Emulator hangs when install Windows 3.1

[OldMadMan]

I've compiled Tsugaru to High-Fidelity mode using cmake under Windows, when install Windows 3.1, Just at the last moment before the installer will enter the GUI stage, one of the following two errors will occur:

The first klnd of error is:

Write to CRTC-HST register. VM Aborted! Device:486DX Reason:286 16-bit INT gate not supported Towns TIME (Nano-Seconds): 127222141110 CS:EIP=0053:00000F00 LINEAR:80005890 EFLAGS=00003092 CPL=03 EAX=000002A7 EBX=0002306F ECX=0000FFFF EDX=8000FFEF ESI=000036EC EDI=0000FFE8 EBP=00000000 ESP=000000F8 CS=0053(LIN:80004990) DS=004B(LIN:00020C00) ES=0098(LIN:80009000) FS=0000(LIN:00000000) GS=0000(LIN:00016890) SS=004B(LIN:00020C00) CR0=80000021 CR1=00000000 CR2=00000000 CR3=00452000 CF0 PF0 AF1 ZF0 SF1 TF0 IF0 DF0 OF0 IOPL03 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:8B 21 53 00 92 32 83 00 00 44 00 44 00 01 DB 00 SS+00000010:FE 1F A8 02 87 29 98 00 1F 01 70 48 00 80 00 01 0053:00000F00 E89C05 CALL 0000149F

The second kind of error is:

VM Aborted! Device:486DX Reason:Clocks-Passed is not set. Towns TIME (Nano-Seconds): 65444254675 CS:EIP=0000:000000A8 LINEAR:000000A8 EFLAGS=00027293 CPL=03 EAX=000008C0 EBX=0002A303 ECX=0000B90C EDX=00149C61 ESI=0000CA00 EDI=00000E82 EBP=0000531E ESP=00005612 CS=0000(LIN:00000000) DS=2ABE(LIN:0002ABE0) ES=0000(LIN:00000000) FS=0020(LIN:00000200) GS=1675(LIN:00016750) SS=4BAB(LIN:0004BAB0) CR0=80000001 CR1=00000000 CR2=00000000 CR3=007E0000 CF1 PF0 AF1 ZF0 SF1 TF0 IF1 DF0 OF0 IOPL03 NT1 RF0 VM1 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 SS+00000010:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000:000000A8 DA10 FICOM(m32int)DWORD PTR [BX+SI]

Is there any solution to this problem at present? Thank you so much.

[captainys]

Interesting. So the installer looks like running in what they call 'standard mode'. I am using an hdd image captured from (presumably) a pre-install model to skip the installation. I'll look into the installer.

[OldMadMan]

Interesting. So the installer looks like running in what they call 'standard mode'. I am using an hdd image captured from (presumably) a pre-install model to skip the installation. I'll look into the installer.

Thank you so much for replying me. I would like to add here that I also tested the installation of Windows 3.0. It turns out that during the installation process, the installer has a certain chance to enter the GUI stage.

After the installation is complete and restarted, it is difficult to enter Windows 3.0 by typing win under DOS. The emulator often freezes shortly after the boot screen appears. At this time, the hard disk read/write indicator is always on, but no error message appears.

I also couldn't get Windows to start in real mode or protected mode. Windows will directly prompt that it does not support booting in these two modes.

But I also have luck when I can enter the system, as shown in the figure

[OldMadMan]

I've compiled newest code ([a2a277c]) and tried again, error "Reason:Clocks-Passed is not set." still occured.

[qazmko1029]

I got "286 16-bit INT gate not supported" in previous commit, now I tried the latest commit and it still hang up, but with different reason.

Write to CRTC2 Reg(D0)=0000 Value=00 Write to CRTC-HST register. Write to CRTC-HST register. VM Aborted! Device:486DX Reason:Interrupt to lower-privilege level should raise exception. Towns TIME (Nano-Seconds): 87379076190 CS:EIP=0053:00000F27 LINEAR:800058B7 EFLAGS=00003016 CPL=03 EAX=80000004 EBX=00000004 ECX=00000002 EDX=000006F9 ESI=000019D1 EDI=000019C8 EBP=000030C4 ESP=000030BC CS=0053(LIN:80004990) DS=0100(LIN:00016890) ES=0108(LIN:00100000) FS=0000(LIN:00000000) GS=0000(LIN:00016890) SS=0068(LIN:00020C00) CR0=80000021 CR1=00000000 CR2=00000000 CR3=00452000 CF0 PF1 AF1 ZF0 SF0 TF0 IF0 DF0 OF0 IOPL03 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:84 05 F8 00 16 32 19 05 1C 04 00 00 FF DE 00 00 SS+00000010:D8 30 00 00 E4 30 00 00 10 00 00 00 F9 06 00 00 0053:00000F27 E87505 CALL 0000149F

Tsugaru_CUI.exe _roms\mx -TOWNSTYPE MX -SCALE 100 -FREQ 100 -MEMSIZE 32 -USEFPU -CMOS _profile\MX\cmos.bin -CD "W:\l12\SETUP_CDROM.cue" -HD0 _profile\MX\hdd_128m.h0 -GAMEPORT0 PHYS0 -GAMEPORT1 MOUSE

[captainys]

OK. I had to fix a few more CPU behaviors, but I successfully got past the issues you described. Icon labels seem to be corrupt during the installation, but once you start real Windows 3.1, you are fine. Also, if you have some drive letters assigned, but partition does not exist, you get an error, but you can simply click on "Cancel" to get past the dialog.

Windows 3.1 support is real preliminary. At least I confirmed I can play Solitair, but many programs do not work at this point. But, please feel free to post an issue you found here.

[OldMadMan]

Unfortunately, I compiled the latest code again, but still got the same error (Clocks-Passed is not set), here is some information about my computer's hardware and software environment, which may help.

CPU: AMD Ryzen 7 5800X OS: Windows 11 Build 25324.1011 Vsual Studio: Visual Studio 2022 17.6.0 Preview 2.0

Process of compiling: a. Download latest Tsugaru code package and extract it to D:\Tsugaru b. Create a folder called ci_Windows in D:\Tsugaru c. Open "x86 Native Tools Command Prompt for VS 2022" from Start Menu, type D: then cd Tsugaru\ci_windows d. Type cmake ../srchf, then cmake --build . --config Release e. Put the compiled exe file together with the Auto Release v20230113 version of Tsugaru_GUI and use it.

[qazmko1029]

OK, with the latest commit I installed win3.1, but in 1024x768 the screen glitches with mouse moving, but fine. BTW, using general english keyboard I can't press alt key for windows and dos app menu, ESC is fine with keyboard set to TRANS1 though.

[qazmko1029]

Tried again with current different revision of win3.1 on the Internet, Win3.1 L10 failed with same "Interrupt to lower-privilege level should raise exception", L11 and L12 is fine. Maybe something changed between revs to make it work. Win3.1 L10 is available in redump archive, download here: https://mega.nz/file/E1hSAI4D#Z8rX319SO-SCwN2U4amtbBjKlspKAW5nTiTjoNDl2_Y Win3.1 L11 is available in Neokobe archive, download: https://archive.org/download/neo_kobe_fujitsu_fm_towns_2016-02-25-repack_20200803/Fujitsu%20FM%20Towns/%5BOS%5D%20Windows%203.1%20L11%20%28Microsoft%29/

[OldMadMan]

Alright, finally I find out that Windows 3.1 GUI Setup works only when I use commands to start Tsugaru_CUI. If I use Tsugaru_GUI, Windows 3.1 cannot be installed. I wonder why.

[captainys]

Alright, finally I find out that Windows 3.1 GUI Setup works only when I use commands to start Tsugaru_CUI.

Maybe some default options is blocking something. I will worry about GUI later. Also I used Windows 3.1 L12, I think. Right now I'm working on swap-in and swap-out. Somehow some bytes swapped out to the disk is not swapped in from the correct sector. If you specify like 32MB RAM, you have less chance of hitting this swap-in and -out issue.

[captainys]

I have fixed exception handling in a bunch of instructions. I haven't tested Win 3.0 and Win3.1 L10 and L11 myself, but can you try again with the latest source? I still need to support exception handling in many more instructions, but at least majority of the time if it is not supported, it should tell you "Unhandled Exception" error. Also you have a better chance of success if you start with 32MB RAM rather than 4MB because it will make less chances of swap-ins and swap-outs.

