w00t!, win7 32bit mem limit gone...

I JUST got this done with.

I hacked the kernel, then patched the pe checksum with editbin from vc++.
DISABLE_INTEGRITY_CHECKS set from easybcd.

But there's still one more prob left, windows fails to boot because the darned thign isn't signed.
But :) ..., I pressed F8, set to disable driver signing enforcement, and bam she boots :D.
Success.

Now I gotta get around to figuring out either how to sign the darned thing or bypass the signing stuff all together, perhaps looking into the win7 boot logo mods can help me do this, I'll do that later.

Here's a screenshot.
Do note my windows is tweaked to death, so the stuff in the cpl is null, and right now my taskmgr don't work so I'm using proccess explorer in the meantime.
(Recent tweaks I did the other day screwed up taskmgr and disk manager...)
Attachment 124074

This thread is for all the nay sayers...
And yeah I know it doesn't look like normal windows when it says unavailable and such.
I'm not faking you guys out... :)

the screenshot doesn't fit my eyeballs correctly :P

Open in a new page, it's a full sized screenshot at 1080p, but the forum resizes them like that...
Imgshack is a member only type of thing apparently these days :(.

Maybe this will help:
http://www.xtremesystems.org/forums/...4&d=1329044695

Edit:
Here's another screenshot showing aida64.
Note my bench score is low, I'm running stuff in the bg...

Attachment 124075

drats it does resize... does windows know how to address all the memory?

Some programs apparently don't.
Bitspirit for example, a chinese torrent client, only see's 2 gigs max apperently.
I never paid much attention to it in x64...

I read something about patching different exe's to make them large address aware and supposedly that helps.
I'm not sure if any 32bit program in windows can use more then 2 gigs at once, without patching.
Some might though, since it's a requirement for 64bit windows I guess.

The amount of ram total in aida64 looks goofy though, 15gigs or so, when I only got 8gigs of ram and a 2gig swap.
Not sure what's up on that.

Supposedly there's an issue with some drivers not mapping into mem correctly when you do this hack, but so far I've had no probs.
Audio, video, 3d gaming all work.
I've only had it going for a little bit though.

I got the info from here:
http://www.geoffchappell.com/notes/w...nse/memory.htm


My notes:

Look for:
7C118B45FC85C0740A
7C108B45FC85C07409

Replace with:
7C11B8000002009090
7C10B8000002009090

bcdedit /set {current} kernel ntkr128g.exe
editbin /release ntkr128g.exe

I used easybcd to create a 2nd menu option to the same copy of windows, original kernel just in case.
1st time I modded it without using the editbin tool it refused to boot so it was a good idea to make that backup.

I used winhex to edit the kernel, renamed it to a bin file to make it easy (exe's don't show a open with menu in windows).
I searched for the hex code above, but in this format:
7C3F8B45FC85C0743F
I also checked the box in winhex for the hex search, wild card = 3F, that allowed me to find the 2 instances of code to patch.

Then I had to dl visual studio express..., install vc++ on my 64bit os, used it's cmd console and ran editbin from there :).
That part wasn't as hard as I thought it would be.

But I gotta get it to boot without my intervention though (f8 key -> disable driver signing enforcement crap...).
I'm happy camper though, I didn't like the 64bit windows so much.
I do have to test it more to make sure it's all good though.
That and what sort of program limits there are, I would assume something like s&m memtest, or hci memtest could use all the ram in 32bit since they were meant for 64bit anyways.

There is one more mode I'de like to find out about, if it exists for windows.
64bit for 32bit windows, you can doit for dos I assume without probs, just a bit of asm code needed.
But windows, I'm sure there's a way..., I'll probably never find the info though.
You might ask why not use 64bit windows then?, because I don't like the emulation layer stuff winx64 does, it doesn't feel like real 64bit to me (coding wise).


Edit:
The exact list of changes in the kernel file, they are just renamed from exe to bin for my convenience.

Code:

---

Search for differences

1. C:\Users\Administrator\Desktop\ntkrnlpa.bin: 3,966,848 bytes
2. C:\Users\Administrator\Desktop\ntkr128g.bin: 3,966,848 bytes
Offsets: hexadec.

