Can't start 16-bit apps with OTVDM after uninstalling NTVDMx64 (As well as a few other issues)

[AngryDavid808]

Hello! I have a Windows 10 machine and I have recently installed NTVDMx64 It kept crashing with a different error code every time, so I uninstalled it through Control Panel. I have set my machine to start 16-bit apps with otvdm, but now that I've uninstalled NTVDMx64, this error message appears instead: "APP PATH HERE is a 16-bit application. You don't have permission to execute 16-bit applications. Contact your system Adminstrator." Now, I am the adminstrator, but I still couldn't find my way out of this. Also, for some reason, ldntvdm.dll is still in System32, and injected into winlogon.exe, and I honestly want to remove the injection and delete the file to get everything back to what it was before. How can I do this? Thanks in advance. Regards, David

[leecher1337]

There was a bug in the uninstaller leaving the loader intact after uninstallation which was fixed in https://github.com/leecher1337/ntvdmx64/commit/7f12eff823ab3eb4b559a456b89b4cc9b89f191d To completely remove the loader, remove it from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs key. after a reboot, you should be able to delete the ldntvdm.dll in System32 directory.

The loader should be compatible with OTVDM and give it precedence on 16bit Windows applications,if it is installed.

Out of interest, which errors did you get? It runs flawlessly here, so I wonder what problems occured on your machine. Did they occur in ntvdm.exe directly?

[AngryDavid808]

There was a bug in the uninstaller leaving the loader intact after uninstallation which was fixed in https://github.com/leecher1337/ntvdmx64/commit/7f12eff823ab3eb4b559a456b89b4cc9b89f191d To completely remove the loader, remove it from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs key. after a reboot, you should be able to delete the ldntvdm.dll in System32 directory.

The loader should be compatible with OTVDM and give it precedence on 16bit Windows applications,if it is installed.

Out of interest, which errors did you get? It runs flawlessly here, so I wonder what problems occured on your machine. Did they occur in ntvdm.exe directly?

Well, to be honest, I can't remember what these errors exactly say, but I do remember that they give a different error code every single time, and my 16-bit apps as well as my DOS apps never start. And yes, same goes for ntvdm.exe directly, I tried to directly execute it before reinstalling Windows because of a BsoD with stop code 0x0000c1, I believe that was the stop code. Since I now know how to get rid of the injection, I may actually reinstall NTVDMx64 and try to capture some of these error for you. Thank you for responding btw.

[leecher1337]

Sounds like ERROR_BAD_EXE_FORMAT. May be a problem with the loader. Which Windows version and which file date of the loader? Weird, I never managed to produce a BSOD with the loader yet...

Btw., 16bit support was only added recently (3 days ago), but also the old loader left 16bit apps alone so that they can be handled by otvdm (the new loader checks for the presence of OTVDM and if OTVDM is installed, it takes OTVDM, otherwise it handles it with NTVDM to not interfere with it).

The loader generally logs to DebugView console, so its log output may shed some light on the issue. Generally, the injection is somewhat time critical when injecting into console processes and therefore can be a bit unrealiable sometimes (the conhost methos still turned out to be the most reliable compared to other methods), however the AppInit-injection into windowed processes should be OK.

[AngryDavid808]

Sounds like ERROR_BAD_EXE_FORMAT. May be a problem with the loader. Which Windows version and which file date of the loader? Weird, I never managed to produce a BSOD with the loader yet...

Btw., 16bit support was only added recently (3 days ago), but also the old loader left 16bit apps alone so that they can be handled by otvdm (the new loader checks for the presence of OTVDM and if OTVDM is installed, it takes OTVDM, otherwise it handles it with NTVDM to not interfere with it).

The loader generally logs to DebugView console, so its log output may shed some light on the issue. Generally, the injection is somewhat time critical when injecting into console processes and therefore can be a bit unrealiable sometimes (the conhost methos still turned out to be the most reliable compared to other methods), however the AppInit-injection into windowed processes should be OK.

Thank you for your response.