[qazmko1029]

Tried it, now win3.1 L10 is able to get to GUI stage, but WINSETUP crashed instantly.

command: Tsugaru_CUI.exe "_roms\mx" ^ -TOWNSTYPE MX -SCALE 100 -NOWAIT ^ -FREQ 200 -MEMSIZE 32 -USEFPU ^ -CMOS _profile\MX\cmos.bin ^ -CD "W:\30l14\Nihongo Microsoft Windows V3.0 with Multimedia Extensions V1.0 L10 (Japan).cue" ^ -HD0 _profile\MX\hdd_128m.h0 ^ -GAMEPORT0 PHYS0 -GAMEPORT1 MOUSE ^ -KEYBOARD TRANS1 -KEYMAP "_profile\keymap_fix_alt.txt"

DOS environment use FMT MS-DOS 5.0 L22 with himem+emm386, GDS.SYS, cdrom , ms-mouse 7.0 and smartdrv driver loaded.

1st try:

2nd try:

Write to CRTC-HST register. VM Aborted! Device:486DX Reason:Undefined REG for C0 Towns TIME (Nano-Seconds): 195508718045 CS:EIP=0E6F:0000086C LINEAR:0021127C EFLAGS=00003246 CPL=03 EAX=163F0000 EBX=000076F2 ECX=00000000 EDX=00000000 ESI=000018C4 EDI=000009D6 EBP=00004678 ESP=00004660 CS=0E6F(LIN:00210A10) DS=0FAF(LIN:0014E170) ES=0000(LIN:0012B530) FS=0000(LIN:00000180) GS=0000(LIN:00000180) SS=163F(LIN:0012B530) CR0=00000021 CR1=00000000 CR2=00000000 CR3=00FCE000 CF0 PF1 AF0 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL03 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3C 18 D6 09 00 00 FF 19 75 4B 78 46 FE 19 8E 46 SS+00000010:4F 0A 00 00 01 00 01 00 8E 46 5A 0A 01 00 00 00 0E6F:0000086C C07509F7 C0? BYTE PTR [DI+09H],F7H

3rd try: (crashed back to ms-dos after 3 seconds going into GUI stage with no debugger pause or any indication.)

tried more times but occurred more random problem with no luck.

For win3.0, L17 installs fine in previous commit but would freeze on running certain apps including the ones bundled in system. It still happens now, for example when I open calc VM freeze:

VM Aborted! Device:486DX Reason:Clocks-Passed is not set. Towns TIME (Nano-Seconds): 230639188705 CS:EIP=0AA5:000026E5 LINEAR:00043925 EFLAGS=00000202 CPL=01 EAX=00000429 EBX=00000010 ECX=00000AAD EDX=00002757 ESI=000000B5 EDI=00000A8E EBP=00002594 ESP=00002584 CS=0AA5(LIN:00041240) DS=0AA5(LIN:00041240) ES=0039(LIN:8001529C) FS=0000(LIN:00039520) GS=0000(LIN:00000000) SS=0A8D(LIN:8052AA40) CR0=8000002B CR1=00000000 CR2=80534000 CR3=0015A000 CF0 PF0 AF0 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:AD 0A 52 00 3C 00 00 00 9E 02 85 0A 9E 00 85 0A SS+00000010:00 00 00 00 00 00 00 00 00 00 00 00 A1 25 AC 25 0AA5:000026E5 9BDBE4 FWAIT ?FPUINSTDB E4 REG=04 If comment out the particular Abort function, calc runs but whatever number type in would return "too large number"(i guess, can't read japanese and didn't use translator)

win3.0 L14 is the same as before, installs but fails to run. Crashed back to dos after the error msg:

BTW, mouse works perfectly in win3.1 L11 and L12 but somehow not in win3.1 L10 or any win3.0, in these situation mouse click works but I can't move the cursor.

Hope it helps.

[captainys]

Thank you for testing! I'll look into L10 installation. By the way, regarding the FPU error, can you try with -DONTUSEFPU option and see if it makes a difference?

[captainys]

Regarding 3.0 L17's calc, 9B EB E4 can be LOCK FSETPM, if this version of calc.exe came from 80286 code. I've added support for FSETPM instruction and pushed the source.

[qazmko1029]

Tried new code, now calc in win3.0 l17 works in -DONTUSEFPU but in -USEFPU it still freeze. Running calc in -USEFPU: Write to CRTC-HST register. VM Aborted! Device:486DX Reason:Clocks-Passed is not set. Towns TIME (Nano-Seconds): 57442763340 CS:EIP=0A85:0000097D LINEAR:80536A5D EFLAGS=00000246 CPL=01 EAX=00000009 EBX=00000064 ECX=00000004 EDX=0000076D ESI=0000017A EDI=00000020 EBP=000024B6 ESP=00002408 CS=0A85(LIN:805360E0) DS=0A8D(LIN:8052E0A0) ES=0000(LIN:80530E40) FS=0000(LIN:0004B520) GS=0000(LIN:00000000) SS=0A8D(LIN:8052E0A0) CR0=8000002B CR1=00000000 CR2=80549000 CR3=0015A000 CF0 PF1 AF0 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:80 0F 6D 0A 7A 01 20 00 45 0A 2A 24 6B 3D 45 0A SS+00000010:00 00 FF 3C B4 08 00 00 00 00 3E 24 00 00 3C 24 0A85:0000097D 9BDF07 FWAIT ?FPUINST REG=00

BTW, system freeze with some other apps I tried(using -DONTUSEFPU):

Running "Windows Setup" freeze the system: Write to CRTC-HST register. VM Aborted! Device:486DX Reason:Clocks-Passed is not set. Towns TIME (Nano-Seconds): 65553760965 CS:EIP=00FD:000003CC LINEAR:0003E8EC EFLAGS=00000286 CPL=01 EAX=0000F31E EBX=00003940 ECX=0000F31B EDX=0000000A ESI=00000053 EDI=00000E62 EBP=00007574 ESP=0000393E CS=00FD(LIN:0003E520) DS=0AB5(LIN:00093F20) ES=0000(LIN:00046040) FS=0000(LIN:8001529C) GS=0000(LIN:00000000) SS=0AB5(LIN:00093F20) CR0=80000021 CR1=00000000 CR2=8054B000 CR3=0015A000 CF0 PF1 AF0 ZF0 SF1 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:62 0E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 SS+00000010:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00FD:000003CC 6D

Running "Terminal" freeze the system after choosing serial port: Write to CRTC-HST register. VM Aborted! Device:486DX Reason:Clocks-Passed is not set. Towns TIME (Nano-Seconds): 190296840805 CS:EIP=0028:80007220 LINEAR:80007220 EFLAGS=00000046 CPL=00 EAX=80400BB0 EBX=80428100 ECX=00000000 EDX=00000A00 ESI=80402E24 EDI=8085EE80 EBP=8000722C ESP=80007208 CS=0028(LIN:00000000) DS=0030(LIN:00000000) ES=0030(LIN:00000000) FS=03DD(LIN:8055D540) GS=0000(LIN:00000000) SS=0030(LIN:00000000) CR0=80000021 CR1=00000000 CR2=80573000 CR3=0015A000 CF0 PF1 AF0 ZF1 SF0 TF0 IF0 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=32 Default Address Size=32 Stack Address Size=32 !EXCEPTION! SS+00000000:31 D1 03 80 37 95 02 80 00 10 42 80 08 B3 02 80 SS+00000010:25 5E 00 80 00 00 00 00 DD 03 00 00 30 00 00 00 0028:80007220 DD03 FLD(m64real)DWORD PTR [EBX]

[captainys]

FYI. High-Fidelity mode will be a command-line option, instead of re-compiling, soon. Will be exposed in the GUI as well.

[captainys]

"Interrupt to lower-privilege level should raise exception" was probably from my PIC implementation. Same issue happens from time to time if I started Win3.1L12 in the standard mode (with WIN /S). I fixed it. I hope it also fixes L10 installation.

Also Terminal problem seems to be i8251 implementation issue, but I haven't fully figured how I should fix yet.

The latest source you don't need to re-compile to use Windows 3.1. You can start with -HIGHFIDELITY option. Or you can choose CPU fidelity from the GUI.

