Win7 SP1 winload.exe revision 23569

[jeremitu]

Tested and working. Partly based on https://github.com/Elbandi/PatchPae2. Provided exe and Visual Studio 2017 build.

[krombel]

@jeremitu Your patch is not working (at least in my env).
I see the "Starting Windows" screen with the animation and then the screens turns and stays black.
But interestingly I can boot to "Safe Mode" without issues with this patch so I can validate that it uses all of my RAM.

Have you tested with bitlocker enabled? Or any commands to debug that?

[jeremitu]

Never used bitlocker. I suppose you have issues with the graphic card, see comments under original wj32 patch I enhanced.
What graphic card are you using? "Intel HD and Nvidia graphics are known issues."
These driver problems were the main reasons Microsoft has named when forbidding 4GB+ for 32 bit Windows.

[krombel]

Ohh. I have "Intel HD"...
Thanks for you fast answer though

[jeremitu]

You might try older video drivers. Good luck!

[Satoshi64]

KB4056897 updated winload to 6.1.7601.23992 breaking it again.

[jeremitu]

Actually the same patch worked. I opened up the version check.
The source code is on Github, the full story and an exe to test on my website.

[Satoshi64]

It worked greatly, thank you!
Just had to rollback my video drivers to 332.21 as nvidia refuses to support pae on the newest. Didn't check at exactly which version they stopped.

[Satoshi64]

Microsoft has released a new security update, September 11, 2018—KB4457145, which fixes a severe flaw on the way windows handles images. This update has changed:
Ntkrnlpa.exe,6.1.7601.24231,"4,054,192",10-Aug-18,15:45
Ntoskrnl.exe,6.1.7601.24231,"3,961,440",10-Aug-18,15:44
Winload.exe,6.1.7601.24149,"535,616",30-May-18,13:04
Edit: Patch seems to still work.

[cnrat]

Microsoft has released a new security update, September 11, 2018—KB4457145, which fixes a severe flaw on the way windows handles images. This update has changed:
Ntkrnlpa.exe,6.1.7601.24231,"4,054,192",10-Aug-18,15:45
Ntoskrnl.exe,6.1.7601.24231,"3,961,440",10-Aug-18,15:44
Winload.exe,6.1.7601.24149,"535,616",30-May-18,13:04
Edit: Patch seems to still work.

Start failed with: MissingOsLoader. It seems MS add verification to winload.exe.

[Elbandi]

added an "invalid" char (utf8?) to source code

[Satoshi64]

Hello again, i hope this might be useful to anybody still using this in the future.

The last Windows 7 normal & ESU updates since have changed both ntkrnlpa.exe and winload.exe over the years. Right now the updated patch by jeremitu is able to patch all winloads until version 24538, any winload.exe above that will instantly fail. Stick to that one.
The tool is also still able to patch all ntkrnlpa.exe kernels until the latest version, 26220. But there is a trap: You will get bsods with error 0x00000100-something while booting on anything above 26174, so stick with that kernel.

[anonymoususer16]

Hello again, i hope this might be useful to anybody still using this in the future.

The last Windows 7 normal & ESU updates since have changed both ntkrnlpa.exe and winload.exe over the years. Right now the updated patch by jeremitu is able to patch all winloads until version 24538, any winload.exe above that will instantly fail. Stick to that one. The tool is also still able to patch all ntkrnlpa.exe kernels until the latest version, 26220. But there is a trap: You will get bsods with error 0x00000100-something while booting on anything above 26174, so stick with that kernel.

Version 26909 (2023/12):
edit winloadp.exe (or winload.exe)
Patch region 1
00 04 00 00 22 d8 08 00 10 00 -> 00 04 00 00 1a eb 08 00 10 00

Patch region 2
7c 24 14 8b 44 24 14 5f 5e 5b -> 7c 24 14 31 c0 90 90 5f 5e 5b