I was and still am on Windows 10 Build 1909. Before I reinstalled Windows, I actually had a user-made registry problem that caused Windows to reboot with no errors right whenever it finishes the boot process. I tried to do a System Restore, and this BsoD started appearing. Note that I had the same problem I have now when I did that System Restore. Because of this, I'm actually kind of scared to update Windows 10 to Build 2004. As for which version of the loader, I don't quite know, I fetched a pre-built copy from columbia.edu.

Also, where can I find the latest pre-built version of NTVDMx64? I actually want to give it another shot before I remove the injection.

I honestly can't read debug logs, but if you want some, please tell me how I can send them over for you to take a look at it.

[leecher1337]

My current test machine is Windows 10 Build 1903 (I didn't get any offers for update yet, not even to 1909... Don't know why, it says,I'm on most current release).

Also, where can I find the latest pre-built version of NTVDMx64? I actually want to give it another shot before I remove the injection. Most recent loaders can be found in this repo: https://github.com/leecher1337/ntvdmx64/tree/master/ntvdmpatch/release/ldntvdm

As for ntvdm executable and libraries, as I cannot provide them due to legal reasons, you either have to build them yourself using the minnt build instructions or wait, until columbia.edu updates their build. E. Mendelson usually updates the files within a few weeks after a new release here.

To get the debug logs, just download DebugView and let it run, the loader ldntvdm should spit out some log lines that you can copy as soon as you start an application. You can copy and paste them here together with an error description (possibly screenshot). I cannot promise that I can see something from it, but we can try at least.

[AngryDavid808]

My current test machine is Windows 10 Build 1903 (I didn't get any offers for update yet, not even to 1909... Don't know why, it says,I'm on most current release).

Maybe you can try downloading the Windows 10 Disc Images from microsoft.com and install the latest version using them. I used their Disc Images to reinstall Windows, so yeah, maybe you can try giving it a go in a VM and try testing NTVDMx64 on it.

[AngryDavid808]

Update on the situation:

So, I downloaded a pre-built version of NTVDMx64 from columbia.edu (Late April build), installed it with making sure that Avast is turned off and that the Windows folder is added as an exception in Avast. I directly start ntvdm.exe a few times, it gives me some error about preparing the environment every time. Now for some ducking reason, NTVDMx64 works just fine with no errors, and OTVDM started functioning like normal again. I absolutely have no idea how I did it, but it just happened. I suspect it was all Avast's fault since it kept detecting and deleting ldntvdm.dll from pretty much everywhere it existed on my computer. So yeah, all is working.... Except for Duke Nukem 3D, setup.exe throws an error. I'll send it tommorow when I get enough sleep.

[leecher1337]

Just to let you know: Starting ntvdm.exe directly must fail, that's not how it works. The whole loader is just there to prepare everything so that ntvdm can launch. Technically, the loader registers the next command to execute with the console host and when ntvdm.exe starts, it fetches the next command to execute from console host.

Antivirus programs are a real pest, I even tried to encrypt the loader, but it didn't help against these annoying AV-programs. And when I apply for a whitelisting with an AV-vendor, the drama starts again as soon as a new loader version is compiled.

Running games with NTVDMx64 won't make you very happy anyway, as the CCPU is just way too slow for an acceptable gaming experience, so I'd say you should resort to DosBox for gaming, which is highly optimized for this.

[AngryDavid808]

Indeed, I faced problems with the games that actually worked. And apps as well.

Sometimes any app I use (I tried EDIT and QBASIC) doesn't respond well to input, so it disregards some of the keys I press. Hope you know what I mean. As for Duke Nukem and Duke Nukem 2, they worked, but with slowdowns and no PC Speaker output, except for a long beep on Duke Nukem 2 (I use a laptop that has a PC Speaker in it). I also couldn't check Soundblaster in Duke Nukem 2's settings to get some music and sound output. Both games give me no audio output.

[AngryDavid808]

Alright! So, I finally had time to log what exactly is going on when starting Duke Nukem 3D's setup program, as well as the error itself. Both of them are inside this ZIP file here.