[qazmko1029]

Thanks, but L10 still can't be installed. Choosing "Express installation" in text setup stage, installation crashed after GUI setup copy files, then stop in gray background:

Choosing custom installation, 1st try: VM aborted after passing GUI setup component seclection window: Write to CRTC-HST register. VM Aborted! Device:486DX Reason:Undefined REG for C0 Towns TIME (Nano-Seconds): 139761621640 CS:EIP=0E6F:0000086C LINEAR:0021127C EFLAGS=00003246 CPL=03 EAX=163F0000 EBX=000076F2 ECX=00000000 EDX=00000000 ESI=00001888 EDI=000009D6 EBP=00004678 ESP=00004660 CS=0E6F(LIN:00210A10) DS=0FAF(LIN:0014E170) ES=0000(LIN:0012B530) FS=0000(LIN:00000180) GS=0000(LIN:00000180) SS=163F(LIN:0012B530) CR0=00000021 CR1=00000000 CR2=00000000 CR3=00FCE000 CF0 PF1 AF0 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL03 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3C 18 D6 09 00 00 FF 19 75 4B 78 46 FE 19 8E 46 SS+00000010:4F 0A 00 00 01 00 01 00 8E 46 5A 0A 01 00 00 00 0E6F:0000086C C07509F7 C0? BYTE PTR [DI+09H],F7H

2nd try:

3rd try: using 16 colors video driver instead of 256 colors one, it crashed back to dos after same stage. just so random lol.

[captainys]

Thank you for checking! If you are running from the terminal, can you try running with -DEBUG option to see if the debugger tells anything?

[qazmko1029]

Sure, but how do I use the debugger? Any documentation?

latest commit, win3.1 L10 express installation, after GUI copying files(tried 2 times): VM Aborted! Device:486DX Reason:Unhandled exception! ND(0x00000B8C) Debugger Enabled. Towns TIME (Nano-Seconds): 122491683385 CS:EIP=0B77:0000023C LINEAR:0005782C EFLAGS=00003256 CPL=03 EAX=F8FF0CD2 EBX=00000CD2 ECX=00000000 EDX=0000030B ESI=00000000 EDI=000045C0 EBP=000045A8 ESP=000045A0 CS=0B77(LIN:000575F0) DS=0D07(LIN:00197F30) ES=163F(LIN:0012B530) FS=0000(LIN:00000180) GS=0000(LIN:00000180) SS=163F(LIN:0012B530) CR0=00000021 CR1=00000000 CR2=00000000 CR3=00FCE000 CF0 PF1 AF1 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL03 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 !EXCEPTION! SS+00000000:01 01 F6 1D AF 0F 01 01 CA 45 20 24 9F 0E 99 00 SS+00000010:6E 01 A2 0C 94 08 A0 1B 8A 00 6D 00 F6 01 06 01 0B77:0000023C C207A7 RET A707H

VM Aborted! Device:486DX Reason:Unhandled exception! ND(0x00000EF4) Debugger Enabled. Towns TIME (Nano-Seconds): 255187822325 CS:EIP=0DDF:000009C4 LINEAR:00062E94 EFLAGS=00003202 CPL=03 EAX=163F0001 EBX=00000107 ECX=00000100 EDX=00000000 ESI=00001984 EDI=00001AB6 EBP=000045A2 ESP=000044D6 CS=0DDF(LIN:000624D0) DS=0FAF(LIN:0019C790) ES=11F7(LIN:0006E6B0) FS=0000(LIN:00000180) GS=0000(LIN:00000180) SS=163F(LIN:00125C70) CR0=00000021 CR1=00000000 CR2=00000000 CR3=00FCE000 CF0 PF0 AF0 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL03 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 !EXCEPTION! SS+00000000:AF 0F 50 03 01 00 00 00 80 00 6F 04 4E 00 02 80 SS+00000010:00 00 48 1B 4C C3 00 00 89 00 7F 1E B6 1A A4 01 0DDF:00003D6D CA0A00 RETF 000AH 0DDF:000009C4 8ED8 MOV DS,AX

custom installation, after GUI typing in computer name: VM Aborted! Device:486DX Reason:Unhandled exception! ND(0x00000B8C) Debugger Enabled. Towns TIME (Nano-Seconds): 139882106625 CS:EIP=0B77:0000023C LINEAR:0005782C EFLAGS=00003256 CPL=03 EAX=F8FF0CD2 EBX=00000CD2 ECX=00000000 EDX=0000030B ESI=00000000 EDI=000045C0 EBP=000045A8 ESP=000045A0 CS=0B77(LIN:000575F0) DS=0D07(LIN:00197F30) ES=163F(LIN:0012B530) FS=0000(LIN:00000180) GS=0000(LIN:00000180) SS=163F(LIN:0012B530) CR0=00000021 CR1=00000000 CR2=00000000 CR3=00FCE000 CF0 PF1 AF1 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL03 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 !EXCEPTION! SS+00000000:01 01 F6 1D AF 0F 01 01 CA 45 20 24 9F 0E 99 00 SS+00000010:6E 01 A2 0C 94 08 A0 1B 8A 00 6D 00 F6 01 06 01 0B77:0000106D CA0E00 RETF 000EH 0B77:0000023C C207A7 RET A707H

custom installation, after GUI typing in computer name and component selection window, 2nd try: VM Aborted! Device:486DX Reason:Unhandled exception! ND(0x00000EA4) Debugger Enabled. Towns TIME (Nano-Seconds): 168615267695 CS:EIP=0E6F:00000D4E LINEAR:0021175E EFLAGS=00003246 CPL=03 EAX=163F0001 EBX=0000088C ECX=00000047 EDX=00000000 ESI=00001888 EDI=000009D6 EBP=00004652 ESP=0000464A CS=0E6F(LIN:00210A10) DS=0FAF(LIN:0014E170) ES=163F(LIN:0012B530) FS=0000(LIN:00000180) GS=0000(LIN:00000180) SS=163F(LIN:0012B530) CR0=00000021 CR1=00000000 CR2=00000000 CR3=00FCE000 CF0 PF1 AF0 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL03 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 !EXCEPTION! SS+00000000:AF 0F 88 18 57 00 00 00 78 46 6C 08 FF 0E 01 00 SS+00000010:88 18 3C 18 D6 09 3C 18 D6 09 00 00 FF 19 75 4B 0E6F:00000439 CA0E00 RETF 000EH 0E6F:00000D4E 08FF OR BH,BH

[captainys]

Thanks! Except the first case showing ND exception on RET instruction, the rest consistently getting ND exception on RETF instruction. Probably correct exception handling from ENTER instruction reduced the randomness. I've just pushed the new source that handles exceptions from RETF. I hope it let the installer run.

If you enable debugger, it will do some additional checks and tells you if something went wrong. Especially, if CPU registers change from the beginning of the instruction when it handles an exception, it will stop and tell you what instruction messed up. Majority of the times, what I was doing wrong was changing CPU state while running an instruction but did not restore when an exception was raised. There can be more locations I was making the same mistake. The hope is the debugger catches those errors.

If you are interested in using debugger commands, type H in the terminal to see all commands.

[qazmko1029]

Now 3.1 L10 installs fine, but can't get into it. What does this mean? Debugger has no output.

Edit: win /s can get me into the system. Running builtin CD Player really slows down the system and get me this output in loop: CDROM Command 3F function unknown. Currently just return no-error status. CDROM Command 3F function unknown. Currently just return no-error status. CDROM Command 3F function unknown. Currently just return no-error status.

Once close the app the speed get recovered.

[captainys]

Thank you again! Big step forward. FM TOWNS CDC Commands are undocumented. There might have been internal document at one point in history, but it is permanently lost (unless someone who developed FM TOWNS still retains it secretly). It would take some more reverse engineering to see what CDC is supposed to return to command 3F.

Regarding WIFEMAN.DLL, the message says "Load Error: WIFEMAN.DLL". First can you check if WIFEMAN.DLL exists by:

dir \Windows\system\wifeman.dll

? My guess is it does exist because this file is needed in both enhanced and standard modes, but just in case.

Also, can you tell me command parameters you are using to start Tsugaru?

[qazmko1029]

command: Tsugaru_CUI.exe "_roms\mx" ^ -TOWNSTYPE MX -SCALE 100 -NOWAIT -HIGHFIDELITY -DEBUG ^ -FREQ 200 -MEMSIZE 32 -DONTUSEFPU ^ -CMOS _profile\MX\cmos.bin ^ -CD "W:\31l10.cue" ^ -HD0 _profile\MX\hdd_128m.h0 ^ -GAMEPORT0 PHYS0 -GAMEPORT1 MOUSE ^ -KEYBOARD TRANS1 -KEYMAP "_profile\keymap_fix_alt.txt"

This's my homemade bootdisk for testing windows 3.x installation, for convenience. I've tried MS-DOS 3.1/5.0/6.2 and 5.0 seems to work best for me. \Windows\system\wifeman.dll does exist. Actually I have no idea how to fix anything by now, very appreciate your help.

[captainys]

Thanks for your help! You have already helped me fixing a bunch of features.

Regarding MAME, it could have helped earlier, but at this time, very subtle difference is making problems. Finding subtle difference between Tsugaru and MAME may not be too much different from debugging inside Tsugaru at this stage.

