PAE patch updated for Windows 8.1

This patch allows you to use more than 3/4GB of RAM on an x86 Windows system. Works on Windows Vista SP2, Windows 7 SP0, Windows 7 SP1, Windows 8 and Windows 8.1. Instructions and source code included.

Download: PatchPae2.zip (209302 downloads)

Before using this patch, make sure you have fully removed any other “RAM patches” you may have used. This patch does NOT enable test signing mode and does NOT add any watermarks.

Note: I do not offer any support for this. If this did not work for you, either:

  • You cannot follow instructions correctly, or
  • You cannot use more than 4GB of physical memory on 32-bit Windows due to hardware/software conflicts. See the comments on this page for more information.

162 thoughts on “PAE patch updated for Windows 8.1

    1. Bruce

      I was usiing Patchpae2 fine on windows 8.1. Now I have upgraded to windows 10 and the program will not work anymore – say “wrong kernel level”. Will there be an update – or another way to use more that 2.75 GB on a 32 bit system?

      Reply
  1. P Sv Rns Srikanth

    Thank you so much for this updated Patch for Windows 8.1. I am eagerly waiting for this. 100% works on Windows 8.1 (32-bits(X86)) all versions :)

    Reply
  2. alex

    it wont boot after:

    @echo off
    TITLE …::: Win8 32-bit Unlocker Script :::… by: Wiwi-maX
    color 30
    echo Script use PatchPae v2.
    cd %Windir%\system32

    C:\PatchPae2\PatchPae2.exe -type kernel -o ntoskrnx.exe ntoskrnl.exe
    C:\PatchPae2\PatchPae2.exe -type loader -o winloadp.exe winload.exe
    echo.
    bcdedit /copy {current} /d “Windows 8 (Unlocked)”
    echo.
    echo.
    bcdedit /set {current} kernel ntoskrnx.exe
    bcdedit /set {current} path \Windows\system32\winloadp.exe
    bcdedit /set {current} nointegritychecks 1
    bcdedit /default {current}
    bcdedit /set {bootmgr} timeout 2

    shutdown.exe -r -f -t 5 -c “RAM 2GB’s Limit Removed.”

    Reply
  3. Andre

    Works great – thank you so much!

    After getting the new boot entry like {12345678-abcd-1234-abcd-123456789abc},
    you can copy your {…} to the associated commands in your personal “readme.txt”.
    For example:
    bcdedit /set {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} kernel ntoskrnx.exe
    becomes
    bcdedit /set {12345678-abcd-1234-abcd-123456789abc} kernel ntoskrnx.exe
    Then work with copy&paste to insert 100% correct commands to your Command prompt window.

    Reply
  4. slalalavka

    C:\Windows\System32>C:\WherePatchPaeIs\PatchPae2.exe -type kernel -o ntoskrnx.ex
    e ntoskrnl.exe
    Unsupported kernel version.

    Reply
  5. Jackson

    I had the boot loop as well on 8.1. I just let it keep rebooting, eventually it worked after maybe 7 or 8 attempts. I made the mistake of having updates pending on the reboot. Thought that’s why it might have given problems. Seems fine now.

    Reply
  6. DavidB

    Thank you very much.

    But disabling the integrity checks is a stability and security risk.
    Is there any way to patch the ntkrnlpa.exe/ntoskrnl.exe file so the digital signature would check out ok…?

    Best regards, DavidB

    Reply
  7. PaVink

    Thank you so much, Wen Jia!
    Installation was simple and straightforward.

    I had dug up a similar patch (albeit way more complicated than this one!) under Win 7, and I hated going back to 3-something GB under Win 8 when I switched over. I am so happy being back at 4 GB now. Great job – thank you for your efforts and proving (once again) that all the Microsoft language about the 4GB limitation is just bullshit.

    Reply
  8. Erik

    Hola, probé el script en 8.1, y todo se ejecutó perfecto, pero al reiniciar empezó a dar pantallazos -como de incompatibilidad de driver o resolución de video- y apareció la linda pantalla azul de volcado de memoria. Alguién sabe si hay alguna corrección que realizar antes?
    Atte,
    Erik

    Reply
  9. Sepp Meier

    d:\patchpae2\PatchPae2.exe -type kernel -o ntoskrnx.exe ntoskrnl.exe

    Sorry, at the first command I get “Unable to copy file: access denied” (Win 8.1 pro)
    Of course I started the cmd as administrator.
    Only the TrustedInstaller has the right to write.

