Break Winpe/bartpe Resource Limits Legally, No need for Winlogon resource patch! Options

[Bart Lagerweij]

Just for knowledge, here is a workaround to break the 24 hour limit in an easy and legal way:
After startup, just kill the following two processes in order:

smss.exe
winlogon.exe

in that exact order. Otherwise your machine will reboot.

I tried this using winxp/sp2

I also noticed that after stopping these 2 processes I also could launch about 20 programs. So does killing this also disables the max. process limit?

Or is it just me...
(I did not touch winlogon.exe)

Regards,
Bart.

[Wendy]

I used the version of PELoader by thetruth, and i managed to start 108 instances of notepad, along with 4nt, and irfanview. It was quite cute. I had minimised notepads tiled 5 in a row, up to 20 rows. Then it started on the 21st row, and put one over the other.

I have not found a bug with thetruth's peloader as yet, despite its 0,3 version number. I should poke around a bit more with it though :S

[Former_Talyn_post]

Is there any adverse effects (being able to logon into network shares, etc...) in terminating smss.exe and winlogon.exe?

Does a hacked winlogon or using the XPe plugin also get rid of the 24 hour limit?

[paraglider]

A hacked winlogon is the only other way to bypass the 24hr limit.

[Metzen]

Just for knowledge, here is a workaround to break the 24 hour limit in an easy and legal way:
After startup, just kill the following two processes in order:

smss.exe
winlogon.exe

in that exact order. Otherwise your machine will reboot.

I tried this using winxp/sp2

I also noticed that after stopping these 2 processes I also could launch about 20 programs. So does killing this also disables the max. process limit?

Or is it just me...
(I did not touch winlogon.exe)

Regards,
Bart.

I have not had the same luck you have had. Running explorer then starting "explorer" after explorer from the command-line (opens new windows) results in resource-limit symptoms (missing menus, scroll bars, etc.)

[Wendy]

I could only start five or so processes with these processes stopped.

I stopped smss.exe and winlogon.exe, using pskill. Then i closed the 4nt window, and then restarted it. I then tried to open more than five instances of notepad via the start /min notepad command, that i got 108 instances of notepad last night. It stopped at five. (All proggies are latest version).

However, i think i will stick with thetruth's version. While it may not be the be-all and end-all of avoiding the 24-hour limit, it does give one a pocket windows that one can do all sorts of nice things with (including running it when the hard drive is dead ).

This is done on a toshiba laptop with 128 mb ram, the thing is booting off the c:\ drive, the BartPE is built from ver 3.00.32 and Windoze 5.10.2600.1106 (ie XP Pro sp1). Shell (GUI abstraction) = explorer.exe, cmdline (user shell) = nu2menu.exe. Home grown wall paper. Looks like the weekend hack of it.

[Bart Lagerweij]

I tried this using winxp/sp2

I also noticed that after stopping these 2 processes I also could launch about 20 programs. So does killing this also disables the max. process limit?

Regards,
Bart.

Aaaargh!
Stupid me, I had peloader.exe also loaded...
I build BartPE so often that I sometimes forget what I put in it...

Regards,
Bart.

[TheTruth]

@jaclaz

Just a humble suggestion, instead of the command line pskill.exe, have you considered this nifty freeware:
TaskMan+ v1.5

Tried this little tool but for example I was unable to terminate the smss.exe process.
I mentioned pskill because you can use it in a btch file to be called upon startup.
If you need a real task manager, no tool I have ever seen comes close to Sysinternals' Process Explorer by Mark Russinovich, there is a good plugin by sherpya that's workable on read-only media.

@Bart

I also noticed that after stopping these 2 processes I also could launch about 20 programs. So does killing this also disables the max. process limit?

This is the first idea that came to me during testing , but I was almost sure it wouldn't work as terminating the Winlogon process won't switch you from the "Winlogon" desktop that has the processes limitation.

@Wendy

I have not found a bug with thetruth's peloader as yet, despite its 0,3 version number

This is enough to raise the version to 1.0 with next update

@Talyn

Is there any adverse effects (being able to logon into network shares, etc...) in terminating smss.exe and winlogon.exe?

