This page is currently a draft. Don't link drafts to main pages.
Draft:List of builds with components stored on the Microsoft Symbol Server
This is a list of builds with components stored on the Microsoft Symbol Server. The symbol server was created in roughly 2001 and builds began to be pushed to it regularly in roughly 2005 (some builds were in alternative folders and were removed in 2020). The earliest binaries are for the RTM build of Windows XP, symbols still on the server are for builds 5600 and later.
For unknown reasons, random internal builds sometimes show up here, possibly by mistake. It's also rumored that Win8/8.1/10 daily winmain went up here but were removed at some point after 2012. If so, Canary builds (for rs_prerelease, RS3/4+) still go up here roughly 24 hours after compile date, so it's possible. There's a random winmain (7758) here, of which ~1,800 files were recovered. It's just a random internal build, so it could be evidence for this. Some leaked builds from winmain also have symbols, while others don't.
The file srmlib.dll has a timestamp that reflects the correct date/time the file was compiled and has not changed since ~789x so can be used for scanning. Generally expect builds in unleaked architectures, ARM32 was pushed for 7850 and later.
At some point between 3 March and 6 March 2023 (exact date not known), all bootmgr.efi, bootmgfw.efi and hvloader.efi binaries were removed from the Microsoft Symbol Server, most likely in response to the discovery of the BlackLotus bootkit, which hardcodes 3 such symbol server links in its installer. Symbols for these binaries were also removed initially, this was reverted around 9 March 2023.
Large (thousands) of components recoverable[edit source]
Any build before the introduction of reproducible builds (in Windows 10 build 14980). Some builds may only have binaries accessible.
The file srmlib.dll (NET binary) is still sometimes compiled with legitimate timestamps to this day. Approximate build date can be derived for some >14980 in this manner. Imagesize=1a000 for 7899-current.
updateagent.dll, facilitator.dll, setuphost.exe and windowsupdatebox.exe retain build lab information. These are harder to check due to frequently changing imagesizes + unpredictable timestamps.
Windows XP[edit source]
Windows Vista[edit source]
Service Packs[edit source]
Windows Server 2008[edit source]
Windows 7[edit source]
Service Packs[edit source]
Windows Server 2008 R2[edit source]
Windows 8[edit source]
Updates[edit source]
Windows Server 2012[edit source]
Windows 8.1[edit source]
Windows 10[edit source]
Threshold 1[edit source]
(first to use NT 10.0 - 9883 is still 6.4)
Updates[edit source]
Threshold 2[edit source]
Updates[edit source]
Redstone 1[edit source]
- Released to MSDN
Updates[edit source]
Redstone 2[edit source]
Kernel + SrmLib.dll recoverable, as well as components that do not change between builds:[a][edit source]
The kernel was not subject to reproducible builds until early rs5 (1761x) and therefore has a valid TimeDateStamp that can be used to bruteforce symsrv urls. RS2 was the first? to have daily builds pushed, as evidenced by 14993 having valid symsrv links. 14357 does not, but the rs1 branch has not been checked, only rs1_release. Before then only RTMs and major milestones (5112 (deleted 2020), 5384, 5600, 5744, 6000, 6001, 6002, 6519, 6608, 6801, 7000, 7100, 7600, 7601, 7850, 7950, 8102, 8250, 8400, 9200, 9347?, 9431, 9600, 10240, 10586, 14393, etc).
Allegedly winmain was also pushed here around 2010-2012 and then deleted. Possibly 7758, 9884, are remnants of this?
Redstone 2[edit source]
Builds before 14980 go in the section above.
Updates[edit source]
Windows Mobile 10[edit source]
Feature 2 (Win10 Mobile)[edit source]
Redstone 3[edit source]
Updates[edit source]
Redstone 4[edit source]
=> buildstring pending
Updates[edit source]
Redstone 5[edit source]
Updates[edit source]
Azure Stack HCI (RS5-based)[edit source]
Only files that do not change between builds recoverable (small minority of components) + srmlib.dll + Windows Feature Experience Pack[edit source]
Any build after around 17604-17628 is of this nature. They usually get pushed 1-2 days post compile.
Builds get pushed usually but not always daily, usually from current branches (ni_release, rs_prerelease, etc) - files that don't have datetimestamp and imagesize change
Buildtag difficult to obtain due to "WinBuild.160101.0800" caused by reproducible builds - only some setup files:[b] still have builds which have frequently changing imagesizes + timestamps.
19H1[edit source]
Updates[edit source]
Vibranium[edit source]
Updates[edit source]
Manganese[edit source]
Iron[edit source]
Updates[edit source]
Hololens[edit source]
Cobalt[edit source]
Nickel[edit source]
- components only, full build likely not produced
Unknown[edit source]
Copper[edit source]
Zinc[edit source]
(Production Signed)
(Production Signed)
Gallium[edit source]
Other components are stored but as the TimeDateStamp is unpredictable obtaining them is computationally infeasible. However, several system files contain valid timestamps alongside a valid file version, with the most notable being srmlib.dll.
Pending checks[edit source]
- Official Milestone 1 build of Windows 8.1, x64 Free/Retail leaked
- Xeno - not having any luck finding csrss.exe which is my goto file to see if binaries can be downloaded
- RS1 branch
- winmain
- fbl_release (TH1) - 9824, 9826, 9828
- DP2, DP3, DP5, DP6, DP8 (DP1 was the public DP, DP4; CP, DP7 was Windows 8 build 8375)
Once on the symbol server, but removed[edit source]
- Removed in 2020?
Symbols only[edit source]
Likely confirmed to NOT exist[edit source]
Checked[edit source]
- pivotman checked for this. May double-check, image size changes are possible...?