[leecher1337]

For music, you need to set the sound to Adlib (as stated in the readme). I suspect you didn't read the readme file, otherwise you would have noticed the comment about PC Speaker output solution in there.

I never experienced any missed keystrokes, I cannot reproduce this no matter how fast I type.

[AngryDavid808]

I'm deeply sorry, nevermind about the keystroke problem. I felt it while using EDIT.exe, but now that I'm adapted to how it works, I don't feel it anymore. Btw, can I somehow maximize the window of whatever DOS app I'm using and stretch its display (sorry if that's not the correct expression), or put it in fullscreen mode?

[leecher1337]

There used to be the -EyeStrain[xx] parameter on non-x86 builds where [xx] is a hex-code from the list of VK_ keycodes for a key to be assigned to switch between 3 stretching modes (normal - medium - big) via a hotkey. This worked in NT/2k - times when the loader fetched the commandline to execute from cmdline regkey in WOW registry node, but as the newer loaders have harcoded ntvdm.exe in the kernelbase.dll the parameter cannot be specified this way anymore. I'll issue a little patch that will allow to read the parameter from the VDM environment regkey to enable this useful feature again, let's see, if it works.

The other sad history part is fullscreen: This used to work on Windows versions up to Windows 8, until Microsoft enforded their new WDDM Display driver model which doesn't allow direct hardware pass-through anymore and therefore fullscreen was effectively dead. As Windows 7 supported both XPDDM and WDDM (no idea why they pulled XPDDM support in later Windows versions even though it worked on Windows 7), it was possible to use with some tricks on Win 7 x32. BUT: This functionality relies on IO permission bitmap and this isn't supported on 64bit Windows, so it still isn't possible on Windows 7 x64. Fullscreen support would be ideal for gaming etc., as it would allow direct harware access to the card without having to do the slow VGA emulation, but sadly, it's not possible with the current Windows driver architecture.

[AngryDavid808]

Hey, I had a tiny question, thanks for all the help btw. ^^

How can I benefit from your last commitment? Thank you again in advance.

[leecher1337]

Compile it and try it out, it's not so complicated, there even is a video tutorial: https://github.com/leecher1337/ntvdmx64/blob/master/ntvdmpatch/doc/minnt.txt

You can just update the ntvdm.exe in SysWOW64 directory, if you fear that your current setup will break again by uninstalling and reinstalling.

[peter8777555]

2020/06/02 PM 06:49 2,134,653 ntvdmx64-master.zip MD5 : 11f76834a8c0f95a952a00e19bdafd39

Building OK.

[leecher1337]

@peter8777555 Did you test the new WOW32 part (16bit Windows support)? Would be interesting to hear if it works for you.

[peter8777555]

I have installed WineVDM on Windows 7 X64.

How to disable the WineVDM ? I do NOT want to uninstall WineVDM.

I have checked below

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NtVdm64\0OTVDM "CommandLine"=" --ntvdm64: \"%m\" --ntvdm64-args: %c" "InternalName"="" "ProductName"="" "ProductVersion"="*" "MappedExeName"="K:\DOS\WineVDM\otvdmw.exe"

and

set WOWTRACE=C:\log.txt set WOWLOGLVL=16

[leecher1337]

@peter8777555 If you do not want to use the .reg scripts from otvdm for install and uninstall, which will set and remove mentioned 0OTVDM key, just rename 0OTVDM to something different. In case you have the newest ldntvdm.dll loader installed (only the newest loader supports Win16, the old one just doesn't handle Win16 applications at all), it will then start NTVDM for wow16 after a reboot (or another event that causes the loader to inject where it checks presence of OTVDM).. If you want to have OTVDM back, name the key back to 0OTVDM and reboot.

[peter8777555]

Step 1:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NtVdm64\0OTVDM HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\NtVdm64\0OTVDM

rename to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NtVdm64\1230OTVDM HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\NtVdm64\1230OTVDM

Step 2 : UnInstall NTVDMX64 by Administrator.

Step 3 : Install NTVDMX64 by Administrator.

