Jump to content

KernelEx 2022 (Kex22) Test Versions (


Recommended Posts

  • 2 weeks later...

@filth - Please set IDA to Win2000 mode or higher. GDI32.DLL:GetCharABCWidthsI is no longer enabled in BASE mode. Testers, remember to check CORE.INI and KTree when a regression appears.

@Dibya - Install 98se, then:
1) install Kernelex 4.5.2 choosing Disable by default
2) copy KernelEx folder to K45_2016. (DOS 8.3 name)
3) extract Core Update 4.5.2016. files to K45_2016. folder
4) exit to DOS
5) rename KernelEx folder to K45_0002
6) rename K45_2016. folder to KernelEx
7) reboot

Link to comment
Share on other sites

@jumper; Can we utilize radmin32 ansi library for all the ntdll and advapi32 functions that it has, it would enable the use of a wide range of new libraries. Can we redirect DelayLoadFalureHook to shlwapi IE6 SP1. The KnownDll list, not all are fully compatible but may be of use.

msvcr80 vs 8.0.31113.25 or 8.40209.38 are a fully functional replacement for msvcrt and only have _ctype missing from the 6.1.9848 msvcrt. They share the same memory base as Kexbasen and either Kexbasen or Msvcrt need to be relocated in memory as a consequence. 07D000000 can Kexbasen be shifted up a bit? Update (There are more functions that are missing but they seem not to be used. For the record I have uploaded the official differences comparing 3 Msvcrt substitutes : - output.csv - in the knowndlls.zip).

Divx Player 7.2 or later vs calls for an ANSI function when viewed in depends but when run using kernelex2016.17 calls a Unicode function in advapi32 (which is there) but it does not run.


Edited by Goodmaneuver
I have shifted non topic to 178142-screen-icons-refresh-when-opening-explorer-browsing-drive
Link to comment
Share on other sites

I would like to report that VLC 3.0.x runs with the Kext entry  "[Kernel32.dll] CheckRemoteDebuggerPresent= " up to Release/Update 10. The runtime error occurs since kexbases 11 and higher.  Could it be to do with LeaveCriticalSection and SetCriticalSectionSpinCount? 

Link to comment
Share on other sites

@Goodmaneuver - Thanks for the heads-up on Radmin32.dll. I've investigated dsclient9x.msi before but was focused on other dll's in the package.
+ Dnsapi.dll -- has DnsQuery_A, DnsQuery_W, DnsRecordListFree (or can be used whole)
+ Cryptdll.dll -- has MD5Final, MD5Init, MD5Update
+ Secur32.dll -- has DecryptMessage, EncryptMessage, FreeContextBuffer
* Radmin32.dll -- Kex overlaps: 68 Advapi32, 65 Ntdll, 37 Netapi32, 2 Winspool, 1 Kernel32
. . . Some are already implemented, but many are stubs.

Win9x Advapi32 and other system dll's also have many stubs, so many more might be useful.
Redistribution needs to be investigated. The whole package only needs to be installed for file sharing with XP+ systems.

As for DelayLoadFailureHook, Tihiy already has it forwarding to Shlwapi in an odd way. Unfortunately it's not in the versions that ship with 98se and ME!

@schwups - What is the runtime error and why did you choose to mention CheckRemoteDebuggerPresent, LeaveCriticalSection, and SetCriticalSectionSpinCount?

Link to comment
Share on other sites

I don't get a detailed error message. (This application has requested the runtime to terminate it in an unusual way.) DumpPE creates a very large logfile of 14MB. What should I look for?

Taking into account the changes from release 10 to 11, only these api's have become conspicuous for me.
 It is only my suspicion. I tried to override the added api's with K452stub.ini or core.ini. The two abovementioned showed an effect. Already the Explorer didn't start. MSVCRT.DLL was mentioned in that message.

Link to comment
Share on other sites

@jumper: radmin32 is also from the dsclient.exe within the UWMESP3.exe package. Dsclient.exe and UWMESP3.exe are self extracting.

dnsapi.dll (NT6 Kernelex) 5.1.2296 or similar is essential for my Netgear wireless adapter if I do not use the upgrade my new modem (router) terminates the WG111v3.exe. Also Win2K SP4 does the same thing, the first 2005 rollup KB891861-v2 stops the termination but CPU usage goes to 100%. (eapwake did not load). 5.1.2296 was just before DelayLoadFailureHook became prevalent. LinkInfo.dll unicode update speeds up navigation and stability but is not safe mode friendly.

crypt32 cryptnet cryptui cryptext docprop2 nddeapi msvidctl wintrust can be swapped from 5.1.2296 safemode friendly. I disable Kernelex extensions for some of the main files including all kernelex files themselves. Kernel32 (extensions disabled). I shifted kernelex to the system folder because I was getting unicows errors mainly along the way. I think when there is a full buffer the system trying to navigate to another directory may have been the trouble? Anyway much better very few times that I can recall happening since making the change 3 months ago. Imagehlp 6.0.5270 (imgutil dbghelp XPSP3) there are many upgrades.

