[RalfFriedl]

Thank you for your reply.

I had attached the debugger to ntvdm, as that was the process consuming the CPU time. It seems to do some busy waiting for something that happens either after hours of waiting, or never. What I don't know is how I find out which BIOS instructions are executed. Do I need the DOS-Mode debugger, debug.exe? If so, this is a problem, because as a DOS program, debug.exe needs/runs ntvdm and again hangs. Or do I have to start a real DOS and trace through INT 10? If so, which function?

What I don't understand is why the VGA BIOS even matters, and if it does than only for DOS mode programs not for other programs in a console window. Even if a DOS program uses INT 10, there is no reason to invoke the VGA BIOS because initialization/output goes to the console window, not to the real screen. Actually it would seems dangerous to invoke the VGA BIOS, it might change the mode from graphics to text, it might write something into VGA memory that might distort the image. And trying to switch to fullscreen just gives the message that fullscreen is not supported on the system.
Would it be possible to patch the BIOS Image so that INT 10 immediately returns?

Some programs use INT 10, although most do not because is was also slow on the original machines. It seems Intel wants to do a proper emulation, although I'm not sure the original machines were that slow. Regarding your statement about Linux, Intel has working text output, they just don't care that it is so slow that you can see the characters appear. Linux users have no real problem because it affects only the boot manager, Linux will talk directly to the hardware.

Regarding your offer, what would I need to have installed?
On an intellectual level I would like to know what causes this and how to fix it. On a practical level, I have installed Microsoft's Virtual XP Mode, and while not ideal, it works.

[leecher]

Hi,

You ar eright, using a DOS-debugger doesn't make much sense if DOS startup itself is affected.
What you can try to do, even though it may be a bit of a mess, is to use WinDbg from Microsoft Debugging Tools for windows, it also allows you to debug your real mode stuff.
This may not be the most elegant solution to enter current DOS code, but what I usually do the following:

0:000> !vdmexts.load
0:000> !vdmexts.r
eax=00000132 ebx=0000001e ecx=00000001 edx=00000000 esi=000000ee edi=000003d0
eip=00000aa6 esp=00000a62 ebp=00000a72                nv up ei pl zr na po nc 
cs=020c  ss=00a7  ds=0040  es=00a7  fs=0000  gs=0000             efl=00090246
020c:0aa6 eb06            jmp	aae	
0:000> bp &020c:0aa6
0:000> g
Breakpoint 2 hit
eax=00000132 ebx=0000001e ecx=00000001 edx=00000000 esi=000000ee edi=000003d0
eip=00000aa6 esp=00000a62 ebp=00000a72 iopl=0     vif nv up ei pl zr na pe nc
cs=020c  ss=00a7  ds=0040  es=00a7  fs=0000  gs=0000             efl=000a0246
<Unloaded_rt.dll>+0x2b65:
020c:0aa6 eb06            jmp     0AAE

Now you can step through, set breakpoints, etc. Remember to use the & prefix for real mode Segment:Offset addresses. As you surely know, video BIOS is at segment C000. Maybe you are stuck in there?

Now for your question:
NTVDM needs to load/map the Video BIOS to the original location on startup. It sets up some traps for INT10h in windowed mode though, which redirect the stuff to the console window and these traps are not in effect when you use fullscreen where it really directly writes to the screen which is of course faster (already mentioned this dispatcher in my article about the Intel bug). To accomplish this, the classic Video I/O ports are passed through to the Hardware by the video driver (V86 mode actually "traps" out to the NTVDM on every attempted Port I/O so that the NTVDM.exe "hypervisor" can then handle it, i.e. pass it on, interpret or ignore it etc., so there is no danger of really writing to the Hardware as you mentioned, as it all must go through NTVDM first). This mechanism also gets used to communicate between the NTVDM's MS-DOS Kernel and the NTVDM, by issuing a BOP (this is normally an illegal instruction which then causes the CPU to call NTVDM's fault handler which in turn does the handling of these special commands).
Now there is a requirement that Video drivers have to tell the system which additional port ranges besides the usual Port-ranges their Videobios uses so that these can be forwarded to the real ports so that VGA BIOS isn't broken in NTVDM. But I aready mentioned this in my "NVIDIA GEFORCE" article above, I think.
If you would kill VGA BIOS from NTVDM, you won't get any usable text output, you need some kind of BIOS to do the INT 10h handling anyway, so why not use the real one...
On the GEFORCE patch, I wrote my own INT 10h handler for display Mode switch, reimplementing all the stuff that the Video BIOS already offers doesn't sound like a good solution to me.

