jumper

SE shipped with IE5.0. Did ME ship with IE5.5? There were a few API updates in IE5.5, so some apps may "require" ME but also work with SE+IE5.5.

I recommend that everyone add these entries. FlsAlloc is the first new function in several years to be identified as needing its scope limited in CORE.INI, but there have been others in the past. Theoretically, all new functions (stubs and full) should have corresponding entries in CORE.INI to limit their scope. In practice, however, that would bloat CORE.INI beyond usability. The UPX support hack treats "want" requests as "need" requests, exposing any Vista-aware modules that are UPX'ed to potential compatability problems. I'm working on an updated architecture that solves the UPX problem and also allows new functions to be assigned a minimum OS mode. I hope to deprecate CORE.INI eventually.

You didn't mention the capacity of the new HDD. If it is greater than ~120GB, FDISK and SE will likely have trouble with it. See: Important "Stickified" [Pinned] 95/98/98 SE/ME Topics

Please clarify "anymore". (FlsAlloc didn't change in .15) Un-UPX opera.dll Edit CORE.INI to disable Fls in modes lower than WIN2K3 Try ME mode. Solved: in CORE.INI add: [DCFG1.names.98] KERNEL32.FlsAlloc=none [DCFG1.names.Me] KERNEL32.FlsAlloc=none [WIN2K3.names] KERNEL32.FlsAlloc=kexbases.0

Actually, the HD logo is only on the diskettes that are both high density and double-sided. The single-sided 720KB diskettes (that I had to drill a hole through to convert to 1440KB/1.4MB) don't have the HD logo even though they are high density at 18-21 sectors per track. ...And now in the closet I find a box of ten 5.25" diskettes that go back ~30 years: Memorox 2S/HD Double Sided High Density (1.6 MB) Flexible Disks TEN: 5 1/4" FOR: IBM PC-AT AND OTHERS and 5660 Recording Sides: Two Media Density: High Sectoring: Soft Tracks Per Side: 80 Memorex 2S/HD Flexible Disk

Firing up my XPsp3 machine, address 0x77b51d4a appears to be in function ApphelpCheckInstallShieldPackage in Apphelp.dll. You may need to find a newer version of Apphelp.dll. Also try portable versions of Opera and Chrome (that don't use an installer).

Most of the 3.5" floppies stacked at the back of my desktop have an "HD" logo. Some date back over 25 years! Several read: maxell SUPER RD MF2 HD DOUBLE SIDED HIGH DENSITY DOUBLE TRACK/135 TPI

The Wow64*Wow64FsRedirection functions should be in Kernel32, not Ntdll. I've moved them--Thanks MiKl! I've also corrected minor issues with the FLS* function stubs. kexbases.15.7z

Perhaps a shortcut to the Floppy was added to your desktop or SendTo folder. If you already have one on your desktop, something is triggering desktop refreshes (select a desktop item and hit F5 to trigger manually). Perhaps something is trying to load the icon of a recently used app from the floppy, or is displaying thumbnails of recently opens docs and checking for their existance. Check the registry for references to A: It not an app, then try flushing your system ShellIconCache.

"Need-only" means functions are only used if a module won't load without them. They are not used for delay-loading. If a module is UPXed, Need-only status is ignored and all functions (including stubs) can be used at any time. This will break some features and some complete apps. UPX support is still highly experimental. Un-UPX any files that do not work as expected. Almost all of the new functions in v.14 are Need-only stubs that are only used if a module won't load without them. These will not affect any currently working apps that are not UPX'ed. They are definitions from my Kexstubs.ini file tested to help run additional apps and dlls that previously did not load. LockFileEx was converted to Need-only because its incomplete implementation could cause a thread to hang (based upon SeaMonkey debugging). The other new functions are just forwards: - Ntdll.RtlGetCurrentDirectory_U - Ntdll.RtlSetCriticalSectionSpinCount - Rpcrt4.UuidCreateSequential

