Jump to content

Windows Me IO.SYS (WINBOOT.SYS) format


Recommended Posts

The IO.SYS extracted from Windows XP SP3 diskcopy.dll can be uncompressed without any transplant from other files, and works OK both in the original compressed form and in the uncompressed form, AFAIK. Why did you find it necessary to transplant the initial 2k block? Please elaborate on it.

Later edit: Now I understand... You mean to restore Win ME Real-DOS ability, as per this patch, right? My guess is it would be easier to collect Win ME COMMAND.COM and REGENV32.EXE and the IO.SYS extracted from Windows XP SP3 diskcopy.dll, and apply to these files their patch directly, and then use RLoew's IO8DCOMP.EXE on IO.SYS.

An unmodified original IO.SYS in boot image placed on Windows Me OEM CD no need any patch,directly support real MS-DOS mode, COMMAND.COM can be modified by replacing in this file at hex offset 00006510 byte 75 by byte EB (Comparison of x86 DOS operating systems - Wikipedia, the free encyclopedia).

First 2048 bytes from original Windows Me OEM CD IO.SYS to restore the "Real-mode functionality" in IO.SYS extracted from diskcopy.dll Windows XP, Vista, 7

OEM.zip

Edited by _Smoker
Link to comment
Share on other sites


Well, since you're working with Win ME IO.SYS, here's something you may find interesting: a spoofing device driver that allows one to use MS-DOS 7.10 files with Win ME IO.SYS. All it does is to trap the IO.SYS replies to Version queries, changing its reply from "8.00" to "7.10". This permits to take advantage of the fact that Win ME IO.SYS already contains HIMEM.SYS, in creating a real minimalist boot disk. To use it, load VER710.SYS early from CONFIG.SYS (that is, put DEVICE=VER710.SYS as the very first line in CONFIG.SYS), and you're all set! :yes:

Notice that you can accomplish that by directly patching an uncompressed version of Win ME IO.SYS, but this allows one to use also the compressed versions, which cannot be patched, unless someone creates a recompressor for IO.SYS.

BTW, you'll certainly find this Boot-Land thread of interest, if you don't already know it (I suspect you do, but, in any case, here's the pointer just for the record).

VER710.7z

Link to comment
Share on other sites

Well, since you're working with Win ME IO.SYS, here's something you may find interesting: a spoofing device driver that allows one to use MS-DOS 7.10 files with Win ME IO.SYS. All it does is to trap the IO.SYS replies to Version queries, changing its reply from "8.00" to "7.10". This permits to take advantage of the fact that Win ME IO.SYS already contains HIMEM.SYS, in creating a real minimalist boot disk. To use it, load VER710.SYS early from CONFIG.SYS (that is, put DEVICE=VER710.SYS as the very first line in CONFIG.SYS), and you're all set! :yes:

Notice that you can accomplish that by directly patching an uncompressed version of Win ME IO.SYS, but this allows one to use also the compressed versions, which cannot be patched, unless someone creates a recompressor for IO.SYS.

BTW, you'll certainly find this Boot-Land thread of interest, if you don't already know it (I suspect you do, but, in any case, here's the pointer just for the record).

Thanks for driver, it's best replacement setver.exe. Now i use deversioned ms-dos 8.0 files by replacing byte sequence 3D 08 00 74 ->90 90 90 EB.

Interesting thing from Boot-Land thread by Wendy: "The inclusion of himem.sys may have been a failsafe device. It is indeed possible to deactivate various things in io.sys, and it may be possible to deactivate the internal one"...

Link to comment
Share on other sites

Thanks for driver, it's best replacement setver.exe.

Yeah, thanks!

The problem with setver.exe is that it loads too late to fool COMMAND.COM, while my driver can fool it all right. :D

Wendy knows a lot about DOS, especially the latest versions... she may well be right, but there's lots to be learned about v. 8.00, still. And RLoew's decompressor opened up a novel window of opportunity to investigate the v. 8.00 IO.SYS, so interesting developments should be forthcoming.

Link to comment
Share on other sites

Well, since you're working with Win ME IO.SYS, here's something you may find interesting: a spoofing device driver that allows one to use MS-DOS 7.10 files with Win ME IO.SYS. All it does is to trap the IO.SYS replies to Version queries, changing its reply from "8.00" to "7.10". This permits to take advantage of the fact that Win ME IO.SYS already contains HIMEM.SYS, in creating a real minimalist boot disk. To use it, load VER710.SYS early from CONFIG.SYS (that is, put DEVICE=VER710.SYS as the very first line in CONFIG.SYS), and you're all set! :yes:

Notice that you can accomplish that by directly patching an uncompressed version of Win ME IO.SYS, but this allows one to use also the compressed versions, which cannot be patched, unless someone creates a recompressor for IO.SYS.

Small Patches to Windows ME IO.SYS can be done to the compressed Version by adding the Patch Code after the Decompression has taken place. Phelum did this with his Windows ME Version of his Partition Offset bug Patch.

It should also be possible to shrink the compressed IO.SYS file if one or more of the 48K (uncompressed) blocks can be removed.

