2 all
Опытным путем определил минимальное количество оперативки, необходимое для запуска:
1) Windows NT SP6a (ENG) - 6!!! Mb.
2) Windows 2000 SP4 (ENG) - 16!!! Mb.
Ковыряние в кернеле XPSP2 продолжается.
Выяснил что CMPXCHG8B импользуется в ntoskrnl.exe (и его вариантах) 8 раз и в NTDLL.DLL.
Также установил что ядро WinXP при отключенной проверке на CMPXCHG8B/CPUID ошибочно воспринимает *любой* 486-й камень как 386-й и "вылетает" в недрах ntoskrnl.exe с отключенным ACPI (F7/F5):
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Opened \\.\com1
Waiting to reconnect...
Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE
Kernel Debugger connection established.
Symbol search path is: .\SYMBOLS
Executable search path is:
Loading symbols for 80400000 ntoskrnl.exe -> ntoskrnl.exe
ModLoad: 80400000 80614780 ntoskrnl.exe
Windows XP Kernel Version 2600 UP Free x86 compatible
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x80400000 PsLoadedModuleList = 0x80483b20
System Uptime: not available
Loaded dbghelp extension DLL
Loaded ext extension DLL
Loaded exts extension DLL
Loaded kext extension DLL
Loaded kdexts extension DLL
Force unload of ntoskrnl.exe
ModLoad: 80400000 80614780 ntoskrnl.exe
ModLoad: 80615000 8062ec00 hal.dll
*** Fatal System Error: 0x0000005d
(0x01040305,0x756E6547,0x49656E69,0x6C65746E)
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.
A fatal system error has occurred.
...
...
********************************************
Use !analyze -v to get detailed debugging information.
BugCheck 5D, {1040305, 756e6547, 49656e69, 6c65746e}
Probably caused by : ntoskrnl.exe ( nt!KiInitializeKernel+444 )
Followup: MachineOwner
---------
nt!RtlpBreakWithStatusInstruction:
8040cb25 cc int 3
kd> !analyze -v
********************************************
UNSUPPORTED_PROCESSOR (5d)
386 - System failed because the processor is only a 386 or
compatible. The system requires a Pentium (or higher) compatible processor.
Arguments:
Arg1: 01040305
Arg2: 756e6547
Arg3: 49656e69
Arg4: 6c65746e
Debugging Details:
------------------
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x5D
LAST_CONTROL_TRANSFER: from 8045b8e7 to 8040cb25
STACK_TEXT:
80479410 8045b8e7 00000003 8047976c 00000000 nt!RtlpBreakWithStatusInstruction
8047945c 8045c3be 00000003 80479890 ffdffa2c nt!KiBugCheckDebugBreak+0x19
8047983c 8045c9ae 0000005d 01040305 756e6547 nt!KeBugCheck2+0x574
8047985c 805e3f39 0000005d 01040305 756e6547 nt!KeBugCheckEx+0x1b
804798bc 805d2d2c 80482580 80482320 80479b80 nt!KiInitializeKernel+0x444
00000000 00000000 00000000 00000000 00000000 nt!KiSystemStartup+0x2bf
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiInitializeKernel+444
805e3f39 cc int 3
SYMBOL_STACK_INDEX: 4
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 41108004
SYMBOL_NAME: nt!KiInitializeKernel+444
FAILURE_BUCKET_ID: 0x5D_nt!KiInitializeKernel+444
BUCKET_ID: 0x5D_nt!KiInitializeKernel+444
Followup: MachineOwner
---------
2 all
Опытным путем определил минимальное количество оперативки, необходимое для запуска:
1) Windows NT SP6a (ENG) - 6!!! Mb.
2) Windows 2000 SP4 (ENG) - 16!!! Mb.
Ковыряние в кернеле XPSP2 продолжается.
Выяснил что CMPXCHG8B импользуется в ntoskrnl.exe (и его вариантах) 8 раз и в NTDLL.DLL.
Также установил что ядро WinXP при отключенной проверке на CMPXCHG8B/CPUID ошибочно воспринимает *любой* 486-й камень как 386-й и "вылетает" в недрах ntoskrnl.exe с отключенным ACPI (F7/F5):
Microsoft (R) Windows Debugger Version 6.6.0007.5 Copyright (c) Microsoft Corporation. All rights reserved. Opened \\.\com1 Waiting to reconnect... Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE Kernel Debugger connection established. Symbol search path is: .\SYMBOLS Executable search path is: Loading symbols for 80400000 ntoskrnl.exe -> ntoskrnl.exe ModLoad: 80400000 80614780 ntoskrnl.exe Windows XP Kernel Version 2600 UP Free x86 compatible Built by: 2600.xpsp_sp2_rtm.040803-2158 Kernel base = 0x80400000 PsLoadedModuleList = 0x80483b20 System Uptime: not available Loaded dbghelp extension DLL Loaded ext extension DLL Loaded exts extension DLL Loaded kext extension DLL Loaded kdexts extension DLL Force unload of ntoskrnl.exe ModLoad: 80400000 80614780 ntoskrnl.exe ModLoad: 80615000 8062ec00 hal.dll *** Fatal System Error: 0x0000005d (0x01040305,0x756E6547,0x49656E69,0x6C65746E) Break instruction exception - code 80000003 (first chance) A fatal system error has occurred. Debugger entered on first try; Bugcheck callbacks have not been invoked. A fatal system error has occurred. ... ... ******************************************** Use !analyze -v to get detailed debugging information. BugCheck 5D, {1040305, 756e6547, 49656e69, 6c65746e} Probably caused by : ntoskrnl.exe ( nt!KiInitializeKernel+444 ) Followup: MachineOwner --------- nt!RtlpBreakWithStatusInstruction: 8040cb25 cc int 3 kd> !analyze -v ******************************************** UNSUPPORTED_PROCESSOR (5d) 386 - System failed because the processor is only a 386 or compatible. The system requires a Pentium (or higher) compatible processor. Arguments: Arg1: 01040305 Arg2: 756e6547 Arg3: 49656e69 Arg4: 6c65746e Debugging Details: ------------------ DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x5D LAST_CONTROL_TRANSFER: from 8045b8e7 to 8040cb25 STACK_TEXT: 80479410 8045b8e7 00000003 8047976c 00000000 nt!RtlpBreakWithStatusInstruction 8047945c 8045c3be 00000003 80479890 ffdffa2c nt!KiBugCheckDebugBreak+0x19 8047983c 8045c9ae 0000005d 01040305 756e6547 nt!KeBugCheck2+0x574 8047985c 805e3f39 0000005d 01040305 756e6547 nt!KeBugCheckEx+0x1b 804798bc 805d2d2c 80482580 80482320 80479b80 nt!KiInitializeKernel+0x444 00000000 00000000 00000000 00000000 00000000 nt!KiSystemStartup+0x2bf STACK_COMMAND: kb FOLLOWUP_IP: nt!KiInitializeKernel+444 805e3f39 cc int 3 SYMBOL_STACK_INDEX: 4 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntoskrnl.exe DEBUG_FLR_IMAGE_TIMESTAMP: 41108004 SYMBOL_NAME: nt!KiInitializeKernel+444 FAILURE_BUCKET_ID: 0x5D_nt!KiInitializeKernel+444 BUCKET_ID: 0x5D_nt!KiInitializeKernel+444 Followup: MachineOwner ---------