I tried your example in WinDbg, but it didn't work. I get an error message after "!vdmexts.r", and then it seems to early to insert the breakpoint, probably either because no memory is mapped there yet, or I don't know how to make ntvdm start a DOS mode.
Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
CommandLine: C:\Windows\System32\ntvdm.exe
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
ModLoad: 0eea0000 0ef63000 ntvdm.exe
ModLoad: 77c30000 77d72000 ntdll.dll
ModLoad: 76180000 76255000 C:\Windows\system32\kernel32.dll
ModLoad: 75dd0000 75e1b000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 77a20000 77ac1000 C:\Windows\system32\ADVAPI32.dll
ModLoad: 76510000 765bc000 C:\Windows\system32\msvcrt.dll
ModLoad: 764b0000 764c9000 C:\Windows\SYSTEM32\sechost.dll
ModLoad: 76990000 76a32000 C:\Windows\system32\RPCRT4.dll
ModLoad: 77e30000 77e7e000 C:\Windows\system32\GDI32.dll
ModLoad: 765d0000 76699000 C:\Windows\system32\USER32.dll
ModLoad: 765c0000 765ca000 C:\Windows\system32\LPK.dll
ModLoad: 763b0000 7644d000 C:\Windows\system32\USP10.dll
ModLoad: 71f70000 71f73000 C:\Windows\System32\sfc.dll
ModLoad: 71f60000 71f6d000 C:\Windows\System32\sfc_os.DLL
ModLoad: 76ca0000 778ec000 C:\Windows\system32\SHELL32.dll
ModLoad: 76450000 764a7000 C:\Windows\system32\SHLWAPI.dll
(c8c.d74): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00000000 ecx=0018f8a8 edx=77c76c74 esi=fffffffe edi=00000000
eip=77cd05d9 esp=0018f8c4 ebp=0018f8f0 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -
ntdll!LdrVerifyImageMatchesChecksum+0xbee:
77cd05d9 cc int 3
0:000> !vdmexts.load
0:000> !vdmexts.r
Current thread has no vdmtib (Teb.Vdm == NULL)
0:000> bp &020c:0aa6
0:000> g
Unable to insert breakpoint 0 at 00002b66, Win32 error 0n299
"Nur ein Teil der ReadProcessMemory- oder WriteProcessMemory-Anforderung wurde abgeschlossen."
The breakpoint was set with BP. If you want breakpoints
to track module load/unload state you must use BU.
bp0 at 020c:0aa6 failed
WaitForEvent failed
eax=00000000 ebx=00000000 ecx=0018f8a8 edx=77c76c74 esi=fffffffe edi=00000000
eip=77cd05da esp=0018f8c4 ebp=0018f8f0 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!LdrVerifyImageMatchesChecksum+0xbef:
77cd05da 8975fc mov dword ptr [ebp-4],esi ss:0023:0018f8ec=00000000 The running NTDV seems to loop in ntvdm!getIntelRegistersPointer. I don't know how to find the emulated instruction from this information.
