WildBill Posted November 9, 2011 Author Share Posted November 9, 2011 Would you mind testing a bootskin to see how that works out? Link to comment Share on other sites More sharing options...
tomasz86 Posted November 9, 2011 Share Posted November 9, 2011 It works only partially. The bootskin is loaded but at the same time there's the standard progress bar too which is located in the up-left corner of the screen. Link to comment Share on other sites More sharing options...
WildBill Posted November 9, 2011 Author Share Posted November 9, 2011 Hmm. What were the bootskin settings? Link to comment Share on other sites More sharing options...
tomasz86 Posted November 9, 2011 Share Posted November 9, 2011 I used your settings:/bootskin=1:1:1:0:1:264:384:112:7:8and the bootskin.bmp from #234. Link to comment Share on other sites More sharing options...
WildBill Posted November 10, 2011 Author Share Posted November 10, 2011 Oops Mistake on my part. I messed up how I was testing the flag.Windows2000-KB2393802-v1-early-c5q-x86-ENU.exe Link to comment Share on other sites More sharing options...
tomasz86 Posted November 10, 2011 Share Posted November 10, 2011 (edited) I think the checksum is wrong...or maybe not as I've just checked it and it looks fine. I tried to install the patch on a uniprocessor system and got a BSOD on boot.EDITAfter doing more tests I can say that the same BSOD appears when I try to install v3 of the update... It's related to ntoskrnl.exe. I'll post the details later on. Edited November 10, 2011 by tomasz86 Link to comment Share on other sites More sharing options...
WildBill Posted November 10, 2011 Author Share Posted November 10, 2011 The uniprocessor one definitely won't work as I haven't migrated the changes to it yet. Only the non-PAE mp one is "done". I wanted to see if you give it a good bill of health on the bootskin stuff before updating the other three files. Link to comment Share on other sites More sharing options...
tomasz86 Posted November 11, 2011 Share Posted November 11, 2011 Are you sure? I'm outside now and can't check it once again but I tried installing both the current fixed version and also the original v3. Uniprocessor kernel should be fully functional in that one, shouldn't it?In both cases the BSOD was exactly the same, related to ntoskrnl.exe.The configuration it happened is a notebook:Pentium III-M 933Mhz640 MB PC133 SDRAMintegrated Intel GraphicsIDE HDD Link to comment Share on other sites More sharing options...
WildBill Posted November 11, 2011 Author Share Posted November 11, 2011 If the checksum is wrong, it won't even load: you'll get an error saying it's missing or corrupted. I've started porting the changes to the other files, so I'll be able to test it over the weekend. The V3 one worked here last time I checked... Link to comment Share on other sites More sharing options...
tomasz86 Posted November 11, 2011 Share Posted November 11, 2011 (edited) As I said before, I've checked the checksums and everything seems to be fine so it's not the problem here. I guess it may be a different issue but I'll wait with more testing for your final version I also forgot to say that the progress bar issue was fixed after installing c5q.On the other hand, I've prepared some new updates:MS11-?: Fraudulent digital certificates could allow spoofingWindows2000-UU-KBz2641690-x86-Global.exe (replaces 2616676)Microsoft VC++ 2005/2008/2010YumeYao_MicrosoftVC78910RuntimeLibraries_Addon_2_0_7_Win2K.7z (HFSLIP folder: HFAAO)This is a modified version of YumeYao's addon. It replaces Microsoft's VC++ 2005, VC++ 2008 & VC++ 2010. Some files from VC++ 2010 rely on kernel32.dll from BlackWingCat's KDW which is included in this addon. Edited November 11, 2011 by tomasz86 Link to comment Share on other sites More sharing options...
