Driver Studio 3.2 hang-up on WinXP
 

I have a AMD64 CPU with less than 4GB RAM and I am running WinXP SP1a (32-bit) with all updates (expect SP2) installed. I am using the recent Driver Studio 3.2 release. My computer is a fresh system, so there is no protector's driver making me problems.

I have the video driver set to start at boot-up and SoftICE to start manual. When I launch SoftICE either with "net start ntice" or with the suplied "startsi.exe", it simply hangs itself. This is done by SoftICE putting itself into a endless loop ("EB FE") inside NTICE code. So the OS is locked but I still can call SoftICE with the key-combo and I can read the error messages.

The only message is "Int0E Fault in SoftICE at address XXXXXXX offset XXXXXXXX". Then there is also a stack and register dump and a message that SoftICE could not parse all symbols correctly. More at the top there is this highlighted: "*** API Hook Failure: MiCopyOnWrite".

Even if I don't have SP2 installed, I tried the /NOPAE and /NOEXECUTE=ALWAYSOFF settings, but without luck.

I also saw the "BREAKINSHAREDMODS" variable is not recognized any more, but I don't think that has to do with this.

Can anybody tell me what I am making wrong? or can anybody tell me what happened to the BREAKINSHAREDMODS variable?

I think you should download the osinfo.dat for XP SP2. It may be help.

I think answers are here already:
http://www.exetools.com/forum/showthread.php?t=6804

http://www.exetools.com/forum/showthread.php?t=6794

I have downloaded the new osinfo.dat and copied it to the windows\system32\drivers directory overwriting the old one, but it still locks my computer.

Where can I get the old kernel file? Windows Update overwrited the old one but the one on the CD is too old and I don't want to reinstall my system because then I need to do Windows activation again and I heard that you should not use this too often or microsoft have you to explain why you activate so often.

What is with the BREAKINSHAREDMODS variable now? How is it called now?

DEP
 

I think it may be confict with DEP. You can disable DEP in boot.ini. Change /NoExecute to /Execute.

In DS3.2. There is not usermodebreakpoint. Bpx now have parameter .t|.p to set breakpoint on thread or process. So it need not usermodebreakpoint now. If you set breakpoint with no param, it act as 2.7 before, break on every process.

I'm betting that 64 bit is not properly supported even with the osinfo.dat file. I've scoured the site for compuware and the it doesn't specifically say that it supports 64 bit processing. Even on a 32 bit system to 64 the upper byte blocks would be 0000:0000 and it shouldn't matter, but the only thing compuware mentions is devpartner42 which is not linked to driver studio.

I could be wrong, hopefully others with a 64 bit system can chime in to add more

Chris

Well, I have installed DS3.2 on AMD64 with XP-SP1 and SP2 and it works great. DS3.1 was not working at all on AMD64.

I have /NoExecute=OptIn in boot.ini.

Also, Visual Softice works also great.

Crazy this computer world...it should be the same for same computer... :)

DS32 hanged up WinXP SP1 during "Manual" start (other modes was not checked) in my computer when "Kaspersky Anti-Virus Monitor" was installed. Was switched off but installed only!
I deleted "Monitor" (but "Scanner" is still in use) and DS works well now.

It's not only now. These modifiers existed in ver.2.7 already (and I am not sure but they were in some earlier versions...)

@MarkusO:
I already posted this in an other thread, but it hasn't been posted here yet, so here it is again:

Maybe you have BIOS settings for this problem. I once worked with a 8x Xeon MP computer with 16 GB RAM installed and its BIOS contained a setting like (I don't remember the exact words): "enable memory hole above 4G". When you enabled it, Windows wasn't able to detect more than 4 GB of RAM. Although I don't know if this had an effect on the PAE settings.

I didn't yet install DS 3.2 (I only update when a protector "needs" it or when I reformat my HDD), so I can't tell you what happened to the variable you mentioned.