---

Advanced INF Install

INF Install Failed。Reason: Access Deny。

---

OK

What is wrong ?? Which file access deny ??

Step 4 :

C:\Windows\SysWOW64

2020/06/03 PM 02:59 1,418,752 ntvdm.exe 2017/03/09 AM 12:52 14,336 ntvdm64.dll 2020/06/03 PM 02:59 15,872 ntvdmd.dll

OK : It can run ALL DOS program. NG : It can NOT run ALL Windows 16 bit.

By the way,

set WOWTRACE=C:\log.txt set WOWLOGLVL=16

No log.txt in C:\

[leecher1337]

Hm, access denied? Normally it should tell you which file or regkey it cannot install. Unfortunately, there was a bug in all older NTVDMx64 versions which failed to remove the ldntvdm.dll loader. Therefore, please validate that the ldntvdm.dll loaders in system32 and syswow64 are both the most recent ones from this repository, if an old loader is still present, it will still start, but 16bit support won't work with it. The set WOWTRACE obvisouly only works, if you issued the command in the same console you are later starting the 16bit app from, it's not a global setting, but I guess you know that. As you have troubles starting 16bit applications, it's clear that there is no log then, as they cannot be executed. Also make sure that wow32.dll and user.exe from Windows installation got replaced by the ones from NTVDMx64 (compare file sizes and timestamp). These 2 files are still present in modern Windows versions and are basically stubs that need to be replaced by our versions.

If you still have an old loader present, please report, I might need to add a check to the install.bat then to give an option to remove the old loader code, if still present in system, as the problem may occur to all users who want to update. Not sure if Advanced Inf installer takes care of it, theoretically, it should. As always, Debugview logs may be helpful for debugging loader output, in case it fails to start win16 applications.

[peter8777555]

I use Screen2Exe to demo(record) my problem. Run Demo.exe

By the way, 2017/03/09 AM 12:52 16,384 ntvdm64.dll Can i delete this file ?

Why install.bat no OVERWRITE with NEW version ?

Do i need copy C:\work\ntvdmpatch\releases\usa\wow32 C:\Windows\SysWOW64 ??

[leecher1337]

2017/03/09 AM 12:52 16,384 ntvdm64.dll Can i delete this file ?

If you want to permanently ruin your chances to get otvdm working again, you may delete it. :-D So as I guess you are as happy with winevdm as I am, no, please don't delete ntvdm64.dll

Install.bat should move the wow32.dll and user.exe to a backup location after doing a takeown /f on them so that they can be replaced by the Advanced Inf installer. That's why you got "Access denied", I suppose, as takeown and move didn't work for whatever reason. Unfortunately, as I had to test my wow32, I already had these files removed and therefore there wasn't an error hit in my install tests in the test VM. That's why it's always good if more people test to find such problems. See here: wow32.inf

[InstallCmdsPre]
%10%\Symbols\instntvdmx64.bat instwow "%16425%" "%10%\Symbols\Backup"

install.bat

:instwow
md %3
takeown /f %2\wow32.dll
move %2\wow32.dll %3\
takeown /f %2\user.exe
move %2\user.exe %3\

Maybe install.bat can be modified to log the result of the commands to find out why moving these file doesn't work. I guess I need to install a fresh VM to reproduce the problem myself, or do you have an idea?

What I also saw in your demo is that there are a lot of questions whether to overwrite the files in syswow64. Did you just reinstall without uninstalling (which is OK in this case), or does my uninstallation routine fail to remove these files (not a real problem, but for the sake of cleanness...)?

[peter8777555]

I overwrite wow32.dll and user.exe to C:\Windows\SysWOW64

Run ALL Win16 programs always error

---

File Error

Cannot find NETWORK.DRV

Close(C)

[leecher1337]

Cannot find NETWORK.DRV

Close(C)

Thank you for the hint, I completely forgot to add the contents of wow2.reg to the .inf file. Of course that also didn't occur on my test VM as entries were already there. I will fix this shortly

[peter8777555]

So as I guess you are as happy with winevdm as I am

What I also saw in your demo is that there are a lot of questions whether to overwrite the files in syswow64.