WildBill Posted November 12, 2011 Author Share Posted November 12, 2011 (edited) I finished porting the changes and the patch is working here, so I've posted MS11-011 v4 and updated the link on the master list. For the record, the complete list of new API calls the patch adds is:ntoskrnl.exe/ntkrnlpa.exe/ntkrnlmp.exe/ntkrpamp.exeKeAcquireInterruptSpinLockKeReleaseInterruptSpinLockInterlockedPushEntrySListInterlockedPopEntrySListRtlInt64ToUnicodeStringRtlIntegerToUnicodeRtlClearBitRtlTestBitRtlSetBitZwQueryInformationThread......already there, added it to the export tableIoForwardIrpSynchronously/IoForwardAndCatchIrp (same routine, has two different exported names)PsRemoveLoadImageNotifyRoutine (had to completely redesign the set and call routines to make this work)PsRemoveCreateThreadNotifyRoutine (had to completely redesign the set and call routines to make this work)_vsnwprintf_aulldvrmRtlGetVersionKeFlushQueuedDpcs ntdll.dllRtlIpv4StringToAddressARtlIpv4StringToAddressWRtlIpv4StringToAddressExARtlIpv4StringToAddressExWRtlIpv4AddressToStringARtlIpv4AddressToStringWRtlIpv4AddressToStringExARtlIpv4AddressToStringExWRtlIpv6StringToAddressARtlIpv6StringToAddressWRtlIpv6StringToAddressExARtlIpv6StringToAddressExWRtlIpv6AddressToStringARtlIpv6AddressToStringWRtlIpv6AddressToStringExARtlIpv6AddressToStringExWRtlInitializeGenericTableAvlRtlIsGenericTableEmptyAvlRtlGetElementGenericTableAvlRtlNumberGenericTableElementsAvlRtlInsertElementGenericTableAvlRtlDeleteElementGenericTableAvlRtlEnumerateGenericTableLikeADirectoryRtlLookupElementGenericTableAvlRtlEnumerateGenericTableWithoutSplayingAvlRtlEnumerateGenericTableAvlRtlEncodePointer (not a stub -- it's the real functionality and depends on changes to ntoskrnl.exe, etc.)RtlDecodePointer (not a stub -- it's the real functionality and depends on changes to ntoskrnl.exe, etc.)RtlInterlockedPushEntrySListRtlInterlockedPopEntrySListRtlInterlockedFlushSListRtlQueryDepthSListRtlInitializeSListHeadLdrLockLoaderLockLdrUnlockLoaderLockLdrAddRefDllRtlComputePrivatizedDllName_URtlValidateUnicodeStringRtlDuplicateUnicodeStringRtlDowncaseUnicodeCharRtlFindCharInUnicodeStringRtlpEnsureBufferSizeRtlMultiAppendUnicodeStringBufferRtlAppendPathElementLdrEnumerateLoadedModulesRtlRandomExRtlUnhandledExceptionFilter2RtlUnhandledExceptionFilterbootvid.dllVidSetVgaPalette (used by the bootskin code)kernel32.dllDecodePointer (forwarded export to NTDLL.RtlDecodePointer)EncodePointer (forwarded export to NTDLL.RtlEncodePointer)InterlockedPushEntrySList (forwarded export to NTDLL.RtlInterlockedPushEntrySList)InterlockedPopEntrySList (forwarded export to NTDLL.RtlInterlockedPopEntrySList)InterlockedFlushSList (forwarded export to NTDLL.RtlInterlockedFlushSList)QueryDepthSList (forwarded export to NTDLL.RtlQueryDepthSList)InitializeSListHead (forwarded export to NTDLL.RtlInitializeSListHead)GetModuleHandleExAGetModuleHandleExWIsWow64ProcessIsWow64MessageGetProcessHandleCountGetNativeSystemInfo (same as GetSystemInfo, simply added another export table entry)SetDllDirectoryASetDllDirectoryWGetDllDirectoryAGetDllDirectoryWAttachConsoleTzSpecificLocalTimeToSystemTimeSetClientTimeZoneInformationIsValidUILanguageGetSystemWow64DirectoryAGetSystemWow64DirectoryWSetHandleContextGetProcessIdEDIT: forgot to list a couple of extra routines I added to ntdll. Edited November 12, 2011 by WildBill Link to comment Share on other sites More sharing options...
WildBill Posted November 13, 2011 Author Share Posted November 13, 2011 tomasz: just as soon as you can give me the all-clear for V4 I'll consider that a green light for V5 (I've already started on it and added a few more routines to ntdll and kernel32)... Link to comment Share on other sites More sharing options...
tomasz86 Posted November 13, 2011 Share Posted November 13, 2011 I missed the fact that you already uploaded a v4 I've installed it on both my desktop and laptop computers and while everything seems to work fine here (on the desktop), there's still the same error on the other one:*** STOP: 0x0000001E (0xC0000005, 0xDDC6473E, 0x00000000, 0x0000000C)KMODE_EXCEPTION_NOT_HANDLED*** Address DDC6473E base at DDC00000, DateStamp 4ebda139 - ntoskrnl.exeSystem specifications are listed in #398 Link to comment Share on other sites More sharing options...
WildBill Posted November 13, 2011 Author Share Posted November 13, 2011 (edited) Hmm. I'm going to need some more info to track that one down, since the address is pointing to a trap routine (specifically, it traps 0x57, which I assume means int 0x57). When does the BSOD happen? Does it create a minidump file? It looks like it trapped an interrupt (maybe from a driver?) and it didn't like it.The 0xC0000005 means ACCESS_VIOLATION, so I assume that it tried to access an invalid memory location. The problem is going to be finding where it happened.Edit: it looks like int 57h is a relocated IRQ7, so maybe a driver that's using IRQ7 is causing the problem. The interrupt request for a driver is shown under the Resources tab in the Device Manager. It's also possible that it's really IRQ15, from a secondary interrupt controller. Edited November 13, 2011 by WildBill Link to comment Share on other sites More sharing options...
tomasz86 Posted November 13, 2011 Share Posted November 13, 2011 The BSOD happens just right after the GUI mode of /SOS startup is loaded. Surprisingly, safe mode works which is an improvement compared to the previous versions when the BSOD appeared during safe mode booting too.It appears before bootlog is created and minidump also is not created when the BSOD happens. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now