jumper

Great information, everyone! bff*41ca (in Kernel32.dll) and 7d00b90d (in Kexbasen.dll) are the common keys. More about this later (even if someone else makes use of the new PDB files, runs DumpPE on Kexbasen, and reports back before me ).... I looked at Kexbasen in Dependency Walker and found 21 non-delay-load system file dependencies. Most of them I have disabled Kernelex on. Crypt32.dll was the key (haha)--I un-disabled KernelEx on it and was finally able to reproduce the crash (ironically with DumpPE): DUMPPE caused an invalid page fault in module KERNEL32.DLL at 016f:bff741ca. Registers: EAX=c140bad0 CS=016f EIP=bff741ca EFLGS=00010202 EBX=00000001 SS=0177 ESP=006bfb18 EBP=006bfb44 ECX=7d00b90d DS=0177 ESI=5cf01500 FS=3497 EDX=00000000 ES=0177 EDI=00000000 GS=0000 Bytes at CS:EIP: ff 4a 10 75 08 89 42 08 ff 42 04 90 c3 39 42 08 Stack dump: 7d00b90d 00000000 5cf01500 00000001 8181f7c8 bff741f7 bffc9490 bff8433d 00000000 5cf01500 8181dde0 006bfb8c 5cf33132 00000001 5cf01500 00000001 Re-disabling KernelEx on Crypt32.dll fixed the problem again. (Note: in KernelEx property tab, the Apply button is broken and will prevent changes from being applied; use the Okay button!)