Release.14.7z advapi32_named_apis[] = . DECL_API("CredDeleteW", CredDeleteW_stub), . DECL_API("CredEnumerateW", CredEnumerateW_stub), . DECL_API("CredFree", CredFree_stub), . DECL_API("CredReadW", CredReadW_stub), . DECL_API("CredWriteW", CredWriteW_stub), . DECL_API("GetExplicitEntriesFromAclA", GetExplicitEntriesFromAclA_stub), . DECL_API("GetExplicitEntriesFromAclW", GetExplicitEntriesFromAclW_stub), . DECL_API("MD5Final", MD5Final_stub), . DECL_API("MD5Init", MD5Init_stub), . DECL_API("MD5Update", MD5Update_stub), . DECL_API("RegGetValueA", RegGetValueA_stub), . DECL_API("RegGetValueW", RegGetValueW_stub), . DECL_API("RegisterServiceCtrlHandlerExW", RegisterServiceCtrlHandlerExW_stub), kernel32_named_apis[] = . DECL_API("FlsAlloc", FlsAlloc_stub), . DECL_API("FlsFree", FlsFree_stub), . DECL_API("FlsGetValue", FlsGetValue_stub), . DECL_API("FlsSetValue", FlsSetValue_stub), . DECL_API("LockFileEx", LockFileEx_need), . DECL_API("LockFileEx", LockFileEx_new), // removed in .14 netapi32_named_apis[] = . DECL_API("DsEnumerateDomainTrustsW", DsEnumerateDomainTrustsW_stub), . DECL_API("DsGetDcNameW", DsGetDcNameW_stub), . DECL_API("DsGetDcNameWithAccountW", DsGetDcNameWithAccountW_stub), . DECL_API("I_NetNameCanonicalize", I_NetNameCanonicalize_stub), . DECL_API("I_NetNameValidate", I_NetNameValidate_stub), . DECL_API("NetAlertRaiseEx", NetAlertRaiseEx_stub), . DECL_API("NetApiBufferAllocate", NetApiBufferAllocate_stub), . DECL_API("NetApiBufferFree", NetApiBufferFree_stub), . DECL_API("NetFileGetInfo", NetFileGetInfo_stub), . DECL_API("NetGetAnyDCName", NetGetAnyDCName_stub), . DECL_API("NetGetDCName", NetGetDCName_stub), . DECL_API("NetGetJoinInformation", NetGetJoinInformation_stub), . DECL_API("NetGroupEnum", NetGroupEnum_stub), . DECL_API("NetGroupGetInfo", NetGroupGetInfo_stub), . DECL_API("NetGroupGetUsers", NetGroupGetUsers_stub), . DECL_API("NetLocalGroupAddMembers", NetLocalGroupAddMembers_stub), . DECL_API("NetLocalGroupGetMembers", NetLocalGroupGetMembers_stub), . DECL_API("NetMessageBufferSend", NetMessageBufferSend_stub), . DECL_API("NetMessageNameAdd", NetMessageNameAdd_stub), . DECL_API("NetMessageNameDel", NetMessageNameDel_stub), . DECL_API("NetMessageNameEnum", NetMessageNameEnum_stub), . DECL_API("NetRemoteTOD", NetRemoteTOD_stub), . DECL_API("NetServerEnum", NetServerEnum_stub), . DECL_API("NetUseAdd", NetUseAdd_stub), . DECL_API("NetUseDel", NetUseDel_stub), . DECL_API("NetUseEnum", NetUseEnum_stub), . DECL_API("NetUseGetInfo", NetUseGetInfo_stub), . DECL_API("NetUserDel", NetUserDel_stub), . DECL_API("NetUserEnum", NetUserEnum_stub), . DECL_API("NetUserGetGroups", NetUserGetGroups_stub), . DECL_API("NetUserGetInfo", NetUserGetInfo_stub), . DECL_API("NetUserGetLocalGroups", NetUserGetLocalGroups_stub), . DECL_API("NetWkstaGetInfo", NetWkstaGetInfo_stub), . DECL_API("NetWkstaTransportEnum", NetWkstaTransportEnum_stub), ntdll_named_apis[] = . DECL_API("FlsAlloc", FlsAlloc_stub), . DECL_API("FlsFree", FlsFree_stub), . DECL_API("FlsGetValue", FlsGetValue_stub), . DECL_API("FlsSetValue", FlsSetValue_stub), . DECL_API("NtQueryAttributesFile", NtQueryAttributesFile_stub), . DECL_API("NtQueryDirectoryFile", NtQueryDirectoryFile_stub), . DECL_API("NtQueryInformationFile", NtQueryInformationFile_stub), . DECL_API("RtlCreateSecurityDescriptor", RtlCreateSecurityDescriptor_fwd), // removed