Ok, to make people rest assured I'll clarify this briefly:
First of all, most of the functions of these two processes (winlogon and smss) are carried up at their startup.

+ As for amss.exe process, after carrying up the startup functions (creating the Win32 subsystem process (csrss.exe, win32k.sys) and the Lsass subsystem process, creating paging files and environment variables, etc.), it'll be waiting for any of the two processes winlogon or csrss to exit to terminate your session.
there are however two important functions of smss remainig:
- the first, waiting for client requests to load new subsystems (other than Win32 subsystem, like POSIX and OS/2 subsystems), this function of smss is applicable only if you're going to run PSIX or OS/2 apps.
- the second, waiting for client rquests to create new sessions (Terminal Sessions), and this function is applicable only if you're running the terminal services and there is a user want to start a a session from a remote terminal.

So, I think no missing functionality from terminating the smss process as long as you are not in need of the last two functions, which I'm sure no one in PE is.

+ As for the Winlogon process, after carrying up its startup functions (creating Window Stations and Desktops objects, registering the SAS sequence and negotiating MSGINA.DLL (not in PE), creating the process pointed to by the "CmdLine" reg key, etc.), the remaining functions of Winlogon like loging in/out users, listening to the SAS sequence (Ctrl+Alt+Del), and controlling the differnet desktops are NOT working BY DEFAULT in PE.

So, again I think no missing functionality from terminating the Winlogon process.

Last, if there is anyone who still sees any problems from terminating these processes, let me know.

@Wendy

While it may not be the be-all and end-all of avoiding the 24-hour limit

The next update of PEShell+PELoader will terminate these processes as part of its startup operations to gain control over the environment.

Regards,
Thetruth

[Svenska]

Aaaargh!
Stupid me, I had peloader.exe also loaded...
I build BartPE so often that I sometimes forget what I put in it...

Regards,
Bart.

There is a way around that problem. Have different sets of plugins for different kinds of builds but because the plugin folder is locked in PEB one also must have multiple PEB folders.

[Wendy]

I still wonder if terminating winlogon / smss is a good idea.

On the laptop where i have been testing the burn images of BartPE, killing these meant that the ctl/alt/del sequence was not being handled by anyone. I am not sure if this is anyone else's experience.

The laptop is the same one, that 'pskill'ing smss.exe and winlogon did not unshakle the memory resources. I am not sure about the 24 hour limit, since the longest i ever ran a pc for was 31 hours.

I have not been running a standard build of BartPE since my build #1. I have made any number of builds since then, the idea is to move as much out of the Windows directory as i can. Currently i path \programs\exe, and have \programs\ini for lots of non-pathed junk. Eventually i plan to move the total commander key file there, so one can drop total commander on some machine, as a shareware copy.

The freeDOS project has an interesting mod on their cd that allows one to open a variety of things on their pop-up context menu, including opening directories. I plan to use something like that to open the registry hack files.

[Troglodyte]

I just thought that I would mention that I have been experiencing the same problem that Paraglider decscribed in a previous post...

Do you know why when peloader runs it resizes the window from 1024 * 768 to 800 * 600 ?

FYI: I am using the VGASave driver service, i.e. predefined registry keys to set the resolution, as shown here;

CODE

[SetupReg.AddReg]
; Screen setting 640x480 16Bit
0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.BitsPerPel",0x010
0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.XResolution",0x280
0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.YResolution",0x1E0

;Screen setting 800x600 32Bit
0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.BitsPerPel",0x020
0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.XResolution",0x320
0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.YResolution",0x258

;Screen setting 1024x768 32Bit
0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.BitsPerPel",0x020
0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.XResolution",0x400
0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.YResolution",0x300

; Screen setting 1280x1024 32Bit
;0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.BitsPerPel",0x020
;0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.XResolution",0x500
;0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.YResolution",0x400

; Screen setting 1600x1200 32Bit
;0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.BitsPerPel",0x020
;0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.XResolution",0x640
;0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.YResolution",0x480


;XResolution:
;0x280 is 640
;0x320 is 800
;0x400 is 1024
;0x500 is 1280
;0x640 is 1600

;YResolution:
;0x1E0 is 480
;0x258 is 600
;0x300 is 768
;0x400 is 1024
;0x480 is 1200


;in BitsPerPel:
;0x8  is  8 Bit
;0x10 is 16 Bit
;0x18 is 24 Bit
;0x20 is 32 Bit

;refresh rate
;60=03C
;65=41
;70=046
;72=048
;75=04B
;85=055

; Sample key for refresh rate
; Refresh rate 75 HERTZ
0x4,"ControlSet001\Services\VgaSave\Device0","DefaultSettings.VRefresh",0x055

;WARNING: Windows is supposed to reject unsupported settings but do not rely on that.
;If you specify unsupported settings you can damage your hardware.