    Reply
  10. Sepp Meier

    The patch works :-)
    But not with an on-board graphic card! I see only pixels on my screen.

    It would be better for testing to change the wait time in the boot menu to 30 seconds to have enough time to select the normal boot if something goes wrong.

    Reply
  11. Caleb

    I can patch but its not giving me the new boot code after I patch So I do not know what to use for: bcdedit /set {12345678-abcd-1234-abcd-123456789abc} kernel ntoskrnx.exe

    How would I get the new boot code if this one does not give on patch & or the winload.exe patch?
    Running windows 7 ultimate Sp1 on an AMD FX-8350 8 core 4.00 GHz with 8 gig ram 1TB HD.

    Reply
  12. Shenzie

    Patch works great…with one small problem: When the PC starts, sound almost always has various patterns of static and/or hash. (Rarely, sound starts w/o this.) Resetting Windows Audi Service one or more times (not consistent) clears it—the hash pattern changes with every service reset. AudioSrv.dll is byte-for-byte identical to correct MS version.

    This is 8 GB on Win7 Home Premium—all other programs and functions work perfectly.

    Any advice on how to solve the audio problem?

    Shenzie

    Reply
  13. miken

    I’m seeing some folks talked about how they got stuck in a loop when they rebooted their machine after successfully installing the patch. I had the same problem. Never got it to work. I would get the blue screen with an error saying KMODE_EXCEPTION_NOT_HANDLED. Eventually, I would get lucky and have a chance to choose to start the non patch windows. Anyone have luck resolving this?

    Reply
  14. Terry

    It would seem that the patch can be affected by video drivers. It did not work using intel HD onboard graphics, neither did it work with a new Nvidia GEForce 610 card using the supplied video driver. It would work however using basic 640×480 VGA mode driver.

    I got the patch to work perfectly by installing an older 2 year old GEForce 610 driver from another computer running Windows 7 for which the patch worked perfectly.

    The recent update to Windows 8.1 (April 8) did not cause any problems.

    Reply
  15. Pingback: サバンナ速報 » 【超速報】Windows XP(32bit)でメモリー4GBの壁が突破される【PAE】

  16. PaVink

    Unfortunately, for me the patch stopped working after installing the 8.1 Update. :-)

    I had disabled/removed the patch before applying the 8.1 upgrade (just to be sure), then applied it again after the upgrade. When booting, I get a windows error (Windows 8-style blue screen) related to the video driver and the system freezes at that point.

    I then downloaded the latest video drivers (nVidia GeForce), but that that doesn’t make any difference.

    Too bad – I did like my 1 GB of extra memory! Anybody seeing same/similar issues …?

    Reply
  17. Terry

    Hi PaVink, it may be worthwhile finding and installing older nvidia drivers, and see if the patch then works.
    The Nvidia website has some older drivers.

    If the patch works in safe mode, or when the Nvidia drivers are uninstalled and you use a standard VGA display, then it confirms a driver problem.

    If you go through the comments on the Windows 7 page, (wj32 gives a link at the top of this page), the common failure theme is video drivers.

    Reply
  18. Pingback: サバンナ速報 » 【超速報】Windows XP(32bit)でメモリー4GBの壁が突破される【PAE】★2

  19. devDark

    Hi.
    After applying this patch to the new kernel ntkrnlpa.exe version 6.1.7601.18247 (win7sp1_gdr.130828-1532) Windows 7 after booting with the modified kernel goes to pseudo cyclo rebooting, specifically continuously displays shutdowning.
    But this patch still works fine with the old kernel ntkrnlpa.exe version 6.1.7601.17514 (win7sp1_rtm.101119-1850) without any problems.