I think I know what change triggered the problem, but am still trying to determine what the actual problem is. I haven't been able to reproduce the problem on my SE system, but it may have to do with what DLL's (names and versions) are dynamically linked to by Kexbasen at load time. Here is my Taskinfo2000 Process Pane and MPREXE.EXE Current Process Pane (sorted by name) right after a full reboot: Process PaneID Process % CPU LT % CPU CPU Sw/s InMem KB Total KB Th Pri Ver State Path + Idle 98.54% 94.52% 3:33 14 0 0 1 Idle 4.0 Idle + KERNEL32.DLL 0.05% 0.10% 10 32 44 3 High 4.3 32 C:\WINDOWS\SYSTEM\KERNEL32.DLL + MSGSRV32.EXE 0.05% 0.04% 0:03 2 52 64 1 Norm 4.0 16 Sys C:\WINDOWS\SYSTEM\MSGSRV32.EXE + MPREXE.EXE 0:01 0 0 0 1 Norm 4.0 32 Sys C:\WINDOWS\SYSTEM\MPREXE.EXE + mmtask.tsk 0 0 0 1 Norm 4.0 16 Sys C:\WINDOWS\SYSTEM\mmtask.tsk + EXPLORER.EXE 0.05% 0.07% 0:04 2 1,932 8,064 4 Norm 4.0 32 C:\WINDOWS\EXPLORER.EXE + SYSTRAY.EXE 1 668 2,900 1 Norm 4.0 32 C:\WINDOWS\SYSTEM\SYSTRAY.EXE + TASKINFO.EXE 1.23% 4.83% 0:05 13 904 2,840 1 Norm 4.0 32 D:\PROGRAM FILES\TASKINFO\TASKINFO.EXE + VxD NTKERN 0.05% 0.38% 0:01 22 0 0 7 Norm 4.3 NTKERN Current Process PaneName Base Size Version Description Company Full Path ADVAPI32.DLL BFE80000 65,536 4.80.1675 Win32 ADVAPI32 core component Microsoft Corporation C:\WINDOWS\SYSTEM\ADVAPI32.DLL COMCTL32.DLL BFB70000 581,632 5.81 Common Controls Library Microsoft Corporation C:\WINDOWS\SYSTEM\COMCTL32.DLL COMDLG32.DLL 7FE10000 184,320 4.72.3510.2300 Common Dialogs DLL Microsoft Corporation C:\WINDOWS\SYSTEM\COMDLG32.DLL CRYPT32.DLL 5CF00000 479,232 5.131.1880.14 Crypto API32 Microsoft Corporation C:\WINDOWS\SYSTEM\CRYPT32.DLL CRYPTUI.DLL 61400000 450,560 5.131.1878.14 Microsoft Trust UI Provider Microsoft Corporation C:\WINDOWS\SYSTEM\CRYPTUI.DLL GDI32.DLL BFF20000 155,648 4.10.2227 Win32 GDI core component Microsoft Corporation C:\WINDOWS\SYSTEM\GDI32.DLL IMAGEHLP.DLL 7CC00000 118,784 4.00 Windows NT Image Helper Microsoft Corporation C:\WINDOWS\SYSTEM\IMAGEHLP.DLL IMM32.DLL BFE20000 16,384 4.10.1998 Win32 IMM32 core component Microsoft Corporation C:\WINDOWS\SYSTEM\IMM32.DLL KERNEL32.DLL BFF70000 471,040 4.10.2222 Win32 Kernel core component Microsoft Corporation C:\WINDOWS\SYSTEM\KERNEL32.DLL KERNELEX.DLL BFA00000 233,472 4.5.2015.11 KernelEx Core with ApiHook Xeno86 C:\WINDOWS\KERNELEX\KERNELEX.DLL KEXBASEN.DLL 7D000000 118,784 4.5.2015.11 KernelEx Base Non-shared Api Library Xeno86 C:\WINDOWS\KERNELEX\KEXBASEN.DLL KEXBASES.DLL BFA40000 274,432 4.5.2015.11 KernelEx Base Shared Api Library Xeno86 C:\WINDOWS\KERNELEX\KEXBASES.DLL KSTUB822.DLL 19980000 65,536 C:\WINDOWS\KERNELEX\KSTUB822.DLL LZ32.DLL BFE60000 24,576 4.10.1998 Win32 LZ32 core component Microsoft Corporation C:\WINDOWS\SYSTEM\LZ32.DLL MPR.DLL 7FBF0000 57,344 4.10.1998 WIN32 Network Interface DLL Microsoft Corporation C:\WINDOWS\SYSTEM\MPR.DLL MPREXE.EXE 00500000 28,672 4.10.1998 WIN32 Network Interface Service Process Microsoft Corporation C:\WINDOWS\SYSTEM\MPREXE.EXE MPRSERV.DLL 7FAD0000 155,648 4.10.2222 Multinet Router Microsoft Corporation C:\WINDOWS\SYSTEM\MPRSERV.DLL MSASN1.DLL 77430000 69,632 5.00.2195.6905 ASN.1 Runtime APIs Microsoft Corporation C:\WINDOWS\SYSTEM\MSASN1.DLL MSNET32.DLL 7FB00000 77,824 4.10.1998 Microsoft 32-bit Network API Library Microsoft Corporation C:\WINDOWS\SYSTEM\MSNET32.DLL MSNP32.DLL 7FB20000 81,920 4.10.2222 Network provider for Microsoft networks Microsoft Corporation C:\WINDOWS\SYSTEM\MSNP32.DLL MSPWL32.DLL 7FB40000 40,960 4.10.1998 Password list management library Microsoft Corporation C:\WINDOWS\SYSTEM\MSPWL32.DLL MSVCR70.DLL 7C000000 344,064 7.00.9981.0 Microsoft® C Runtime Library Microsoft Corporation C:\WINDOWS\SYSTEM\MSVCR70.DLL NTDLL.DLL BFEE0000 20,480 4.10.1998 Win32 NTDLL core component Microsoft Corporation C:\WINDOWS\SYSTEM\NTDLL.DLL OLE32.DLL 7FF20000 790,528 4.71.2900 Microsoft OLE for Windows and Windows NT Microsoft Corporation C:\WINDOWS\SYSTEM\OLE32.DLL RPCRT4.DLL 7FB90000 335,872 4.71.2900 Remote Procedure Call DLL Microsoft Corporation C:\WINDOWS\SYSTEM\RPCRT4.DLL SHELL32.DLL 7FCB0000 1,400,832 4.72.3612.1700 Windows Shell Common Dll Microsoft Corporation C:\WINDOWS\SYSTEM\SHELL32.DLL SHLWAPI.DLL 70BD0000 278,528 5.00.2614.3500 Shell Light-weight Utility Library Microsoft Corporation C:\WINDOWS\SYSTEM\SHLWAPI.DLL USER32.DLL BFC00000 69,632 4.10.2233 Win32 USER32 core component Microsoft Corporation C:\WINDOWS\SYSTEM\USER32.DLL USP10.DLL 66650000 344,064 1.0325.2180.1 Uniscribe Unicode script processor Microsoft Corporation C:\WINDOWS\SYSTEM\USP10.DLL VERSION.DLL BFE70000 24,576 4.10.1998 Win32 VERSION core component Microsoft Corporation C:\WINDOWS\SYSTEM\VERSION.DLL WININET.DLL 76280000 458,752 5.00.2614.3500 Internet Extensions for Win32 Microsoft Corporation C:\WINDOWS\SYSTEM\WININET.DLL WINMM.DLL BFDF0000 65,536 4.03.1998 System APIs for Multimedia Microsoft Corporation C:\WINDOWS\SYSTEM\WINMM.DLL WINSPOOL.DRV 7FE40000 36,864 4.10.1998 Win32 WINSPOOL core component Microsoft Corporation C:\WINDOWS\SYSTEM\WINSPOOL.DRV WINTRUST.DLL 47600000 172,032 5.131.1880.14 Microsoft Trust Verification APIs Microsoft Corporation C:\WINDOWS\SYSTEM\WINTRUST.DLL WS2_32.DLL 76000000 73,728 4.10.2222 Windows Socket 2.0 32-Bit DLL Microsoft Corporation C:\WINDOWS\SYSTEM\WS2_32.DLL WS2HELP.DLL 75FE0000 24,576 4.10.1998 Windows Socket 2.0 Helper for Windows 98 Microsoft Corporation C:\WINDOWS\SYSTEM\WS2HELP.DLL Please test your systems with the latest version of Kexbasen that will allow you to reach the desktop and report any DLL differences that might be significant.