Edited by Goodmaneuver
Link to comment
Share on other sites

DivX 7.2 works with Kernelex 2015.14. DivX supplies old apps on their web. Have to copy files from other OS to test

VLC3 gets the runtime error at 2015.13. More info at MSFN_Here

DivX works up until KEX16.

I am using uxtheme from one-core-x86.rar, (vDbgPrintWithPrefix is linked to DbgPrint) & ReactOS 45155 (not critical), as UxthemeBase.dll - (msvcrt used for ntdll imports and printf as DgbPrint). This will give 107 functions.

I use PDH 5.0.2195.1600, - needs more installations for native NT performance programs to run.

I used to be able to run net framework with 4.5.2 by disabling extensions on mscoree.dll and on the program. 2015.4 is the earliest I can find to test and these 2 libraries system.XML.dll (in the hidden assembly folder) and fusion.dll do not load on a test program; (Crossword Creator). The hidden assembly folders can be viewed copied etc with WinMerge (Disable custom heap)

Ignore this last paragraph as far as not working as the system memory manager can just handle everything at times, it just probably did not handled it. Modules have to be relocated for example or it is a registry error. UPDATE I have tested OK DotnetFX with KernelEx disabled on the program and on Mscoree.dll with earlier builds of my system.

Edited by Goodmaneuver
Added last paragraph.
Link to comment
Share on other sites

  • 3 weeks later...

I finally got time to test this newer version of KernelEx...hmmm, something's not right. I originally installed KernelEx 4.5.2 + v18 updates (I made sure to mix the v18 updates with a folder of updates up to v17). Once Windows rebooted, it gave me an error message that the drivers cannot be found. KernelEx gives me the newer options, but only resets after being applied...

I am also installing this on Windows ME

Edited by ~♥Aiko♥Chan♥~
Link to comment
Share on other sites

On 1/7/2019 at 3:58 AM, Goodmaneuver said:

@~♥Aiko♥Chan♥~ KerneLex.dll v17.7 needs to be used.

It seems KernelEx may have broken something in my Windows 98SE installation. The folders will not display anything despite setting them to view everything. I had to install total commander to get around this problem. EDIT: NVM I just had to set the view to icons xD

K-Meleon does work with the new updates and no longer gives the .db file error (tested on vmware).

Edited by ~♥Aiko♥Chan♥~
Link to comment
Share on other sites

@~♥Aiko♥Chan♥~ Might be folder.htt corruption, located in the root dir, windows dir, system dir, program files dir. I am using the original registry settings of webvw.dll 5.50.4134.100 for WinME as I like to keep the color scheme. Before registering webvw.dll I would take a copy of the %windir%\WEB folder and registry. I am using wscript.exe from win7. Explorer.exe with 95 settings may be required if 'Drive Properties' does not work. I recommend MDIE6CU.EXE as a base start for IE6SP1 it takes it up to Q982381. If you can get a good copy of folder.htt from the root dir of another build and copy into this build. Could also be a desktop.ini file at fault and I have rundll32.exe in both the system and windows directories. Rundll32.exe needs a minimum KernelEx setting to load some DLLs can not use disabled. Perhaps replace explorer and shell32.dll and re-register? MSHTML.dll may need disabling in KEX. Try a start up in safe-mode this will reset the icon and font caches to what are safe-mode compatible especially if RP9 is in use. The icon cache size should be up-sized in registry or by using X-Setup Pro. A figure of 6000 will enable 6000 icons to be cached.

PS KEX18 stepped up to a new Core.ini, so remember to replace Core.ini with original if going back to earlier KEX. Also if URLMON.dll is not being loaded it will cause the same symptoms.

Edited by Goodmaneuver
If KEX was not working then similar results could occur + more info
Link to comment
Share on other sites

  • jumper changed the title to KernelEx 2022 (Kex22) Test Versions (

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Create New...