Vista x64 and 5gb of memory, Aero shuts down intermittently withperformance errors

Discussion in 'Windows 64bit' started by djrobx, Nov 29, 2007.

  1. djrobx

    djrobx Guest

    Problem:

    On my Mac Pro with 5GB of system memory, Aero intermittently shuts
    down. Balloons appear in the lower right reporting that "Windows has
    detected that performance is low" or that it has "exceeded dedicated
    memory". The same behavior occurs with a NVidia 6300GT with 256mb,
    or an ATI X1900XT with 512mb.

    Additionally, Desktop Window Manager will make log entries:

    9025: The Desktop Window Manager has stopped locking system memory due
    to passing its working set threshold

    9024: The Desktop Window Manager has been disabled automatically by
    the system due to too much system memory in use

    The amount of windows that need to be open to trigger the problem
    varies. You might be able to open dozens of windows and have it be
    OK, and later find Aero shut down with only 10 windows on the
    screen.

    I can consistently cauase Vista to trigger the bug by sleeping and
    waking the machine.

    I am fairly certain this is a bug in DWM pertaining to the large
    amount of system memory overflowing a 32 bit integer somewhere.
    According to Microsoft's Aero documentation, these events should be
    triggered when Aero uses more than 25% and 30% of system memory,
    respectively. But on my system, this happens when extremely small
    percentages of the system memory is in use.

    I have reported the incident to Microsoft. They provided a hotfix
    which did not work.

    Taking matters into my own hands, I attempted a patch to DWM.EXE. My
    aim was simply bypass the performance check. I found this section in
    the assembly code.

    00003062 (03) 83f8 1e CMP EAX, 0x1e
    00003065 (02) 8bfb MOV EDI, EBX
    00003067 (02) 76 30 JBE 0x3099
    00003069 (02) 33c9 XOR ECX, ECX
    0000306b (05) e8 68fdffff CALL 0x2dd8
    00003070 (02) 3bc3 CMP EAX, EBX
    00003072 (02) 8bf8 MOV EDI, EAX
    00003074 (02) 7d 57 JGE 0x30cd
    00003076 (01) 44 INC ESP
    00003077 (03) 8d43 02 LEA EAX, [EBX+0x2]
    0000307a (01) 48 DEC EAX
    0000307b (06) 8d15 07deffff LEA EDX, [0xffffde07]
    00003081 (03) 8d4b 15 LEA ECX, [EBX+0x15]
    00003084 (01) 44 INC ESP
    00003085 (02) 8bc8 MOV ECX, EAX
    00003087 (08) c74424 20 86010000 MOV DWORD [ESP+0x20], 0x186
    0000308f (05) e8 ac690000 CALL 0x9a40
    00003094 (05) e9 9a000000 JMP 0x3133
    00003099 (06) 381d 353e0100 CMP [0x13e35], BL
    0000309f (02) 74 48 JZ 0x30e9
    000030a1 (03) 83f8 19 CMP EAX, 0x19
    000030a4 (06) 0f86 89000000 JBE 0x3133
    000030aa (02) 33c9 XOR ECX, ECX

    Guessing that the CMP EAX, 0x19 and CMP EAX, 0x1E are the 25% and 30%,
    I substituted the values for 7F (127%), attempting to be as minimally
    invasive as possible. Since changing the values, my system is able to
    sleep and wake and open windows with no more performance errors.

    So if anyone else runs into this before Microsoft fixes it, copy dwm
    to a work file, open a hex editor and search for:

    83 F8 1E

    Replace with:

    83 F8 7F

    Then search for:

    83 F8 19

    Replace with

    83 F8 7F

    Take ownership and give yourself permissions to DWM.EXE and replace
    it:

    cd\windows\system32
    takeown /f dwm.exe
    cacls dwm.exe /G yourusername:F
    ren dwm.exe dwm.bak
    copy dwmhacked dwm.exe

    Then reboot.
     
    djrobx, Nov 29, 2007
    #1
    1. Advertisements

  2. I was having the same issue, pounding my head against the wall in Windows 7. Believe it or not this fix is still relevant. The instructions are in a different location within the file but doing the find and replace worked perfectly!

    Wouldn't have gotten this myself in 10 years, very nice work sir!
     
    Andrew Robinson, Aug 23, 2010
    #2
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.