in .14 (duplicate) . DECL_API("RtlGetCurrentDirectory_U", GetCurrentDirectoryW_new), . DECL_API("RtlInterlockedFlushSList", InterlockedFlushSList_stub), . DECL_API("RtlSetCriticalSectionSpinCount", SetCriticalSectionSpinCount_new), . DECL_API("Wow64DisableWow64FsRedirection", Wow64DisableWow64FsRedirection_stub), . DECL_API("Wow64EnableWow64FsRedirection", Wow64EnableWow64FsRedirection_stub), . DECL_API("Wow64RevertWow64FsRedirection", Wow64RevertWow64FsRedirection_stub), ole32_named_apis[] = . DECL_API("CLSIDFromProgIDEx", CLSIDFromProgIDEx_stub), . DECL_API("CoAllowSetForegroundWindow", CoAllowSetForegroundWindow_stub), . DECL_API("CoGetObjectContext", CoGetObjectContext_stub), . DECL_API("CoGetStdMarshalEx", CoGetStdMarshalEx_stub), . DECL_API("CoRegisterInitializeSpy", CoRegisterInitializeSpy_stub), . DECL_API("CoRevokeInitializeSpy", CoRevokeInitializeSpy_stub), . DECL_API("HDC_UserFree", HDC_UserFree_stub), . DECL_API("HDC_UserMarshal", HDC_UserMarshal_stub), . DECL_API("HDC_UserSize", HDC_UserSize_stub), . DECL_API("HDC_UserUnmarshal", HDC_UserUnmarshal_stub), . DECL_API("HICON_UserFree", HICON_UserFree_stub), . DECL_API("HICON_UserMarshal", HICON_UserMarshal_stub), . DECL_API("HICON_UserSize", HICON_UserSize_stub), . DECL_API("HICON_UserUnmarshal", HICON_UserUnmarshal_stub), rpcrt4_named_apis[] = . DECL_API("I_RpcAsyncAbortCall", I_RpcAsyncAbortCall_stub), . DECL_API("I_RpcAsyncSetHandle", I_RpcAsyncSetHandle_stub), . DECL_API("I_RpcBindingInqLocalClientPID", I_RpcBindingInqLocalClientPID_stub), . DECL_API("I_RpcExceptionFilter", I_RpcExceptionFilter_stub), . DECL_API("I_RpcGetBufferWithObject", I_RpcGetBufferWithObject_stub), . DECL_API("NdrAsyncClientCall", NdrAsyncClientCall_stub), . DECL_API("NdrDcomAsyncClientCall", NdrDcomAsyncClientCall_stub), . DECL_API("NdrGetUserMarshalInfo", NdrGetUserMarshalInfo_stub), . DECL_API("NdrMesTypeAlignSize2", NdrMesTypeAlignSize2_stub), . DECL_API("NdrMesTypeDecode2", NdrMesTypeDecode2_stub), . DECL_API("NdrMesTypeEncode2", NdrMesTypeEncode2_stub), . DECL_API("RpcAsyncCancelCall", RpcAsyncCancelCall_stub), . DECL_API("RpcAsyncCompleteCall", RpcAsyncCompleteCall_stub), . DECL_API("RpcAsyncGetCallStatus", RpcAsyncGetCallStatus_stub), . DECL_API("RpcAsyncInitializeHandle", RpcAsyncInitializeHandle_stub), . DECL_API("RpcCancelThreadEx", RpcCancelThreadEx_stub), . DECL_API("RpcCertGeneratePrincipalNameW", RpcCertGeneratePrincipalNameW_stub), . DECL_API("RpcServerInqCallAttributesW", RpcServerInqCallAttributesW_stub), . DECL_API("RpcServerRegisterIf2", RpcServerRegisterIf2_stub), . DECL_API("RpcServerTestCancel", RpcServerTestCancel_stub), . DECL_API("RpcServerUnregisterIfEx", RpcServerUnregisterIfEx_stub), . DECL_API("RpcTestCancel", RpcTestCancel_stub), . DECL_API("UuidCreateSequential", UuidCreate),

