[WIP] Windows Vista Extended Kernel

[CosmoDreamy]

I don't think I can thank you enough for keeping the unloved but adorable Vista alive with a project like this! <3

You could consider putting up a separate message board for Vista stuff tbh, it might be worth it given how much of a niche it is even in the MS dev community heh (heck there's an Aero-esque theme for phpBB 3.2.x, lol)

Edited June 30, 2020 by CosmoDreamy

[win32]

I appear to have exhausted all reasonable options for modifying the import table aside from rebuilding it from scratch. But shell32 calls over 1200 functions so that is practically impossible. The procedure for doing this on x86 is considerably easier thanks to PE Maker.

So I decided to call NtQueryInformationFile instead and now Waterfox Classic 2020.3.1 including e10s works.

We are back on track. Even took a peek inside Server 2019's uefi.sys and dxgkrnl.sys. The latter has what appears to be calling dozens of functions missing from ntoskrnl.exe , yet uefi.sys only has about 4.

[burd]

5 hours ago, docR said:

 

Also, I do have one question for you. As @WinClient5270 and myself have learned, painfully from experience. Haswell absolutely does not play ball with Vista. Not even my x99 Haswell-E setup. Vista will complete installation, and even support all/or most chipset functions. But it suffers from a rather severe startup issue. Essentially, about 1 in every 5 boots will present with a "timing initialization error" or some such. This will either blacken out the login screen, or login with incomplete services. Explorer might not start, or a network/sound device may not initialize, etc. I was wondering if you could perhaps look into this issue?

 

 

 

 

Even back in 2016 when i got my skylake pc it had this same issue , i read somewhere this problem existed in 7 but was patched up although vista didnt receive the patch, although a reboot isnt necessary one can simply create the dwm/explorer processes manually to make it work(atleast i do this on my skylake 6770hq) the audio service can be started from services ofcourse

Edited June 30, 2020 by burd

[docR]

3 minutes ago, burd said:

Even back in 2016 when i got my skylake pc it had this same issue , i read somewhere this problem existed in 7 but was patched up although vista didnt receive the patch, although a reboot isnt necessary one can simply create the dwm/explorer processes manually to make it work(atleast i do this on my skylake 6770hq)

Well sure, provided its something as meager as DWM or explorer.exe. But when a sound device cannot initialize despite any attempt to manually start it, or the network device fails, heck the Windows Firewall goes haywire. Worse of all is if one device isn't initialized, it's fairly safe to assume something else didn't start. I ran Vista on my Z97 PC Mate for several months and at one point ClearType corrupted itself. This bug is truly nothing short of chaos.  Granted, my budget z97 board at the time probably excavated the issue. In my brief testing with my t5810, startup initialization failures were far less frequent. But I didn't keep the install long enough to test long-term stability.

[burd]

36 minutes ago, docR said:

Well sure, provided its something as meager as DWM or explorer.exe. But when a sound device cannot initialize despite any attempt to manually start it, or the network device fails, heck the Windows Firewall goes haywire. Worse of all is if one device isn't initialized, it's fairly safe to assume something else didn't start. I ran Vista on my Z97 PC Mate for several months and at one point ClearType corrupted itself. This bug is truly nothing short of chaos.  Granted, my budget z97 board at the time probably excavated the issue. In my brief testing with my t5810, startup initialization failures were far less frequent. But I didn't keep the install long enough to test long-term stability.

btw, afaik this bug doesnt exist on 32bit vista(i for one havent tried so cant confirm) , also is haswell worse than skylake is it safe to say so? i get a few issues here and there but they can all be fixed. Sound Issues are fixed through services , sometimes it would just run so slow due to superfetch not running but nothing major over here.

 

@win32 Great job on getting PM and WF working , idk if this info might be useful but in the future it could possibly help , nvidia drivers unofficially do work upto 372.70 , using 372.90 doesnt work , so that might be a great starting point for you? might be just a few missing functions or so since it does support w7 rtm

[win32]

I think this is the Windows 7 hotfix applicable to this situation:

https://support.microsoft.com/en-us/help/2615701/-logon-process-initialization-failure-error-message-and-the-logon-process-does-not-start-in-windows-7-or-in-windows-server-2008-r2

Quote

This issue occurs because a system-wide event is used during the logon process before the event object is created. This behavior causes the logon process to fail.

