This is a number that is going to become very familiar to me over the coming months and probably years. It'll join a hall of fame, along with 42, 832, 2032, 288,6018. Why? Is it my ATM pin? My new car registration? No, neither of these.

It is in fact the "Revision part" of the version number of most DLLs in service pack 1 of .NET Framework 2.0. I tend to refer to it as the QFE or hotfix build number as it is the bit we increment when we release a new hotfix. You can see how they progress in this list of CLR hotfixes that we have released, for example.

When you spend your day looking at dump files of .NET applications from lots of different systems you very quickly become familiar with the most common QFE build numbers. It's important because you can work out what fixes the system in question already has. For example if I got a new dump in today and saw this in the debugger:

0:050> lmvmmscorwks
start end module name
79e70000 7a3d1000 mscorwks (deferred)
Image path: C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorwks.dll
Image name: mscorwks.dll
Timestamp: Fri Sep 23 12:33:00 2005 (4333E7EC)
CheckSum: 0055FD21
ImageSize: 00561000
File version: 2.0.50727.42
Product version: 2.0.50727.42
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® .NET Framework
InternalName: mscorwks.dll
OriginalFilename: mscorwks.dll
ProductVersion: 2.0.50727.42
FileVersion: 2.0.50727.42 (RTM.050727-4200)
FileDescription: Microsoft .NET Runtime Common Language Runtime - WorkStation
LegalCopyright: © Microsoft Corporation. All rights reserved.
Comments: Flavor=Retail

I would immediately know that the customer's system was on the RTM (Release To Manufacturing == first, final, non-beta release) of the .NET 2.0 Framework. I would therefore know that not only do they not have the service pack we just released but they also do not have the MS07-040  security patch we released in July or any of the other hotfixes we've released for the CLR.

So almost the first thing I do when I open a dump is check the version of mscorwks.dll.

Not every file in the framework/runtime gets patched in a service pack or hotfix, only those that need to be (taking into account dependencies and files updated in previous fixes). Most files do get updated in a service pack and mscorwks.dll is the core DLL of the CLR/runtime so that gets patched in any CLR hotfix.

The following table summarises some of the key build numbers for the CLR:

1.0.3705.0 1.0 RTM
1.0.3705.209 1.0 SP1
1.0.3705.288 1.0 SP2
1.0.3705.6018 1.0 SP3
1.0.3705.6060 1.0 + MS07-040
1.1.4322.573 1.1 RTM
1.1.4322.2032 1.1 SP1
1.1.4322.2407 1.1 + MS07-040
1.1.4322.2300 1.1 with Windows Server 2003 SP1
2.0.50727.42 2.0 RTM
2.0.50727.312 2.0 Included with Vista
2.0.50727.832 MS07-040
2.0.50727.1433 2.0 SP1


When I was preparing this blog post I came across this cool web page by Frank Dzaebel  who provides a neat batch file for checking the version information on your system and a reference table for comparison. There are also a couple of other .NET version pages that Frank links to, here at TMG Development and here at Pluralsight.