WIFEMAN.DLL seems to be something to do with fonts. L10's WIFEMAN.INI has the followinb lines:

; This file is a profile for WIFEMAN.DLL in Standard or 386 Enhanced Mode. ; WIFEMAN.DLL is Font Driver Manager.

What we know so far is:

• L10's WIFEMAN.DLL somehow survives in the standard mode, but not in the enhanced mode.
• If WIFEMAN.DLL is deleted in L12 environment, L12 also quits with "LOAD ERROR: WIFEMAN.DLL"
• D:\WINDOWS\SYSTEM\WIFEMAN.DLL exists in your environment.

I'm thinking what can be done next.

[qazmko1029]

I installed both L10 and L11, extracted both windows folders out and compare then. WIFEMAN.DLL is totally the same in code section between L10 and L11, only version info number got updated. WIFEMAN.INI is almost the same and I don't think it affects anything because L11 still boot when I replace the file with L10 one. Need more investigation. Extracted WINDOWS folders here(sorry for wrong charset in *.GRP filename)

BTW, I now get some "MODE1READ time out." quite often in the whole installation process especially when copying files, probably affects nothing since it's reported both in installing L10 and L11.

[captainys]

Thanks for the update! I'll take a look at your WINDOWS folders.

MODE1READ timeout is from CDCACHE.SYS. It issues MODE1READ command to all the way to the end of the CD, and let it timeout when its own buffer fills up.

[captainys]

Surprisingly, if I replace my WINDOWS directory with your WINDOWS directory, it started. MS-DOS prompt is unstable, but it probably is because Windows was assuming DOS5 COMMAND.COM. My installation is on DOS6. Can you also upload you CMOS.BIN file as well?

[qazmko1029]

cmos.bin https://mega.nz/file/SV4mxQhT#cgqtB0LeXZyuFu_l9WHNtCu5J0A4y2G54zxBgVkYlJI

[captainys]

Hmmm, it started with your CMOS. I suspected it had something to do with the CMOS setting, but that doesn't seem to be the case. It is quite difficult to track down. I think about what to do next.

[captainys]

I hope I am not asking you too much, but I've enhanced a debugger command so that it can catch Windows 3.1 FOPEN.

Can you build from the latest source, start Tsugaru and type debugger command:

BRKON FOPEN WIFEMAN.*

and then start your Windows? First of all, I hope the debugger finds where it is opening WIFEMAN.DLL. If it catches it, the debugger will print something like:

Break on FOPEN D:\WINDOWS\SYSTEM\WIFEMAN.DLL

Then, print call stack by typing:

PRI CST

The last two lines should look like:

FR=0117:00001D68 TO=003B:003B032A RET=0117:00001D6D FR=003B:0000032A TO=0028:80007DB0 RET=003B:0000032C (INT 30,AX=3D80H)

The address may be different. Then, take the return address of the second from the last line, in this case 0117:00001D6D, and try:

run 0117:00001D6D

I want to see if the program returned to that address, and if CF is set or clear. And also type MEMDUMP DS:DX 16 2 to double check that the file name was really WIFEMAN.DLL.

CF=1 means failure to open the file. This way we can check if the file was opened successfully or failed somehow.

[qazmko1029]

Tried latest, set breakpoint and run win, it returns:

Passed 0 times. Debugger Enabled. Towns TIME (Nano-Seconds): 31044236415 CS:EIP=0028:80007DB0 LINEAR:80007DB0 EFLAGS=00000006 CPL=00 EAX=00003D80 EBX=00000F32 ECX=00000000 EDX=00000F32 ESI=00000C7A EDI=00000C62 EBP=00000EE8 ESP=80010D9C CS=0028(LIN:00000000) DS=0097(LIN:00053170) ES=0097(LIN:00053170) FS=0000(LIN:00000000) GS=0000(LIN:00000000) SS=0030(LIN:00000000) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF0 SF0 TF0 IF0 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=32 Default Address Size=32 Stack Address Size=32 HOLD IRQ for 1 Instruction SS+00000000:2C 03 00 00 3B 00 00 00 06 02 00 00 D2 0E 00 00 SS+00000010:97 00 00 00 2F 01 00 00 2F 01 00 00 00 00 00 00 Break on FOPEN D:\WINDOWS\SYSTEM\WIFEMAN.DLL 003B:0000032A CD30 INT 30H 0028:80007DB0 83EC04 SUB ESP,04H

print call stack:

PRI CST FR=FC00:0000077A TO=FC00:00000BB9 RET=FC00:0000077D FR=FC00:00000C5E TO=FC00:00000CA3 RET=FC00:00000C61 FR=FC00:00000CC8 TO=B000:B0000004 RET=FC00:00000CCA FR=B200:000000DB TO=B000:B0000004 RET=B200:000000E0 FR=9F29:000007E0 TO=1456:0000109E RET=9F29:000007E2 (INT 21,AX=4B00H DOS.Load or Exec \COMMAND.COM) FR=FF11:000041F5 TO=FF11:00009F88 RET=FF11:000041FA FR=B65C:000029CF TO=B65C:000059D5 RET=B65C:000029D1 FR=B65C:000029CF TO=B65C:000059D5 RET=B65C:000029D1 FR=B65C:000029CF TO=B65C:000059D5 RET=B65C:000029D1 FR=305B:000001DA TO=312D:00001685 RET=305B:000001DC (INT 21,AX=4B00H DOS.Load or Exec D:\WINDOWS\WIN.COM) FR=FF11:000041F5 TO=FF11:00009F88 RET=FF11:000041FA FR=4043:000006C1 TO=312D:00001685 RET=4043:000006C3 (INT 21,AX=4B00H DOS.Load or Exec D:\WINDOWS\system\win386.exe) FR=FF11:000041F5 TO=FF11:00009F88 RET=FF11:000041FA FR=FF11:000041F5 TO=FF11:00009F88 RET=FF11:000041FA FR=AE85:0000AD22 TO=AE85:0000C70C RET=AE85:0000AD25 FR=AE85:0000C73E TO=FCAD:FCAD15E9 RET=AE85:0000C742 FR=FCAD:000015E9 TO=0028:80006E5C RET=FCAD:000015ED (INT 06 INVOP,AX=0000H) FR=FCA8:00001639 TO=0028:80006E5C RET=FCA8:0000163D (INT 06 INVOP,AX=0100H) FR=0117:000054FC TO=0117:00005747 RET=0117:000054FF FR=0117:00005795 TO=0117:00001B72 RET=0117:00005798 FR=0117:00001BFD TO=0117:00001D37 RET=0117:00001C00 FR=0117:00001D68 TO=003B:003B032A RET=0117:00001D6D FR=003B:0000032A TO=0028:80007DB0 RET=003B:0000032C (INT 30,AX=3D80H)

run from the address:

run 0117:00001D6D Passed 0 times. Debugger Enabled. Towns TIME (Nano-Seconds): 31051964555 CS:EIP=0117:00001D6D LINEAR:0004718D EFLAGS=00000246 CPL=03 EAX=00000008 EBX=00000F32 ECX=00000000 EDX=00000F32 ESI=00000C7A EDI=00000C62 EBP=00000EE8 ESP=00000ED8 CS=0117(LIN:00045420) DS=0097(LIN:00053170) ES=0097(LIN:00053170) FS=0000(LIN:00000000) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 HOLD IRQ for 1 Instruction SS+00000000:00 1C 98 57 17 01 46 02 2F 01 62 0C 7A 0C 80 3D SS+00000010:FC 0E FF 54 80 28 32 0F 97 00 07 00 2A 0F 2F 01 0117:00001D6D 1E PUSH DS

memdump shows it is WIFEMAN.DLL:

MEMDUMP DS:DX 16 2 DS:00000F32 44 3A 5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45|D:\WINDOWS\SYSTE DS:00000F42 4D 5C 57 49 46 45 4D 41 4E 2E 44 4C 4C 00 59 53|M\WIFEMAN.DLL YS

It seems WIFEMAN.DLL successfully get loaded, error comes from somewhere else.

[captainys]

Great! Now, can you try the following?

BRKON FOPEN WIFEMAN.DLL

and start Windows and wait until it stops. Then,

RUN 0117:00005554

Hopefully it stops with little wait. Then, can you see if AX is 0008 or FFFF? To pass, AX needs to be a file handle. FFFFH means failure in DOS function AX=5700H.

If AX is 0008 (or not FFFF),

RUN 011F:000017C4

Then,

T

Command T executes one instruction. I want to see where it returns from 011F:000017C4. Probably it should return to 011F:00001632, and AX should be zero at 011F:00001632.