But for some stupid reason it keeps redirecting me to a failed attempt to sign in to a M$ account. And of course the hotfix system has been dismantled so no attempts at comparison can be made between that and regular Windows 7 files, in order to backport to Vista. But I don't think that is the exact problem, as this is from late 2011 and Haswell was only released in 2013. And it also doesn't mention the behaviour where the logon process does initialize but other services don't. And I'm sure there are many people who are using Windows 7 without this hotfix and never having logon process issues on Haswell and later. It's not in Simplix pack and it doesn't appear that a future update superseded it unless the modifications made in this hotfix were discreetly carried over to later versions.

But for what it's worth, it appears that the changes were mostly in kernel32.dll (which is broken up into several files on Windows 7) as well as the Local Session Manager. Plus WOW64 and Terminal Services. But I'm not sure what these changes are.

I also found some potential registry-based solutions for dealing with individual services not starting up:

https://support.microsoft.com/en-us/help/943996/some-services-do-not-start-in-windows-vista-and-windows-7

Also, did the logs/event viewer produce any information of substance?

@burd

And I just checked out 372.90's kernelmode (NVLDDMKM.SYS) driver. Only one function missing in ntoskrnl.exe, which is memcpy_s. The usermode Direct3D shim driver (nvumdshimx.dll) is missing the following functions in user32.dll:

GetDisplayConfigBufferSizes

QueryDisplayConfig

DisplayConfigGetDeviceInfo

Those functions are also called by the 372.70 version of the file. Maybe that's why you get such crappy D3D performance with those drivers! I'm definitely adding those ones to user32.

UPDATE: turns out 365.19 also does call them. But they also don't support 1000 series where this problem happens.

And MS is lying about DisplayConfigGetDeviceInfo being in Vista:

https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-displayconfiggetdeviceinfo

I certainly don't have it and I do have every update up to Vista's EOL.

Edited June 30, 2020 by win32

[burd]

3 hours ago, win32 said:

 

Those functions are also called by the 372.70 version of the file. Maybe that's why you get such crappy D3D performance with those drivers! I'm definitely adding those ones to user32.

UPDATE: turns out 365.19 also does call them. But they also don't support 1000 series where this problem happens.

 

most people here dont have a 10 series card or above , although i remember someone mentioning that their 900 series card worked just fine on 372.70 aswell. Modifying 365.19 gives a bsod , so using modified 368 and above works but still same performance as 372.70 , quite weird , opengl applications work just fine aswell on all of them and vulkan doesnt work on either of them through my testing , i dont exactly remember but maybe nvumdshimx.dll was the issue even in that.

Edited June 30, 2020 by burd

[NT 6.0]

Yes..unfortunately, I have chosen the GTX 1050 Ti back then. It is a small card that fits inside this prebuilt OEM desktop. Works fine for the "gaming" that I intend to do, which is mostly older, not very demanding applications (if any at all). That is a major issue that holds me back from even attempting to install Vista at the moment. 

[win32]

5 hours ago, burd said:

and vulkan doesnt work on either of them through my testing

I looked at the Vulkan driver (both vulkan dlls in VulkanRT-Installer.exe) and it doesn't seem to have any dependency issues on Vista. I'm stuck on a GTX 260/Quadro FX 3800 so I can't test anything though. Perhaps the Vulkan applications have their own compatibility issues?

Though, while I'm at it, here are the missing functions in ntoskrnl required for Skylake graphics:

strncpy_s

wcscpy_s

IoUnregisterPlugPlayNotificationEx

swprintf_s

strcpy_s

RtlUnicodeToUTF8N

vswprintf_s

_vsnprintf_s

vsprintf_s

_snprintf_s

KeSetCoalescableTimer

strnlen

sprintf_s

strcat_s

memcpy_s

wcsncpy_s

Most of these functions exist in Vista but without the "_s" appended to them.

[greenhillmaniac]

21 hours ago, win32 said:

Though, while I'm at it, here are the missing functions in ntoskrnl required for Skylake graphics:

Is it possible that GPU drivers have a hard coded OS check at the sys level? I say this, because AMD drivers on Windows 8.0 completely BSOD, while they work just fine on Windows 7 (maybe there could be a similarity to Intel's Vista approach)

[win32]

1 hour ago, greenhillmaniac said:

Is it possible that GPU drivers have a hard coded OS check at the sys level? I say this, because AMD drivers on Windows 8.0 completely BSOD, while they work just fine on Windows 7 (maybe there could be a similarity to Intel's Vista approach)

I could see them calling reg keys like HKLM\Software\Microsoft\Windows NT\CurrentVersion and calling KeBugCheck or something similar if they saw (or did not see) a certain version. But I don't think that happened in that case.

