Draft:List of builds with components stored on the Microsoft Symbol Server

This is a list of builds with components stored on the Microsoft Symbol Server. The symbol server was created in roughly 2001 and builds began to be pushed to it regularly in roughly 2005 (some builds were in alternative folders and got removed in 2020). The earliest binaries are for the RTM build of Windows XP, symbols still on the server are for builds 5600 and later.

For unknown reasons, random internal builds sometimes show up here. Possibly by mistake. It's also rumoured that Win8/8.1/10 daily winmains went up here but got removed at some point after 2012. If so, Canary builds (for, RS3/4+) still go up here roughly 24 hours after compile date, so it's possible. There's a random winmain (7758) here, of which ~1,800 files were recovered. It's just a random internal build, so it could be evidence for this. Some leaked builds from winmain also have symbols, while others don't.

The file srmlib.dll has real tiemstamps and has not changed since ~789x so can be used for scanning. Generally expect builds in unleaked architectures, ARM32 was pushed for 7850 and later.

At some point between 1 March and 6 March 2023 (exact date not known), all  binaries were removed from the Microsoft Symbol Server, most likely in response to the discovery of the BlackLotus bootkit, which hardcodes 3 such symbol server links in its installer.een

Large (thousands) of components recoverable
Any build before the introduction of reproducible builds (in Windows 10 build 14980). Some builds may only have binaries accessible.

The file  (NET binary) is still sometimes compiled with legitimate timestamps to this day. Approximate build date can be derived for some >14980 in this manner. Imagesize=1a000 for 7899-current.

,,   and   retain build lab information. These are harder to check due to frequently changing imagesizes + unpredictable timestamps.

Threshold 1
(first to use NT 10.0 - 9883 is still 6.4)

Redstone 1
- Released to MSDN

Kernel + SrmLib.dll recoverable, as well as components that do not change between builds
The kernel was not subject to reproducible builds until early rs5 (1761x) and therefore has a valid TimeDateStamp that can be used to bruteforce symsrv urls. RS2 was the first? to have daily builds pushed, as evidenced by 14993 having valid symsrv links. 14357 does not, but the  branch has not been checked, only. Before then only RTMs and major milestones (5112 (deleted 2020), 5384, 5600, 5744, 6000, 6001, 6002, 6519, 6608, 6801, 7000, 7100, 7600, 7601, 7850, 7950, 8102, 8250, 8400, 9200, 9347?, 9431, 9600, 10240, 10586, 14393, etc).

Allegedly winmain was also pushed here around 2010-2012 and then deleted. Possibly 7758, 9884, are remnants of this?

Redstone 2
Builds before 14980 go in the section above.

Redstone 4
=> buildstring pending

Only files that do not change between builds recoverable (small minority of components) + srmlib.dll + Windows Feature Experience Pack
Any build after around 17604-17628 is of this nature. They usually get pushed 1-2 days post compile.

Builds get pushed usually but not always daily, usually from current branches (ni_release, rs_prerelease, etc) - files that don't have datetimestamp and imagesize change

Buildtag difficult to obtain due to "WinBuild.160101.0800" caused by reproducible builds - only some setup files still have builds which have frequently changing imagesizes + timestamps.

Nickel
- components only, full build likely not produced

Zinc
Other components are stored but as the TimeDateStamp is unpredictable obtaining them is computationally infeasible. However, several system files contain valid timestamps alongside a valid file version, with the most notable being.

Pending checks

 * Official Milestone 1 build of Windows 8.1, should have been pushed.
 * Xeno - not having any luck finding csrss.exe which is my goto file to see if binaries can be downloaded
 * Xeno - not having any luck finding csrss.exe which is my goto file to see if binaries can be downloaded


 * RS1 branch
 * winmain
 * fbl_release (TH1) - 9824, 9826, 9828
 * DP2, DP3, DP5, DP6, DP8 (DP1 was the public DP, DP4; CP, DP7 was Windows 8 build 8375)

Once on the symbol server, but removed
- Removed in 2020?

Checked
- pivotman checked for this. May double-check, image size changes are possible...?