If we get there, then we can look into next step, FREAD, which should start from:

011F:00001640 E831F7 CALL 00000D74

Thanks!

[qazmko1029]

Set breakpoint and run win, it stops: Passed 0 times. Debugger Enabled. Towns TIME (Nano-Seconds): 20216079935 CS:EIP=0028:80007DB0 LINEAR:80007DB0 EFLAGS=00000006 CPL=00 EAX=00003D80 EBX=00000F32 ECX=00000000 EDX=00000F32 ESI=00000C7A EDI=00000C62 EBP=00000EE8 ESP=80010D9C CS=0028(LIN:00000000) DS=0097(LIN:00053170) ES=0097(LIN:00053170) FS=0000(LIN:00000000) GS=0000(LIN:00000000) SS=0030(LIN:00000000) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF0 SF0 TF0 IF0 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=32 Default Address Size=32 Stack Address Size=32 HOLD IRQ for 1 Instruction SS+00000000:2C 03 00 00 3B 00 00 00 06 02 00 00 D2 0E 00 00 SS+00000010:97 00 00 00 2F 01 00 00 2F 01 00 00 00 00 00 00 Break on FOPEN D:\WINDOWS\SYSTEM\WIFEMAN.DLL 003B:0000032A CD30 INT 30H 0028:80007DB0 83EC04 SUB ESP,04H

RUN 0117:00005554 Passed 0 times. Debugger Enabled. Towns TIME (Nano-Seconds): 20221873180 CS:EIP=0117:00005554 LINEAR:0004A974 EFLAGS=00000246 CPL=03 EAX=00000008 EBX=00000008 ECX=00001940 EDX=00001AD5 ESI=00000F2A EDI=00000007 EBP=00000F12 ESP=00000EFE CS=0117(LIN:00045420) DS=012F(LIN:00051E00) ES=0097(LIN:00053170) FS=0000(LIN:00000000) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:70 5D 17 01 80 28 2A 0F 97 00 3E 10 2F 01 07 00 SS+00000010:2A 0F 2F 01 D2 0F A5 17 1F 01 80 28 2A 0F 97 00 0117:00005554 CA0A00 RETF 000AH

RUN 011F:000017C4 Passed 0 times. Debugger Enabled. Towns TIME (Nano-Seconds): 20221892565 CS:EIP=011F:000017C4 LINEAR:80791CC4 EFLAGS=00000206 CPL=03 EAX=00000000 EBX=00000008 ECX=00001940 EDX=00000001 ESI=00000F2A EDI=00000008 EBP=00000FD2 ESP=00000F22 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0137(LIN:00053060) FS=0000(LIN:00000000) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:32 16 3E 10 DF 01 2F 01 25 01 00 00 D5 1A 40 19 SS+00000010:44 3A 5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 011F:000017C4 C3 RET

T Debugger Enabled. Towns TIME (Nano-Seconds): 20221892590 CS:EIP=011F:00001632 LINEAR:80791B32 EFLAGS=00000206 CPL=03 EAX=00000000 EBX=00000008 ECX=00001940 EDX=00000001 ESI=00000F2A EDI=00000008 EBP=00000FD2 ESP=00000F24 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0137(LIN:00053060) FS=0000(LIN:00000000) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3E 10 DF 01 2F 01 25 01 00 00 D5 1A 40 19 44 3A SS+00000010:5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 4D 5C 011F:00001632 0BC0 OR AX,AX

BTW, using recent commits I can't even get to the GUI setup after resetting bios settings using setup2.exe, installation crashed back to dos before going into GUI setup. weird.

[captainys]

BTW, using recent commits I can't even get to the GUI setup after resetting bios settings using setup2.exe,

OK. Can you go to the Tsugaru directory and:

git checkout 8701c2ac8c1ab8a3d42230c22e083127bc373996

and then build and try again? (I think you know by now, but you can cut & paste to your Power Shell or CMD. You don't have to type all the command.) It it works, we can do bi-section search to get to which revision broke.

[qazmko1029]

tried https://github.com/captainys/TOWNSEMU/commit/8701c2ac8c1ab8a3d42230c22e083127bc373996, this works into GUI setup. Need to check what commit break this.

Edit: I know bi-section search, just trying across these commits, for some reason I can't made it success in 8701c2ac8c1ab8a3d42230c22e083127bc373996 now. investigating...

[captainys]

Thanks! Let's narrow it down to half. Can you try:

824f787bc283e283fb75967d70b99261b5c08dd4

?

[qazmko1029]

Never mind, I found out that it's my own fault, the commits are fine. Setting Ramdisk to fill the rest memory space in setup2.exe will prevent DOS 5.0 smartdrive to run correctly, thus the problem, I knew this when making the bootdisk but then forgot lol. Sorry for wasting time here.

WIFEMAN.DLL problem isn't change though, debugger output shows as above. See what can be done next.

[captainys]

OK. Back to the elusive WIFEMAN.DLL then. Can you try to go to the same place by BRKON FOPEN WIFEMAN.DLL, and then the following commands?

BP 011F:00001668 BP 011F:0000166E RUN

Looks like Windows skips 011F:00001668 if there were errors while reading the file. I want to see if it is getting to 011F:1668, or it just skipped the instruction due to error.

Thanks!

[qazmko1029]

BRKON FOPEN WIFEMAN.DLL Break On FOPEN is ON.

Passed 0 times. Debugger Enabled. Towns TIME (Nano-Seconds): 13331108495 CS:EIP=0028:80007DB0 LINEAR:80007DB0 EFLAGS=00000006 CPL=00 EAX=00003D80 EBX=00000F32 ECX=00000000 EDX=00000F32 ESI=00000C7A EDI=00000C62 EBP=00000EE8 ESP=80010D9C CS=0028(LIN:00000000) DS=0097(LIN:00053170) ES=0097(LIN:00053170) FS=0000(LIN:00000000) GS=0000(LIN:00000000) SS=0030(LIN:00000000) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF0 SF0 TF0 IF0 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=32 Default Address Size=32 Stack Address Size=32 HOLD IRQ for 1 Instruction SS+00000000:2C 03 00 00 3B 00 00 00 06 02 00 00 D2 0E 00 00 SS+00000010:97 00 00 00 2F 01 00 00 2F 01 00 00 00 00 00 00 Break on FOPEN D:\WINDOWS\SYSTEM\WIFEMAN.DLL 003B:0000032A CD30 INT 30H 0028:80007DB0 83EC04 SUB ESP,04H

BP 011F:00001668 BP 011F:0000166E RUN Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 13382684090 CS:EIP=011F:0000166E LINEAR:80791B6E EFLAGS=00000246 CPL=03 EAX=00000000 EBX=000003A0 ECX=00000000 EDX=00000000 ESI=0000004A EDI=00000002 EBP=00000FD2 ESP=00000F24 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0000(LIN:00051E00) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078DF80 CR3=011FD000 CF0 PF1 AF0 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 44 3A SS+00000010:5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 4D 5C 011F:0000166E E90B07 JMP 00001D7C

[captainys]

Great! Something went wrong in the following part!

011F:00001640 E831F7 CALL 00000D74 011F:00001643 3D2000 CMP AX,0020H 011F:00001646 7223 JB 0000166B 011F:00001648 E87A01 CALL 000017C5 011F:0000164B 3D2000 CMP AX,0020H 011F:0000164E 721B JB 0000166B 011F:00001650 E81002 CALL 00001863 011F:00001653 3D2000 CMP AX,0020H 011F:00001656 7213 JB 0000166B 011F:00001658 E8F102 CALL 0000194C 011F:0000165B 3D2000 CMP AX,0020H 011F:0000165E 720B JB 0000166B 011F:00001660 E8A503 CALL 00001A08 011F:00001663 3D2000 CMP AX,0020H 011F:00001666 7203 JB 0000166B 011F:00001668 E88C04 CALL 00001AF7 011F:0000166B E81206 CALL 00001C80 011F:0000166E E90B07 JMP 00001D7C

So, now can you:

(1) Get to the FOPEN by BRKON FOPEN WIFEMAN.DLL (2) When it stops, can you try the following commands? MP 011F:00001646 MP 011F:0000164E MP 011F:00001656 MP 011F:0000165E MP 011F:00001666 MP 011F:00001668 MP 011F:0000166B RUN 011F:0000166E

It will tell us which procedure returning an errorcode (AX less than 0020H).

Thanks!

[qazmko1029]

BRKON FOPEN WIFEMAN.DLL Break On FOPEN is ON.