The error with the lacking fullscreen operation is just because of the fact that the newer WDDM display drivers don't support VGA anymore as the XPDM dirvers did. Use my mode switching patch in order to fix this so that you can force Windows 7 to disable the WDDM driver and switch to plain VGA which still supports fullscreen.

For letting me check the startup delays, I'd need WinDbg installed on your machine (including vdmexts mentioned above, but I think they ship with WinDbg by default) and probably a TeamViewer or something like that fo remote access. But maybe you want to step around with WinDbg yourself first?

Regards

[RalfFriedl]

I tried your example in WinDbg, but it didn't work. I get an error message after "!vdmexts.r", and then it seems to early to insert the breakpoint, probably either because no memory is mapped there yet, or I don't know how to make ntvdm start a DOS mode.

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: C:\Windows\System32\ntvdm.exe
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
ModLoad: 0eea0000 0ef63000   ntvdm.exe
ModLoad: 77c30000 77d72000   ntdll.dll
ModLoad: 76180000 76255000   C:\Windows\system32\kernel32.dll
ModLoad: 75dd0000 75e1b000   C:\Windows\system32\KERNELBASE.dll
ModLoad: 77a20000 77ac1000   C:\Windows\system32\ADVAPI32.dll
ModLoad: 76510000 765bc000   C:\Windows\system32\msvcrt.dll
ModLoad: 764b0000 764c9000   C:\Windows\SYSTEM32\sechost.dll
ModLoad: 76990000 76a32000   C:\Windows\system32\RPCRT4.dll
ModLoad: 77e30000 77e7e000   C:\Windows\system32\GDI32.dll
ModLoad: 765d0000 76699000   C:\Windows\system32\USER32.dll
ModLoad: 765c0000 765ca000   C:\Windows\system32\LPK.dll
ModLoad: 763b0000 7644d000   C:\Windows\system32\USP10.dll
ModLoad: 71f70000 71f73000   C:\Windows\System32\sfc.dll
ModLoad: 71f60000 71f6d000   C:\Windows\System32\sfc_os.DLL
ModLoad: 76ca0000 778ec000   C:\Windows\system32\SHELL32.dll
ModLoad: 76450000 764a7000   C:\Windows\system32\SHLWAPI.dll
(c8c.d74): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00000000 ecx=0018f8a8 edx=77c76c74 esi=fffffffe edi=00000000
eip=77cd05d9 esp=0018f8c4 ebp=0018f8f0 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
ntdll!LdrVerifyImageMatchesChecksum+0xbee:
77cd05d9 cc              int     3
0:000> !vdmexts.load
0:000> !vdmexts.r
Current thread has no vdmtib (Teb.Vdm == NULL) 
0:000> bp &020c:0aa6
0:000> g
Unable to insert breakpoint 0 at 00002b66, Win32 error 0n299
    "Nur ein Teil der ReadProcessMemory- oder WriteProcessMemory-Anforderung wurde abgeschlossen."
The breakpoint was set with BP.  If you want breakpoints
to track module load/unload state you must use BU.
bp0 at 020c:0aa6 failed
WaitForEvent failed
eax=00000000 ebx=00000000 ecx=0018f8a8 edx=77c76c74 esi=fffffffe edi=00000000
eip=77cd05da esp=0018f8c4 ebp=0018f8f0 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!LdrVerifyImageMatchesChecksum+0xbef:
77cd05da 8975fc          mov     dword ptr [ebp-4],esi ss:0023:0018f8ec=00000000

The running NTDV seems to loop in ntvdm!getIntelRegistersPointer. I don't know how to find the emulated instruction from this information.