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x139--kernel-security-check-failure

Yours had a 3 in parameter 1, so a corrupted LIST_ENTRY.

Quote

Because many system components internally utilize LIST_ENTRY lists, various types of resource mismanagement by a driver using system APIs might cause linked list corruption in a system-managed linked list.

But the issue seems to only be restricted to Windows 8's dxgkrnl.sys; there seem to be no issues with the ones in 7 and 8.1. Perhaps the last working and first broken driver need to be compared, or dxgkrnl.sys needs to be replaced with a 7 or 8.1 version (preferably 8.1). There must be some differences in 8's dxgkrnl.sys compared to the 7 and 8.1 versions, and perhaps the driver no longer accommodates for that one since it's no longer a targeted/supported platform. More specifically, DXGCONTEXT::SubmitPresentHistoryToken needs to be compared between the three OSes.

Going back to Vista, I admit that the road to an extended ntoskrnl.exe/dxgkrnl.sys/etc will be tricky. Even with Windows 2000's kernelmode driver extension, some XP display drivers were quite unstable in certain games; BWC had to edit the drivers further to improve functionality. But it will be interesting to see how far we go.

[win32]

Heads up about Firefox installers (78.0.1 to be exact). To install, add "setup.exe" to the list of applications in Application Verifier x86 and adjust version settings accordingly.

Firefox 68.9 ESR is mostly working, except for a quirk involving the address/search bars. There are no default search engines and no way to add them. Thus, if you want to load pages directly from the address bar, you have to specify the protocol (like http;// or ftp://). Please note that the uxtheme.dll I'm using is a little stubby, but it does seem to be a far-fetched link. And I'd think that uxtheme would be OK being stubbed as, much like with dwmapi, uxtheme only needs to accommodate themes compatible with Windows Vista and not those for Windows 7. Perhaps some more debugging is needed.

As for 78.0.1, it appears we will now need K32GetPerformanceInfo in kernel32.dll. The Firefox executable now also calls for RtlQueryPerformanceCounter in ntdll.dll.

The thing is that, ntdll seems to be untouchable in NT 6.0! There's tonnes of extra data beyond the specified sections, which CFF Explorer does not handle gracefully. Stud_Pe does recognize the extra data, and makes new sections beyond it. But I still haven't tried adding any code since, as RtlQueryPerformanceCounter can easily be substituted for something like NtQueryInformationProcess.

In fact, now that I extended kernel32.dll and modified firefox.exe, it seems to work similar to 68.9 ESR with the same bug. I'll get to the bottom of this!

UPDATE: Turns out that windbg still works with my kernel extensions. So, this is what happens with Firefox 68.9 ESR:

Quote

This happens when typing in the address bar

[JavaScript Error: "Unable to initialize search service." {file: "resource://gre/modules/PlacesSearchAutocompleteProvider.jsm" line: 48}]
initialize@resource://gre/modules/PlacesSearchAutocompleteProvider.jsm:48:13

This happens when typing in the search bar

[JavaScript Error: "uncaught exception: 2147500037" {file: "chrome://browser/content/search/searchbar.js" line: 154}]
[JavaScript Error: "NS_ERROR_FAILURE: Failure'Failure' when calling method: [nsISearchService::defaultEngine]" {file: "chrome://browser/content/search/searchbar.js" line: 154}]
get currentEngine@chrome://browser/content/search/searchbar.js:154:27
_setupEventListeners/<@chrome://browser/content/search/searchbar.js:471:11

This is what happens when trying to installing the DuckDuckGo browser search extension. The Privacy Essentials extension does work.