Passed 0 times. Debugger Enabled. Towns TIME (Nano-Seconds): 19076384525 CS:EIP=0028:80007DB0 LINEAR:80007DB0 EFLAGS=00000006 CPL=00 EAX=00003D80 EBX=00000F32 ECX=00000000 EDX=00000F32 ESI=00000C7A EDI=00000C62 EBP=00000EE8 ESP=80010D9C CS=0028(LIN:00000000) DS=0097(LIN:00053170) ES=0097(LIN:00053170) FS=0000(LIN:00000000) GS=0000(LIN:00000000) SS=0030(LIN:00000000) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF0 SF0 TF0 IF0 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=32 Default Address Size=32 Stack Address Size=32 HOLD IRQ for 1 Instruction SS+00000000:2C 03 00 00 3B 00 00 00 06 02 00 00 D2 0E 00 00 SS+00000010:97 00 00 00 2F 01 00 00 2F 01 00 00 00 00 00 00 Break on FOPEN D:\WINDOWS\SYSTEM\WIFEMAN.DLL 003B:0000032A CD30 INT 30H 0028:80007DB0 83EC04 SUB ESP,04H

MP 011F:00001646 MP 011F:0000164E MP 011F:00001656 MP 011F:0000165E MP 011F:00001666 MP 011F:00001668 MP 011F:0000166B RUN 011F:0000166E Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 19122278720 CS:EIP=011F:00001646 LINEAR:80791B46 EFLAGS=00000206 CPL=03 EAX=000001CF EBX=000001E6 ECX=000000BE EDX=00000802 ESI=00000F2A EDI=00000008 EBP=00000FD2 ESP=00000F24 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0000(LIN:00051E00) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3E 10 DF 01 2F 01 25 01 00 00 D5 1A 40 19 44 3A SS+00000010:5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 4D 5C 011F:00001646 7223 JB 0000166B

Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 19122304985 CS:EIP=011F:0000164E LINEAR:80791B4E EFLAGS=00000202 CPL=03 EAX=00000021 EBX=00000000 ECX=0000000C EDX=00000802 ESI=00000F2A EDI=00000008 EBP=00000FD2 ESP=00000F24 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF0 AF0 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3E 10 DF 01 2F 01 25 01 00 00 D5 1A 40 19 44 3A SS+00000010:5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 4D 5C 011F:0000164E 721B JB 0000166B

Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 19124706190 CS:EIP=011F:00001656 LINEAR:80791B56 EFLAGS=00000206 CPL=03 EAX=000001CF EBX=00000000 ECX=00000001 EDX=0006023E ESI=00000F2A EDI=00000181 EBP=00000FD2 ESP=00000F24 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3E 10 DF 01 2F 01 25 01 00 00 D5 1A 40 19 44 3A SS+00000010:5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 4D 5C 011F:00001656 7213 JB 0000166B

Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 19124996085 CS:EIP=011F:0000165E LINEAR:80791B5E EFLAGS=00000202 CPL=03 EAX=0000010F EBX=00000F2A ECX=00000000 EDX=0006010F ESI=0000018B EDI=00000183 EBP=00000FD2 ESP=00000F24 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF0 AF0 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 44 3A SS+00000010:5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 4D 5C 011F:0000165E 720B JB 0000166B

Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 19129568130 CS:EIP=011F:00001666 LINEAR:80791B66 EFLAGS=00000283 CPL=03 EAX=00000000 EBX=00008341 ECX=00000000 EDX=000001CF ESI=0000004A EDI=00000002 EBP=00000FD2 ESP=00000F24 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0000(LIN:806B8000) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078DF80 CR3=011FD000 CF1 PF0 AF0 ZF0 SF1 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 44 3A SS+00000010:5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 4D 5C 011F:00001666 7203 JB 0000166B

Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 19129569145 CS:EIP=011F:0000166B LINEAR:80791B6B EFLAGS=00000283 CPL=03 EAX=00000000 EBX=00008341 ECX=00000000 EDX=000001CF ESI=0000004A EDI=00000002 EBP=00000FD2 ESP=00000F24 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0000(LIN:806B8000) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078DF80 CR3=011FD000 CF1 PF0 AF0 ZF0 SF1 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 44 3A SS+00000010:5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 4D 5C 011F:0000166B E81206 CALL 00001C80

Passed 0 times. Debugger Enabled. Towns TIME (Nano-Seconds): 19132002645 CS:EIP=011F:0000166E LINEAR:80791B6E EFLAGS=00000246 CPL=03 EAX=00000000 EBX=000003A0 ECX=00000000 EDX=00000000 ESI=0000004A EDI=00000002 EBP=00000FD2 ESP=00000F24 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0000(LIN:00051E00) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078DF80 CR3=011FD000 CF0 PF1 AF0 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 44 3A SS+00000010:5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 4D 5C 011F:0000166E E90B07 JMP 00001D7C

[captainys]

Thanks! Looks all good up tol 011F:165E, but

011F:00001660 E8A503 CALL 00001A08

This needs to return 0020H<=AX, but it is returning AX=0. In my environment, it is returning AX=023FH.U

Can you try, BRKON FOPEN WIFEMAN.DLL (Wait until stop) RUN 011F:00001660 (Wait until stop) then:

BP 011F:1663 MP 011F:00001A57 MPSF 011F:00001A11 MPSF 011F:00001A70 MPSF 011F:00001A76 MPSF 011F:00001A87 RUN

? I am trying to understand the meaning of this AX. Thanks!

[qazmko1029]

BRKON FOPEN WIFEMAN.DLL Break On FOPEN is ON.

Passed 0 times. Debugger Enabled. Towns TIME (Nano-Seconds): 12279469805 CS:EIP=0028:80007DB0 LINEAR:80007DB0 EFLAGS=00000006 CPL=00 EAX=00003D80 EBX=00000F32 ECX=00000000 EDX=00000F32 ESI=00000C7A EDI=00000C62 EBP=00000EE8 ESP=80010D9C CS=0028(LIN:00000000) DS=0097(LIN:00053170) ES=0097(LIN:00053170) FS=0000(LIN:00000000) GS=0000(LIN:00000000) SS=0030(LIN:00000000) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF0 SF0 TF0 IF0 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=32 Default Address Size=32 Stack Address Size=32 HOLD IRQ for 1 Instruction SS+00000000:2C 03 00 00 3B 00 00 00 06 02 00 00 D2 0E 00 00 SS+00000010:97 00 00 00 2F 01 00 00 2F 01 00 00 00 00 00 00 Break on FOPEN D:\WINDOWS\SYSTEM\WIFEMAN.DLL 003B:0000032A CD30 INT 30H 0028:80007DB0 83EC04 SUB ESP,04H

RUN 011F:00001660 Passed 0 times. Debugger Enabled. Towns TIME (Nano-Seconds): 12325854180 CS:EIP=011F:00001660 LINEAR:80791B60 EFLAGS=00000202 CPL=03 EAX=0000010F EBX=00000F2A ECX=00000000 EDX=0006010F ESI=0000018B EDI=00000183 EBP=00000FD2 ESP=00000F24 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF0 AF0 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 44 3A SS+00000010:5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 4D 5C 011F:00001660 E8A503 CALL 00001A08

BP 011F:1663 MP 011F:00001A57 MPSF 011F:00001A11 MPSF 011F:00001A70 MPSF 011F:00001A76 MPSF 011F:00001A87 RUN Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 12325862245 CS:EIP=011F:00001A57 LINEAR:80791F57 EFLAGS=00000246 CPL=03 EAX=0000010F EBX=00000F2A ECX=0000000B EDX=0006010F ESI=00000040 EDI=00000000 EBP=00000FD2 ESP=00000F22 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:63 16 3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 SS+00000010:44 3A 5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 011F:00001A57 47 INC DI 011F:00001A87 51 PUSH CX 011F:00001A70 83C60A ADD SI,0AH

Passed 2 times. Debugger Enabled. Towns TIME (Nano-Seconds): 12328210105 CS:EIP=011F:00001A57 LINEAR:80791F57 EFLAGS=00000202 CPL=03 EAX=000001EF EBX=00000EE4 ECX=0000000A EDX=000001E6 ESI=0000004A EDI=00000001 EBP=00000FD2 ESP=00000F22 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078EFC0 CR3=011FD000 CF0 PF0 AF0 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:63 16 3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 SS+00000010:44 3A 5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 011F:00001A57 47 INC DI 011F:00001A87 51 PUSH CX

Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 12331618605 CS:EIP=011F:00001663 LINEAR:80791B63 EFLAGS=00000286 CPL=03 EAX=00000000 EBX=00008341 ECX=00000000 EDX=000001CF ESI=0000004A EDI=00000002 EBP=00000FD2 ESP=00000F24 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0000(LIN:806B8000) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078DF80 CR3=011FD000 CF0 PF1 AF0 ZF0 SF1 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 44 3A SS+00000010:5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 4D 5C 011F:00001663 3D2000 CMP AX,0020H

[captainys]

You are fast! The program is diverging from my path 2nd in the loop.