I don't have ME, so you need to tell us what Kernel32 API "0177:bff641a2" is in. "DumpPE -disasm Kernel32.dll" will help. If the code doesn't appear to be in an exported function, check the call stack for an address that is. In SE, bff741a2 is in the function: BFF74176 fn_BFF74176: ; Xref BFF7C9C9 BFF87CFCSo I would check the call stack for addresses about five (the length of a typical call instruction) higher: BFF7C9CE, BFF87D01. Keep doing the same until you find an exported API.

Release.11 Changelog: * some apis added to kexbases * some forwards removed from kexbasen (use Kexports for updated api lists) * includes map and pdb files for debugging * updated installer Release.11.7z The following details are still not quite complete: KernelEx 4.5.2015.11 file summary changelog Kexbasen.dll 4.5.2015.11 api changelog Kexbases.dll 4.5.2015.11 api changelog

From: http://www.softwarepatch.com/utilities/atk0110-acpi-utlility-driver.html

> I tried about ten programs but none worked under Windows98 (even not with KernelEx) Most video apps are compiled to use SSE instructions for speed. What cpu are you using and what are some of these programs that you would like to see working under Win98 with KernelEx?

> The purpose I have in mind is so that when I am finished with that list I can go to Windows Update and let it give me a once over. Oops.

Try renaming the video files with a .mp4 extension.I tried your download link in two browsers and the server at onedrive.live.com is unavailable....

Can the host server for the Zen update be blocked in our Hosts file?

GoPro support knows what format the video and photo files are in. Contacting them is the very first thing he should have done.

If the first error message was displayed by the camera, either (the camera or the card are defective) or (the camera and card are incompatible). Were they bundled at the store or separate items? Have you contacted GoPro support? > sandisc 32gb SD card I hope you meant "SanDisk" -- a "sandisc" would be a fake. SanDisk makes several 32GB SD cards. Do you have the Ultra, Extreme Pro, or what?