Code:
0:000> p
eax=00000001 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3192 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntvdm!getIntelRegistersPointer+0x2aa:
0e9c3192 f6051407000003 test byte ptr ds:[714h],3 ds:0023:00000714=00
0:000> p
eax=00000001 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3199 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x2b1:
0e9c3199 7405 je ntvdm!getIntelRegistersPointer+0x2b8 (0e9c31a0) [br=1]
0:000> p
eax=00000001 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c31a0 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x2b8:
0e9c31a0 e8aef6ffff call ntvdm!getMSW (0e9c2853)
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c31a5 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x2bd:
0e9c31a5 a801 test al,1
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c31a7 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x2bf:
0e9c31a7 7456 je ntvdm!getIntelRegistersPointer+0x317 (0e9c31ff) [br=1]
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c31ff esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x317:
0e9c31ff 818e9803000000000200 or dword ptr [esi+398h],20000h ds:0023:022a3390=00010246
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3209 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntvdm!getIntelRegistersPointer+0x321:
0e9c3209 391dc42da00e cmp dword ptr [ntvdm!fSeparateWow+0x4e6c (0ea02dc4)],ebx ds:0023:0ea02dc4=00000000
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c320f esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x327:
0e9c320f 740b je ntvdm!getIntelRegistersPointer+0x334 (0e9c321c) [br=1]
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c321c esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x334:
0e9c321c 53 push ebx
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c321d esp=011bf748 ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x335:
0e9c321d 53 push ebx
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c321e esp=011bf744 ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x336:
0e9c321e 881d38659f0e mov byte ptr [ntvdm!SetShadowDescriptorEntries+0x1f141 (0e9f6538)],bl ds:0023:0e9f6538=01
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3224 esp=011bf744 ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x33c:
0e9c3224 ff159814980e call dword ptr [ntvdm+0x1498 (0e981498)] ds:0023:0e981498={ntdll!ZwVdmControl (77c06590)}
0:000> p
eax=00000000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c322a esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x342:
0e9c322a 8bf0 mov esi,eax
0:000> p
eax=00000000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c322c esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x344:
0e9c322c c60538659f0e01 mov byte ptr [ntvdm!SetShadowDescriptorEntries+0x1f141 (0e9f6538)],1 ds:0023:0e9f6538=00
0:000> p
eax=00000000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c3233 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x34b:
0e9c3233 391dc42da00e cmp dword ptr [ntvdm!fSeparateWow+0x4e6c (0ea02dc4)],ebx ds:0023:0ea02dc4=00000000
0:000> p
eax=00000000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c3239 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x351:
0e9c3239 740b je ntvdm!getIntelRegistersPointer+0x35e (0e9c3246) [br=1]
0:000> p
eax=00000000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c3246 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x35e:
0e9c3246 3bf3 cmp esi,ebx
0:000> p
eax=00000000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c3248 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x360:
0e9c3248 0f8c93000000 jl ntvdm!getIntelRegistersPointer+0x3f9 (0e9c32e1) [br=0]
0:000> p
eax=00000000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c324e esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x366:
0e9c324e 64a118000000 mov eax,dword ptr fs:[00000018h] fs:003b:00000018=7ffde000
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c3254 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x36c:
0e9c3254 a32ce0a20e mov dword ptr [ntvdm!CurrentMonitorTeb (0ea2e02c)],eax ds:0023:0ea2e02c=7ffde000
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c3259 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x371:
0e9c3259 64a118000000 mov eax,dword ptr fs:[00000018h] fs:003b:00000018=7ffde000
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c325f esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x377:
0e9c325f 8bb0180f0000 mov esi,dword ptr [eax+0F18h] ds:0023:7ffdef18=022a2ff8
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3265 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x37d:
0e9c3265 3bf3 cmp esi,ebx
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3267 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntvdm!getIntelRegistersPointer+0x37f:
0e9c3267 7478 je ntvdm!getIntelRegistersPointer+0x3f9 (0e9c32e1) [br=0]
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3269 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntvdm!getIntelRegistersPointer+0x381:
0e9c3269 391d54df9f0e cmp dword ptr [ntvdm!SetShadowDescriptorEntries+0x26b5d (0e9fdf54)],ebx ds:0023:0e9fdf54=00000000
