学步园

Kernel Versions

Each new name for a Windows package bringsat least a change of the minor version number until contemporaneous client andserver editions are reunited for version 6.0:

After version 6.0, the next change in theminor version number is a change of name in client ediitions but is just an epithetfor the contemporaneous server edition.

Files

The NT kernel is distributed with eachWindows package in as many as four files:

• NTOSKRNL.EXE, single-processor without PAE;
• NTKRNLMP.EXE, multi-processor without PAE;
• NTKRNLPA.EXE, single-processor with PAE (version 5.0 and higher);
• NTKRPAMP.EXE, multi-processor with PAE (version 5.0 and higher).

An installed system has either thesingle-processor kernels or the multi-processor kernels but not both. If themulti-processor kernels are installed, they are renamed as if for asingle-processor system. Put another way, the single-processor kernels have thestandard
names.

The difference concerning Physical AddressExtension (PAE) is mostly a matter of specialising the memory manager to use32-bit or 64-bit page table entries exclusively. Users can select the one orthe other at boot time, through the /PAE and /NOPAE switchesin
BOOT.INI or the pae optionin the Boot Configuration Data (BCD). Later versions also allow for selectionof the PAE kernel to be forced by a /NOEXECUTE switch
or nx option.

The loader has the standard nameshard-coded. Unless an alternative is specified by a /KERNEL switchor kernel option,the kernel that is
loaded is whatever file is named NTOSKRNL.EXE ordinarily orNTKRNLPA.EXE if PAE is wanted.

Builds

The following builds have been inspectedfor these notes. Most are from MSDN discs. Some, especially since Microsoftgreatly reduced its shipment of operating systems on MSDN discs, are fromservice packs downloaded (typically as self-extracting executables)
from aMicrosoft website.

Builds are arranged in increasing order ofthe file version as recorded in the executable’s resources. This version numberis readily visible using Windows Explorer either in a so-called infotip for thefile or by accessing the Version tab in the Properties
dialog for the file.Programmers know this version number as coming from the so-called root block ofthe version-information resource, specifically from the dwFileVersionMS and dwFileVersionLS membersof a VS_FIXEDFILEINFO structure.

The date stamp shown for each version ismore obscure. File dates are easily modified after the executable is built andare anyway liable to be shown differently when read from different time zones.However, there is in each executable’s header a date stamp
which is set whenthe executable is built and which is not commonly changed afterwards. It isreadily accessible to anyone with programming knowledge and appropriate tools,e.g., Microsoft’s own DUMPBIN utility.

The kernel files for each build are listedin the order: NTOSKRNL.EXE, NTKRNLMP.EXE, NTKRNLPA.EXE, NTKRPAMP.EXE. Versionsbefore 5.0 have only NTOSKRNL.EXE and NTKRNLMP.EXE. Versions from 6.0 onwardsare built with both single-processor and multi-processor
kernels in the samepattern as for earlier versions, but the installation image on the distributionmedia has only the multi-processor kernels, and these are already renamed toNTOSKRNL.EXE and NTKRNLPA.EXE.

A self-extracting executable for Windows2000 SP2 has been inspected for these notes but no kernels were found.

Each kernel in Windows Server 2008 is thesame as in Windows Vista SP1, byte for byte.

64-Bit Windows

Microsoft’s distribution of 64-bit Windowson MSDN discs is even less reliable than is my renewal of subscriptions. I seemnever to have received a 64-bit edition of Windows XP, which is therefore notincluded in this study. Though correspondents tell me that
64-bit Windows Vistawas readily available the moment that Windows Vista was released, my experienceis instead that an MSDN subscription in 2007 produced no x64 build of theoriginal Windows Vista. The copy inspected of that is from an OEM disc. Thoughall service-pack
builds that have been inspected for this study are availablethrough an MSDN subscription, the copies studied have instead been downloadedas self-extracting executables from Microsoft’s free websites since, for whoknows what reason, the MSDN site that I pay
for is intolerably slow—not that mytolerance is high, given that Microsoft leaves me to the tedium of burningdisks and labelling them and has the nerve to tell me that doing so isenvironmentally friendly.

The kernels for each build are listed inthe order: NTOSKRNL.EXE, NTKRNLMP.EXE. Versions from 6.0 onwards are built withboth single-processor and multi-processor kernels, but the installation imageon the distribution media has only a multi-processor kernel,
which is alreadyrenamed to NTOSKRNL.EXE.

Where two packages are shown for the samebuild, the executables are identical. This identity is formalised for Windows 7SP1 and Windows Server 2008 R2 SP1 since Microsoft provides the oneself-extracting executable for both product names.

Some Microsoft documentation, e.g., ofthe KeAcquireSpinLockRaiseToDpc function in the Windows DriverKit (WDK) version 7600.16385.0 for Windows 7, talks of “64-bit versions ofWindows 2000” but Idon’t believe the MSDN site has ever listed
such things even as being availableto download.

http://www.geoffchappell.com/studies/windows/km/ntoskrnl/history/index.htm