A forum for reverse engineering, OS internals and malware analysis 

Discussion on reverse-engineering and debugging.
 #24729  by Microwave89
 Tue Dec 23, 2014 7:05 pm
Hi km.info,

Recently I've also upgraded Windows 10 to the latest available build 9901.
I tested out a small program of mine and since on the latest build it didn't run anymore I wanted to check a couple of things (major, minor version, ..).
However, this wasn't too successful as WinDbg is lacking suitable debug symbols on the official download server.

Now my question: Does anyone have the amd64 ntdll.pdb (and maybe ntkrnlpa) file for build 9901?
Or does someone know a link to these symbols?
And is it true that the OS version number is not anything like 6.5 or 7.0 but rather 10.0?
If I judge from both PEB+0x118 and ntoskrnl.exe image it got to be this way...

Google search didn't turn up too useful results IMO.

Best Regards

Microwave89

EDIT: Not sure, if this is fine here, maybe it's better in General Discussion...
 #24736  by EP_X0FF
 Wed Dec 24, 2014 3:01 pm
And is it true that the OS version number is not anything like 6.5 or 7.0 but rather 10.0?
Yes. Sad MS marketing did the job. Well I have better idea for next gen Windows -> make these values totally random.
I doubt you can find symbols unless some MS employee or affiliated will not show up and attach them. It is private confidential build isn't it?
 #24773  by Microwave89
 Tue Dec 30, 2014 5:44 pm
Hey, Yes it seems to be a private build although it has been leaked.. However, I thought if the Windows version gets leaked (accidentally?) why shouldn't happen the same to it's (public) symbol files?
Wonder if they will be upped on 21 of January...

Best Regards

Microwave89
 #24807  by Patrick
 Sat Jan 03, 2015 12:24 pm
Microwave89 wrote:I thought if the Windows version gets leaked (accidentally?) why shouldn't happen the same to it's (public) symbol files?
The symbol server isn't updated/populated automatically, and this is why every time there's an update to the NT kernel, you'll get symbol errors in the debugger until MSFT updates their symbols. The last time I can think of having to contact MSFT to do so was back in Oct 2013, when NT was updated on the 9th? I believe. So with that said, they're probably not adding symbols for a leaked version for obvious reasons.
 #24918  by SomeUnusedName
 Mon Jan 12, 2015 2:57 pm
EP_X0FF wrote:Sad MS marketing did the job.
I'd like to believe this more reasonable explanation:

http://www.reddit.com/r/technology/comm ... 10/ckwq83x

Quoting the post:
Microsoft dev here, the internal rumours are that early testing revealed just how many third party products that had code of the form
Code: Select all
if(version.StartsWith("Windows 9"))
{ /* 95 and 98 */
} else {
and that this was the pragmatic solution to avoid that.
 #24919  by EP_X0FF
 Mon Jan 12, 2015 4:08 pm
SomeUnusedName wrote:
EP_X0FF wrote:Sad MS marketing did the job.
I'd like to believe this more reasonable explanation:

http://www.reddit.com/r/technology/comm ... 10/ckwq83x

Quoting the post:
Microsoft dev here, the internal rumours are that early testing revealed just how many third party products that had code of the form
Code: Select all
if(version.StartsWith("Windows 9"))
{ /* 95 and 98 */
} else {
and that this was the pragmatic solution to avoid that.
It is rumor nothing more and this code is from Java, Windows reports itself to programs as Windows NT.
 #25161  by labmice
 Thu Feb 05, 2015 10:37 am
I have found the following files... its from MSDN, the last two might help you with the symbols you are looking for ? (sorry If I am totally out of topic :( )

File Name: en-gb_windows_10_technical_preview_9926_x64_dvd_6246854.iso
Languages: English
SHA1: 26DC8B6C95E9DDE0F667D6788AB4FBD03DA52F02

File Name: en_windows_10_technical_preview_9926_x64_dvd_6245061.iso
Languages: English
SHA1: 6A95316728299D95249A29FBEB9676DED23B8BEB

File Name: en_windows_10_technical_preview_symbols_9926_x64_6297597.msi
Languages: English
SHA1: B3B52D3352DA6F8E8E6F636CDEDB70DFAF9AD652

File Name: en_windows_10_technical_preview_symbols_9926_debug_checked_x64_6297568.msi
Languages: English
SHA1: 9925B14D4F0D994E533D6118CBF82614EE6D40DF
 #25166  by Microwave89
 Thu Feb 05, 2015 6:36 pm
Hey thank you very much, however, it seems that the latest symbols (9926) are upped since 29..30.01.2015, since even if I do .reload WinDbg doesn't complain anymore, now.
But the checked build is also being interesting, thank you!

Best Regards

Microwave89
 #25168  by labmice
 Thu Feb 05, 2015 10:11 pm
thanks for your reply Microwave89, pls tell me if you want these files (but something tells me that you have access to them already :P )