Welcome to the new Woodmann RCE Messageboards Regroupment
Please be patient while the rest of the site is restored.

To all Members of the old RCE Forums:
In order to log in, it will be necessary to reset your forum login password ("I forgot my password") using the original email address you registered with. You will be sent an email with a link to reset your password for that member account.

The old vBulletin forum was converted to phpBB format, requiring the passwords to be reset. If this is a problem for some because of a forgotten email address, please feel free to re-register with a new username. We are happy to welcome old and new members back to the forums! Thanks.

All new accounts are manually activated before you can post. Any questions can be PM'ed to Kayaker.

USB drivers for Win 7 on 8th generation Intel chipset

All-in-one reversing related discussions
WaxfordSqueers
Senior Member
Posts: 1001
Joined: Tue Apr 06, 2004 11:00 am

Post by WaxfordSqueers »

Kayaker wrote:This thread should be split at some point if it goes off topic.
Do whatever you think is best, kayaker.

I started the thread as a general query into USB 3 drivers for W7 on a newer generation mobo. Microsoft never has supplied drivers on W7 for USB3.

I needed to find a debugger to do that and the discussion lead off into 64 bit debuggers. I needed to learn Windbg properly while finding a way to study W7 and W10 USB trees with the hope of finding a clue as to why current Intel USB 3 drivers won't load on my B360 chipset.

Currently I am trying to follow the loading sequence used in Device Manager to see if I can find a clue as to why the drivers won't activate. However, I plan to attack it at a deeper level once I get a feel for what is involved. It's a steep learning curve.

Break the current thread into two or more threads as you see fit.
WaxfordSqueers
Senior Member
Posts: 1001
Joined: Tue Apr 06, 2004 11:00 am

Post by WaxfordSqueers »

blabberer wrote:the instruction syscall / sysenter / int 2e / int2b etc are executed from usermode but the actual work is done in kernel mode

so you may need to wait on the other side with proper breakpoints to catch the action
Thanks for info, Blabbs and good to hear from you.

There is good info here for me to study in windbg. Thanks for taking the time to put it together.

I went back to the syscall command and set a bp on the ret address. It never broke, the code entered by syscall must have called back into the user app and likely won't return till further processes is done.

As it stands, as I indicated in an earlier post, I was barking up the wrong tree. The syscall was in code leading to an INF file and was related to an open dialog box with an OK button. I needed to activate that button and reach the next stage where the driver is loaded.
blabberer
Senior Member
Posts: 1535
Joined: Wed Dec 08, 2004 11:12 am

Post by blabberer »

sure just leech it from the src and recompile it

attaching a windbg extension dll 64 bit version for just !hwnd scroll to end



Code: Select all

0:000> .extmatch /e simplext hw*
!simplext.hwnd
0:000> !hwnd 70258
Window    0000000000070258
Name      USB drivers for Win 7 on 8th generation Intel chipset - Page 10
Class     TabWindowClass
WndProc   0000000000000000
Style     WS_OVERLAPPED 
ExStyle   WS_EX_LEFT WS_EX_LTRREADING WS_EX_RIGHTSCROLLBAR 
HInstance 00007ff949270000
ParentWnd 0000000000000000
Id        0000000000000000
UserData  0000000000000000
Unicode   TRUE
ThreadId  0000000000002664
ProcessId cccccccc000026c8
0:000> !hwnd 80310
Window    0000000000080310
Name      USB drivers for Win 7 on 8th generation Intel chipset - Page 10 ‎- Microsoft Edge
Class     ApplicationFrameWindow
WndProc   0000000000000000
Style     WS_OVERLAPPED 
ExStyle   WS_EX_WINDOWEDGE WS_EX_LEFT WS_EX_LTRREADING WS_EX_RIGHTSCROLLBAR 
HInstance 00007ff94eea0000
ParentWnd 0000000000000000
Id        0000000000000000
UserData  0000000000000000
Unicode   TRUE
ThreadId  00000000000018d0
ProcessId cccccccc000006f4
WaxfordSqueers
Senior Member
Posts: 1001
Joined: Tue Apr 06, 2004 11:00 am

Post by WaxfordSqueers »

blabberer wrote:sure just leech it from the src and recompile it
Thanks, blabbs.