0:000> p
eax=00000001 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3192 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntvdm!getIntelRegistersPointer+0x2aa:
0e9c3192 f6051407000003  test    byte ptr ds:[714h],3       ds:0023:00000714=00
0:000> p
eax=00000001 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3199 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x2b1:
0e9c3199 7405            je      ntvdm!getIntelRegistersPointer+0x2b8 (0e9c31a0) [br=1]
0:000> p
eax=00000001 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c31a0 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x2b8:
0e9c31a0 e8aef6ffff      call    ntvdm!getMSW (0e9c2853)
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c31a5 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x2bd:
0e9c31a5 a801            test    al,1
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c31a7 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x2bf:
0e9c31a7 7456            je      ntvdm!getIntelRegistersPointer+0x317 (0e9c31ff) [br=1]
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c31ff esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x317:
0e9c31ff 818e9803000000000200 or  dword ptr [esi+398h],20000h ds:0023:022a3390=00010246
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3209 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntvdm!getIntelRegistersPointer+0x321:
0e9c3209 391dc42da00e    cmp     dword ptr [ntvdm!fSeparateWow+0x4e6c (0ea02dc4)],ebx ds:0023:0ea02dc4=00000000
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c320f esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x327:
0e9c320f 740b            je      ntvdm!getIntelRegistersPointer+0x334 (0e9c321c) [br=1]
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c321c esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x334:
0e9c321c 53              push    ebx
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c321d esp=011bf748 ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x335:
0e9c321d 53              push    ebx
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c321e esp=011bf744 ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x336:
0e9c321e 881d38659f0e    mov     byte ptr [ntvdm!SetShadowDescriptorEntries+0x1f141 (0e9f6538)],bl ds:0023:0e9f6538=01
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3224 esp=011bf744 ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x33c:
0e9c3224 ff159814980e    call    dword ptr [ntvdm+0x1498 (0e981498)] ds:0023:0e981498={ntdll!ZwVdmControl (77c06590)}
0:000> p
eax=00000000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c322a esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x342:
0e9c322a 8bf0            mov     esi,eax
0:000> p
eax=00000000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c322c esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x344:
0e9c322c c60538659f0e01  mov     byte ptr [ntvdm!SetShadowDescriptorEntries+0x1f141 (0e9f6538)],1 ds:0023:0e9f6538=00
0:000> p
eax=00000000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c3233 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x34b:
0e9c3233 391dc42da00e    cmp     dword ptr [ntvdm!fSeparateWow+0x4e6c (0ea02dc4)],ebx ds:0023:0ea02dc4=00000000
0:000> p
eax=00000000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c3239 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x351:
0e9c3239 740b            je      ntvdm!getIntelRegistersPointer+0x35e (0e9c3246) [br=1]
0:000> p
eax=00000000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c3246 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x35e:
0e9c3246 3bf3            cmp     esi,ebx
0:000> p
eax=00000000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c3248 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x360:
0e9c3248 0f8c93000000    jl      ntvdm!getIntelRegistersPointer+0x3f9 (0e9c32e1) [br=0]
0:000> p
eax=00000000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c324e esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x366:
0e9c324e 64a118000000    mov     eax,dword ptr fs:[00000018h] fs:003b:00000018=7ffde000
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c3254 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x36c:
0e9c3254 a32ce0a20e      mov     dword ptr [ntvdm!CurrentMonitorTeb (0ea2e02c)],eax ds:0023:0ea2e02c=7ffde000
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c3259 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x371:
0e9c3259 64a118000000    mov     eax,dword ptr fs:[00000018h] fs:003b:00000018=7ffde000
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=00000000 edi=00000200
eip=0e9c325f esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x377:
0e9c325f 8bb0180f0000    mov     esi,dword ptr [eax+0F18h] ds:0023:7ffdef18=022a2ff8
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3265 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x37d:
0e9c3265 3bf3            cmp     esi,ebx
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3267 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntvdm!getIntelRegistersPointer+0x37f:
0e9c3267 7478            je      ntvdm!getIntelRegistersPointer+0x3f9 (0e9c32e1) [br=0]