[JavaScript Error: "uncaught exception: 2147500037" {file: "chrome://browser/content/parent/ext-chrome-settings-overrides.js" line: 325}]
[JavaScript Error: "NS_ERROR_FAILURE: Failure'Failure' when calling method: [nsISearchService::getEngineByName]" {file: "chrome://browser/content/parent/ext-chrome-settings-overrides.js" line: 325}]
[JavaScript Error: "Content Security Policy: The page’s settings blocked the loading of a resource at eval (“script-src”)." {file: "moz-extension://3aea4e1a-c0f1-42cc-8ee6-b729a89b5653/public/js/background.js" line: 3759}]
1593666162617    addons.xpi    WARN    Failed to remove temporary file C:\Users\Shane\AppData\Local\Temp\tmp-8vz.xpi for addon https://addons.cdn.mozilla.net/user-media/addons/385621/duckduckgo_privacy_essentials-2020.5.28-an+fx.xpi?filehash=sha256%3A4b71055a9ee9f720ae8b793e68ebe100c1e6274623655a783fd85c4192c9faa7: [Exception... "Component returned failure code: 0x80520015 (NS_ERROR_FILE_ACCESS_DENIED) [nsIFile.remove]"  nsresult: "0x80520015 (NS_ERROR_FILE_ACCESS_DENIED)"  location: "JS frame :: resource://gre/modules/addons/XPIInstall.jsm :: removeTemporaryFile :: line 1481"  data: no] Stack trace: removeTemporaryFile()@resource://gre/modules/addons/XPIInstall.jsm:1481
startInstall()@resource://gre/modules/addons/XPIInstall.jsm:1860
[JavaScript Error: "tried to detect trackers before rules were loaded" {file: "moz-extension://3aea4e1a-c0f1-42cc-8ee6-b729a89b5653/public/js/background.js" line: 287}]
getTrackerData@moz-extension://3aea4e1a-c0f1-42cc-8ee6-b729a89b5653/public/js/background.js:287:19
handleRequest@moz-extension://3aea4e1a-c0f1-42cc-8ee6-b729a89b5653/public/js/background.js:19347:32
applySafeWithoutClone@resource://gre/modules/ExtensionCommon.jsm:588:24
fire@resource://gre/modules/ExtensionChild.jsm:1171:41
receiveMessage@resource://gre/modules/ExtensionChild.jsm:1175:17
_callHandlers/<@resource://gre/modules/MessageChannel.jsm:914:29
_callHandlers@resource://gre/modules/MessageChannel.jsm:913:14
_handleMessage/deferred.promise<@resource://gre/modules/MessageChannel.jsm:992:12
_handleMessage@resource://gre/modules/MessageChannel.jsm:989:24
receiveMessage/<@resource://gre/modules/MessageChannel.jsm:225:14
receiveMessage@resource://gre/modules/MessageChannel.jsm:218:10

[JavaScript Error: "[Exception... "Component returned failure code: 0x80070057 (NS_ERROR_ILLEGAL_VALUE) [nsIDOMWindowUtils.addSheet]"  nsresult: "0x80070057 (NS_ERROR_ILLEGAL_VALUE)"  location: "JS frame :: resource://gre/modules/ExtensionCommon.jsm :: runSafeSyncWithoutClone :: line 75"  data: no]"]
runSafeSyncWithoutClone@resource://gre/modules/ExtensionCommon.jsm:75:12
inject/cssPromise<@resource://gre/modules/ExtensionContent.jsm:506:13

 

Where is search engine information stored in modern Firefox?

Furthermore, it thinks I have no Windows Media Foundation. Maybe if I extended it (mf and mfplat.dll) it would work. Maybe.

And now for Visual Studio Code: to install it, add VSCodeUserSetup-x64-1.46.1.tmp (or whatever the exe is called, just with a tmp at the end) to Application Verifier x86.

It needs these functions:

shell32

Shell_NotifyIconGetRect

user32

ChangeWindowMessageFilterEx

SetWindowDisplayAffinity

kernel32

PowerClearRequest

PowerCreateRequest

PowerSetRequest

QueryUnbiasedInterruptTime

RaiseFailFastException

K32GetMappedFileNameW (this one is for Brave browser based on Chromium 83)

But apparently Office 2016+ and MS Edge installers (click-to-run) don't like local files, so they won't install.

Edited July 2, 2020 by win32

[win32]

Unfortunately things aren't working out with Brave:

Quote

KERNEL32!RaiseException+0x3d:
00000000`727466cd 4881c4c8000000  add     rsp,0C8h

then

chrome_7fedb060000!ChromeMain+0xcee46:
000007fe`db13269e 488b11          mov     rdx,qword ptr [rcx] ds:00000000`00000000=????????????????

And I have identified two conditions that may cause a system to lock up; first, running chrome_pwa_launcher.exe from Brave's folder or attempting to use Netflix in Firefox 68 ESR and later. In the second case, it seemed to be due to GetCurrentPackageId, which is a Windows 8 function. Firefox also does exhibit completely different behaviour if tricked into thinking it's on 8.x, as most UI elements don't work in that case. You can disable buggy functions by opening your local copy of a dll in ExportTableTester, and simply changing "XXXXFunction" to "XXXXFunctio_".