    Files are attached to this post.
    https://drive.google.com/folderview?id=0B0lhbwujz_6AOHJWY2ZHbVUxeVU&usp=sharing
    https://www.virustotal.com/ru/file/7a68f8c22255496d6153fde0b31b6f5917fb373a1afdffa0aa7b5105db375174/analysis/1398712540/
    https://www.virustotal.com/ru/file/e2fabd65e41c7dbc66ae6c191ad80dfd515b2f72f011a7a6a74019e8aa2e6ae7/analysis/1398714041/
    https://www.virustotal.com/ru/file/a9b7a8c65da08f88953cf412b167f11f8a120dfbece9c7d37fe24bbaf74dc32e/analysis/1398715099/

    Reply
      1. dimapvdevDark

        Yes, above are attached link to the older version of patched and successful worked kernel, but this kernel was used with the older Nvidia driver, so I believe that this problem isn’t in the kernel, this is more like a bugs in the latest GPU drivers such as Nvidia / Intel.

        Reply
  20. Jeff

    hi, can you please confirm this still works with win8.1 UPDATE 1, it was going fine for me until 1 day I got a bsod, so I was wondering if it had to be updated to make sure nothing changed in UPDATE 1, I wonder if the kernel version changed?!

    Reply
  21. Terry

    The patch works ok for me with Win8.1 + update 1 and “old” Nvidia drivers but if you have automatic updates set then your system may download and install updated video drivers which may be the cause of the problem.

    Reply
    1. Jeff

      thanks for the update, I only use AMD, nothing Nvidia in my system, but possibly updates overrode the patched kernel

      Reply
  22. Tpfumefx

    Does this patch work only for ms windows, or along with practical apps like 3dsmax photoshop etc… I mean can other applications other than windows make the use of more than 4gb Like computer graphics apps for exemple?

    Reply
    1. Achraf52

      Not really, any given application can only use maximum 4GB using this trick, because pointer address sizes are still 4 bytes long (not 8 bytes like in Windows 64 bit versions) which means a program like Adobe Photoshop can only access a maximum of 4.2 Billion memory addresses, even though there’s more left unused and can be assigned by Windows to other applications.
      If you have 8GB and you use PAE then you can run Adobe Photoshop for example and use 4GB maximum and Adobe Illustrator and use the rest (roughly 3GB) at the same time.

      Reply
  23. Gabriel

    I have applied the patch on a Windows 7 Ultimate SP1, but I cannot find a “PAE compatible” nVidia driver (I have a Quadro FX 580). Lots of artifacts and after a while BSODs appear (when using modified kernel), related to graphics drivers. I have read some were lucky with older nVidia drivers…so I would like to know which driver versions are confirmed to work perfectly while in PAE-enabled kernel mode. Thank you very much in advance, GABRIEL.

    Reply
  24. Terry

    You will probably need to go to the Nvidia website, driver downloads page, click on ‘Beta and Older Drivers’ put your Quadro FX 580 details into the boxes and click Search.

    http://www.nvidia.com/Download/index.aspx

    They appear to have Beta drivers for your card going back as far as 2009.
    You could try these and see if the patch works.

    It will be very much trial and error.

    In my case I found the driver for the GE Force GT610, dated 2/10/2012 version 9.18.13.697 which I already had for an older version of GT610, worked OK, whereas the newer version which came on the disk with a new video card was dated sometime in 2013 didn’t work.

    Reply
  25. josrob21

    hola se ve interesante el programa pero nose como utilizarlo no habló inglesh y por eso no lo entiendo nose si puden hacer un videoguia porfavor para W7 y W8 lo se agradeceria porfavor mucho lo necesito urgente.

    in engles

    hello program looks interesting but nose how to use Inglesh not speak and so do not get nose if puden videoguide please make a W7 and W8 to know much appreciate please I need urgent.

    Reply
  26. jacob

    I cant get past step 3, with typing the cmd code: C:\WherePatchPaeIs\PatchPae2.exe -type kernel -o ntoskrnx.exe ntoskrnl.exe. –It keeps saying “The system cannot find the path specified”. What am I doing wrong?

    Reply
    1. Terry

      You don’t actually type ‘WherePatchPaeIs’, instead of that you type the directory where you put PatchPae2.exe.
      I assume that is why the system cannot find the path specified, but excuse me if I am wrong :)

      In my case I put it in C:\Windows\System32, but you could put it anywhere, as long as it isn’t in a place where it could get deleted, such as a temporary folder.

      Reply
  27. PaVink

    I previously reported that after upgrading to Win 8.1, the patch stopped working for me (pc would not boot). I finally got around to seek and download some older video drivers (nVidia, release 331.82 from November 2013), and now all is fine again. Windows 8.1 + PatchPae2 working great.