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3269 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntvdm!getIntelRegistersPointer+0x381:
0e9c3269 391d54df9f0e    cmp     dword ptr [ntvdm!SetShadowDescriptorEntries+0x26b5d (0e9fdf54)],ebx ds:0023:0e9fdf54=00000000
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c326f esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x387:
0e9c326f 751c            jne     ntvdm!getIntelRegistersPointer+0x3a5 (0e9c328d) [br=0]
0:000> p
eax=7ffde000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3271 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x389:
0e9c3271 e8ddf5ffff      call    ntvdm!getMSW (0e9c2853)
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3276 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x38e:
0e9c3276 a801            test    al,1
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3278 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x390:
0e9c3278 7413            je      ntvdm!getIntelRegistersPointer+0x3a5 (0e9c328d) [br=1]
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c328d esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x3a5:
0e9c328d bf00020000      mov     edi,200h
0:000> p
eax=022a0000 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3292 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x3aa:
0e9c3292 8d8e98030000    lea     ecx,[esi+398h]
0:000> p
eax=022a0000 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3298 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x3b0:
0e9c3298 8b01            mov     eax,dword ptr [ecx]  ds:0023:022a3390=00030246
0:000> p
eax=00030246 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c329a esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntvdm!getIntelRegistersPointer+0x3b2:
0e9c329a a900000200      test    eax,20000h
0:000> p
eax=00030246 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c329f esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
ntvdm!getIntelRegistersPointer+0x3b7:
0e9c329f 7407            je      ntvdm!getIntelRegistersPointer+0x3c0 (0e9c32a8) [br=0]
0:000> p
eax=00030246 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32a1 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
ntvdm!getIntelRegistersPointer+0x3b9:
0e9c32a1 25fffffdff      and     eax,0FFFDFFFFh
0:000> p
eax=00010246 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32a6 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntvdm!getIntelRegistersPointer+0x3be:
0e9c32a6 8901            mov     dword ptr [ecx],eax  ds:0023:022a3390=00030246
0:000> p
eax=00010246 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32a8 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntvdm!getIntelRegistersPointer+0x3c0:
0e9c32a8 8b86ac050000    mov     eax,dword ptr [esi+5ACh] ds:0023:022a35a4=00000002
0:000> p
eax=00000002 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32ae esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntvdm!getIntelRegistersPointer+0x3c6:
0e9c32ae 018690030000    add     dword ptr [esi+390h],eax ds:0023:022a3388=00006130
0:000> p
eax=00000002 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32b4 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntvdm!getIntelRegistersPointer+0x3cc:
0e9c32b4 8b86a8050000    mov     eax,dword ptr [esi+5A8h] ds:0023:022a35a0=00000000
0:000> p
eax=00000000 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32ba esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntvdm!getIntelRegistersPointer+0x3d2:
0e9c32ba 83f809          cmp     eax,9
0:000> p
eax=00000000 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32bd esp=011bf74c ebp=011bf75c iopl=0         nv up ei ng nz ac po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000293
ntvdm!getIntelRegistersPointer+0x3d5:
0e9c32bd 7c08            jl      ntvdm!getIntelRegistersPointer+0x3df (0e9c32c7) [br=1]
0:000> p
eax=00000000 ebx=00000000 ecx=022a3390 edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32c7 esp=011bf74c ebp=011bf75c iopl=0         nv up ei ng nz ac po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000293
ntvdm!getIntelRegistersPointer+0x3df:
0e9c32c7 ff14853c659f0e  call    dword ptr ntvdm!SetShadowDescriptorEntries+0x1f145 (0e9f653c)[eax*4] ds:0023:0e9f653c=0e9c32eb
0:000> p
eax=00000001 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32ce esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntvdm!getIntelRegistersPointer+0x3e6:
0e9c32ce 389e74060000    cmp     byte ptr [esi+674h],bl     ds:0023:022a366c=01
0:000> p
eax=00000001 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c32d4 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntvdm!getIntelRegistersPointer+0x3ec:
0e9c32d4 0f85b8feffff    jne     ntvdm!getIntelRegistersPointer+0x2aa (0e9c3192) [br=1]
0:000> p
eax=00000001 ebx=00000000 ecx=011bf71c edx=77c06c74 esi=022a2ff8 edi=00000200
eip=0e9c3192 esp=011bf74c ebp=011bf75c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntvdm!getIntelRegistersPointer+0x2aa:
0e9c3192 f6051407000003  test    byte ptr ds:[714h],3       ds:0023:00000714=00

