KernelEx 2022 (Kex22) Test Versions (4.22.26.2)

[jumper]

Crypt32.dll might not be the only file we need to change the compatibility setting for....

Before proceeding, export HKEY_LOCAL_MACHINE\Software\KernelEx with RegEdit! (in addition to a ScanReg backup)

Open Kexbasen.dll (v.11) in Dependency Walker and go to the Module List (non-tree) panel. Select the first entry and press Alt+Enter to bring up the Property sheet for that DLL. Then click the next entry and press the down arrow key and then Alt+Enter to bring up the next sheet. Quickly repeat until sheets for all DLL's are open. Then for each sheet click: the KernelEx tab, "Disable KernelEx extensions", OK.

Now export HKEY_LOCAL_MACHINE\Software\KernelEx again and use Windiff or fc to isolate the changes.

You are now ready to try Kexbasen.dll v.11 again.

Edited January 5, 2016 by jumper

[schwups]

I don't have ME, so you need to tell us what Kernel32 API "0177:bff641a2" is in. "DumpPE -disasm Kernel32.dll" will help. If the code doesn't appear to be in an exported function, check the call stack for an address that is.

In SE, bff741a2 is in the function:

BFF74176                    fn_BFF74176:                ; Xref BFF7C9C9 BFF87CFC

So I would check the call stack for addresses about five (the length of a typical call instruction) higher: BFF7C9CE, BFF87D01. Keep doing the same until you find an exported API.

 

I had downloaded DumpPE 2.20 from softpedia yesterday. I am not familiar with it. It works, but the box closes or crashes immediately after writing the last line. Is there somewhere a text or log output?

[jumper]

DumpPE is a 32-bit console app. Run it in a DOS box, or from a batch file such as:

DumpPE-disasm.bat

@echo off%0\..\DumpPE -disasm %1 > %1.asmcls

I have a shortcut (renamed simply "DumpPE -disasm") to this batch file in my SendTo folder.

Last version of DumpPE is 2.32. I'll add a Wayback link to it in Post #1.

Edited January 5, 2016 by jumper

[loblo]

DumpPE 2.32 can be found in the current MASM32 package. http://www.masm32.com/download.htm

 

I have disabled KernelEx on all first level dependencies of kexbasen.dll v11 and I get the exact same crashes on reboot.

[loblo]

Running kernelex.dll v11, kexbases.dll v11 and original xeno kebasen.dll I have the following broken:

 

Apps/plugins I use relying on the Windows Imaging Component crash in windowscodecs.dll

Date 01/05/2016 Time 12:19MINICAP caused an invalid page fault inmodule WINDOWSCODECS.DLL at 0177:530012d5.Registers:EAX=530ac18e CS=0177 EIP=530012d5 EFLGS=00210296EBX=00000020 SS=017f ESP=00a7f568 EBP=00a7f594ECX=5306b3cc DS=017f ESI=530ac1b0 FS=67ffEDX=00000000 ES=017f EDI=530ac1b8 GS=0000Bytes at CS:EIP:02 0a 53 00 00 00 00 00 00 00 00 23 f5 09 53 58 Stack dump:00000002 00a80000 530a0234 7c001ee2 530ac1e8 5309f60d 530012a8 530012d8 00000000 00000000 833d20f8 00a7f5f4 5309f788 53000000 00000000 00000000 

CoreAudioToolbox..dll fails to initialize as per error message in console window when trying to use QAAC to transcode audio to aac/m4a.

 

Reverted to kernelex.dll v10, kexbases.dll v10 and original xeno kexbasen.dll.

[schwups]

DumpPE is a 32-bit console app. Run it in a DOS box, or from a batch file such as:

DumpPE-disasm.bat

@echo off%0\..\DumpPE -disasm %1 > %1.asmcls

I have a shortcut (renamed simply "DumpPE -disasm") to this batch file in my SendTo folder.

Last version of DumpPE is 2.32. I'll add a Wayback link to it in Post #1.

