NTDLL Versions

Only in the NT versions of Windows is NTDLL.DLL a substantial executable. Until version 6.0 reunified client and server editions under different product names, each new Windows package brought at least a change of the minor version number. (Yes, that should be unremarkable, but compare with DLLs from the Windows Shell, some of which kept to one version number for Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008.)

For the versions of Windows that run on MS-DOS, NTDLL exists only as a small collection of stub functions, and might more usefully be considered a different executable.

Builds

The following builds have been inspected for these notes. Most are from MSDN discs. Some, especially since Microsoft greatly reduced its shipment of operating systems on MSDN discs, are from service packs downloaded (typically as self-extracting executables) from a Microsoft website.

Builds are arranged in increasing order of the file version as recorded in the executable’s resources. This version number is readily visible using Windows Explorer either in a so-called infotip for the file or by accessing the Version tab in the Properties dialog for the file. Programmers know this version number as coming from the so-called root block of the version-information resource, specifically from the dwFileVersionMS and dwFileVersionLS members of a VS_FIXEDFILEINFO structure.

The date stamp shown for each version is more obscure. File dates are easily modified after the executable is built and are anyway liable to be shown differently when read from different time zones. However, there is in each executable’s header a date stamp which is set when the executable is built and which is not commonly changed afterwards. It is readily accessible to anyone with programming knowledge and appropriate tools, e.g., Microsoft’s own DUMPBIN utility.

32-Bit Windows (x86)

For the two Windows 95 versions (original and OSR2) and the two Windows 98 versions (original and SE), the only difference between the binaries in each pair is that the later is built with newer import libraries for some DLLs, so that the two have slightly different Import Address Tables and a different checksum in the executable’s header.

The build for Windows Me differs from the two for Windows 98 only by a change of version number and by rebasing, both for the executable itself and for imported addresses, with a corresponding change in the file header’s date stamp and checksum.

The executables for Windows Vista SP1 and Windows Server 2008 are exactly identical.

64-Bit Windows (x64)

Where two packages are shown for the same build, the executables are identical.

32-Bit Windows on 64-Bit Windows (wow64)

NTDLL is sufficiently low-level that its 32-bit executables for 64-bit Windows differ from those of the corresponding 32-bit Windows versions.

Where two packages are shown for the same build, the executables are identical.