I managed to patch conhost and ntdvm, but it didn't change anything. It is possible that enabling 32Bit I/O in NTVDM might help.

Regarding the BIOS, if it is needed, than Microsoft should provide a generic BIOS that has the necessary functions, and nothing that interferes with the Window mode. Assuming a BIOS implementation waits for vertical sync to avoid flicker before it outputs a character, that time would be wasted in emulation. As Microsoft does provide a BIOS with the Virtual XP Mode, that should work, I just need a way to load it into memory before it is accessed.

If you want, I can give you access to TeamViewer, but for you to fix it would probably cost more than the complete computer.

[leecher]

Hi,

Did you try all threads? Iirc command has to be issued in Thread 0.
The loop that you are seing isn't in getIntelRegistersPointer, it is in a funtion that is 0x2aa bytes away from this function. You are seeing this, because the debugger can only rely on the publically visible function names/exports.
You are most likely in the processing loop of cpu_simulate which is perfectly fine.

I attached 32bit IOfix to try.

I guess it's not so easy to coordinate Teamviewer access via board, but as said, I can have a look at it for free and will warn you when I find out that it is a lot of work and I therefore cannot do it for free
You can PM me a Teamviewer ID and PW and I can send you back a date/time when I will use it so that you can prepare for it, if you want.

[RalfFriedl]

Thank you for the 32-Bit fix. With this fix, it works.
I have disassembled the BIOS, it seems it's doing 32-Bit I/O to addresses 0CF8, 0CFC, F000, F004. Ports 0CF8 and 0CFC seem to be PCI config, the result from those is used to determine ports F000 and F004. The BIOS area is writable and accessed via CS register.

I still think it is a stupid idea from Microsoft to use the VGA BIOS at this point (or at all). For all we and Windows knows, the BIOS may pass the parameters to the GPU to do the real work, as the GPU is often faster that the main CPU, especially with Atom and Celeron CPUs. Not that the output speed is an indication of that.
I think fullscreen mode should also not use the BIOS. It is better and faster to require support in the Windows VGA Driver than to call the real mode BIOS and then trap and emulate the I/O access.

I also tried the following program to load a complete BIOS:

#define i386
#include <windows.h> 

#pragma comment (lib, "user32.lib")

__declspec(dllexport) BOOL __cdecl VDDInitialize(IN PVOID DllHandle, IN ULONG Reason, IN PCONTEXT Context OPTIONAL)
{
  switch (Reason) {

  case DLL_PROCESS_ATTACH:
    {
      HANDLE hFile;
      DWORD dwLen;
      hFile = CreateFile ("C:/WINDOWS/SYSTEM32/VGABIOS.BIN", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
      if (hFile == INVALID_HANDLE_VALUE) {
	OutputDebugString ("VGABIOS.BIN not found.");
	return FALSE;
      }
      ReadFile (hFile, (LPVOID)0xC0000, 0x20000, &dwLen, NULL);
      CloseHandle (hFile);
      break;
    }
  case DLL_PROCESS_DETACH:
    break;
  default:
    break;
  }
  return TRUE;
}

I tried to compile it with the compiler from the "SDK for Windows 7" with "cl -LD vgabios.c". This created a DLL, and I could verify with ProcMon that the DLL is loaded by NTVDM, but I saw no indication that it would try to open the BIOS file. Is this idea generally flawed, do I have to do something else to create a library that can be used by NTVDM, or is it generally no possible to access files this way from NTVDM? Can you tell me what is necessary to create a suitable DLL for NTVDM, or if special tools are necessary, compile the program for me?

