Jump to content
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble

MSFN is made available via donations, subscriptions and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. Alternatively, register and become a site sponsor/subscriber and ads will be disabled automatically. 


win32

[WIP] Windows Vista Extended Kernel

Recommended Posts

4 minutes ago, win32 said:

I'll try that soon, once I get the x86 ball rolling, since there doesn't seem to be any x64 binaries available for Windows. In fact, my earlier post about shelving MS Edge and Office 2016+ due to disobedient installers was in error, since I just checked and found that the installers are indeed 32-bit. I've turned into Tim Apple with his OS' relentless pursuit to abandon 32bit binaries. :lol:

I wouldn't go quite that far. If you were Tim Cook you wouldn't be in pursuit of patching an OS from 2007, you'd be too preoccupied depreciating one from 2017 :buehehe:

Fair enough, I didn't take into account the x86/x64 subsystems. It's easy to forget x64 NT 6.x is like 2 OSes.

  • Like 3

Share this post


Link to post
Share on other sites

Out of curiosity, I tried running Passmark Performance Test v. 10 under Vista. It's updated with Server 2008 updates up through January, on build 6003. This is the error I observed after attempting to launch the executable post-installation.

 

passmark 10 vista error.png

Share this post


Link to post
Share on other sites
11 hours ago, docR said:

Out of curiosity, I tried running Passmark Performance Test v. 10 under Vista. It's updated with Server 2008 updates up through January, on build 6003. This is the error I observed after attempting to launch the executable post-installation.

 

passmark 10 vista error.png

With or without the kernel extension? either way i doubt this function was added to kernel32 by win32

Share this post


Link to post
Share on other sites
Posted (edited)

I'll add GetActiveProcessorCount (plus associated functions GetActiveProcessorGroupCount, GetMaximumProcessorCount and GetMaximumProcessorGroupCount) once I get back to the x64 files. My x86 kernel32.dll is about 25% finished. I am holding off a wider release until the x86 files are completed and a few bugs are fixed.

Edited by win32
  • Like 1

Share this post


Link to post
Share on other sites
50 minutes ago, win32 said:

I'll add GetActiveProcessorCount once I get back to the x64 files. My x86 kernel32.dll is about 25% finished. I am holding off a wider release until the x86 files are completed and a few bugs are fixed.

Just a quick question , do you believe a backport of w7's trim functionality is possible?

Share this post


Link to post
Share on other sites
17 minutes ago, burd said:

Just a quick question , do you believe a backport of w7's trim functionality is possible?

Perhaps. It would have to be implemented through the NTFS/ReFS drivers. My confidence is low since my success rate for kernel mode extensions is still 0%,

But I have tracked down what appears to be the functions referencing "DisableDeleteNotification" and "DisableDeleteNotificationDrain" in the 2012R2 ntfs driver; fsutil querys "DisableDeleteNotify" to check TRIM status. So a backport is possible.

Share this post


Link to post
Share on other sites
23 minutes ago, win32 said:

Perhaps. It would have to be implemented through the NTFS/ReFS drivers. My confidence is low since my success rate for kernel mode extensions is still 0%,

But I have tracked down what appears to be the functions referencing "DisableDeleteNotification" and "DisableDeleteNotificationDrain" in the 2012R2 ntfs driver; fsutil querys "DisableDeleteNotify" to check TRIM status. So a backport is possible.

Hmm, well then the possibility still remains for the future , thanks for the info.

Share this post


Link to post
Share on other sites
Posted (edited)

I have done changes to uxtheme and dwmapi.dll (x64 in both cases) that strips them of any code associated to the new functions in each file, making them true stubs pointing to memory addresses far out of the file's range. Firefox 68 ESR and 78 (regular) are unaffected by the change, while the new stub-like properties of the functions do not affect logonui/winlogon in any way like my earlier attempts did, allowing for the OS to run with them. Windows Explorer is also stable with them.

And furthermore, I got Firefox 68+ address and search bars working like normal after these changes! But it cannot automatically download Widevine CDM.

So now I can focus on adding the last five functions (K32EnumProcess plus the ones in my post above) to x64 kernel32.dll.

x86 kernel32 is actually quite difficult to modify in some way. Doing a "paste write" of the code into HxD like I do for x64 files breaks the x86 files in some way. And a "paste insert" seems to work, but it doesn't replace the existing zero bytes, it just pushes them farther down so to speak, making the file bigger and presumably why this would break an export table located below it (as I found to happen with x64 files where the export table was already relocated by me).

update: actually there is another bug where the download progress bar is not updated in all browsers from Serpent/New Moon to Firefox 78. I'll investigate that one further. And some fonts on DDG in Firefox 78 didn't appear (perhaps they failed to download, possibly linked to Widevine CDM failing to download). In any event, you can still redirect Serpent and New Moon to the original Vista DLLs. These problems seem to be linked to kernel32.

Edited by win32
  • Like 1

Share this post


Link to post
Share on other sites
Posted (edited)
2 hours ago, win32 said:

 

update: actually there is another bug where the download progress bar is not updated in all browsers from Serpent/New Moon to Firefox 78. I'll investigate that one further. And some fonts on DDG in Firefox 78 didn't appear (perhaps they failed to download, possibly linked to Widevine CDM failing to download). In any event, you can still redirect Serpent and New Moon to the original Vista DLLs.

Theres something wrong with a few numbers aswell for example the palemoon startpage shows the last update 400+ years ago for some reason , also on a certain website peoples birthdays show as 494 years or something similar

 

example : https://imgur.com/a/ZSfYHhW

Edited by burd

Share this post


Link to post
Share on other sites
Posted (edited)
Just now, burd said:

Theres something wrong with a few numbers aswell for example the palemoon startpage shows the last update 400+ years ago for some reason , also on a certain website peoples birthdays show as 494 years or something similar

 

example : https://imgur.com/a/ZSfYHhW

Yes, this bug also affects quotes on here. All of them are dated as "just now".