The attachment requires a password. Don't recall if you had a stock one for all your attachments.

If you don't want to post it, ask kayaker to pass it on to me. Or maybe you have the means yourself.

I am a bit tied up at the moment helping someone on a project. I will be sure to apply these invaluable hints from you. Thanks.
WaxfordSqueers
Senior Member
Posts: 1001
Joined: Tue Apr 06, 2004 11:00 am

Post by WaxfordSqueers »

Just noted threads have been split. I have been posting to wrong thread. :D

Have not given up on this thread, I have just been busy on an unrelated project. I'll be back.
Elenil
Senior Member
Posts: 140
Joined: Tue Sep 30, 2008 7:53 pm

Post by Elenil »

WaxfordSqueers wrote:Just noted threads have been split. I have been posting to wrong thread. :D

Have not given up on this thread, I have just been busy on an unrelated project. I'll be back.
waxfordsqueers i might got the problem fixed you where talking in page 1

i tryed to fix the problems for this old tool
i made a beta you might try it out ?

(removed see woodmann downloads for download)


i will delete the link later its kinda off tropic since i cant send a private msg
WaxfordSqueers
Senior Member
Posts: 1001
Joined: Tue Apr 06, 2004 11:00 am

Post by WaxfordSqueers »

Elenil wrote:i will delete the post later its kinda off tropic since i cant send a private msg
Thanks, elenil. It's not off-topic to me. You are welcome to leave the link on this thread if you like. Kayaker might want to do something with it, however.
User avatar
Kayaker
Posts: 4169
Joined: Thu Oct 26, 2000 11:00 am

Post by Kayaker »

Of course, updates to IceStealth is always welcome.
WaxfordSqueers
Senior Member
Posts: 1001
Joined: Tue Apr 06, 2004 11:00 am

Post by WaxfordSqueers »

Kayaker wrote:Of course, updates to IceStealth is always welcome.
Kayaker...noted that your join date was in 2000. Your 20th anniversary will be coming up soon.

Planning a party? :D
WaxfordSqueers
Senior Member
Posts: 1001
Joined: Tue Apr 06, 2004 11:00 am

solved...but not by me

Post by WaxfordSqueers »

Sorry for long vacation from this thread. I have recently gotten back to looking at the problem of USB 3 drivers on Windows 7 on an 8th generation Intel motherboard. My mobo is an Asus B360M.

The problem has been solved but not by me. Using the drivers I now have full USB support on W7 on an 8th generation Intel mobo using an Intel i5-8400 series processor with 6 cores. Microsoft has never released USB drivers for W7 but a person at the following link has modded a driver to work on W7.

https://www.win-raid.com/t4883f52-Solution-Win-drivers-for-USB-Controllers-of-new-Intel-chipset-systems.html

Not sure what was done or how the person figured out what to do. In the link, he claims the mod was done using IDA and a hex editor. W7 is now running on my new mobo as well as W10 without all the overhead.

Now I am working on getting XP running on the same mobo. :) Don't laugh, it going well and some folks at win-raid have XP running well on modern mobos complete with hyper-threading and the ability to use multiple processor cores.
User avatar
Kayaker
Posts: 4169
Joined: Thu Oct 26, 2000 11:00 am

Post by Kayaker »

Good job someone figured it out, shame that anyone had to at all.

Sounds like a classic hack, lol.

"So I use IDA7.0 to modify it, use jmp and nop to block the ID Identification and Configuration Zone, make it work as a generic driver."
WaxfordSqueers
Senior Member
Posts: 1001
Joined: Tue Apr 06, 2004 11:00 am

Post by WaxfordSqueers »

Kayaker wrote:Sounds like a classic hack, lol.

"So I use IDA7.0 to modify it, use jmp and nop to block the ID Identification and Configuration Zone, make it work as a generic driver."
Sounds like someone has intentionally written the driver so it cannot be used on certain systems. I suppose that could be called 'perverse' engineering. :D

Having a good time trying to get XP running on the same system. Making grounds but I am stuck at the product ID page during install. Windows won't accept a perfectly legit product key from my jewel case sticker.