I've been playing with upgrading Mozilla and Qt apps with files from related apps. Some improvements to ImportPatcher.41 would be very helpful. So here's what's on the drawing board for ImportPatcher.42: EncodePointer / DecodePointer support For non-relocatable EXE's and DLL's, insert the needed four bytes of code somewhere and bind the import linkage to Kernel32.dll using our code address for these two functions. For relocatable DLL's, the relocation table will need two new entries (the bound address locations) added to it. For portable apps that need to run with different versions of Kernel32.dll, binding isn't feasible so the functions need to be renamed (or changed to ordinals) and additional startup code is needed to patch on-the-fly. This could be done in-place if the Import Address Table is in an executable section of memory. Binding / Unbinding support Initially just for the first case above. Also, "Unbind broken bindings" last worked in v.39. This should be reviewed and fixed. Msvcrt substitution Add button to add/remove these [DLL replacements] MSVCR90.dll=MSVCR80.dllMSVCR100.dll=MSVCR80.dllMSVCR110.dll=MSVCR80.dllMSVCR120.dll=MSVCR80.dllMsvcr80.dll is available (or can easily be patched) for Win9x. I've successfully used the 90 and 100 replacements several times.Display basic PE info for current file Link timestamp Link version Image version Full version information in drop-down box

if /I not "%COMPUTERNAME:~0,4%" == "hoem" goto :END

> I'm running Windows 98 SE. No, you were not. You were running 98lite which doesn't support KernelEx in all configurations. 98lite may be installing older (Win95) versions of some files or completely skipping others (such as IE system updates). Advapi32.dll comes to mind. Now that it is working, use Dependency Walker (v2.2.6000, File->Save As...Save As Type: Text) or TaskInfo2000 (v2.1, Edit->Copy Panes To Clipboard) to take a snapshot of all the necessary DLL names and version numbers. Those are the files you'll need to try updating in 98lite.

Prerelease of KernelEx.dll v4.5.2015.11 Same as v10, but with legacy Kexstubs support reenabled. Make sure you reboot the system! per new post #1 install instructions. Release.11a.7z

Your friend's camera might be capable of taking razor-sharp large pictures, but they were saved in a low quality mode (small size in this case). Regular JPEG is a lossy-compression format. The clarity of the original images is lost and gone forever. > If I take several very large jpegs and reduce them in size, a simple mouse click will restore them to their original size. No harm done. You must first have large, high quality images, and then the app must support undo. If you resave the files and the power fails or the system crashes before clicking "undo", the original quality is gone.

Implicit imports are "needed" to load, just in case their functionality is wanted later. Explicit imports are "wanted" to be used right now. Stubs are needed to enable modules to load, but don't actually do anything if called other than try to fake the app into not crashing. Adding new api stubs for new apps that "need" them has the potential to crash apps that "want" them but used to work without them. Flash 19 needs some Kexstubs definitions to load. These are implicit-only with v10 which is fine. However Flash 19 may also be invoking other Kexstubs definitions explicitly. That is no longer fine in v10. Check your Kexstubs log file to see which are being invoked. Try clearing the log file and then trigger the screensaver and/or loading a page that uses flash in an already-running browser. If you can give me a list of all definitions needed for a working Flash 19, I'll add support for all of them in v11. (Bonus points for any extra definitions needed for older flash versions!)

@MiKl: UPX converts most implicit import dependencies into explicit, delay-load dependencies. That is a potential problem for the new implicit-only stub loading method in v.10. If the Flash plugin dll is UPX-ed, try un-UPX-ing it. Same for all other files that work with kernelex.dll v9 but not v10. I have extracted SeaMonkey Setup 2.9.1.exe, original filename: 7zS.sfx.exe, size: 19818694. Without setup, it loads in v10 (but hangs with 100% cpu usage after displaying the UI and release notes page). Other than RtlUnwind, SeaMonkey 2.9.1 does not have any Rtl* dependencies. What module (and version) is reporting the missing reference? update: Cross-post with last three replies.... @loblo: > the problem with kexbasen.dll on windows ME seems to be gone Kexstubs definitions are also now implicit-only (0x54 prefix)...or perhaps related to the seven forwards to phantom Msvcrt functions I removed? > Many upx-compressed programs...[o]nce decompressed...run fine however. Good verification. I plan to add some new property sheet options for better control of the stub resolving logic. > Programs built with QT5.... such as? (a small one please!) @Dave-H: Good version details!

Older versions of SumatraPDF (1.9-2.2) would delay-load NtSetInformationProcess and were incompatible with any implementation. A stub for other apps could only be added once the "resolver" in kernelex.dll was modified to support implicit-only stubs. Be aware that by using kexbases.dll v10 with kernelex.dll v9, I expect you will not be able to run these older versions of SumatraPDF. There is nothing in your crash report (such as low stack addresses) to indicate what version of SeaMonkey you are refering to. As SM 2.0.14 is working okay for me, and SM 2.6.1 is also loading, what version is crashing for you? (I'm running SE with no formal service packs on a non-SSE cpu with 256MB of memory.)

