D
djrobx@gmail.com
Guest
Problem:
On my Mac Pro with 5GB of system memory, Aero intermittently shuts
down. Balloons appear in the lower right reporting that "Windows has
detected that performance is low" or that it has "exceeded dedicated
memory". The same behavior occurs with a NVidia 6300GT with 256mb,
or an ATI X1900XT with 512mb.
Additionally, Desktop Window Manager will make log entries:
9025: The Desktop Window Manager has stopped locking system memory due
to passing its working set threshold
9024: The Desktop Window Manager has been disabled automatically by
the system due to too much system memory in use
The amount of windows that need to be open to trigger the problem
varies. You might be able to open dozens of windows and have it be
OK, and later find Aero shut down with only 10 windows on the
screen.
I can consistently cauase Vista to trigger the bug by sleeping and
waking the machine.
I am fairly certain this is a bug in DWM pertaining to the large
amount of system memory overflowing a 32 bit integer somewhere.
According to Microsoft's Aero documentation, these events should be
triggered when Aero uses more than 25% and 30% of system memory,
respectively. But on my system, this happens when extremely small
percentages of the system memory is in use.
I have reported the incident to Microsoft. They provided a hotfix
which did not work.
Taking matters into my own hands, I attempted a patch to DWM.EXE. My
aim was simply bypass the performance check. I found this section in
the assembly code.
00003062 (03) 83f8 1e CMP EAX, 0x1e
00003065 (02) 8bfb MOV EDI, EBX
00003067 (02) 76 30 JBE 0x3099
00003069 (02) 33c9 XOR ECX, ECX
0000306b (05) e8 68fdffff CALL 0x2dd8
00003070 (02) 3bc3 CMP EAX, EBX
00003072 (02) 8bf8 MOV EDI, EAX
00003074 (02) 7d 57 JGE 0x30cd
00003076 (01) 44 INC ESP
00003077 (03) 8d43 02 LEA EAX, [EBX+0x2]
0000307a (01) 48 DEC EAX
0000307b (06) 8d15 07deffff LEA EDX, [0xffffde07]
00003081 (03) 8d4b 15 LEA ECX, [EBX+0x15]
00003084 (01) 44 INC ESP
00003085 (02) 8bc8 MOV ECX, EAX
00003087 (08) c74424 20 86010000 MOV DWORD [ESP+0x20], 0x186
0000308f (05) e8 ac690000 CALL 0x9a40
00003094 (05) e9 9a000000 JMP 0x3133
00003099 (06) 381d 353e0100 CMP [0x13e35], BL
0000309f (02) 74 48 JZ 0x30e9
000030a1 (03) 83f8 19 CMP EAX, 0x19
000030a4 (06) 0f86 89000000 JBE 0x3133
000030aa (02) 33c9 XOR ECX, ECX
Guessing that the CMP EAX, 0x19 and CMP EAX, 0x1E are the 25% and 30%,
I substituted the values for 7F (127%), attempting to be as minimally
invasive as possible. Since changing the values, my system is able to
sleep and wake and open windows with no more performance errors.
So if anyone else runs into this before Microsoft fixes it, copy dwm
to a work file, open a hex editor and search for:
83 F8 1E
Replace with:
83 F8 7F
Then search for:
83 F8 19
Replace with
83 F8 7F
Take ownership and give yourself permissions to DWM.EXE and replace
it:
cd\windows\system32
takeown /f dwm.exe
cacls dwm.exe /G yourusername:F
ren dwm.exe dwm.bak
copy dwmhacked dwm.exe
Then reboot.
On my Mac Pro with 5GB of system memory, Aero intermittently shuts
down. Balloons appear in the lower right reporting that "Windows has
detected that performance is low" or that it has "exceeded dedicated
memory". The same behavior occurs with a NVidia 6300GT with 256mb,
or an ATI X1900XT with 512mb.
Additionally, Desktop Window Manager will make log entries:
9025: The Desktop Window Manager has stopped locking system memory due
to passing its working set threshold
9024: The Desktop Window Manager has been disabled automatically by
the system due to too much system memory in use
The amount of windows that need to be open to trigger the problem
varies. You might be able to open dozens of windows and have it be
OK, and later find Aero shut down with only 10 windows on the
screen.
I can consistently cauase Vista to trigger the bug by sleeping and
waking the machine.
I am fairly certain this is a bug in DWM pertaining to the large
amount of system memory overflowing a 32 bit integer somewhere.
According to Microsoft's Aero documentation, these events should be
triggered when Aero uses more than 25% and 30% of system memory,
respectively. But on my system, this happens when extremely small
percentages of the system memory is in use.
I have reported the incident to Microsoft. They provided a hotfix
which did not work.
Taking matters into my own hands, I attempted a patch to DWM.EXE. My
aim was simply bypass the performance check. I found this section in
the assembly code.
00003062 (03) 83f8 1e CMP EAX, 0x1e
00003065 (02) 8bfb MOV EDI, EBX
00003067 (02) 76 30 JBE 0x3099
00003069 (02) 33c9 XOR ECX, ECX
0000306b (05) e8 68fdffff CALL 0x2dd8
00003070 (02) 3bc3 CMP EAX, EBX
00003072 (02) 8bf8 MOV EDI, EAX
00003074 (02) 7d 57 JGE 0x30cd
00003076 (01) 44 INC ESP
00003077 (03) 8d43 02 LEA EAX, [EBX+0x2]
0000307a (01) 48 DEC EAX
0000307b (06) 8d15 07deffff LEA EDX, [0xffffde07]
00003081 (03) 8d4b 15 LEA ECX, [EBX+0x15]
00003084 (01) 44 INC ESP
00003085 (02) 8bc8 MOV ECX, EAX
00003087 (08) c74424 20 86010000 MOV DWORD [ESP+0x20], 0x186
0000308f (05) e8 ac690000 CALL 0x9a40
00003094 (05) e9 9a000000 JMP 0x3133
00003099 (06) 381d 353e0100 CMP [0x13e35], BL
0000309f (02) 74 48 JZ 0x30e9
000030a1 (03) 83f8 19 CMP EAX, 0x19
000030a4 (06) 0f86 89000000 JBE 0x3133
000030aa (02) 33c9 XOR ECX, ECX
Guessing that the CMP EAX, 0x19 and CMP EAX, 0x1E are the 25% and 30%,
I substituted the values for 7F (127%), attempting to be as minimally
invasive as possible. Since changing the values, my system is able to
sleep and wake and open windows with no more performance errors.
So if anyone else runs into this before Microsoft fixes it, copy dwm
to a work file, open a hex editor and search for:
83 F8 1E
Replace with:
83 F8 7F
Then search for:
83 F8 19
Replace with
83 F8 7F
Take ownership and give yourself permissions to DWM.EXE and replace
it:
cd\windows\system32
takeown /f dwm.exe
cacls dwm.exe /G yourusername:F
ren dwm.exe dwm.bak
copy dwmhacked dwm.exe
Then reboot.