Virtual Relativity

[jds]

A. Background.

I have an old HP printer/scanner that I would like to "connect" to a peer-to-peer WiFi network. I also have an older Pentium MMX computer that is doing nothing and could make it happen (yes, I do have a WiFi card that works with it).

The problem is that the driver/software disk for the printer/scanner refuses to install, because the minimum processor requirements are a Pentium MMX 233MHz, whereas this one's (a much more common in their day) 200MHz. That's it! The system meets all other requirements (W98SE O/S, RAM, disk space, star sign, etc).

Now, this stupidity really riles me! What possible difference is there between a 200MHz and a 233MHz Pentium MMX computer? You would be hard pressed to notice any performance difference, but this seems like elitism, since 233MHz (and 266MHz) Pentium MMX computers were much rarer than 200MHz. This software even refuses to install when I over-clock this computer to 225MHz!

B. The theory.

So, doing some research, it seems frequency checks such as this are typically performed by reading the Pentium's Time Stamp Counter with the RDTSC instruction and comparing this to a know time source, such as the real time clock. However, it is possible to make the RDTSC instruction privileged, so that user-mode (ring 3) applications (such as the above install software) will trigger an exception when they try to do so. The exception can be trapped by a handler, which can then simulate a Time Stamp Counter that is running at a different (faster) rate.

This is tricky stuff, involving some code that must run in ring 0, but at least it's easier to get there in W9X than in NT.

C. The practice.

Well, it's been about two months of research and struggle, many lock-ups, reboots, crashes, etc., but I've reached the stage where I can at least make the RDTSC instruction privileged, and thereby cause the above installation software to terminate with an error when it attempts to measure the processor speed.

But I can't seem to get it as far as to simulate a faster TSC (I plan to quadruple the apparent processor speed) for other (external) applications. If I invoke the RSTSC instruction within the same application, the exception gets trapped and the value returned is quadrupled. But for other (external) applications, an exception is generated but not intercepted.

Perhaps a fresh pair of eyes from someone more experienced in system programming can see what I'm doing wrong???

I'm at my wit's end.

The source code is attached. It's mainly assembly code within a Delphi skeleton. (Note that since I have Delphi 5, I have to hand-code the RDTSC instruction and instructions involving the CR4 register. Maybe newer versions of Delphi don't need this).

Joe.

quad_tsc.zip

[allen2]

Could you post the printer/scanner model (so i can try to clone the driver/software install) ?

Do you have a faster computer with vmware or any other virtualisation tool (you could easily install the driver in the virtual machine and then get it back in the physical one) ?

Sorry if you already tried this method.

[jds]

Could you post the printer/scanner model (so i can try to clone the driver/software install) ?

Do you have a faster computer with vmware or any other virtualisation tool (you could easily install the driver in the virtual machine and then get it back in the physical one) ?

Sorry if you already tried this method.

Hi Allen,

The model is PSC 1610.

No, I do not have any virtualisation software like vmware (nor do I have any experience with such).

In times past, I have tried to install recalcitrant software on another PC and transferring the files to the true target, but soon realized that doesn't work due to registry entries and registering of DLL's (which I presume also involves the registry). From your comment, using virtualisation software provides a way to do this successfully?

Joe.

[allen2]

Here is what i'll try (using the virtual machine trick) :

- create an offline disk image of the 200 MMX computer.

- restore it in a virtual machine on a faster computer.

- install the hp software.

- create an offline image of the virtual machine.

- restore it to the physical machine.

I'll look the drivers and see if they can be cloned for Windows 98SE.

[allen2]

Ok using installrite in a 98se virtual machine, i was able to clone the drivers install:

Here is the list of added files, modified files, registry key added, registry keys modified.

I could repackage the needed files if you need them.

Also as i made this on a clean 98Se some files already newer on your computer might exist and you'll probably only need the newer ones.

[jds]

Ok using installrite in a 98se virtual machine, i was able to clone the drivers install:

Here is the list of added files, modified files, registry key added, registry keys modified.

I could repackage the needed files if you need them.

Also as i made this on a clean 98Se some files already newer on your computer might exist and you'll probably only need the newer ones.

Hey, thanks Allen!

I'll try it out and let you know how it goes.

Joe.

[jds]

Hi again Allen,

Yikes! Looking at the registry entries created or modified, there's a total of 4105 of them, which look like they'll add maybe 400kB to the registry. Out of control.

Anyway, I notice in the list of new and modified files, that there are 38 with a date code of 21/11/10, which implies they are either created or modified by the software. I presume those hex numbers at the end of each line are a CRC32, so I'll see if the files in question can be extracted from the install software and if so, whether the CRC matches. If not, then I'll need to trouble you for a copy of these files, about 1.6MB uncompressed, no idea what size with compression. In addition, I'll probably need a "before and after" for WIN.INI, which is one of those 38 files.

Thanks for your help,

Joe.

PS. After more testing of my Virtual Relativity experiment, I've come to the conclusion that Windows must be swapping out the Interrupt Descriptor Table when handing control to other tasks, so my little application is unable to do the GPF handling except for its own code, hence cannot provide a simulated RDTSC. Maybe I have to learn how to write a VXD to do this sort of thing.

[allen2]

Ok i made an archive of the needed files and registry: http://www.megaupload.com/?d=TLEIA8E9 .

You should make a backup of your windows 98 Se before testing (a partiton image should be the best ) as we never now what could happen when replacing files and reg entries.

As for the win.ini, only one line is removed: in [Compatibility] section, the line SETUP=0x00000000.

[jds]

Ok i made an archive of the needed files and registry: http://www.megaupload.com/?d=TLEIA8E9 .

You should make a backup of your windows 98 Se before testing (a partiton image should be the best ) as we never now what could happen when replacing files and reg entries.

As for the win.ini, only one line is removed: in [Compatibility] section, the line SETUP=0x00000000.

Thank you Allen, you have gone above and beyond the call of duty!

I've downloaded and will report back on the success of this venture.

Joe.

[jds]

Success!

Printing and scanning are both now functioning on this Pentium MMX & PSC-1610.

Thanks again for your help, Allen.

PS. I had had a little setback that delayed things. The NVRAM/RTC (M48T86PC1) chose this time to finally exhaust its battery capacity. The PC kept saying something like "Checksum error, Flat battery, Reseting to factory defaults", even when rebooted with the power applied. Since these factory defaults have the USB controller disabled, it was impossible to connect either a flash drive or the PSC-1610. The M48T86PC1 appears to be discontinued, but fortunately, equivalents from Benchmarq (TI) and Dallas (Maxim) are still available.

PPS. As for the original GPF handler attempt, it is clear now that if you swap the IDT, it only gets used for the current process, other processes still use the standard IDT. But if I try to modify the GPF handler address in the standard IDT, I'm back to those instant reboot problems. So, this approach (via an application) just seems impossible, maybe if I ever learn how to write a VXD it may work ...