  2D0:        AC        99
  2D1:        88        2E
  2D2:        3C        3D
3605F8:        8B        B8
3605F9:        45        00
3605FA:        FC        00
3605FB:        85        02
3605FC:        C0        00
3605FD:        74        90
3605FE:        0A        90
360638:        8B        B8
360639:        45        00
36063A:        FC        00
36063B:        85        02
36063C:        C0        00
36063D:        74        90
36063E:        09        90

17 difference(s) found.

---

Or you could just use x64 version like normal people and not have to go through all this painstaking hassle for no reason.

I want to see available memory being under 3.5 GB, that way you know it's actually addressable and not just visible. Congrats all the same :)

Attachment 124076

This shows that it is possible to use all the ram, it actually wasn't easy to get it to use this much.
The real prob is the programs, they think they only have the amount of mem that a 32bit windows would have.
They are all limited to 2gigs each.
Some programs actually see all the mem though, but can't use it, like intelburn test and s&m.

Speaking of those 2...
Intel burn test, if I try to run it above the norm, it auto passes lol, says test complete at 0.23 or 0.22ms lol.
S&m on the other hand doesn't complain at all about 32bit limits, but it throws out an exception once it passes the 1st test, it still only uses 2 gigs too, so it works until the end of the test, then screws up.

I do remember reading about userva size, from 2gigs to 3gigs, moving the kernel up in mem.
There's other old info's out there too, mainly for win2k3.
I'm gonna have to look them up to get this working better.

There's also a mod for each program you want to use more mem with, large address aware.
But I would of thought that intelburntest and s&m were already setup for that because of then being dual types, 32bit and 64bit in a single exe (well sorta anyways).
It's interesting but I gotta make it more useful then this, otherwise I will have to make the change to 64bit windows (I do got it, I just don't like using it to much of a hassle to get everything working, plus I'de lose all my current video capture ability).

What makes me wonder though, I do have windows 2003 enterprise 32bit.
Which supports 2tb of mem I think.
I wonder what would happen with some of these programs in that os, if they could use all 8 gigs or not.
It would be kinda messed up if say I use a stock win2k3 os, not modded, ran s&m or intelburntest with 8gigs of installed ram and seen the same exact probs.

Nicely done, but I have to ask why?

Several reasons.

Originally I decided it was time to move on to 64bit, using my abit 754 to test with, I set off to try to tweak out win 64 and see if it was worth my while.
So I found a really nice copy of windows, win2k3 datacenter x64 vlm (tossed now).
Anyways I benched it, seemed ok'ish, no improvement though in benchs but it was faster at extracting thumbs in explorer.

(sigh..., just killed my main usb port on my keyboard..., thought it killed my new mouse too, anyways whatever, I should of replaced the keyboard cable sooner...).

Well anyways I got most of my stuff working, even got a dialup modem working (was on dialup at the time).
So I decide to start programming and porting my stuff over.
Well...
I learned right away that it didn't support com files.
And it doesn't support exe's, dos exe's, if it contains a pe header it'll run it.
So it was win32 for me, console or gui, didn't matter, as long as it was a 32 or 64bit pe exe.
When I was programming with fasm, making my own header and so on, I found that my code wasn't running as expected.
Some of the results were really odd, I might have the src and notes around, I'll look.
That along with missing dos interrupts, with no great improvement in speed either, it turned me off windows 64bit.
I'm not against 64bit, just microsoft's implementation of it.

So I've been using 32bit since.
And I tried using 64bit again later on, with windows 7, thinking if I end up liking that enough I'll switch to win2k8r2 (I hated win2k3 pre-r2..., funny though one of the main bugs I hated in it is still around in win7 but not easy to encounter anymore).
So I messed around with that, again no speed improvements, except thumbnail extraction lol.
Coding wise, I did work on it, not in the code it's self but my compiler for my bios stuff, had to get that working, which I did, except for lha compression that sucks I can't run the right ver of lha that I need on winx64...
Then there's media player classic.
Most of it runs fine, heck the 32bit ver runs great on x64.
The 64bit one has it's issues though.
There's just certain media that don't work quite right on it.
Especially 64bit ver's of avisynth.
32bit was a real pain to get working too, but it did work.
The 64bit ver of that program is one of the main reason I looked back at the 64bit to begin with.
Anyways, to be honest, the 64bit ver of avisynth has probably been updated a little since, and so has mpc-hc x64, not saying it will work though but who knows.
One thing that does not work at all is my copy of real player alt.
I still have a dozen or so real player files, I could always convert them but being who I am, I don't like messing with original's, unless they are corrupt.