;NOTE: Many problems with 0x18 24 Bit, 16 Bit and 32 Bit work OK.

Any one else having this problem?, and if so, how did you fix it?

Thanks...

[risolutore]

I prefer the sp2 tecnique descripted in other topic, for the 24h limit.
for 6 process peloader can do the job.
in order to have a small memory footprint you have to patch other file in sys32,
related to netbios....()

[myegon]

Ok, I read this thread.
It's not totally obvious to me whether it isn't necessary to use/enable peloader (v0.4) if xpe-1.02 is used.

Thanks
..--

[paraglider]

XPE 1.0.2 provides equivalent functionality so no its not required if you are using XPE as the shell.

[Wendy]

I am still sticking with version 0,03, rather than version 0.04, since (a) i don't mind the 24 hour limit, and ( b ) it makes shutdown smoother. Often chkdsk runs on machines that you shut down with the BRS.

[ChrisD]

To add the "common" knowledge base:

Here is what I've experienced trying to get a fully working TrueImage Server 8.0.0.786 using PeBuilder 3.1 and W2K3 sources.

If I build using PeLoader 0.4 starting TI8 I get the famous "RPC Server is unavailable" error (when I try to execute a "Scheduled task" from with TI8)

If I build without PELoader 0.4 I get a different error: "Device is not ready".

So it looks like some programs (TI8?), rely to some degre, on one or both of the processes PELoader 0.4 removes.

Using RegMonitor I can see that TrueImage.exe is reading or trying to read some of the keys under "winlogon" and other "Netlogon" type keys ...... so it could make sense that TI8 is trying to use "winlogon.exe"

I also do experience a lot of chkdsk (when I reboot my W2K3 server)....not sure if this is PELoader 0.4 or TI8 (or the combination)....

[webmedic]

I cant say it;s true image but I've been using the 0.4 version for a bit now and have never had a system run chkdsk. I dont think I'm just lucky as I have never seen this at all. It simply has never happened and I'm running a whole bunch of plugins. Recently I've even been using true explorer instead of nu2menu and geo and so far have not had this issue with it either.

I will say though that I have had issues with the mmc working properly though which was one of the reasons I decided to use true explorer. I think I'll try ging back to 0.3 and see if it solves this issue.

[thasan]

Hi. Can someone help me with the .INF files for Explorer shell for WXP-SP2 or W2k3? . Would really appreciate it.

[ARUNACHALAM]

Hi,
Can someone help me in solving the problem that I am facing wrt WinPE resource limits? I am using the following lines of code for resolving the issue.

hndWindowsStation = OpenWindowStation("WinSta0",false,WINSTA_CREATEDESKTOP);
hndDefaultDesktop = OpenDesktop("DEFAULT", 0, TRUE, GENERIC_ALL);
SetThreadDesktop(hndDefaultDesktop);
SwitchDesktop(hndDefaultDesktop);
CloseDesktop(hndDefaultDesktop);
CloseWindowStation(hndWindowsStation);
ShellExecute ( 0,"open","cmd.exe","","d:\\i386\\system32",SW_SHOWNORMAL);


I am not able to see the command prompt. Is there any API that I need to execute for making the Command prompt visible? Any help would be appreciated.

Thanks,
Arunachalam

[Bart Lagerweij]

@ARUNACHALAM

Are you using MS winpe? I have heard that winpe 2004 has "WINPESHL.EXE" to do this...

You must not use ShellExecute because this creates the new windows on the same desktop as the calling program.

You must use CreateProcess API and fill in the "new" desktop into lpStartupInfo.lpDesktop this way your process is created on the correct desktop.

Regards,
Bart.