Jump to content

KernelEx 2022 (Kex22) Test Versions (4.22.26.2)


jumper

Recommended Posts

Crypt32.dll might not be the only file we need to change the compatibility setting for....

Before proceeding, export HKEY_LOCAL_MACHINE\Software\KernelEx with RegEdit! (in addition to a ScanReg backup)

Open Kexbasen.dll (v.11) in Dependency Walker and go to the Module List (non-tree) panel. Select the first entry and press Alt+Enter to bring up the Property sheet for that DLL. Then click the next entry and press the down arrow key and then Alt+Enter to bring up the next sheet. Quickly repeat until sheets for all DLL's are open. Then for each sheet click: the KernelEx tab, "Disable KernelEx extensions", OK.

Now export HKEY_LOCAL_MACHINE\Software\KernelEx again and use Windiff or fc to isolate the changes.

You are now ready to try Kexbasen.dll v.11 again.

Edited by jumper
Link to comment
Share on other sites


I don't have ME, so you need to tell us what Kernel32 API "0177:bff641a2" is in. "DumpPE -disasm Kernel32.dll" will help. If the code doesn't appear to be in an exported function, check the call stack for an address that is.

In SE, bff741a2 is in the function:

BFF74176                    fn_BFF74176:                ; Xref BFF7C9C9 BFF87CFC
So I would check the call stack for addresses about five (the length of a typical call instruction) higher: BFF7C9CE, BFF87D01. Keep doing the same until you find an exported API.

 

I had downloaded DumpPE 2.20 from softpedia yesterday. I am not familiar with it. It works, but the box closes or crashes immediately after writing the last line. Is there somewhere a text or log output?

Link to comment
Share on other sites

DumpPE is a 32-bit console app. Run it in a DOS box, or from a batch file such as:

DumpPE-disasm.bat

@echo off%0\..\DumpPE -disasm %1 > %1.asmcls
I have a shortcut (renamed simply "DumpPE -disasm") to this batch file in my SendTo folder.

Last version of DumpPE is 2.32. I'll add a Wayback link to it in Post #1.

Edited by jumper
Link to comment
Share on other sites

Running kernelex.dll v11, kexbases.dll v11 and original xeno kebasen.dll I have the following broken:

 

Apps/plugins I use relying on the Windows Imaging Component crash in windowscodecs.dll

Date 01/05/2016 Time 12:19MINICAP caused an invalid page fault inmodule WINDOWSCODECS.DLL at 0177:530012d5.Registers:EAX=530ac18e CS=0177 EIP=530012d5 EFLGS=00210296EBX=00000020 SS=017f ESP=00a7f568 EBP=00a7f594ECX=5306b3cc DS=017f ESI=530ac1b0 FS=67ffEDX=00000000 ES=017f EDI=530ac1b8 GS=0000Bytes at CS:EIP:02 0a 53 00 00 00 00 00 00 00 00 23 f5 09 53 58 Stack dump:00000002 00a80000 530a0234 7c001ee2 530ac1e8 5309f60d 530012a8 530012d8 00000000 00000000 833d20f8 00a7f5f4 5309f788 53000000 00000000 00000000 

CoreAudioToolbox..dll fails to initialize as per error message in console window when trying to use QAAC to transcode audio to aac/m4a.

 

Reverted to kernelex.dll v10, kexbases.dll v10 and original xeno kexbasen.dll.

Link to comment
Share on other sites

DumpPE is a 32-bit console app. Run it in a DOS box, or from a batch file such as:

DumpPE-disasm.bat

@echo off%0\..\DumpPE -disasm %1 > %1.asmcls
I have a shortcut (renamed simply "DumpPE -disasm") to this batch file in my SendTo folder.

Last version of DumpPE is 2.32. I'll add a Wayback link to it in Post #1.

 

OK, thanks it works:

 

BFF64198 fn_BFF64198: ; Xref BFF627E2 BFF628C0 BFF6296D BFF62A6B

BFF64198 A1F8BCFBBF mov eax,[0BFFBBCF8h]

BFF6419D 8B00 mov eax,[eax]

BFF6419F FF401C inc dword ptr [eax+1Ch]

BFF641A2 FF4A10 dec dword ptr [edx+10h]

BFF641A5 7508 jnz loc_BFF641AF

BFF641A7 894208 mov [edx+8],eax

 

 

And how do I make the next step to QT_Thunk and FT_ Thunk?

 

BTW according to the txt file of DumpPE you added

 

Last version of DumpPE is 2.32. I'll add a Wayback link to it in Post #1.

 version 2.20.

Link to comment
Share on other sites

  • 2 weeks later...

No -- I need help debugging now more than ever!

Follow the instructions in post #243 and then post #232.

Please ignore most of post #229--the important values to note are EIP=bff741ca (or bff641a2) and EDX=00000000, and also Stack dump: 7d00b90d. Use Procwin to debug.

Link to comment
Share on other sites

The fix for Release 4.5.2015.11 is kwinsys.reg:

REGEDIT4[HKEY_LOCAL_MACHINE\Software\KernelEx\AppSettings\Flags]"C:\\WINDOWS\\SYSTEM\\*"=dword:00000001
It can be undone with kwinsys-.reg:

REGEDIT4[HKEY_LOCAL_MACHINE\Software\KernelEx\AppSettings\Flags]"C:\\WINDOWS\\SYSTEM\\*"=-
Link to comment
Share on other sites

I saved the text as a registry file, but I had to modify it as my Windows folder is not the default, (it's C:\WIN-98 instead of C:\Windows.)

Also it wouldn't merge into the registry by double clicking it for some reason. It said it had, but the entry wasn't actually there when I checked.

I had to import it using my registry editor.

:)

Link to comment
Share on other sites

I've got a number of dlls in the system dir that require KernelEx to be enabled. Those are all VC 90, 100, 110 and 120 runtimes, some directshow files, some video codecs and whatnot.

 

I am afraid this "fix" will break so much stuff I run regularly that I am wary of trying it.

 

With this and all that's broken already for me with a partial v11 (some UPX compressed files not loading with v10 already), I am wondering where the new KernelEx is going and whether there is a point installing it over good old one + KexStub as I can't see any  benefit  at all doing this for now.

 

No one reports program x or y running when it wouldn't in the old configuration. nor is there any indication it's going in this direction. Problems and potentially problematic workarounds are plenty however.

 

:)

Link to comment
Share on other sites

Just installed the fix, and it seems to be working ok here (U98SESP3, 98SE2ME, IEradicator, etc) -- it got past the desktop.  

Just for kicks, i removed Kext/KStubs to see what would / would not  work.  Recently-released Audacity v2.1.2 audio editor is working for me with straight KEx updates; previously, it required KExt.  Will report on others if there's any interest.  

To follow up on loblo's comment, KExt/KStubs is pretty-much over my head, being primarily an end user (but a fairly-decent "paint-by-numbers" guy :)).  While it's certain that KExt will always be useful, I welcome the more-generalized solution of the KernelEx updates.  It seems to make sense from an efficiency/elegancy standpoint as well (from a not-too-technically-inclined end-user perspective).  Attempting a "one-size-fits-all" solution certainly does present challenges, though.  

- Doug B.

Edited by DougB
Link to comment
Share on other sites

Compatibility with USP3 and other packs and upgrades is the goal. So please add the registry default mode setting for winsys and change the mode manually for any files that need KernelEx. Better yet, treat them as Auxiliary DLL's--move them into the KernelEx folder and add a [HKEY_LOCAL_MACHINE\Software\KernelEx\KnownDLLs] entry for each.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...