Another thing is my capture card's, none of them will work in x64.
Oh, forgot, I only got the usb one now, anyways that don't work on x64.
I suppose I don't need it...

Ok about the coding thing.
I was under the impression because the way it was acting with my code, that it was emulating it.
I apparently don't have the src code anymore..
Sometime after that I saw an update for fasm about x64 opcodes, apparently a few were'nt correct for the 64bit mode of the cpu.
This actually might of been the reason my code acted differently on the machine level that what it was supposed to.
I haven't taken the time to go back and find out.

So I was in the situation were I preferred to get winx86 working with all it's ram :).
And that is actually the main reason why I just recently bought the ssd and 8 gigs of ram ;).
To play with and hack windows all up :).

I was thinking a little while ago about using amdmsrtweaker's code for ring0.
If I can port that portion of the code to fasm, I can have some real fun and get back into programming my os.
I have 2 main probs with win7, both 32bit and 64bit.
They don't have the old dos interrupts anymore, makes it hard for me to figure things out without them, and it's no fun to keep booting into my own os without prior experience with certain things.
And that I can't find a decent freaking emulator to run my own os in windows anymore, I got one for win2k3, runs great, but not win7, I've tried them all, they all have there own issues and I'm stuck without one.
So I'm thinking, get real hardware access, and start writting a new cmd console for windows 7, one that actually support old dos irq's (my os has some of them already but not hd stuff yet).
With something like that, I could use both api and direct hardware to get what I need out of it ;), the api is the exact same as the old int21 lol, almost exact when it comes to file access.
It wouldn't take much to make it better then winxp's/2k3's console.

Over time I may indeed move on to 64bit.
Just not yet.

Another reason I got the ssd, so I can figure out how to get visual studio working correctly in tweaked windows.
Can't compile a darned thing with it, never could, except for vs2001 or 2000, whatever it was called, vc6, that works but it's to old.
I got like 30-40 gigs free just for os partitions on this thing :), so I can keep backups of windows, and restore them with a quickness.

This post of mine is probably long as heck, anyways that's the story.
Right now I prefer the 32bit windows, to be honest I actually hope this is the last copy of windows I ever use :\.
Win8 should out soon, so I may move to that, but I'm hoping to get my own os going sooner or later.
I'm sick of windows all together.
32bit was my dev platform, not so much now, but at least I can still compile my bios'es with it ;).
Can't do that yet on x64 (again I need a specific lha ver to compile award bios'es correctly and accurately).

I'm gonna end this post lol.

I read through your entire post ;) And you've got way too much free time on your hands :D Well done all the same :)

Thank you much :).

Attachment 124087

Now for the good stuff :D.
Ok, as you may know from what I posted before, 32bit progams usually cannot even see more then 2 gigs.
But what about the ones that can?
Intelburntest for example can see it, but cannot use it, it yells at you saying it's a 32bit os, so without getting that programs limits removed there's nothign to be done.

But what about a program like s&m?, which see's all the mem, but isn't able to use it.
:), there is a way...
I've been reading up on the userva setting.
Everyone knows that if you set it to 3072 (3 gigs), it'll allow your program to use that amount, while it shrinks the amount available to the kernel.
For example, you have 4 gigs of ram, only 3.5gigs is usable normally (actually less), if you let your program use up to 3gigs that gives the kernel up to 512m.
So what's the deal...

Supposedly...
Winx86 allows the userva to go anywhere from 2gigs stock, to a max of 3gigs modded (userva setting).
Winx64, here's the kicker, only allows up to 4gigs per program, we all know that's bs, run one of those mem testing progs in x64 and you'll see that it is indeed able to use all of the mem.
How does that work?, to be honest I don't know the details, but I have a guess.

Perhaps we weren't told the exact truth of the matter ;).
What I do know is that x86 has a 2gig limit per program, and x64 seemly has no such limit (perhaps it does but some programs are able to bypass it).