Did you just reinstall without uninstalling (which is OK in this case), or does my uninstallation routine fail to remove these files (not a real problem, but for the sake of cleanness...)?

Yes,i am happy with WineVDM.

I always copy C:\work\ntvdmpatch\releases\usa\dos C:\Windows\System32 copy C:\work\ntvdmpatch\releases\usa\dos C:\Windows\SysWOW64

I UnInstall NTVDMX64 then Install NTVDMX64.

STRONG SUGGESTION: Install.bat always OVERWRITE with new version.

[peter8777555]

NTVDMX64 for DOS program. WineVDM for Win16 program. So my OLD PC(over 10 years) on Windows 7 X64 can run DOS16/Win16/Win32/Win64 program. Great :-D

[peter8777555]

set WOWTRACE=C:\log.txt

Suggestion: Add 0x0D 0x0A to end of line for Notepad.exe open text file.

[peter8777555]

I try new version

2020/06/04 AM 05:53 2,136,865 ntvdmx64-master.zip

All Win16 programs can NOT run.

See Log.txt

log.zip

[leecher1337]

Confirmed, seems it just works on Win10, not on Win7, will investigate

[peter8777555]

Thank you.

I will be back to WineVDM.

[AbdullahTrees]

I never experienced any missed keystrokes, I cannot reproduce this no matter how fast I type.

Can confirm from Mavis Typing Tutor, even if the program is slow, it somehow gets my WPM right (about 80ish) and does not miss out on any keystrokes.

[leecher1337]

@peter8777555 Does it work for you now?

[peter8777555]

To: leecher1337

I building and test below,

(WineVDM has no these problems)

Please run "0_DemoShow.exe" for screen recording.

1. It always shows "Shared WOWExec" window and ONLY run ONE Win31 program. I MUST close "Shared WOWExec" window and run other Win31 program. It is too bad idea. Suggestion: Disable "Shared WOWExec" window.

2. Delphi1_Console.exe -> Click X -> Crash (PS: WineVDM has no this problem.) Delphi1_WinForm.exe -> Click X -> Crash (PS: WineVDM has no this problem.)

---

Application Error

WOWEXEC caused an access violation in WOW32.DLL at 0x0ffdf35d.

Click on CLOSE to terminate the application Click on CANCEL to debug the application Click on IGNORE to continue, you should save your work in a new file.

---

16 bit Windows Subsystem

NTVDM has encountered a System Error Deny Access。

Choose 'Close' to terminate the application.

Close(C) IGNORE(I)

3. PBRUSH.EXE

---

Application Error

WOWEXEC caused a General Protection Fault in module KRNL386.EXE at 0002:2DD7.

Choose close. WOWEXEC will close.

Close(C)

4. SSFLYWIN.SCR SSMARQUE.SCR SSMYST.SCR SSSTARS.SCR

---

Application Error

WOWEXEC caused a General Protection Fault in module KRNL386.EXE at 0002:2DD7.

Choose close. WOWEXEC will close.

Close(C)

[peter8777555]

[AngryDavid808]

Interesting! I wanna know too! Oh, one other thing. For some reason, both OTVDM and NTVDMx64 uninstalled themselves right after updating Windows 10 from Version 1909 to Version 2004.

[AngryDavid808]

Also, prepare.cmd gives me this error. "\Common was unexpected at this time" I downloaded all correct files, followed through step by step, and then this happens. Not sure what to modify inside of this .cmd file.

[peter8777555]

To: AngryDavid808

I building is OK.

Do you update NTOSBE-master ?

[AngryDavid808]

Yes, it's the latest version.

[leecher1337]

@AngryDavid808 Could this be your problem? https://stackoverflow.com/questions/21749095/cmd-path-error-common-was-unexpected-at-this-time

So there seems to be a paranthesis in your PATH environment variable. Can you check the fix supplied in the stackoverflow article (replace occurances of %PATH% with %PATH:)=^)%? If it works, I'll commit this change to the repo.