Do you know how NTVDM knows how to attach to a DOS command? When I called NTVDM directly, from the command line or in the debugger, it just exits. I also replaced it with a program to display the command line, it seems the NTDVM command line is empty, so there must be something else to tell NTVDM what to do.

The VGA BIOS for this adapter is almost 64kB, while the one from the Virtual Machine is just 32kB. Considering they don't want to support the 16-Bit BIOS, they made it quite big. And is seems to be assembly, not C, so that is not the reason why it is so big.

I will send you the TeamViewer codes in case you are still interested.

[leecher]

Zitat von RalfFriedl

Thank you for the 32-Bit fix. With this fix, it works.
I have disassembled the BIOS, it seems it's doing 32-Bit I/O to addresses 0CF8, 0CFC, F000, F004. Ports 0CF8 and 0CFC seem to be PCI config, the result from those is used to determine ports F000 and F004. The BIOS area is writable and accessed via CS register.

Good to hear! So maybe I should release the fix on the download-page then as fix for your VGA BIOS-Version (as opposed to the Indelvidfix, I wonder if ppl can tell these fixes apart...).

Zitat von RalfFriedl

I still think it is a stupid idea from Microsoft to use the VGA BIOS at this point (or at all). For all we and Windows knows, the BIOS may pass the parameters to the GPU to do the real work, as the GPU is often faster that the main CPU, especially with Atom and Celeron CPUs. Not that the output speed is an indication of that.
I think fullscreen mode should also not use the BIOS. It is better and faster to require support in the Windows VGA Driver than to call the real mode BIOS and then trap and emulate the I/O access.

Every VGA card must be handled differently and as it also gets used in i.e. DOS it perfetly makes sense to use it in fullsreen, as you don't need to write a different driver for every VGA-Card out there. Imagine that this also has to work with standard VGA driver too.

Nevertheless, I haven't tried that, but I think if
in HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System
the Key "Identifier" contains "ARCx86", NTVDM uses emulated ROMs instead of the system ROMs.

Zitat von RalfFriedl

I also tried the following program to load a complete BIOS:
I tried to compile it with the compiler from the "SDK for Windows 7" with "cl -LD vgabios.c". This created a DLL, and I could verify with ProcMon that the DLL is loaded by NTVDM, but I saw no indication that it would try to open the BIOS file. Is this idea generally flawed, do I have to do something else to create a library that can be used by NTVDM, or is it generally no possible to access files this way from NTVDM? Can you tell me what is necessary to create a suitable DLL for NTVDM, or if special tools are necessary, compile the program for me?

Just a shot in the dark: Did you forget to set /entry:"VDDInitialize" in the linker flags?
You can learn more about VDDs by reading d_vdos.chm from the NTDDK.

Zitat von RalfFriedl

Do you know how NTVDM knows how to attach to a DOS command? When I called NTVDM directly, from the command line or in the debugger, it just exits. I also replaced it with a program to display the command line, it seems the NTDVM command line is empty, so there must be something else to tell NTVDM what to do.

NTVDM has to be initiated by the Windows NT Loader. It has to be that way, because NTVDM can actually execute other (i.e. NTVDM) programs within itself, i.e. if you type a command in command.com and it has to reuse its own instance instead of creating a new NTVDM for every new DOS appliation that gets executed. Here is a very short description how it works:
When you first execute a DOS executable, the Windows NT loader will recognize, that it's not a WIN32 PE-Executable. So it next checks if it is a NE-Executable, a Batch-File or even a headerless .COM program.
The loader sets an error code depending on the type of Non-WIN32 Executable the user tries to execute. It sets the error code STATUS_INVALID_IMAGE_PROTECT or STATUS_INVALID_IMAGE_NOT_MZ and passes the error on t the BasepProcessInvalidImage() function. This function then checks with BaseIsDosApplication(), whether the user wants to execute a DOS application or not. If this is the case, the loader does a BaseCheckVDM call to see if there is already an NTVDM here tht can be used to exeute the DOS or Win16 NE application with it. According to the results, it then registers the application to exeute with the CSRSS subsystem and if not present, start up NTVDM with an ID, and optionally also specifies a parameter whether NTVDM should execute as WOW16 layer or as DOS emulator.
NTVDM then in turn uses the GetNextVDMCommand() API call to check what's up next to execute and if it finds something, it executes the command with the given environment block.
So in short: No, you cannot run NTVDM.exe the way you tried