So what does happen when you set the userva setting on a modded kernel, one that's allowed to use all your ram?
You cannot honestly believe windows will all the sudden stop it's ability to use mem for the kernel, it's no longer constrained to 3.5gigs, it runs fine without that limit.
If userva was set to 3gigs, and now windows is only allowed to use 512m/1gig now, how does that effect such a modded system with 8 gigs of usable mem.
It doesn't! :)

I 1st decided that 3gigs userva was something I should try anyways, thinking about the above stuff I wondered.
I went a step further onthe 1st shot.
I set it to 4gigs.
bcdedit /set {current} IncreaseUserVa 4096

Then I typed bcdedit and checked what was set because it said success.
It was set to 4gigs.
Restarted, checked s&m, and bam she's able to use all the mem.
Limit removed, windows 7 x86 is equ to the x64 ver now in terms of mem.
Wrong!
After the 4gigs was surpassed in the test she just sat there, s&m acted as if I were unstable, one time throwing a mem error(s&m test mem error, not an exception or bsod).
2nd run she paused after that mark, tried again and again, reloaded up the cmos and lowered the ram speed, the same.
Hmm, setting userva removed the limit partially but not completely.
Perhaps it cannot be done..., wrong again! :).
Setting userva to 8gigs (wtf am I doing right?, the kernel will have 0 mem, heck widnows cannot even use all 8gigs, it's 10m less because of bios stuff).
Well I did it anyways on a suspicion.
bcdedit /set {current} IncreaseUserVa 8192

Set, checked, looked ok, restarted.
I ran s&m, she went all the way through test1 and on on to test2 without issues :D.
Solution found.
SOME programs, 32bit programs that are written halfway correctly CAN and WILL use all available mem, even on a 32bit os.
They need to be largeaddressaware, I believe is what is key here, I intend to find out sooner or later if that is what it takes.

I took the above screenshot to show you guys.
To put the post simply, to use all your ram, you must set userva to the amount of ram you have total.
If you have 128gigs, the supposed limit of this ver of the kernel patch, you must set userva to 128gigs.
Does setting to that limit without that amount of mem do that trick as well?, that I don't know just yet.
What I do know is that if the limit is gone, and a program tries to use more then what userva is set to, it'll fail.
Setting to 8 gigs and having 16gigs of actual ram will make such programs fail.
There is no auto setting, unless setting to the max the kernel support is such a thing, then that would be the way to go, but at the moment I don't know.

Now I got some more work to do on my os, gotta fix taskmgr and diskmgr (reg tweaks from before this), plus some other things like replacing my sata cable on my ssd with a sata3 ver.
I probably wrote to much, I'm kinda of excited about it though, I can fully test my mem and use all of it in 32bit windows now.
Now it's up to the programs, for a test I plan on modding the original superpi and see if it can find more then 2 gigs and start from there.

Ok, next step, booting without having to press F8 at the boot menu.

You have to mod winload.exe.

Code:

---

28A84        7416                to        9090
28237        7418                to        EB18
28255        0F8400010000        to        909090909090
28268        0F871CFDFFFF        to        909090909090

Search for differences

1. C:\Users\Administrator\Desktop\Kernel Hacks\winload.bin: 508,904 bytes
2. C:\Users\Administrator\Desktop\Kernel Hacks\winload-mod.bin: 508,904 bytes
Offsets: hexadec.

  138:        FA        C9
  139:        2E        EF
  13A:        08        07
28237:        74        EB
28255:        0F        90
28256:        84        90
28257:        00        90
28258:        01        90
28259:        00        90
2825A:        00        90
28268:        0F        90
28269:        87        90
2826A:        1C        90
2826B:        FD        90
2826C:        FF        90
2826D:        FF        90
28A84:        74        90
28A85:        16        90

18 difference(s) found.

---

I went all over the place looking for info on this and in the end some of the info was reliable enough for me to figure it out.

I don't need to press f8 anymore to boot a modded kernel.

Ran into a prob.
When copying over a large file from a hd to a usb stick windows will bsod.
ONLY when I have the kernel mod enabled, doesn't effect the normal x86 windows nor the x64 ver.

I found this:
http://support.microsoft.com/kb/976972

I haven't tried it yet though to see if it fixes the prob.
I have a theory that pre-sp1 had no issue like this, and that sp1 does.
Meaning win2k3 should not have this prob either.
Just a guess though.

