Windows NT 3.1 build 196

Windows NT 3.1 build 196.1 is an early build of Windows NT 3.1 from September 1991, and is an "experimental pre-release development kit" build. A picture of a disc containing this build was first provided by BetaArchive member ReflectiaX in 2018. On 18 December 2020, he obtained said disc and proceeded to share its contents. It is currently the earliest leaked build of Windows NT.

Setup
This build does not include any setup utility, but instead relies on a batch file to copy system files to the hard disk and write the boot loader. The process requires a pre-installed copy of MS-DOS (version 3.1 or later) or OS/2 1.21 or 1.3. The boot partition on which DOS or OS/2 is installed must be a FAT partition, while any additional partitions can be HPFS. For both DOS and OS/2,   should be in a directory that's listed in the   variable. For DOS,  must also be accessible through , as it is used to install the boot loader.

The disc contains  file designed for installing next to MS-DOS 3.1 or later, and   designed for installing next to OS/2 1.2 and 1.3. The installation is initiated by changing to the CD drive and typing  in a command prompt. Adding  to the command will also install the developer tools. On OS/2, adding  to the command will also install the debugger.

Upon installing this build, the setup also runs  to check if the boot files have been stored in contiguous blocks. If they are not, it is required to re-run the setup, otherwise it will not be possible to boot into NT.

Super VGA support
On compatible video cards it is possible to achieve 800x600 resolution with 16 colors by replacing the default  driver in   with   found in the same directory and rebooting. Based on references from newer builds, the 800x600 driver is primarily intended to work with Video 7 video cards, however, it has been found to work with other cards from the same era as well.

Sound
This build includes a Sound Blaster driver, together with sample wave files to play, however, it's currently unknown how to enable it or what parameters it expects/supports. Build 297.1 from June 1992 is the first leaked build where SoundBlaster works and has a known way of configuring it.

Architectural differences
This build has several interesting architectural differences from most later builds of Windows NT.

OS2LDR
The bootloader is a very early version of NTLDR, calling itself  - this is a reference to the NT OS/2 project, which later became Windows NT after the IBM-Microsoft split. It identifies as "NT-386" - probably signifying an i386 build of NT rather than the MIPS version, with the bootloader itself identifying as "PDK Bootloader v1.9" with a 1990 copyright date. Per the README, it is one of the earliest versions of NTLDR to support a (albeit rudimentary) dualboot configuration, with both DOS (3.3+)/NT and OS/2 (1.21/1.3)/NT configurations being supported.

PE Format
This build uses an even earlier version of the Portable Executable format than the Windows NT 3.1 1991-10 build, resulting in executables built for this build of Windows NT completely failing to start on newer builds of the OS; this also results in disassembly tools such as IDA Pro failing to disassemble the file, making analysis significantly more difficult.

Registry
The registry does not appear to exist yet at this point. The system is configured using the,   and   configuration files stored in. A directory tree reminiscent of the registry structure is also created in  upon first launch, however, no files are stored in there, therefore its purpose is currently unknown.

Static linking
Many components that would later be individual kernel-mode (or even user-mode) components are statically linked into NTOSKRNL in this build. This includes the HAL, several boot-critical drivers, including the FAT16 filesystem support code, and a rudimentary version of NTVDM that only supports real-mode DOS apps.

The Service Control Manager is statically linked into each service executable rather than being a standalone executable file as it is in most later builds.

Kernel
Like in the October 1991 build, NTOSKRNL.EXE is a COFF executable.

KeBugCheckEx is nonexistant in this build, and KeBugCheck has a simplistic implementation that prints a string to an attached kernel debugger and then, in an infinite loop, causes a breakpoint. Without a debugger attached, this would be percieved as a hang, and nothing is shown on-screen to indicate that anything happened.

User accounts
The README implies that this was one of the earliest builds to have any semblance of user security implemented, and this is evident by the extremely rudimentary nature of the user account system. While privileged and nonprivileged users are implemented, they only affect usage of a few commands, and you can simply check a checkbox in order to get administrative privileges. The readme also advises you to log in as the SYSTEM account - which has no password. Indeed, there are only four security-related exports in the kernel, compared to NT 3.1's eighteen.

User accounts and groups are stored in.

Subsystems
The only functional subsystem is the Windows subsystem, which as of this build is split between  for graphical applications and   for console applications. This distinction is kept in the PE subsystem field up to this day, although the subsystems have already been merged into one by the December 1991 build. The graphical subsystem is launched by default to initiate the session, while it is currently unknown when the character mode subsystem gets spawned.

The build also includes the OS/2 subsystem seemingly based on an early version of OS/2 2.0, however, trying to launch any OS/2 applications using the   launcher breaks into the debugger, resulting in a system hang. also includes a subsystem entry for the POSIX subsystem, although its executable is not included.

If the Session Manager fails to load any subsystems automatically, it will drop to a rudimentary command-line interface accessible via a debugger, which supports process management, debugging user mode NT processes, managing environment variables, and probing system parameters. Without an attached debugger, this appears as a system hang as the only thing displayed is a blank gray screen with a blinking text mode cursor and a row of equal sign characters at the bottom. From this point it is possible to continue system startup manually by initializing a subsystem server via a debugger.

General usage

 * At least Notepad in this build does not support the Select All keyboard shortcut.
 * Creating a new file in Notepad may result in garbage being placed inside the "empty" text file.
 * Files may randomly not appear in File Manager.
 * Using a drag and drop operation (presumably DDE) will crash the system.
 * This build is generally unstable, and can easily hang on certain tasks. It can be as simple as launching an application, or even leaving the system alone for a couple of seconds.
 * On 86Box, this build will typically freeze after 15 to 30 minutes of use with 16 MB of RAM with a 386SX/40. This may be due to a memory leak, but this has not been empirically tested at this time.
 * Task Manager does not start.
 * Mouse has a high chance of not working on this build, however the Microsoft InPort mouse tends to work best.

Documentation
A README.TXT document is included inside the installation contents, which contains information about certain things, such as how to install this build and new features compared to the previous build. The README's contents:

Naming
This build identifies itself with several different names in several different places; this build identifies as NT 1.0 in NTUSER.CFG, "NT 32-bit Windows" on the desktop watermark, "NT-386" (with "NT-MIPS" being the MIPS equivalent) while booting, and "Windows NT Version 3.2" in Command Prompt.