Release.10.7z KernelEx v4.5.2015.10 by jumper2015-07-22+ 69 new api's, 37 improved, 9 removed.+ Support for implicit-only stubs.+ Prefix instruction added to beginning of all stubs in Kexbases and Kexbasen DS: (0x3e) for legacy stubs, ES: (0x26) for new stubs (implicit-only)+ API logging reduced to KernelEx enhancements (non-STD) only.Details by branch:Core\ Resolver.cpp: ExportFromOrdinal() and ExportFromName() modified to ignore implicit-only stubs when resolving explicitly Changed usage of terms for "implicit"/"explicit" from "static"/"dynamic" to "import"/"delay".Kexcrt\ strcpy.c reverted to version 4.5.2Common\ common.h "*UNIMPL_FUNC" macros prefixed with DS: (opcode 0x3e) for creating import+delay (legacy) stubs. common.h "*_UNIMPL_FUNC" macros prefixed with ES: (opcode 0x26) for creating import-only stubs. version.h renamed to kexversion.h to avoid conflict with standard header file; all references updated.ApiLibs\Kexbases\ Gdi32\Orhpans.cpp renamed to Orphans.cpp; updated reference in kexbases.dsp Gdi32\Orhpans.h renamed to Orphans.h; updated references in kexbases.dsp, Orphans.cpp, GdiObjects.c comctl32\: fixed warning in newclassreg.c and syslink.c by adding "#ifndef _WIN32_WINNT" 8 new Kernel32 stubs: se_UNIMPL_FUNC(FindActCtxSectionGuid, 5, ERROR_NI); //f5e rse_UNIMPL_FUNC(FindActCtxSectionStringW, 1, 5, 0 ); //o5e0 se_UNIMPL_FUNC(GetSystemWow64DirectoryA, 2, ERROR_NI); //z2e120 #65 se_UNIMPL_FUNC(GetSystemWow64DirectoryW, 2, ERROR_NI); //z2e120 #65 #304 se_UNIMPL_FUNC(GetVolumeNameForVolumeMountPointA, 3, ERROR_NI); //z3e120 se_UNIMPL_FUNC(GetVolumeNameForVolumeMountPointW, 3, ERROR_NI); //z3e120 se_UNIMPL_FUNC(GetVolumePathNamesForVolumeNameA, 4, ERROR_NI); //z4e120 se_UNIMPL_FUNC(GetVolumePathNamesForVolumeNameW, 4, ERROR_NI); //z4e120 2 removed Kernel32 stubs: FindActCtxSectionGui_, FindActCtxSectionStrin_W 7 updated Kernel32 stubs (to return correct error values): seUNIMPL_FUNC(CreateHardLinkA, 3, ERROR_NI); seUNIMPL_FUNC(CreateHardLinkW, 3, ERROR_NI); seUNIMPL_FUNC(ReplaceFileA, 6, ERROR_NI); seUNIMPL_FUNC(ReplaceFileW, 6, ERROR_NI); seUNIMPL_FUNC(GetProcessIoCounters, 2, ERROR_NI); seUNIMPL_FUNC(GetComputerNameExA, 3, ERROR_NI); seUNIMPL_FUNC(GetComputerNameExW, 3, ERROR_NI); 16 new Advapi32 stubs (plus 30 updated to return correct error values): se_UNIMPL_FUNC(AddAccessAllowedAceEx, 5, ERROR_NI); se_UNIMPL_FUNC(AddAccessDeniedAceEx, 5, ERROR_NI); se_UNIMPL_FUNC(ChangeServiceConfig2A, 3, ERROR_NI); se_UNIMPL_FUNC(ChangeServiceConfig2W, 3, ERROR_NI); se_UNIMPL_FUNC(IsTokenRestricted, 1, ERROR_NI); rs_UNIMPL_FUNC(LsaAddAccountRights, STATUS_NI, 4); rs_UNIMPL_FUNC(LsaEnumerateAccountRights, STATUS_NI, 4); rs_UNIMPL_FUNC(LsaFreeMemory, STATUS_NI, 1); rs_UNIMPL_FUNC(LsaLookupNames, STATUS_NI, 5); rs_UNIMPL_FUNC(LsaLookupNames2, STATUS_NI, 6); rs_UNIMPL_FUNC(LsaLookupPrivilegeValue, STATUS_NI, 3); rs_UNIMPL_FUNC(LsaLookupSids, STATUS_NI, 5); rs_UNIMPL_FUNC(LsaQueryInformationPolicy, STATUS_NI, 3); rs_UNIMPL_FUNC(QueryUsersOnEncryptedFile, ERROR_NI, 2); rs_UNIMPL_FUNC(RegOpenUserClassesRoot, ERROR_NI, 4); se_UNIMPL_FUNC(SetSecurityDescriptorControl, 3, ERROR_NI); 1 new Ntdll stub: rse_UNIMPL_FUNC(NtSetInformationProcess, STATUS_NI, 4, ERROR_NI);ApiLibs\Kexbases\ 53 new Ntdll forwards (to Msvcrt): _CIcos _CIlog _CIpow _CIsin _CIsqrt __isascii __iscsym __iscsymf __toascii _atoi64 _ftol2 _ftol2_sse _i64toa _i64tow _itow _lfind _ltoa _ltow _memccpy _memicmp _splitpath _strlwr _tolower _toupper _ui64toa _ui64tow _ultoa _ultow _wtoi64 _wtol atan ceil cos fabs floor iscntrl isgraph isprint ispunct isspace isupper iswalpha iswdigit iswlower iswspace iswxdigit isxdigit log mbstowcs sin tan wcscspn wcstombs 7 removed Ntdll forwards (not in Msvcrt!): _alloca_probe _itoa_s _vscwprintf strcpy_s wcscat_s wcscpy_s wcsnlen