@willii:
I think MarkusO has no conflicts with DEP since he is using SP1a, but DEP was introduced in SP2. He already wrote that he, even if not using SP2, used the BOOT.INI setting "/NoExecute=AlwaysOff", which is identical to "/Execute".

Remember that the FTP also has the

"Compuware_DevPartner64_v1.0.1_iNTERNAL-PARADOX"

release, which might have something for these issues.

See:

http://www.compuware.com/products/devpartner/64.htm

Regards,

@JMI:
But not for 6-post Users in "New Member" group.

@MarkusO:
Don't request anybody to download it for you or you might run into trouble with JMI denying you to step up into the next usergroup for some weeks. Just be a bit more active in the forums and you will get FTP access. Or you could try to catch it on some filesharing networks.

I havent had success installing Devparter64 due to missing serial number for installation. Anyway, it looks an older version than DS3.2, isnt it? So, I guess that DS3.2 is more compatible with newest Windows.

If anyone success installing DevPartner64, just drop a line ;)

Kerlingen:

NOT having FTP access is no excuse. That's why the Diety invented internet search engines. That program is out there is several places, including the one where the rest of them were uploaded from and an alternative location for obtaining DS 3.2 has already been posted here and that source also has the DevPartner version as well. :eek: ;)

Regards,

I installed new ICEEXT 0.66 with DS 3.2 support and it told me that some value in registry was wrong with SoftICE and if it should correct it and I said yes and now SoftICE starts without hanging up.

But now when I enter "net start iceext" at command line to start ICEEXT it tells me a "system error 1450" with a message that I don't have enough system resources to execute the service. this also happens when I enter this and SoftICE is not alraedy loaded. Then it loads SoftICE but for ICEEXT it gives me same error message (not ICEEXT message but Windows messge). But all my memory is free so this can't be. Has anybody seen this alraedy is is this also a problem of SP1 with all updates?

Just to make it more clear (this info is posted in all 3 threads):

If you have the latest Windows Updates installed (as of 24.02.05, MS05-15 is the latest), DriverStudio 3.1 or SoftICE 4.3.1 will WORK if you use the previous version of the NTOSKRNL.EXE, version 5.1.2600.1568 from 17.06.2004.

The update which is causing the problem is KB885835 which comes with a new NTOSKRNL.EXE, version 5.1.2600.1605 from 22.10.2004, and it seems that, for the moment, as of 24.02.2005, the OSINFO.DAT from Compuware's web site does not work with this NTOSKRNL.EXE.

You can find the old version in this directory: C:\WINDOWS\$NtUninstallKB885835$
(replace C:\WINDOWS with your actual path).

So, copy this NTOSKRNL.EXE to OLD_KRNL.EXE and add this line to your BOOT.INI:

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional DS 3.1" /fastdetect /noguiboot /KERNEL=OLD_KRNL.EXE

Then just restart and whenever you want to run DS 3.1, just select the proper configuration
befre you start Windows.
:-)

@MarkusO:
The BreakInSharedMods variable is no longer used in DriverStudio 3.2. I installed the new version a few minutes ago on Win2K and when setting breakpoints they break in all processes, without having to use the ATTACH or ADDR command any longer.

<Edit>
I also tried to install IceExt 0.66, but it doesn't load, even if it is the version especially build for DriverStudio 3.2. I'm getting an error message from NET.EXE when trying to load IceExt, which tries to convince me that I'm out of system resources, even if it runs as stable as with DriverStudio 3.1 and IceExt 0.65 and with the same KDE settings. You don't accidently have your problems only with IceExt installed, do you?
</Edit>

<Edit2>
Your post wasn't yet moderated when I posted this, so yes, I'm also having problems with IceExt 0.66 with the same error message when trying to start the service.
</Edit2>

@leosmi05:
You should better delete your other responses. You posted your last reply in three different threads. If JMI finds out, he will tell you some not very nice sounding words in bold letters (or take care of you in a different way), since all people below 15 posts are watched very closely on what they post. Posting three times exacly the same message doesn't qualify as "useful" post.