Zitat von RalfFriedl

The VGA BIOS for this adapter is almost 64kB, while the one from the Virtual Machine is just 32kB. Considering they don't want to support the 16-Bit BIOS, they made it quite big. And is seems to be assembly, not C, so that is not the reason why it is so big.

My guess is that this MMIO-Stuff which is in there maybe is better optimized for onboard VGA.

Zitat von RalfFriedl

I will send you the TeamViewer codes in case you are still interested.

I guess sending the VGA BIOS dump for my collection will be enough then, thanks

[RalfFriedl]

With the option for entry, I can get the DLL initialization executed, but I get the warning
vgabiosload.dll : warning LNK4086: entrypoint '_VDDInitialize' is not __stdcall with 12 bytes of arguments; image may not run
But whether stdcall or cdecl, replacing the BIOS seems not to be a good idea. Maybe somthing of the original BIOS was already initialized by the time my DLL got called. I tried breakpoints on &c000:0003 and &c000:0014, but the debugger doesn't stop.
Anyway, I placed a call to MessageBox in my function, that causes NTVDM to wait and I can attach to the process. Now I just would have to find out with of the four threads is the correct one and how to get to the emulated CPU.

I have attached the BIOS, and this is the Id strings for the graphics adapter:
PCI\VEN_8086&DEV_22B1&SUBSYS_B27319DA&REV_21\3&115 83659&0&10

[leecher]

Hi,

I wouldn't go your route by writing a VDD driver just overwriting the BIOS area.
The warning with the calling convention is OK for VDDs iirc, don't worry about it.

If you want to force NTVDM to use the *.rom files from System32-Directory, better patch config() function of NTVDM to set UseEmulationROM=TRUE.
Then also stub out the call to GetROMsMapped() so that NtAllocateVirtualMemory for the BIOS areas doesn't fail in the UseEmulationROM=TRUE branch in the same function and if you have luck, you can use v7vga.rom and emulated BIOS ROMs then, if this is what you desire.

PS: CPU isn't "emulated", it's running in V86 mode, so instructions are directly executed by Monitor on your CPU. Emulation is only there on non-x86 CPUs.

[RalfFriedl]

I no longer need to overwrite the BIOS, as 32-Bit I/O solved my problem. But I had thought before that it might be a solution, so I was curious.

Sorry, I don't know where to find the functions config() and GetROMsMapped(). Are the sources to NTVDM somewhere in the files installed by the SDK?

[leecher]

Might be a solution for those whose BIOS is unfixable (with the limitation that fullscreen may be broken), but I agree that fixing the BIOS either with 32bit I/O fix or by patching problematic functions is a better solution.

Regarding the symbols for NTVDM.EXE: You can get them from the Microsoft Symbol Server. You can set up your favourite debugger to use them.
i.e. in Windbg, you can either enter Symbol server path in menu or just start windbg with:

windbg -kl -y SRV*C:\temp\*http://msdl.microsoft.com/download/symbols

Where C:\TEMP is a valid path to cache symbol information. Some of my patches rely on these symbols too in order to find the correct location to patch within the NTVDM.EXE of the user's version. With the increasing number of versions released, hardcoding these offsets per build-number doesn't make a lot of sense anymore, as they are constantly changing.
OllyDbg, x32dbg and alle the other nice debuggers that are good for patching executables support symbol server too.