For anyone wondering why the interest in an XP install on a newer mobo, I have several reasons.

1)XP is still the preferred version for certain legacy games, like Myst.
2)Apparently XP really screams along on a newer mobo.
3)As Mallory claimed when asked why he climbed on Everest..."because it's there". Combine that with 2) and you have it. It's fun.

BTW...I do have XP running on a VM. Not the same for a gaming environment. I even managed to create a VM out of a backup image of XP that was saved in a VM format.

Msoft was aware of the product ID problem in the past and suggested workarounds. It has to do with slipstreaming and using nlite running on a later OS to do the slipstreaming. For a successful slipstream, it has to be done on an OS equivalent to the upgrade being slipstreamed. That means the XP version of nlite must be running on an XP machine.

I should start another thread for that but it's not really reverse engineering at my stage. Some guys over at win-raid have actually reversed drivers and modded the BIOS and registry to allow XP to use the features in modern Intel processors and motherboard chipsets. Some of it is pretty in-depth reversing.

Then there's the SP4 unofficial upgrade by harkaz. The upgrade contains XP drivers that will work on modern mobo chipsets and processors.
Elenil
Senior Member
Posts: 140
Joined: Tue Sep 30, 2008 7:53 pm

Post by Elenil »

did you set your xp to posready i got upgrades up to April 9, 2019 ?

you open regedit and go for:
HKEY_LOCAL_MACHINE
SYSTEM
WPA
PosReady
(picture)
[ATTACH]3056[/ATTACH]
then you create a "reg_dword" called "Installed" what value you set to "0x00000001" aka 1

after this it has downloaded many new updates (even in 2019) and keept all regarding to windows xp (for example KB450033)

xp gone even to framework 4.0 and IE8
but all new programs seems to be written for a newer version of .net framework
Attachments
Windows-XP-Registry-PosReady.jpg
WaxfordSqueers
Senior Member
Posts: 1001
Joined: Tue Apr 06, 2004 11:00 am

Post by WaxfordSqueers »

Elenil wrote:did you set your xp to posready i got upgrades up to April 9, 2019 ?
The unofficial update makes it POS ready but I don't have the version of XP I need running yet.

I misunderstood the installation instructions for SP4. I tried to do a repair install and the choices I had were to do a fresh install or leave the existing files alone. I selected the 2nd option thinking it was a repair install.

It wasn't. It installed an entirely fresh XP install in another directory. I named my xp directory as 'winxp', and the installer named the new directory 'winxp.0'. I did not know you could do that but they did it and the new install boots right to the desktop and is stable.

I have fixed my existing install in winxp by using ACPI and SATA drivers that will run with my 8th generation motherboard. With the stock drivers I was getting an 0XA5 and an 0x7B bsod, related to ACPI and AHCI issues.

I no longer get errors but I get stalled just before the logon screen with an activation nag screen. I can't get past it, whether I press yes to activate or no to not activate. It goes away for 20 seconds and just reappears and sits there.

I can't even get into Safe Mode, likely for problems related to activation. I know if Windows is not activated it won't let you into Safe Mode after the trial period.

I am wondering if I can somehow get at XP via debug mode with windbg run remotely via a serial port from a W7 host.

Blabberer would likely know but he probably wouldn't talk to me about something as ancient as XP. :D

Have you run ice on your XP version?
WaxfordSqueers
Senior Member
Posts: 1001
Joined: Tue Apr 06, 2004 11:00 am

Post by WaxfordSqueers »

ps. Kayaker had a method for identifying the source of window text in mui files. I'd like to track down the activation message to see where it's coming from, likely licdll.dll.

The nag screen title is Windows Product Activation and the message in part is "A problem is preventing Windows from accurately checking the license for this computer...". I am not trying to reverse anything I just want to know which file or files is stalling the boot. Maybe I can get a clue from the file producing the message/title.

I did encounter an issue in the past when trying to run a newer mobo on an existing XP install with a repair install. It also happened at the activation stage and it stalled because the version of Internet Explorer was 6 and the activator software could not run on it. The solution was to upgrade IE to version 8, then the installer finished to the desktop.
Post Reply