But Electron-based Visual Studio Code seems to be in a better place. The only thing holding that back is my incomplete implementation of Shell_NotifyIconGetRect. All I have to do for that one is add a chunk of the function (as in a part that is separated from the rest), two subroutines with a chunk each, as well as a couple of new qword values in the data section. Luckily, all of its imports are accounted for in the Vista version.

I can't think of a good, modern Chromium browser to try. It seems that they are all undesirable in some way, and their only good purpose is to view heavily-DRMed content that roytam1's or Tobin's browsers can't handle.

With the expanded complexity of the project in mind, I have scrapped the idea for the tutorial. I am working on alternative means of distribution for the kernel extensions. Please contact me for more information.

[docR]

20 hours ago, win32 said:

I can't think of a good, modern Chromium browser to try. It seems that they are all undesirable in some way, and their only good purpose is to view heavily-DRMed content that roytam1's or Tobin's browsers can't handle.

I like to use a fork called Advanced Chrome in the occasional event I need something Chromium-based. It doesn't include any background services nor auto updater, and the fonts and tab styling is a bit less.. tacky. GDI-style font rendering is applied via custom mask for DirectWrite. One variant is based on 74, other 84. https://browser.taokaizen.com/

There's another project hosted on Discord too which seeks to make bread and butter Chromium 76 compatible with XP too, but the project has long been brought to a halt due to unmet dependencies. It does, however partially load under Vista. The UI will open after several error messages with aero glass frames, but it can't render pages. Not even the settings tab. I can DM the zip file if you're curious to inspect the errors. It's not open source so I'm not sure about redistribution rights, otherwise I'd drop the link here.

[win32]

22 hours ago, win32 said:

And I have identified two conditions that may cause a system to lock up; first, running chrome_pwa_launcher.exe from Brave's folder or attempting to use Netflix in Firefox 68 ESR and later. In the second case, it seemed to be due to GetCurrentPackageId, which is a Windows 8 function. Firefox also does exhibit completely different behaviour if tricked into thinking it's on 8.x, as most UI elements don't work in that case. You can disable buggy functions by opening your local copy of a dll in ExportTableTester, and simply changing "XXXXFunction" to "XXXXFunctio_".

I've narrowed this down along with other similar limitations. The system lockups are due to me running in debug mode; in fact, pressing PrintScreen will lock up the system!

The only issue with dependency walker/debugging of programs using my extensions is that trying to track GetProcAddress/LoadLibrary functions will cause a buffer overflow exception. Aside from that, debugging with redirected DLLs is very possible. The obvious solution is to replace the system files with mine, which I was able to do early on, yet now it appears that winlogon/logonui can no longer accept them. And they don't redirection.

While Brave and its main DLLs don't seem to export any W7+ functions from DLLs other than kernel32.dll, I decided to copy the rest over and now get a fault in kernel32 at 78DFEC00h, which corresponds to an import table entry for RtlFreeOemString ("Frees the string buffer allocated by RtlUnicodeStringToOemString.") from ntdll, which is called by two subroutines in kernel32. Further investigation required.

Visual Studio Code now works, not hindered by my unfinished implementation of Shell_NotifyIconGetRect, but thanks to the fixing of another bug in another function I implemented. Do not, under any circumstances, try to reimplement ntdll functions in other DLLs (except for ntdll functions that are forwarded from kernel32, in kernel32)!

There are issues though, with the module that implements extensions/plugins, spdlog.node. It uses up lots of CPU time bringing CPU usage to ~94% on my Xeon X5670.

1 hour ago, docR said:

I like to use a fork called Advanced Chrome in the occasional event I need something Chromium-based. It doesn't include any background services nor auto updater, and the fonts and tab styling is a bit less.. tacky. GDI-style font rendering is applied via custom mask for DirectWrite. One variant is based on 74, other 84. https://browser.taokaizen.com/

I'll try that soon, once I get the x86 ball rolling, since there doesn't seem to be any x64 binaries available for Windows. In fact, my earlier post about shelving MS Edge and Office 2016+ due to disobedient installers was in error, since I just checked and found that the installers are indeed 32-bit. I've turned into Tim Apple with his OS' relentless pursuit to abandon 32bit binaries.

Actually Windows 7 x86 kernel32 code is far simpler than the x64 equivalents, so I have an even better feeling about it. Just need to work quickly enough before x86-32 everything is deprecated!

Edited July 4, 2020 by win32