Regarding Win10 update: It's an annoying behaviour of Windows that on Release-upgrades, it always purges the Windows-directory, as it can be seen as a full operating system upgrade. I also got told by a lot of ppl that they have to reinstall a lot of apps after every Win 10 upgradebecause of this misbehaviour. Not much we can do about it.

[AngryDavid808]

Yep! It finally does! Just replaced all %PATH% instances with %PATH:)=^)%. And that's about it!

[AngryDavid808]

Also, here's the output of patch.cmd. Is the output supposed to be like this?

https://pastebin.com/ZJpWdgDM

Oh, and mktools.cmd now reports that buildlocaltools.cmd is missing.

Also, what about this "release" folder inside "ntvdmpatch" folder? Is that a pre-built German version of NTVDMx64?

[leecher1337]

It seems that either your build environment layout is incorrect (as it cannot find minnt), or basepath.cmd is unable to detect it correctly. You can replace all @echo off with @echo on in patch.cmd and ..\basepath.cmd, then you get an output what it tries to do and can see where it searches the files that cannot be found. The report of mktools.cmd also indicates that either your directory layout is broken or basepath.cmd cannot detect it.

The release-folder is a template-folder that is used to build the final releases. It contains the .inf installation scripts that get copied to every language release, the necessary precompiled loaders, etc.So alle the stuff that stays the same for every language version.

[AngryDavid808]

Okay, here's the new output: https://pastebin.com/JuwzLyEt

[leecher1337]

C:\work\ntvdmpatch\minnt>xcopy /Y C:\work\ntvdmpatch\..\minnt\base\mvdm\dos\v86\cmd\backup\kor\makefile C:\work\ntvdmpat
ch\..\minnt\base\mvdm\dos\v86\cmd\backup\jpn\
File not found - makefile
0 File(s) copied

c:\work\minnt\base\mvdm\dos\v86\cmd\backup\kor\makefile is not present, so either the minnt-version you unpacked there is incomplete or you unpacked to the wrong location.The correct minnt snapshot contains mentioned file, therefore a file at this path must exist.

[AngryDavid808]

Strange. I downloaded the specified version of MinNT and everything. How is "kor/makefile" not even there? Btw, I've got an idea. Maybe you can please send the "kor" folder over, I put it where it belongs, and try again?

[AngryDavid808]

So, I tried to copy the entire "base" folder inside "MinNT-master" and merge it with the "base" folder outside of it. Still, no luck getting all errors away.

[leecher1337]

65 contains hashes of the Minnt-repo that was used to build it.

The kor-Folder is just one indicator that the directory structure is wrong or your downloaded minnt-version is incomplete.

7z l MinNT-20170416-85fac4faadc77203db8ddc66af280a75c1b717b0.zip | find /i "backup\kor\"

2017-04-16 10:08:16 .....        36092        21956  MinNT-master\base\mvdm\dos\v86\cmd\backup\kor\backup.exe
2017-04-16 10:08:16 .....          241          179  MinNT-master\base\mvdm\dos\v86\cmd\backup\kor\makefile
2017-04-16 10:08:16 .....          539          273  MinNT-master\base\mvdm\dos\v86\cmd\backup\kor\makefile.inc
2017-04-16 10:08:16 .....           75           58  MinNT-master\base\mvdm\dos\v86\cmd\backup\kor\sources

Also ensure that you haven't write-protected the folders (readonly attribute) and have full access to everything, because i.e. you get:

move C:\work\ntvdmpatch\..\minnt\base\mvdm\dpmi C:\work\ntvdmpatch\..\minnt\base\mvdm\dpmi.new
Access is denied.

which indicates a write permission problem.

And last but not least, don't run the scripts more than once, better start out fresh, as soon as you fixed your file permission problems etc., because i.e. dpmi-folders may already have been ruined as one move command failed and the other one succeeded.

[AngryDavid808]

Alright, I'll just delete the entire work folder and start over. Doesn't seem like it's gonna work.

[peter8777555]

I building the latest version.

Win16 Icons are OK on Windows 7 X64.