For EGA games, the integrated Intel 810 chipset should be all you need.

> but it refused to run "in DOS mode". This sounds like it is a 32-bit Windows executable. You can confirm this by checking it in Dependency Walker or another PE file viewer. A ReactOS Live-CD should be able to boot from disc and run the file. A Linux Live-CD that includes WINE might also be able to run it for you.

DecodePointer and EncodePointer already exist in XP's Kernel32.dll (5.1.2600.6293). They export-forward to NTDLL.RtlDecodePointer and NTDLL.RtlEncodePointer. How are you handling the original exports and how are you implementing the "new" functions? To isolate the cause of the BSOD, do a binary search: remove half of your new functions until the BSOD goes away, then add half back in until it reappears.

Truncated board/topic subdirectory names must now have at least one character after the dash. http://www.msfn.org/board/topic/175991-latest still works but http://www.msfn.org/board/topic/175991- doesn't anymore. (http://www.msfn.org/board/topic/175991 never did.) The character after the dash doesn't have to be valid, so http://www.msfn.org/board/topic/175991-- works, and so does: http://www.msfn.org/board/topic/0--/?do=findComment&comment=1128833 and http://www.msfn.org/board/topic/0-0/?do=findComment&comment=1128833 :-) note: Anchor (a) and Teletype (tt) HTML tags used manually in this post.

nvidia quadro fx 1500 should work: http://www.google.com/search?q=nvidia+quadro+fx+1500+win9x+site:msfn.org

@Dibya: Just search on "code cave tutorial"--look for one that helps you identify or create available space within a PE file. @MiKl: Use KTree to see if your installation of KernelEx already supports vDbgPrintExWithPrefix (recent versions do). If so, KernelEx will override any other definitions of vDbgPrintExWithPrefix with its own stub. That means your new implementation is not getting used or tested. You can add a line to Core.ini to make KernelEx use the version (yours) from the standard library. The address of function needs to point to code in Ntdll.dll that will function without crashing. Try the "c2 14 00 ret 20" at the end of RtlLargeIntegerDivide or NtCreateFile (those complete functions themselves will probably crash). I've only seen vDbgPrintExWithPrefix being called as part of the error reporting process after an app has already suffered a fatal error, so a crash dialog might actually be better than a silent app termination. I seem to recall that a few DLL's from ReactOS and possibly other 2K+ OS'es only have this one unresolved dependency preventing them from loading on 9x.

Use Dependency Walker or another PE viewer to check Dropbox.exe for Kernel32.dll imports such as: GetVersion, GetVersionExA, GetVersionExW, VerifyVersionInfoA, VerifyVersionInfoW.... Say Dropbox.exe calls GetVersion. Dropbox.exe can be hexed to import GetVerWin7 instead, and Dibya can create a GetVerWin7 function that claims the OS is Windows 7.

> new 80 conductor ide cables so i guess that would be the high speed ones? Yes. If the drives are nearly full or otherwise well-used, the test files that are written will be highly fragmented. Defrag or use an empty partition. Check System Properties->Performance for "Drive X is using MS-DOS compatibility mode file system." Check System Properties->Performance->File System->Troubleshooting for any checked boxes. You can shutdown to DOS, or better yet, boot to DOS by pressing F8 or using a boot floppy (EBD) or CD. HDDspeed is one DOS program to try.

> Can you write a tool which can find out which codes are for which function ? Use a disassembler like Procwin and/or DumpPe. > is it all right to expand section , adding entrypoint with some extra code of that function ? Sure. > Wsapoll function causing some problem in ws2_32.dll of xp , i donot know how to fix it. One of my game need it. Try this Kexstubs definition: [Ws2_32.dll] WSAPoll=z3 In assembly: 33 c0 xor eax, eax c2 0c 00 ret 12 ref: https://msdn.microsoft.com/en-us/library/windows/desktop/ms741669(v=vs.85).aspx > is there in detailed guide regarding adding export ? Not that I remember. Search for "code cave" and use that information with ETT below. > I found a awesome tool some where for testing export and adding entry point please see here http://www.woodmann.com/forum/showthread.php?15720-Export-Table-Tester Good find. :) Works with Kex in win2k mode. Main window is unremarkable except for "Edit Exports" button. Clicking (after loading target dll) opens dialog that makes it easy to add export forwards to functions residing in another dll. The process is manual and the checksum is not corrected, but it currently works better than fwd!

The GetModuleHandle calls are for Kernel32.dll (bff70000). We need to know what functions any GetProcAddress calls thereafter are for, so: * Plug the crash address into Procwin and/or DumpPe and view the disabled code * Profile in Dependency Walker * report the full crash error text

> many of them were on 440bx chipsets Sounds like you've tested with multiple motherboards. Are you using a high-speed EIDE cable or an older IDE cable? Have you tested in DOS?

You can also check the dependencies with ImportPatcher. If only a few are missing, you might even be able to patch them well enough to run the app. I just now successfully tested ImportPatcher41 on my XP system, so it should work on 2K as well. It's not just for 9x!

Thanks, Dencorso. My quota is bigger now and I will post .14 soon. > it would be nice to see higher versions than 21.0.0.242 of Flash still working I need to know what API's to fix, stub, or implement. > 3Dmark05 ... was complaining about something missing in advapi32.dll before If you had told be the details, I could have added the API's sooner. > 3dmark05_v130 10.01.244... doesn't run the tests but... Enable API Hook and use DebugWindow.exe to find out what API's are called when you try to run the tests. Also profile with DependencyWalker to see what API delay loads are failing.

Yes. 14 is ready to go, but can't be posted. I have 2.1MB of attachments, my quota was recently reduced to 2.0MB, and there is no way to delete old attachments (or notifications). Update: As of mid-November 2016, the Delete button has been fully restored to My Attachments and works great. Thanks, xper!