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c326f esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x387:
0e9c326f 751c jne ntvdm!getIntelRegistersPointer+0x3a5 (0e9c328d) [br=0]
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3271 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x389:
0e9c3271 e8ddf5ffff call ntvdm!getMSW (0e9c2853)
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3276 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x38e:
0e9c3276 a801 test al,1
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3278 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x390:
0e9c3278 7413 je ntvdm!getIntelRegistersPointer+0x3a5 (0e9c328d) [br=1]
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c328d esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x3a5:
0e9c328d bf00020000 mov edi,200h
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3292 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x3aa:
0e9c3292 8d8e98030000 lea ecx,[esi+398h]
0:000> p
eax=022a0000 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3298 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x3b0:
0e9c3298 8b01 mov eax,dword ptr [ecx] ds:0023:022a3390=00030246
0:000> p
eax=00030246 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c329a esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntvdm!getIntelRegistersPointer+0x3b2:
0e9c329a a900000200 test eax,20000h
0:000> p
eax=00030246 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c329f esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
ntvdm!getIntelRegistersPointer+0x3b7:
0e9c329f 7407 je ntvdm!getIntelRegistersPointer+0x3c0 (0e9c32a8) [br=0]
0:000> p
eax=00030246 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32a1 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
ntvdm!getIntelRegistersPointer+0x3b9:
0e9c32a1 25fffffdff and eax,0FFFDFFFFh
0:000> p
eax=00010246 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32a6 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntvdm!getIntelRegistersPointer+0x3be:
0e9c32a6 8901 mov dword ptr [ecx],eax ds:0023:022a3390=00030246
0:000> p
eax=00010246 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32a8 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntvdm!getIntelRegistersPointer+0x3c0:
0e9c32a8 8b86ac050000 mov eax,dword ptr [esi+5ACh] ds:0023:022a35a4=00000002
0:000> p
eax=00000002 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32ae esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntvdm!getIntelRegistersPointer+0x3c6:
0e9c32ae 018690030000 add dword ptr [esi+390h],eax ds:0023:022a3388=00006130
0:000> p
eax=00000002 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32b4 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntvdm!getIntelRegistersPointer+0x3cc:
0e9c32b4 8b86a8050000 mov eax,dword ptr [esi+5A8h] ds:0023:022a35a0=00000000
0:000> p
eax=00000000 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32ba esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntvdm!getIntelRegistersPointer+0x3d2:
0e9c32ba 83f809 cmp eax,9
0:000> p
eax=00000000 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32bd esp=011bf74c ebp=011bf75c iopl=0 nv up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000293
ntvdm!getIntelRegistersPointer+0x3d5:
0e9c32bd 7c08 jl ntvdm!getIntelRegistersPointer+0x3df (0e9c32c7) [br=1]
0:000> p
eax=00000000 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32c7 esp=011bf74c ebp=011bf75c iopl=0 nv up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000293
ntvdm!getIntelRegistersPointer+0x3df:
0e9c32c7 ff14853c659f0e call dword ptr ntvdm!SetShadowDescriptorEntries+0x1f145 (0e9f653c)[eax*4] ds:0023:0e9f653c=0e9c32eb
0:000> p
eax=00000001 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32ce esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntvdm!getIntelRegistersPointer+0x3e6:
0e9c32ce 389e74060000 cmp byte ptr [esi+674h],bl ds:0023:022a366c=01
0:000> p
eax=00000001 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32d4 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntvdm!getIntelRegistersPointer+0x3ec:
0e9c32d4 0f85b8feffff jne ntvdm!getIntelRegistersPointer+0x2aa (0e9c3192) [br=1]
0:000> p
eax=00000001 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3192 esp=011bf74c ebp=011bf75c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntvdm!getIntelRegistersPointer+0x2aa:
0e9c3192 f6051407000003 test byte ptr ds:[714h],3 ds:0023:00000714=00 I managed to patch conhost and ntdvm, but it didn't change anything. It is possible that enabling 32Bit I/O in NTVDM might help.
Regarding the BIOS, if it is needed, than Microsoft should provide a generic BIOS that has the necessary functions, and nothing that interferes with the Window mode. Assuming a BIOS implementation waits for vertical sync to avoid flicker before it outputs a character, that time would be wasted in emulation. As Microsoft does provide a BIOS with the Virtual XP Mode, that should work, I just need a way to load it into memory before it is accessed.
If you want, I can give you access to TeamViewer, but for you to fix it would probably cost more than the complete computer.