> Laptop Screen at 640x480 Nothing to see. > Laptop Screen at 800x600 Nothing to see. > Laptop Screen at 1024x768 Analog sync problem. Probably wrong refresh rate. Is this the laptop screen or an external crt? > Laptop Screen at 1280x786 Appears to be working correctly at 1024x768 (square icons, pillar box on right side). Best photo of the set, but no mode information (rez/depth) displayed. Need to see Adapter, Monitor, and Displays tabs for this mode (or info from them, see below). This is a very usable mode. > Laptop Screen not present (not detected in Windows 98/ME, notice how the image gets cropped in the middle. > On native resolution 1280x800 the image is cropped in two places and even more shrunk horizontally) Photo is cropped on three sides making it hard to judge what we are seeing. Video mode seems to 1280x768x16 > Laptop Panel in XP (Laptop Screen is detected in Windows XP properly) Photo is cropped on two sides, but screen seems to be detected and working properly at 1280x800x32. In all modes: * In the Adapter tab, is refresh rate set to Adapter default or 60Hz? * In the Color Management tab, what is is the "Current monitor"? * In the Monitor tab, what is the Monitor and is the auto-detect box checked? * In the Performance tab, is Hardware acceleration set to "None"? How much system RAM (1GB?) and what are you doing to limit it? You can also try testing at 8-bit color depth.

https://wiki.mozilla.org/Ports/os2 * last update Nov 5, 2013 * requires SSE

Standard DLL's export available API's via the PE file's export table. Plug-ins "export" available API's via a special function that is specific to that plug-in standard. For KernelEx that function is get_api_table(). > I have sent the folder containing the portable SeaMonkey 2.6.1 to Kexports but I get result 0 and no INI. SeaMonkey DLL's are not KernelEx plug-ins and don't have a get_api_table() function. > Kexport[s] created a ini for iphlpapi3.dll but not for iphlpapid4.dll. Iphlpapi3 and Iphlpapi4 are hybrid DLL's that work both as regular DLL's and as KernelEx plug-ins. Iphlpapi4 doesn't seems to be working correctly as a plug-in (core.ini method), but it doesn't need to if you are using it with the local or Kexstubs methods.

Yes. Kexports: For exporting KernelEx get_api_table() API's. ... 1) put Kexports.exe (or shortcut) in SendTo folder ... 2) send one or more KernelEx dlls or folders to it ... 3) INI file with export list will be created for each KernelEx dll found Kexports.2.7z