I gotta re-install windows again to try this, need to work on tweaks again too (gotta figure out for example what causes flash not to install, or google earth plugin, etc etc).

you're a nut-job! :p: :)
I love it! :up:

Sounds like he's found a way to defy the world of math. Or at least, gut windows into ignoring it. Guess that why there's kernel mods going on. But the processor still has to be a 64-bit unit right? With a 32-bit base, your max memory is still 2^32 = 4,294,967,296 so if the processor was 32 bit then this would be...impossible?! So in the end he has a 64 bit processor that being well under-utilized because it has 32-bit Windows. Yeah, seems a lot of effort to get results that only a small niche few would use.

But sure, nice work. All the minds in a think tank get together and burn brain cells to come up with the stuff like my cell phone and even better graphics cards. Which I can surely appreciate. I'm just a dumb 'user' that likes to play WAY too much golf. Should put those coding skills to work with AMD so they can make drivers that are worth something.

You are correct, I think the only reason Microsoft has offered a 32 bit version for so long is to make money off the people still somehow running a 32 bit proc, other than that I see no other reason into even buying a 32 bit OS anymore specially Windows, it does not cost any more or less to go either route.

Khaotic, that is actually incorrect.
Windows uses memory in pages, it doesn't get direct raw access to the mem.

Win32 uses up to 2gig pages.
Win64 uses up to 4gig pages.
I haven't tried to fix that prob yet.

If a program was meant to use all ram, depending on the api used, it can usually do the same on x86.
For example s&m, uses every little bit of my 8 gigs of mem in win32.

An example of a normal program would be bitspirit, it shows the max mem it support in it's status, 2gigs for 32bit and 4gigs for 64.

You might be thinking well then, 64bit is the way then, it can use all the mem.
To be honest, win32 is the same, it can use up all the mem too, just in 2gig pages.
You could have 4x 2gig programs running at once in win32, in win64 it would take 2x 4gig paged programs to fill up 8gigs of mem.

nVidia vga drivers use all avalible mem, ALL of it, shared mem for textures and such.
This works 100% in x86 after the kernel mod (same goes for s&m, used it many times after the mod to test my mem and clocks).

Anyways windows uses some sort of paged table, where it stores the location and size of the memory page.
And these pages can extend up to 2gigs on the 32bit os'es, and 4gig's on the 64bit ones.
You can have as many as you want essentially.

I'm not sure of the actual limits.
It could be 2tb, or 2eb/2pb, not sure really.
I do know it's much higher then what any of our boards support ^^.

The only real prob with the mod is copying large files over form a drive to a usb stick, causes bsod.
Still haven't tried a fresh install with the usb stack update thingy to see if that fixes it.
Probably better I just move on to win8 x86 and mod that kernel, seeing if the usb bug is still in that os.

don't know very much about this but yeah, 32bit direct addressable ram is limited to the 2^32 limit. But I certainly know some (embedded)cpu systems I've used can be made to address more ram than the number of "bits" the cpu has. The only disadvantage is that it is considerably slower than normal direct memory addressing. That said, I'd expect massive incompatibilities when trying to use the same methods in a operating system hack on an OS as complicated as windows. Respect if you can make it work in a useful functional way.
Hope you can transition to 64 bit easily one day soon:P

Lol, it's no slower then before, ^^....

And to put it more clearly, I should of said this before.
A 32bit cpu can in theory address large amounts of memory with no prob as long as they have a working pae mode.

I know for a fact my athlon "Mobile MP" has pae mode... (I got 2x mp's, not xp's, easy mod for some of the chips).

In reality you guys, ... there is no single app that I know of anywhere for windows that is faster in x64, x64 exe does not matter, it's just as slow as it would be in windows 32...
I don't need to explain this lol, just know it works just as good as x64 windows...
If you know what you are doing, more then 3gigs of ram is usable np :).

I haven't time to work on this, I need to move on to win8 with a quickness anyways and mod that kernel, seeing how that one goes :).
With every major update of windows they bloat the shiz out of it, gotta do some tweaking on that os still, may be interesting though.
I think it might end up in the end with less sevices then win7, with the same config.

For example.
Win2k3, I think I got down to 11 processes, might of been 13, sure it was 11 by now though.
win7, 19-20 processes.

Win8, I think I can get rid of 1 at the very least, perhaps the audio svr thingy or end mapper whatever can be remapped to a diff svchost exe now.
That and with it's ability to use themes with the themese services disabled, looks like it's worth checking out.
Just haven't had the time.

I'm just ranting on now lol :).