Can you try BRKON FOPEN WIFEMAN.DLL (Wait until stop) RUN 011F:00001660 (Wait until stop) then:

BP 011F:1663 MEMDUMP ES:0040 10 11 MPSF 011F:1A57 MPSF 011F:1A76 MPSF 011F:1A87 MPSF 011F:1A93 MPSF 011F:1AA4 MPSF 011F:1AA6 MPSF 011F:1AF1 MPSF 011F:1AF4 RUN

? Thanks!

[qazmko1029]

BRKON FOPEN WIFEMAN.DLL Break On FOPEN is ON.

Passed 0 times. Debugger Enabled. Towns TIME (Nano-Seconds): 10723064890 CS:EIP=0028:80007DB0 LINEAR:80007DB0 EFLAGS=00000006 CPL=00 EAX=00003D80 EBX=00000F32 ECX=00000000 EDX=00000F32 ESI=00000C7A EDI=00000C62 EBP=00000EE8 ESP=80010D9C CS=0028(LIN:00000000) DS=0097(LIN:00053170) ES=0097(LIN:00053170) FS=0000(LIN:00000000) GS=0000(LIN:00000000) SS=0030(LIN:00000000) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF0 SF0 TF0 IF0 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=32 Default Address Size=32 Stack Address Size=32 HOLD IRQ for 1 Instruction SS+00000000:2C 03 00 00 3B 00 00 00 06 02 00 00 D2 0E 00 00 SS+00000010:97 00 00 00 2F 01 00 00 2F 01 00 00 00 00 00 00 Break on FOPEN D:\WINDOWS\SYSTEM\WIFEMAN.DLL 003B:0000032A CD30 INT 30H 0028:80007DB0 83EC04 SUB ESP,04H

RUN 011F:00001660 Passed 0 times. Debugger Enabled. Towns TIME (Nano-Seconds): 10770828960 CS:EIP=011F:00001660 LINEAR:80791B60 EFLAGS=00000202 CPL=03 EAX=0000010F EBX=00000F2A ECX=00000000 EDX=0006010F ESI=0000018B EDI=00000183 EBP=00000FD2 ESP=00000F24 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF0 AF0 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 44 3A SS+00000010:5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 4D 5C 011F:00001660 E8A503 CALL 00001A08

BP 011F:1663 MEMDUMP ES:0040 10 11 ES:00000040 C0 00 DF 02 52 D5 DF 02 EE 01| R ES:0000004A F2 00 30 10 52 D1 30 10 F6 01| 0 R 0 ES:00000054 08 02 24 0F 52 D1 24 0F FE 01| $ R $ ES:0000005E 0E 03 B7 1B 52 C1 B7 1B 06 02| R ES:00000068 6C 06 EF 02 12 D1 F0 02 0E 02|l ES:00000072 9C 06 16 38 12 D1 17 38 16 02| 8 8 ES:0000007C 34 0A C4 01 12 D1 C4 01 1E 02|4 ES:00000086 52 0A 1C 03 12 D1 1C 03 26 02|R & ES:00000090 85 0A 98 05 12 D1 98 05 2E 02| . ES:0000009A D8 04 B0 01 52 C1 B0 01 36 02| R 6 ES:000000A4 F6 04 30 17 73 80 30 17 3E 02| 0 s 0 > MPSF 011F:1A57 MPSF 011F:1A76 MPSF 011F:1A87 MPSF 011F:1A93 MPSF 011F:1AA4 MPSF 011F:1AA6 MPSF 011F:1AF1 MPSF 011F:1AF4 RUN 011F:00001A57 47 INC DI 011F:00001A87 51 PUSH CX 011F:00001A93 7511 JNE 00001AA6 011F:00001AA6 52 PUSH DX 011F:00001AF1 E97CFF JMP 00001A70 011F:00001A57 47 INC DI 011F:00001A87 51 PUSH CX 011F:00001A93 7511 JNE 00001AA6 011F:00001AA6 52 PUSH DX 011F:00001AF4 E97EFB JMP 00001675 Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 10778948420 CS:EIP=011F:00001663 LINEAR:80791B63 EFLAGS=00000286 CPL=03 EAX=00000000 EBX=00008341 ECX=00000000 EDX=000001CF ESI=0000004A EDI=00000002 EBP=00000FD2 ESP=00000F24 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0000(LIN:806B8000) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078DF80 CR3=011FD000 CF0 PF1 AF0 ZF0 SF1 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 44 3A SS+00000010:5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 4D 5C 011F:00001663 3D2000 CMP AX,0020H

[captainys]

Thanks! AX=0 looks to be coming from 011F:00001AD5 CALLF 0117:0970.

Can you try BRKON FOPEN WIFEMAN.DLL (Wait until stop) RUN 011F:00001660 (Wait until stop) then:

BP 011F:1663 MP 011F:1A57 MP 011F:1AA7 MP 011F:1AAC MP 011F:1ACA MP 011F:1ACF MP 011F:1AD5 MP 011F:1ADA RUN

? Thanks!

[qazmko1029]

BRKON FOPEN WIFEMAN.DLL Break On FOPEN is ON.

Passed 0 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11402509475 CS:EIP=0028:80007DB0 LINEAR:80007DB0 EFLAGS=00000006 CPL=00 EAX=00003D80 EBX=00000F32 ECX=00000000 EDX=00000F32 ESI=00000C7A EDI=00000C62 EBP=00000EE8 ESP=80010D9C CS=0028(LIN:00000000) DS=0097(LIN:00053170) ES=0097(LIN:00053170) FS=0000(LIN:00000000) GS=0000(LIN:00000000) SS=0030(LIN:00000000) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF0 SF0 TF0 IF0 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=32 Default Address Size=32 Stack Address Size=32 HOLD IRQ for 1 Instruction SS+00000000:2C 03 00 00 3B 00 00 00 06 02 00 00 D2 0E 00 00 SS+00000010:97 00 00 00 2F 01 00 00 2F 01 00 00 00 00 00 00 Break on FOPEN D:\WINDOWS\SYSTEM\WIFEMAN.DLL 003B:0000032A CD30 INT 30H 0028:80007DB0 83EC04 SUB ESP,04H

RUN 011F:00001660 Passed 0 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11450026670 CS:EIP=011F:00001660 LINEAR:80791B60 EFLAGS=00000202 CPL=03 EAX=0000010F EBX=00000F2A ECX=00000000 EDX=0006010F ESI=0000018B EDI=00000183 EBP=00000FD2 ESP=00000F24 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF0 AF0 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 44 3A SS+00000010:5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 4D 5C 011F:00001660 E8A503 CALL 00001A08