    Again, thank you for making this available!

    Reply
  28. PaVink

    If you don’t understand the instructions, you are probably not the right person to even attempt this… Better keep a good backup handy! :-)

    Reply
  29. StGreg

    After recent update of Win7Sp1 this patch is no longer working. System cannot boot with old patched files due to “winloadp.exe is corrupted. Also, when i started OS with normal kernel & loader and tried to patch it again i get “Failed” when patching loader. ;/

    Reply
    1. Giangi

      http://wj32.org/wp/2011/02/23/pae-patch-updated-for-windows-7-sp1/#comment-3253

      I had the same today after appling them… I have noticed that both ntkrnlpa.exe and winload.exe have been updated (mine are 6.1.7601.22736).
      The first was patched correctly but winload not; the PatchPae2 output is “Failed.”
      I think the offending one is http://support.microsoft.com/kb/2949927 (Availability of SHA-2 hashing algorithm) because it updates both files! I’ll remove it asap…

      Reply
  30. Al

    Patch doesnt work with latest nvidia drivers, you get only reboot loop or bsod. Need old nvidia driver. However, this does not make sense, requiring older nvidia drivers unfit to W 8.1 Update 1
    Please update the patch!

    Reply
  31. gcalzo

    MS has officially removed the KB294927!!!

    https://technet.microsoft.com/en-us/library/security/2949927.aspx
    Revisions
    •V1.0 (October 14, 2014): Advisory published.
    •V2.0 (October 17, 2014): Removed Download Center links for Microsoft security update 2949927. Microsoft recommends that customers experiencing issues uninstall this update. Microsoft is investigating behavior associated with this update, and will update the advisory when more information becomes available.

    Reply
  32. Terry

    The patch works with Win 8.1 update 1, and may well work with an Intel graphics card, but you would need to try installing the patch to find out if it does.
    It appears to be Intel HD onboard graphics that causes conflicts in the memory above 4GB.

    Reply
  33. Dragos

    Thanks for replying Terry, I did tried it but had no success with it. It may be because of the integrated graphics .. I will try another driver as now I use a modified version of the Intel driver.

    I’ll post back if this works.

    Reply
    1. Marinescu Ionuț-Dragoș

      I did try another Intel driver version but to no avail, now I’m using an old ATI card and it is working on the latest 8.1 release (downloaded from MS a few days ago).

      There is one update for Windows kernel (KB3035131) that I did not install yet.

      Reply
      1. DeMoN

        (KB3035131) does break this patch on WIndows 7. unfortunately, Im on a domain with a very persistent WSUS server and matching GP. Does anyone know a way to block a specific update from the registry? the “hide update” is greyed out.

        Reply
  34. Dragos

    Well, I’ve tried another version (ie the Windows Update one, as I don’t have that many options to choose for the GMA X4500) and I cannot boot to desktop because Windows starts in autorecovery mode … I’ve disabled that and it seems that this driver doesn’t work because I get no video after the Windows logo … it stays at a blank screen (monitor turns off ) for a minute or so then reboots.

    I’ll give it another go after I get a dedicated video card and I’ll post back :)

    If you’re using Windows 8.1 update 1 and have this graphics card and the patched worked for you, please let me know by commenting here, thanks.

    Reply
  35. Dragos

    Haha Terry, I doubt that would help my case. My system has only 4GB of RAM so this patch would have proved efficient to my setup.

    If I switch to x64 it will be pointless cause from I’ve gathered, the x64 version will actually use more RAM, for example some folks were talking about x64 taking about 1.2/4 GB of RAM at idle, while the x86 takes around 6/700MB.

    From my own conclusion I would suspect that to be true, because for an x86 app. to run on x64, there will be 2 instances in RAM? …

    Anyway I will have tot test this out for sure.

    Reply
  36. Pietia

    Can anyone help me ? I recently installed win7 32 professional and wanted to use this hack , I upgraded my system thought windows update so my winloadp is 6.1.7601.17514 and my ntkrnl is 6.1.7601.18409 I booted into pae patched kernel but there were 2 BSOD’s my laptop is acer v3 771G and here are .dmp files:
    http://www.filedropper.com/dumps
    caused by ntfs.sys and ntkrnlpx.exe
    Thank you very much :-)

    Reply
  37. Pingback: 32비트 윈도(Vista/7/8/8.1) 에서 4G 이상 메모리 사용하기 | 커피한잔의 여유와 코딩

  38. Terry

    After installing the latest Microsoft updates for Windows 8.1 (being careful not to accept the Nvidia video update), the computer would not boot using the patched kernel, and got the message ‘critical process died’ so I deleted patchpae using the boot option in msconfig.

