Gavotte RamDisk, PAE

[j7n]

I installed 8 GB of RAM on my system with Server 2003 SP2. Unfortunately I discovered that playing sound on E-MU 0404 (Creative) sound card makes the system crash and cause errors on hard disks. Curiously, playing a video with sound works. CPU-Z wouldn't work. It is really dangerous if drivers can get loaded with small system info or task manager tools. PAE is now disabled using /fastdetect /execute /NOPAE. Disappointingly, only 3 G of memory is available.

To make use of the memory I installed Gavotte RAMDisk 1.0.4096.30, and configured to use 1 G in PAE memory (DiskSizeM=1024, UsePAE=1). A FAT32 volume was created after reboot. However, the Task Manager shows that Commit Charge has increased by 1 G. It seems that it has allocated normal memory. What is wrong? I do not dare to increase the size of the ramdisk.

Edited July 1, 2021 by j7n

[j7n]

No other ramdisks would work, as they rely on PAE being enabled. I resolved this problem by enabling PAE and setting a memory limit at 3 GB with /MAXMEM=3072. Gavotte automatically created a 5 GB disk disregarding the size I asked for. It seems to work well so far. I followed the steps in the readme for creating a mini-image in the registry, and had to dismount the volume with chkdsk.exe T: /X L:2048 or the disk would become corrupted after reboot.

Windows doesn't feel that this is a fully featured disk. It can't be opened as a physical disk and examined by most tools. FORMAT returns instantly, and something else such as WinHex is needed to zero fill it. Disk check from properties doesn't work.

What is the explanation why random reads from "random access memory" still slow down dramatically? I looked at some benchmarks online and this is happens to similar degrees.

[jaclaz]

6 hours ago, j7n said:

Windows doesn't feel that this is a fully featured disk. It can't be opened as a physical disk and examined by most tools. FORMAT returns instantly, and something else such as WinHex is needed to zero fill it. Disk check from properties doesn't work.

 

Yes, this is "normal", a disk driver can be "hooked" at different system levels.

Some drivers do not expose a physical drive, some do expose one but it is inaccessible by disk manager, some only expose the volume, if I recall correctly Gavotte, like IMDISK, is of the latter kind, only the volume is exposed, what sounds "strange" at first sight is that you cannot format it, possibly it is the specific settings/automatic size, etc . that create this situation , this may also depend on the MediaType you have (either set or automatically generated) in the Registry, or some access restrictions, check the attachments in this thread:

 

 

jaclaz

[j7n]

I could format it, but the format was always "Quick". I needed to blank the entire disk to create the tiny image. After boot it contained some data.

[jaclaz]

1 hour ago, j7n said:

I could format it, but the format was always "Quick". I needed to blank the entire disk to create the tiny image. After boot it contained some data.

Yep, and again that could be connected to the Media Type.

In these or similar cases you can still use a workaround.

Format "quick".

The new filesystem will have the minimal structures (FATs or $MFT, etc.) and will be (at filesystem level) "empty".

Now create a new file (or a few of them if hitting the 4GB FAT32 limit) occupying all the free space, then 00 the file(s) and delete them.

I think you cannot use fsutil as it will create a sort of sparse file, if I recall correctly fsz (part of the DSFOK toolkit) creates 00 filled files, the 2003 toolkit contains creatfil.exe but cannot remember if the generated files are 00 filled, otherwise you can use the dd for windows by John Newbigin.

jaclaz

[jumper]

A file/disk shredder utility perhaps.

 

[jaclaz]

11 hours ago, jumper said:

A file/disk shredder utility perhaps.

Yep , sdelete:

https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete

should also do nicely.

It has to be double-checked however, as I remember that in a past version the -c and -z switches were "inverted" or however did not work exactly as stated in the docs, it depèends on specific versions, latest  versions should be fine:

https://www.forensicfocus.com/forums/general/wiping-free-space-in-encrypted-containers/#post-6568809

jaclaz

[j7n]

The disk still gets corrupted, and shows up as a 5 GB unformatted volume. This happens after a cold boot, when it should be as blank as possible. As far as I understand nothing gets carried over from the previous session anyway. Rebooting does not bring it back to normal. I can't access it as a physical disk to check what is written on it when it is broken. I had an NTFS volume with a dozen directories and a blank swap file. If I get rid of Image in registry, the disk seems to work. A swap file gets created on it. From the instructions I understood that I must prepare it in advance, but apparently not.

[UCyborg]

On 7/1/2021 at 4:07 AM, j7n said:

Creative

A company notorious for writing bad drivers in general.

[j7n]

The driver has some unused baggage from Creative Labs consumer products with too many DLL files. But the positive aspects outnumber the flaws. The sound mixing service seems strongly "decoupled" from Windows, and can be recognifigured and restarted, as is sometimes needed when games eat up all the channels, it patches into the basic "Wave" sound well to allow for 22-24-bit accuracy (at 48000 Hz), loopback in the mixer can be lossless, sound streaming is ultra stable with zero glitches. The driver package works much better than M-Audio on XP/2003.

Before E-MU dissolved and the people went to Universal Audio, they released a fixed "beta" driver that works around WinNT6 quirks, and made it compatible with x64 with more than 4 GB of RAM.

[j7n]

Is it common for RAM (or it supporting circuitry) to emit "coil whine" noise? It's a variable pitch squeal when RAM is being accessed in a certain pattern. I observed this before when repeatedly searching through files that had been cached in memory, and now with the ramdisk, this happens every time I alt-tab out of a full screen game. The system copies the memory of the game onto the swap file, which resides in the same memory now, going back and forth quickly.

[dencorso]

9 hours ago, j7n said:

Is it common for RAM (or it supporting circuitry) to emit "coil whine" noise?

Yes, it is. The older the board, the louder it is. That's why some newish Gigabyte boards boast of sound-caps' shielding... 

[j7n]

It doesn't come from loudspeakers, but from inside the computer case.

[jumper]

Maybe from the onboard diagnostic speaker/buzzer? Try covering the sound hole.