Windows whistler build 2202

Windows XP build 2202 is the earliest available build of Windows XP. It identifies itself as «SD Windows 2000 Professional» in the watermark, where SD refers to the Source Depot version control system that Microsoft was deploying at the time. Otherwise, the build still bears Windows 2000 branding and the NT 5.0 kernel version due to its earliness.

This is the first known build to embed an early form of a build tag into the version information of executable files. Although certain executables associated with prior builds (including late Windows 2000 builds) that were distributed as a part of development kits already included one, only the numeric version was embedded into Windows itself. This build uses the tag 5.0.2202.1 built by: ntvbl06 at: 000202-1835, which shows that the build was compiled by the user account used for Lab06 builds.

Ties to Neptune and Whistler projects[edit | edit source]

For some time there had been a debate on whether this build is a post-RTM build of Windows 2000 or a very early build of Whistler. Many system files in this build contain strings beginning with s:\ntc2, which indicates the source tree from which this build was compiled was initially located in the NTC2 folder. Considering it was compiled after the cancellation of the Neptune project, which had the source tree named NTC, it seems logical to assume that NTC2 refers to Whistler.

The Additional Drivers dialog in the Printers control panel also contains options for «Windows 2001» on AXP64 and IA-64-based machines.^[1] The Resource Manager component from Neptune is also present. In addition, support for NDIS 3.0 was removed from this build. This has been verified by viewing the exports of NDIS.SYS. All this rules out the possibility of this build being a post-RTM build of Windows 2000.

Findings[edit | edit source]

[edit | edit source]

The «Comments?» link from Neptune and later builds of Whistler can be added via a registry modification. To enable it, go to HKEY_CURRENT_USER\Control Panel\Desktop and add the DWORD value LameButtonEnabled and set it to 1. The text of the link can be changed via LameButtonText string key. After adding the registry entries, log off and back on and open any application to get the link. The link does nothing when clicked in this build.

Bugs and quirks[edit | edit source]

This build contains a buggy CD-ROM driver, which can cause issues during the installation of this build.

Installation[edit | edit source]

The unmodified version of this build cannot be normally installed (via CD boot) due to a bugcheck during setup. To circumvent this, an MS-DOS boot disk can be used to partition and format the drive, after which setup can be run via WINNT.EXE. Alternatively, the cdrom.sys file located in the \I386 directory of the installation media can be replaced with a version from a different build.

On certain virtualizers and machines, when upgrading from an existing Windows installation via WINNT32.EXE, Setup may ask the user to insert the installation disc during the text-mode part of setup, even if already inserted. It is instead recommended to copy all Setup files from the CD-ROM to the hard disk, and running Setup from there.

File differences[edit | edit source]

Gallery[edit | edit source]

• Boot screen

• System Properties

• «Windows 2001» reference on Additional Drivers for sharing a printer

• «Comments?» link enabled

• Demo

• Safe to shutdown screen

References[edit | edit source]

It seems like everybody and their mother has done a Youtube video or series about the history of Windows in one way or another. Whether they focus on the evolution of a single version by pasting The Collection Book’s screenshots of the interim builds together, or show installs of every major version, they all basically zone in on one aspect, the UI/desktop. And why not, it’s the first point of contact with the product and arguably the most important part of Windows, given that it’s named after it and all.

If you’ve read any other posts here though, you’ll get the idea that I like knowing what’s going on below the surface and behind the scenes. So that’s what I’ve jumped on the bandwagon to do, look at these steps towards XP and find the stuff that other people may have overlooked. Find the series on Youtube under the Winutiae channel.

Why XP? Well, it’s just about the right size to chronicle. It doesn’t have too many files like Vista and up have, had a shortish development period with enough leaked interim bulids so that each has something new without being overwhelming, and lets face it, in the current climate, after Windows 7 it’s still the next most popular version of Windows.

Anyway, on to the first post Windows 2000 build. Whistler 2202.

Build Tag: ntvbl06.000202-1835

Video:
Download from Archive.org
Watch on Youtube:

Just about two months after the release of Windows 2000, the first tentative steps towards the next version began. The watermark text on the desktop calls this version SD Windows 2000, after “Source Depot”, Microsoft’s new code management system.

Картинка с сайта: blog.airesoft.co.uk

.

So what is there to show for these two months of work so far? Well, not much at all visually, or in any other way really. Except for the mentioned desktop string, 99.9% of the branding remains the same as a stock 2000 system. The 0.01% difference isn’t due to the single installation screen which calls it whistler, that’s apparently a fix someone made to make build 2202 installable direct from CD.

No, the 0.01% comes from one other place in the system which acknowledges this as an inauspicious start to the next coming of Windows. Where do you think it’d be? The ntoskrnl exe? Nope. How about kernel32 or ntdll, which have changed in other ways as we’ve already seen? Nope. User32? nah. Even if you listed of all the dlls you know you most likely wouldn’t get it. So where is it? Printui.dll.