So it appears that this bug appeared with my earliest revision to kernel32 this afternoon. I had commented out the Windows 8 function GetCurrentPackageId, but another one was fixed, GetSystemTimePreciseAsFileTime; that was previously typoed as GetSystemTimePreciseAsFileTIme. So I typoed it again and now the date problems and the download progress bar are fixed.

Indeed, this is what this function consists of on Windows 8:


retn    0

 

Makes me wonder how it could work on W8 in the first place.

I also fixed up some code in a subroutine linked to the Power*Request functions. That fixes the Visual Studio Code CPU utilization issue.

Edited by win32
  • Like 1

Share this post


Link to post
Share on other sites
11 hours ago, win32 said:

 

So it appears that this bug appeared with my earliest revision to kernel32 this afternoon.

I had this issue with the earlier kernel32 aswell , i just didnt mention it till now because its a minor issue

Share this post


Link to post
Share on other sites
Posted (edited)

I have received the Windows 7 logon failure hotfix as well as the set of kernel32/kernelbase dlls preceding the ones in the hotfix.

kernel32 is very similar, with the only differences in the text (code) section of the file being in the debug directory. These differences are superficial, mostly consisting of changes in the timestamps.

But kernelbase (which was part of kernel32 in Vista and earlier) is a very different story, with all kinds of small patches scattered throughout the text section. It may take awhile to implement.

Tentatively, this seems to be an issue with a previous implementation of LoadLibraryExW.

I have also finished implementing K32EnumProcess and GetActiveProcessorCount series in x64 kernel32.

Edited by win32
  • Like 1
  • Upvote 1

Share this post


Link to post
Share on other sites
21 hours ago, win32 said:

And furthermore, I got Firefox 68+ address and search bars working like normal after these changes! But it cannot automatically download Widevine CDM.

Slightly deviating from topic. Curiously, 68 ESR suffers Windevine issues on my Vista7 installs too. The plugin appears to download and show up in the list of installed plugins, but it doesn't actually initialize when called on by a DRM protected webplayer. It's so strange because non-ESR isn't affected. I even tried 78.01 standard v. ESR, and the latter was affected just like 68 ESR while rapid release with the same version number wasn't! Only non-affected ESR I've seen is Wf Current, but they have a myriad of their own bugs rn.

Nevertheless I reserve those kind of sites for Chromium.

Share this post


Link to post
Share on other sites
Posted (edited)

VMware Workstation 10-12 installers (and possibly earlier) will need the original Vista kernel32.dll. If they try loading with mine, then they proceed to call all kinds of absent ntdll functions. But 11 and 12 still do not install because the Windows Installer is apparently too old for them (do they need 5.0?).

So it appears that a LoadLibraryExW replacement is needed to solve the Haswell+ logon bugs. The hotfix substantially changed the structure of the function beyond the changes between Vista and 7; these changes were carried over to all later versions of the function through at least Windows 10 1809, it seems.

But as a such a crucial function to the OS, it is rather complex. Indeed, a full implementation of it as in the W7 hotfix would require two new functions (BaseGetProcessDllPath and BaseReleaseProcessDllPath) that in themselves are quite complex. So I tried substituting them for two functions imported from ntdll plus several other differences. This caused the OS to reboot several seconds after the boot screen had faded out (so before the orb appeared).

So it looks like I'm going to implement the Windows 10 1809 version of LoadLibraryExW since it doesn't call those two functions. But it asks for LdrGetDllPath and RtlReleasePath, which do not even exist in Windows 7. RtlReleasePath is quite simple, but LdrGetDllPath is extremely complex. So I need to look for a suitable replacement for LdrGetDllPath. So far I haven't been able to do so (I tried RtlGetFullPathName_U), as I've only been able to get the cursor to appear before automatically rebooting.

Edited by win32
  • Like 2

Share this post


Link to post
Share on other sites
Posted (edited)
2 hours ago, win32 said:

VMware Workstation 10-12 installers (and possibly earlier) will need the original Vista kernel32.dll. If they try loading with mine, then they proceed to call all kinds of absent ntdll functions. But 11 and 12 still do not install because the Windows Installer is apparently too old for them (do they need 5.0?).

So it appears that a LoadLibraryExW replacement is needed to solve the Haswell+ logon bugs. The hotfix substantially changed the structure of the function beyond the changes between Vista and 7; these changes were carried over to all later versions of the function through at least Windows 10 1809, it seems.

But as a such a crucial function to the OS, it is rather complex. Indeed, a full implementation of it as in the W7 hotfix would require two new functions (BaseGetProcessDllPath and BaseReleaseProcessDllPath) that in themselves are quite complex. So I tried substituting them for two functions imported from ntdll plus several other differences. This caused the OS to reboot several seconds after the boot screen had faded out (so before the orb appeared).

So it looks like I'm going to implement the Windows 10 1809 version of LoadLibraryExW since it doesn't call those two functions. But it asks for LdrGetDllPath and RtlReleasePath, which do not even exist in Windows 7. RtlReleasePath is quite simple, but LdrGetDllPath is extremely complex. So I need to look for a suitable replacement for LdrGetDllPath. So far I haven't been able to do so (I tried RtlGetFullPathName_U), as I've only been able to get the cursor to appear before automatically rebooting.

will this also fix the issue where random services dont start? example Windows Audio , Superfetch and even explorer.exe i wonder

Edited by burd

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...