the same as in Windows Vista SP1, byte for byte.

64-Bit Windows

Microsoft’s distribution of 64-bit Windows on MSDN discs is even less reliable than is my renewal of subscriptions. I seem never to have received a 64-bit edition of Windows XP. A subscription in 2007 produced no x64 build of the original Windows Vista. The copy inspected of that is from an OEM disc. Other builds that have been inspected for this study have been downloaded as self-extracting executables from Microsoft’s free websites since, for who knows what reason, the MSDN site that I pay for is intolerably slow—not that my tolerance is high, given that Microsoft anyway puts me to the tedium of burning and labelling, and has the nerve to tell me this is environmentally friendly.

The kernels for each build are listed in the order: NTOSKRNL.EXE, NTKRNLMP.EXE. Versions from 6.0 onwards are built with both single-processor and multi-processor kernels, but the installation image on the distribution media has only a multi-processor kernel, which is already renamed to NTOSKRNL.EXE.

Where two packages are shown for the same build, the executables are identical.

Some Microsoft documentation, e.g., of the KeAcquireSpinLockRaiseToDpc function in the Windows Driver Kit (WDK) version 7600.16385.0 for Windows 7, talks of “64-bit versions of Windows 2000” but I don’t believe the MSDN site has ever listed such things even as being available to download.