 

OK, thanks it works:

 

BFF64198 fn_BFF64198: ; Xref BFF627E2 BFF628C0 BFF6296D BFF62A6B

BFF64198 A1F8BCFBBF mov eax,[0BFFBBCF8h]

BFF6419D 8B00 mov eax,[eax]

BFF6419F FF401C inc dword ptr [eax+1Ch]

BFF641A2 FF4A10 dec dword ptr [edx+10h]

BFF641A5 7508 jnz loc_BFF641AF

BFF641A7 894208 mov [edx+8],eax

 

 

And how do I make the next step to QT_Thunk and FT_ Thunk?

 

BTW according to the txt file of DumpPE you added

 

Last version of DumpPE is 2.32. I'll add a Wayback link to it in Post #1.

 version 2.20.

[Dave-H]

Should I just forget about KernelEx 4.5.2015.11 for the moment?

[jumper]

No -- I need help debugging now more than ever!

Follow the instructions in post #243 and then post #232.

Please ignore most of post #229--the important values to note are EIP=bff741ca (or bff641a2) and EDX=00000000, and also Stack dump: 7d00b90d. Use Procwin to debug.

[jumper]

The fix for Release 4.5.2015.11 is kwinsys.reg:

REGEDIT4[HKEY_LOCAL_MACHINE\Software\KernelEx\AppSettings\Flags]"C:\\WINDOWS\\SYSTEM\\*"=dword:00000001

It can be undone with kwinsys-.reg:

REGEDIT4[HKEY_LOCAL_MACHINE\Software\KernelEx\AppSettings\Flags]"C:\\WINDOWS\\SYSTEM\\*"=-

[Dave-H]

Such a simple fix to implement, although I bet it wasn't at all simple to find out what was needed!

Thanks @jumper, 2015.11 all seems to be working fine now.

Cheers, Dave.

[MiKl]

Seem to be not working for me. Tried reg-merge and/or by manually adding this entry.    

[Dave-H]

I saved the text as a registry file, but I had to modify it as my Windows folder is not the default, (it's C:\WIN-98 instead of C:\Windows.)

Also it wouldn't merge into the registry by double clicking it for some reason. It said it had, but the entry wasn't actually there when I checked.

I had to import it using my registry editor.

[loblo]

I've got a number of dlls in the system dir that require KernelEx to be enabled. Those are all VC 90, 100, 110 and 120 runtimes, some directshow files, some video codecs and whatnot.

 

I am afraid this "fix" will break so much stuff I run regularly that I am wary of trying it.

 

With this and all that's broken already for me with a partial v11 (some UPX compressed files not loading with v10 already), I am wondering where the new KernelEx is going and whether there is a point installing it over good old one + KexStub as I can't see any  benefit  at all doing this for now.

 

No one reports program x or y running when it wouldn't in the old configuration. nor is there any indication it's going in this direction. Problems and potentially problematic workarounds are plenty however.

 

[DougB]

Just installed the fix, and it seems to be working ok here (U98SESP3, 98SE2ME, IEradicator, etc) -- it got past the desktop.  

Just for kicks, i removed Kext/KStubs to see what would / would not  work.  Recently-released Audacity v2.1.2 audio editor is working for me with straight KEx updates; previously, it required KExt.  Will report on others if there's any interest.  

To follow up on loblo's comment, KExt/KStubs is pretty-much over my head, being primarily an end user (but a fairly-decent "paint-by-numbers" guy ).  While it's certain that KExt will always be useful, I welcome the more-generalized solution of the KernelEx updates.  It seems to make sense from an efficiency/elegancy standpoint as well (from a not-too-technically-inclined end-user perspective).  Attempting a "one-size-fits-all" solution certainly does present challenges, though.  

- Doug B.

Edited January 23, 2016 by DougB

[jumper]

Compatibility with USP3 and other packs and upgrades is the goal. So please add the registry default mode setting for winsys and change the mode manually for any files that need KernelEx. Better yet, treat them as Auxiliary DLL's--move them into the KernelEx folder and add a [HKEY_LOCAL_MACHINE\Software\KernelEx\KnownDLLs] entry for each.