Yep, among a bunch of other Windows versioning strings, there are two new additions. Only instead of showing as Windows Whistler, it shows as Windows 2001, and curiously only in the AXP64 and IA64 architectures. You can see it by installing a printer, real or virtual, then going to the properties->sharing tab and selecting Drivers for additional versions of Windows.

Картинка с сайта: blog.airesoft.co.uk

Even if they’re not enabled in this build, the Comments? box that appears in the Window captions can be by adding two entries to the registry. The funnily named LameButtonText which determines the actual text, and LameButtonEnabled which unsurprisingly determines whether it’s enabled or not. Then log off, log on again and viola, as the French say.

Картинка с сайта: blog.airesoft.co.uk

Getting really into nitpicky territory, more differences come from the fact that somehow little errors have creeped into various dll and exe resources. The easiest one to access is in Narrator’s extended about dialog, where a space and newline were added into sensory system’s url. So now we’ll never know how their url ends. Another similar weird change was made to a single resource string in the accessibility wizard where “key” was changed to “k ey”.

Картинка с сайта: blog.airesoft.co.uk

A final really minor change saw a seemingly inaccessible checkbox added in DirectShow’s DV video decoder, qdv.dll. This checkbox enabled the selected resolution of the decoded video to be saved as the default, something which wasn’t possible in Windows 2000. Seemingly inaccessible because the actual resource dialog wasn’t resized to make it visible. Luckily this dialog was used as a child dialog in WMP and the parent is sized big enough to show it.

Картинка с сайта: blog.airesoft.co.uk

Away from the nitpicky and onto the new usable functionality, because, there actually was some. Although at this stage the new functionality is really just existing private functions that’ve been exposed to the public.

The first was the interlocked list functions, though here they’re guarded by a check to see if the cpu supports cmpxchg8b. Obviously, been so close to 2000’s release, Microsoft had yet to decide that CPU support for that instruction was a requirement to run Windows. In this build, if you were running a CPU that didn’t support the instruction, they still had to make the function’s work atomic. The interlocked list functions only allowed for 8 bytes of state, so not enough for a Critical Section object. Plus they don’t have a shutdown, ‘close’, or ‘delete’ function so using the state to house an allocated pointer to one would just leak. So what did they do? They used the peb lock. I can only think that at the time they knew this was a temporary measure because as we all know, using one lock to guard two separate things rarely turns out well.

Картинка с сайта: blog.airesoft.co.uk

As well as that which we’d seen before, a new component we hadn’t came in too. Nebulously described as “WDM Resource Manager” in the version information of its’ kernel mode component and the similarly undescriptive “Resource Manager User Mode” for its user mode component, it’ll be no shock that it appears to be some sort of resource manager. At least, I trust that’s what it is. Looking at the disassembly gives no clues as to what it actually does or services it provides. The user mode component, apart from leaking a critical section in DllMain, just forwards calls to the kernel mode component. Even if there wasn’t a string saying so in the code, it’s clear that whatever their job is its targeted towards multimedia and in particular the DirectX family.

The only importer of the user mode component is quartz.dll, the DirectShow runtime, presumably for use in its implementation of the IResourceManager interface (with no symbols and a thunking QueryInterface it’s hard to tell what the interface is). The kernel mode part is also statically imported, this time by win32k.sys who uses it to register ‘DDRAW_OVERLAY’ (the DirectDraw Overlay) as a resource to manage.

A patent describing what it does in painstaking detail is available on the internet, though the exemplary API towards the end is just that. The function names are the same as those exported, but the number and format of the parameters doesn’t correspond to the bits in this build.

Картинка с сайта: blog.airesoft.co.uk

Lastly, apart from just adding functions, Microsoft they took them away too. Shocking I know considering We think of Microsoft as one who do their best to ensure forwards, backwards, any-which-way-but-loosewards compatibility of software. Alas no, if you only developed NDIS 3 network drivers you now had some work to do to upgrade. To be fair, NDIS 3.0 was contemporary with Windows for Workgroups so it’s not like the interface had just been introduced but still, consigned to the dustbin it was. Luckily, Microsoft publicly documented this, and the document still exists on MSDN today

Картинка с сайта: blog.airesoft.co.uk

And that would be it, as far as things worth mentioning. These are all displayed in moving technicolor in the video so if you want to see how to access or find these things, that’s your best bet. Anyway, next up will be the more interesting 2211 build, featuring among other things, a new logon screen and the first appearance of version 6 of the common controls.

Notes

This is the earliest leaked build for Whistler.
It has been disputed if it is for Whistler or Post-2000 or as a test build for the new Microsoft Build labs.

We still believe this build belongs to the Whistler builds, which is why it is noted here.

Hash

MD5: E2ED3854D456855ABB12C41B69445663

Fixes

Installation
Download this boot image made by KenOath.
Use it as a Floppy Image or insert into the CD-ROM as Boot Image.
http://www.thecollectionbook.info/downloads/winxp5022011kenoathboot.zip

Screenshots (108)

There are more images available in the gallery.