I got it now, but this is for IA64 CPUs (Itanium), not for x86_64 CPUs (AMD64/EM64T). So it can't help here.

Kerlingen:

I think that you are wrong. It can target IA64 and AMD64/EMT64T.

I can't test it since I have no IA64 or AMD64/EM64T Computer available. (hopefully I have an EM64T soon)

I only read the NFO and I think it doesn't leave much room for interpretation:

@Kerlingen
> You should better delete your other responses. You posted your last reply in three different threads.
Yes, it was on purpose, but not to have more posts. I just wanted to let it there so that you don't have to read all the 3 different posts.

@JMI
Sorry about that. I'll post only once if this was not a good idea.
You can remove the post and let it only in one place.
And you can also substract 2 from my message count. ;)

I think JMI did already "review" you. When I warned you about your posts, you had a post count of 14. Now you have a post count of 8.

don't remember exactly which steps i took to make Driver studio 3.1 load without freezing or similar problem.. ididn't like the new command for breakpoint because i'm familiar with SICE 4.05 so decided to uninstall and got 3.2 .. running but i have similar problem as Markuso .. after loading i could do Ctrl+D and SICE loads but Windows is freezed.. happends with manual and booting with windows will not let it load it...so far i remember i didn't edit any boot.ini or anything and 3.1 was loading fine.. now again i'm having trouble with this new version.. running SP1a with all latest updats except Sp2.. Pemtium 3 at 600 mhz, Intel board, 512 MB SDram, ATI Range 128 PRO (32 MB AGP)

so far i see NTice is looping on an infinitive loop (EBFE) . why ?

My boot.ini:

[boot loader]
timeout=30
default=C:\
[operating systems]
C:\="Microsoft Windows 98 SE" /noguiboot
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /noguiboot

attached Winice.dat

any ideas?

@Crk:
Did you already read this whole thread? Do you have a error with hooking "MiCopyOnWrite"? Are you using IceExt? Did you try to replace your KERNEL with the old version? Did you already try /NoPAE and /NoExecute=AlwaysOff switches? How does your hang-up differ from the ideas posted here already?

will try with time the old kernel trick since .. that could be the cause as you explained? i will try later but i didn't used any boot.ini trick before as i mentioned.. maybe was some .dat replacement to make DS 3.1 work.. but not sure .. will let you know.. will give a try those .ini changes explained here to see if work.... to MArKuso ... what trick worked for you??

and about Icext ..i didn't have it installed and DS 3.2 had same problem.. happends with latest version of icext installed or not .. icext (latest version) runs fine for me.

Regards

confirmed the OLD Kernel tricks works.. unfortanely iceext67 is not doing the hidden job very well..... FTPRush (armadillo) exit with some error Code after loading DS 3.2 + iceext

Best Regards

Stepping back to an older kernel is not even necessary. I am running DS 3.01 on the most current XP. All you have to do is:

- Download latest WinDbg (free download from Microsoft) and install it.
- Pick symsrv.dll from WinDbg installation and replace the older version in the DS installation folder with it. Note: There are at least two instances of symsrv.dll in the DS folders.
- Run the DS symbol retriever. Configure output path etc. to your liking, then pick NTOSKRNL.EXE, ntdll.dll, kernel32.dll, user32.dll from your Windows/System32 directory and add them to the list of files.
- Download appropriate debug symbol files from MS and let the symbol retriever translate them to *.nms (Numega symbol format) - this may take a bit of time and the symbol retriever isn't too talkative about the progress. Just be patient until the program has done its work :)
- Run the DS setup program, add the following line to the advanced settings:
NTSYMBOLS=ON
- add the previously generated nms files to the list of symbols to import for SI.
- Download latest osinfo.dat just to make sure and replace the outdated file in your Windows/System32/Drivers (IIRC)
- Save the settings and reboot your comp.
- Open a dosbox, enter "net start ntice" and there ya go.

P.S. I am currently fiddling with IceExt in combination with a total conversion of SoftICE - I'll let you know when (if) I find a way to make it work properly.