BP 011F:1663 MP 011F:1A57 MP 011F:1AA7 MP 011F:1AAC MP 011F:1ACA MP 011F:1ACF MP 011F:1AD5 MP 011F:1ADA RUN Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11450034735 CS:EIP=011F:00001A57 LINEAR:80791F57 EFLAGS=00000246 CPL=03 EAX=0000010F EBX=00000F2A ECX=0000000B EDX=0006010F ESI=00000040 EDI=00000000 EBP=00000FD2 ESP=00000F22 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:63 16 3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 SS+00000010:44 3A 5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 011F:00001A57 47 INC DI Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11450092725 CS:EIP=011F:00001AA7 LINEAR:80791FA7 EFLAGS=00000206 CPL=03 EAX=00000000 EBX=00000F2A ECX=000001E7 EDX=000601E7 ESI=00000040 EDI=00000001 EBP=00000FD2 ESP=00000F1C CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0000(LIN:00051E00) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:E7 01 CF 01 0B 00 63 16 3E 10 DF 01 2F 01 4B 45 SS+00000010:52 4E 45 4C 00 19 44 3A 5C 57 49 4E 44 4F 57 53 011F:00001AA7 9ADC1D1701 CALLF 0117:1DDC Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11450204555 CS:EIP=011F:00001AAC LINEAR:80791FAC EFLAGS=00000216 CPL=03 EAX=00000247 EBX=0000024F ECX=00000000 EDX=000610E7 ESI=00000040 EDI=00000001 EBP=00000FD2 ESP=00000F1E CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0000(LIN:00053170) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF1 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:CF 01 0B 00 63 16 3E 10 DF 01 2F 01 4B 45 52 4E SS+00000010:45 4C 00 19 44 3A 5C 57 49 4E 44 4F 57 53 5C 53 011F:00001AAC 07 POP ES Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11450229980 CS:EIP=011F:00001ACA LINEAR:80791FCA EFLAGS=00000246 CPL=03 EAX=00000247 EBX=00000020 ECX=00000000 EDX=00060000 ESI=00000040 EDI=00000001 EBP=00000FD2 ESP=00000F12 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF0 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:20 00 00 00 00 00 47 02 CF 01 47 02 CF 01 0B 00 SS+00000010:63 16 3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 011F:00001ACA 9AF7261701 CALLF 0117:26F7 Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11450320245 CS:EIP=011F:00001ACF LINEAR:80791FCF EFLAGS=00000256 CPL=03 EAX=00000000 EBX=0000024F ECX=00000000 EDX=00060247 ESI=00000040 EDI=00000001 EBP=00000FD2 ESP=00000F1A CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0000(LIN:00053170) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF1 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:CF 01 47 02 CF 01 0B 00 63 16 3E 10 DF 01 2F 01 SS+00000010:4B 45 52 4E 45 4C 00 19 44 3A 5C 57 49 4E 44 4F 011F:00001ACF 07 POP ES Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11450326295 CS:EIP=011F:00001AD5 LINEAR:80791FD5 EFLAGS=00000296 CPL=03 EAX=00000000 EBX=0000024F ECX=0000FFFF EDX=00060247 ESI=00000040 EDI=00000001 EBP=00000FD2 ESP=00000F14 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=0005C4FC CR3=011FD000 CF0 PF1 AF1 ZF0 SF1 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:FF FF 47 02 01 00 CF 01 47 02 CF 01 0B 00 63 16 SS+00000010:3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 44 3A 011F:00001AD5 9A70091701 CALLF 0117:0970 Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11452622675 CS:EIP=011F:00001ADA LINEAR:80791FDA EFLAGS=00000256 CPL=03 EAX=000001EF EBX=00000EE4 ECX=000001EF EDX=000001EE ESI=00000040 EDI=00000001 EBP=00000FD2 ESP=00000F1C CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078EFC0 CR3=011FD000 CF0 PF1 AF1 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:47 02 CF 01 0B 00 63 16 3E 10 DF 01 2F 01 4B 45 SS+00000010:52 4E 45 4C 00 19 44 3A 5C 57 49 4E 44 4F 57 53 011F:00001ADA 59 POP CX Passed 2 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11452758940 CS:EIP=011F:00001A57 LINEAR:80791F57 EFLAGS=00000202 CPL=03 EAX=000001EF EBX=00000EE4 ECX=0000000A EDX=000001E6 ESI=0000004A EDI=00000001 EBP=00000FD2 ESP=00000F22 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078EFC0 CR3=011FD000 CF0 PF0 AF0 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:63 16 3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 SS+00000010:44 3A 5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 011F:00001A57 47 INC DI Passed 2 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11452816930 CS:EIP=011F:00001AA7 LINEAR:80791FA7 EFLAGS=00000206 CPL=03 EAX=00000000 EBX=00000EE4 ECX=000001E7 EDX=000001E7 ESI=0000004A EDI=00000002 EBP=00000FD2 ESP=00000F1C CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0000(LIN:00051E00) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078EFC0 CR3=011FD000 CF0 PF1 AF0 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:E7 01 CF 01 0A 00 63 16 3E 10 DF 01 2F 01 4B 45 SS+00000010:52 4E 45 4C 00 19 44 3A 5C 57 49 4E 44 4F 57 53 011F:00001AA7 9ADC1D1701 CALLF 0117:1DDC Passed 2 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11452928760 CS:EIP=011F:00001AAC LINEAR:80791FAC EFLAGS=00000216 CPL=03 EAX=00000247 EBX=0000024F ECX=00000000 EDX=000010E7 ESI=0000004A EDI=00000002 EBP=00000FD2 ESP=00000F1E CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0000(LIN:00053170) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078EFC0 CR3=011FD000 CF0 PF1 AF1 ZF0 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:CF 01 0A 00 63 16 3E 10 DF 01 2F 01 4B 45 52 4E SS+00000010:45 4C 00 19 44 3A 5C 57 49 4E 44 4F 57 53 5C 53 011F:00001AAC 07 POP ES Passed 2 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11452954185 CS:EIP=011F:00001ACA LINEAR:80791FCA EFLAGS=00000246 CPL=03 EAX=00000247 EBX=00000340 ECX=00000000 EDX=00000000 ESI=0000004A EDI=00000002 EBP=00000FD2 ESP=00000F12 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078EFC0 CR3=011FD000 CF0 PF1 AF0 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:40 03 00 00 00 00 47 02 CF 01 47 02 CF 01 0A 00 SS+00000010:63 16 3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 011F:00001ACA 9AF7261701 CALLF 0117:26F7 Passed 2 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11453044450 CS:EIP=011F:00001ACF LINEAR:80791FCF EFLAGS=00000256 CPL=03 EAX=00000000 EBX=0000024F ECX=00000000 EDX=00000247 ESI=0000004A EDI=00000002 EBP=00000FD2 ESP=00000F1A CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0000(LIN:00053170) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078EFC0 CR3=011FD000 CF0 PF1 AF1 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:CF 01 47 02 CF 01 0A 00 63 16 3E 10 DF 01 2F 01 SS+00000010:4B 45 52 4E 45 4C 00 19 44 3A 5C 57 49 4E 44 4F 011F:00001ACF 07 POP ES Passed 2 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11453050500 CS:EIP=011F:00001AD5 LINEAR:80791FD5 EFLAGS=00000296 CPL=03 EAX=00000000 EBX=0000024F ECX=0000FFFF EDX=00000247 ESI=0000004A EDI=00000002 EBP=00000FD2 ESP=00000F14 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078EFC0 CR3=011FD000 CF0 PF1 AF1 ZF0 SF1 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:FF FF 47 02 02 00 CF 01 47 02 CF 01 0A 00 63 16 SS+00000010:3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 44 3A 011F:00001AD5 9A70091701 CALLF 0117:0970 Passed 2 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11455549345 CS:EIP=011F:00001ADA LINEAR:80791FDA EFLAGS=00000256 CPL=03 EAX=00000000 EBX=000001F0 ECX=00000000 EDX=000001F6 ESI=0000004A EDI=00000002 EBP=00000FD2 ESP=00000F1C CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=01CF(LIN:00058D80) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078DF80 CR3=011FD000 CF0 PF1 AF1 ZF1 SF0 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:47 02 CF 01 0A 00 63 16 3E 10 DF 01 2F 01 4B 45 SS+00000010:52 4E 45 4C 00 19 44 3A 5C 57 49 4E 44 4F 57 53 011F:00001ADA 59 POP CX Passed 1 times. Debugger Enabled. Towns TIME (Nano-Seconds): 11459177640 CS:EIP=011F:00001663 LINEAR:80791B63 EFLAGS=00000286 CPL=03 EAX=00000000 EBX=00008341 ECX=00000000 EDX=000001CF ESI=0000004A EDI=00000002 EBP=00000FD2 ESP=00000F24 CS=011F(LIN:80790500) DS=012F(LIN:00051E00) ES=0000(LIN:806B8000) FS=0000(LIN:00051E00) GS=0000(LIN:00000000) SS=0097(LIN:00053170) CR0=80000021 CR1=00000000 CR2=8078DF80 CR3=011FD000 CF0 PF1 AF0 ZF0 SF1 TF0 IF1 DF0 OF0 IOPL00 NT0 RF0 VM0 AC0 Default Operand Size=16 Default Address Size=16 Stack Address Size=16 SS+00000000:3E 10 DF 01 2F 01 4B 45 52 4E 45 4C 00 19 44 3A SS+00000010:5C 57 49 4E 44 4F 57 53 5C 53 59 53 54 45 4D 5C 011F:00001663 3D2000 CMP AX,0020H

[captainys]

OK. Looks like everything runs the same as in my environment until 011F:00001AD5. CALLF 0117:0970 calls 0117:000078C5 which is relatively a long procedure. I'm thinking the best way of probing it. I'll get back to you. Thanks!

[captainys]

Thank you very much for your help!

Can you try BRKON FOPEN WIFEMAN.DLL (Wait until stop) RUN 011F:00001660 (Wait until stop) then:

BPPC 011F:00001AD5 2 RUN

and wait until it stops, and

ENA AUTODISASMR DBLOG LOG.txt RUN 011F:00001ADA

and wait until it stops, and

CDBLOG

You'll have LOG.TXT in the working directory. It will be too long to paste here, can you upload LOG.TXT to somewhere I can access?

Thanks!