Link to comment
Share on other sites

Sorry if I chime in WITHOUT :ph34r: having directly experimented with the thingy, but I have a few questions that maybe rloew can answer to:

  1. I assume that inside the compressed IO.SYS there is some code to decompress on-the-fly, and that you managed to rebuild it externally to create your decompressor, right?
  2. Knowing how MS loves to re-use code, I presume that the actual compression is done thorugh one of their known tools, possibly slightly modified, maybe if we can identify the tool, it would be possible to create a re-compressor?

jaclaz

Link to comment
Share on other sites

Sorry if I chime in WITHOUT :ph34r: having directly experimented with the thingy, but I have a few questions that maybe rloew can answer to:

  1. I assume that inside the compressed IO.SYS there is some code to decompress on-the-fly, and that you managed to rebuild it externally to create your decompressor, right?
  2. Knowing how MS loves to re-use code, I presume that the actual compression is done thorugh one of their known tools, possibly slightly modified, maybe if we can identify the tool, it would be possible to create a re-compressor?

jaclaz

The first 2KB Block of IO.SYS loads the rest into memory, decompresees it, then jumps to it.

My decompressor loads IO.SYS into memory, sets up a suitable stack frame and register settings, then calls the decompression subroutine. It then writes out a modified header and the decompressed data from memory.

I have found similar code in WININIT.EXE and SCANDISK.EXE, so it is definitely reused code.

Link to comment
Share on other sites

I have found similar code in WININIT.EXE and SCANDISK.EXE, so it is definitely reused code.

I'll try checking with the "usual suspects" :unsure::

http://www.cabextract.org.uk/libmspack/

http://www.msfn.org/board/index.php?showtopic=81068&st=8

Just for the record, should anyone among the less "technical oriented" members need to extract the ME files from XP/2K3 in order to do some experimenting, this may come of use:

http://www.911cd.net/forums//index.php?showtopic=16745

jaclaz

Edited by jaclaz
Link to comment
Share on other sites

It should also be possible to shrink the compressed IO.SYS file if one or more of the 48K (uncompressed) blocks can be removed.

How to remove uncompressed blocks from compressed IO.SYS(start-end offset)?

Link to comment
Share on other sites

It should also be possible to shrink the compressed IO.SYS file if one or more of the 48K (uncompressed) blocks can be removed.

How to remove uncompressed blocks from compressed IO.SYS(start-end offset)?

First you would have to come up with a small set of patches, to the uncompressed code, that renders an entire 48K Block of data unnecessary, and adjust pointers so that the block can be removed.

Then you could remove the correspnding compressed block and add the Patches to the code following the decompressor.

Link to comment
Share on other sites

First you would have to come up with a small set of patches, to the uncompressed code, that renders an entire 48K Block of data unnecessary, and adjust pointers so that the block can be removed.

Then you could remove the correspnding compressed block and add the Patches to the code following the decompressor.

Sorry, I'm not a programmer/hacker, it is possible to manually remove other unnecessary blocks like as?

The bitmap starts at 'BM' but ends at 0x44005...

Link to comment
Share on other sites

I think it's useless to remove parts of WinME io.sys since you can't compress it back and it won't be smaller than compressed.

I tried to reduce decompressed and restored real-mode functionality IO.SYS by intuitively cut, because too many functions in IO.SYS version 8.0 extracted from diskcopy.dll disabled by Microsoft. It work for me.

Reduced IO.SYS version 8.0 Size 130 832

Original IO.SYS version 8.0 Size 116 736

Edited by _Smoker
Link to comment
Share on other sites

I think it's useless to remove parts of WinME io.sys since you can't compress it back and it won't be smaller than compressed.

I tried to reduce decompressed and restored real-mode functionality IO.SYS by intuitively cut from 0001EF60 to end, because too many functions in IO.SYS version 8.0 extracted from diskcopy.dll disabled by Microsoft. It work for me.

Reduced IO.SYS version 8.0 Size 126 816

Original IO.SYS version 8.0 Size 116 736

Assuming your truncated IO.SYS works properly, you could create a smaller Compressed Version by combining the Loader/Decompressor, the first 3 compressed Blocks, and the Decompression Code Block into a new IO.SYS file.

Be aware that my Decompressor will not apply any Patches, that may have been added, if they are done after Decompression. This includes the Partition Bug fixes by Phelum and myself.

Link to comment
Share on other sites

I know that this may sound like a stupid question, but why do we even have to use the compressor that Microsoft used? There are plenty of EXE/COM compressors that could be modified to do that same job. Once it's loaded into RAM, it hardly matters what the code on disk looks like.

The tasks I see needed to make it work:

1) Create a replacement of the decompression stub that understands the format you want to use. Some really good compressors have decompression stubs that will fit within 2KB.

2) Create a version of the compression tool's library that can deal with the IO.SYS file's raw (decompressed) image. This will create the file to append to the stub.

3) Combine the compressed stream with the stub and you have a newly compressed IO.SYS.

I think this may be a good project to try out. It's been a while since I hacked DOS code. ;)

Link to comment
Share on other sites

I know that this may sound like a stupid question, but why do we even have to use the compressor that Microsoft used? There are plenty of EXE/COM compressors that could be modified to do that same job. Once it's loaded into RAM, it hardly matters what the code on disk looks like.

The tasks I see needed to make it work:

1) Create a replacement of the decompression stub that understands the format you want to use. Some really good compressors have decompression stubs that will fit within 2KB.

2) Create a version of the compression tool's library that can deal with the IO.SYS file's raw (decompressed) image. This will create the file to append to the stub.

3) Combine the compressed stream with the stub and you have a newly compressed IO.SYS.

I think this may be a good project to try out. It's been a while since I hacked DOS code. ;)

Stupid? Absolutely not.

I have thought about this and I see no problem. Additionally, this idea is not limited to IO.SYS 8.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...