    When I get time I’ll investigate further and report back if PatchPae is successfully re-installed.

    Reply
  39. Terry

    I should have re-read the text file that came with the patch and re-run step 3 after Windows Update :)

    Re-patching the kernel restored enabling more than 4GB ram.

    Reply
  40. Garbo

    Works perfectly for me. Windows 7 Ultimate 32 bits up-to-date, KB2949927 removed, 16 GB RAM and ATI Radeon graphic card. Many thanks!!

    Reply
  41. CpServiceSpb

    Hi anybody.
    Can somebody post “live” links to “magic” Barton88 intel video drivers which should allow to use intel hd (1st/2nd generation) with Windows 7/8 x32 (32-bit) and with 4+ Gb RAM patch ?

    Reply
  42. Keith Fukumoto

    Wow, this patch rocks. So simple to apply and it WORKS. (Just copy and paste from the “read me” text file so little room for error.) The only “problem”, if you can call it that, is one of the two patches kept prompting windows to repair itself. (Deleted that patch since repair wasn’t successful.) The only thing that could be improved is being able to copy and paste the long { } string. I’ll know how much more improvement I’ve gained once my 8GB ram chips arrive. But for now, things seem to run faster than before.

    Keithhf

    Reply
      1. Keith Fukumoto

        Ah, thanks for the hint. The 8GB ram chips arrived. Windows 7 shows 8GB installed but only 3GB available. Regardless of what Windows 7 says, however, my laptop is running so much faster. So this may be a matter of not looking a gift horse in the mouth and just accepting the excellent results. Thanks again.

        Reply
        1. Terry

          If Properties page says that only 3GB is available, then it means the patch has not been applied. It should just say “Installed memory (RAM): 8.00 GB”

          It may pay you to go through the procedure again.

          Reply
  43. Terry

    Keith, I would carefully go through the steps again for Windows 7, being sure you don’t inadvertently use any Windows 8 only instructions. I’d suggest you put PatchPae2.exe into C:\Windows\System32\, and that is what you type where it says “C:\WherePatchPaeis\”, ie the path to where you put PatchPae2.exe.

    The re-typed commands will overwrite any you have already made.

    One or two people have thought that you type “WherePatchPaeis” :)

    It is easy to make a mistake in typing out the commands, copying the string to the clipboard at step 5 is a great help as it has to be entered a few times.

    If you get it right, then either the patch will work and you will get the full 8GB…hurrah…, or it wont :( and your computer may hang or get a black screen.

    If it hangs try restarting in safe mode and remove the patch via msconfig as it describes in the readme file.

    If it doesn’t work then there is probably some hardware conflict or a device trying to write into the memory space above 4GB. Have a read through the comments.

    Reply
    1. keith fukumoto

      Thanks again, will repeat step. Patch is in Windows\system 32 already. For whatever reason, the addition of another 4GB of RAM and your patch does seem to make my laptop a lot snappier. Dell e4300, 64GB SATA 3, SSD and 300GB SATA 3, HDD. Windows 7 SP1, OEM version. No BSODs in any event.

      Reply
  44. Pingback: サバンナ速報 » 【悲報】Win XP(32bit)でメモリー4GB以上認識させるパッチが開発されたが、あまり有名にならず

  45. Garbo

    Unfortunately, the last Microsoft updates (march 2015) broke this excellent patch :-( It’s not possible to apply it anymore, it fails when applying the loader part… Too bad !

    Reply
    1. Garbo

      Well, removing the update KB3033929 does the trick for me (this patch updates the kernel for SHA-2 code signing support).

      Reply
        1. Marinescu Ionuț-Dragoș

          If Windows reinstall the update automatically, you need to set Windows Updates to notify you before installing updates instead of automatically installing them.

          To do this follow these steps:

          Control Panel > System and Security > Windows Update : Change Settings (upper left) then select either:

          Never check for updates (and you will have to manually do this once in a while, like once or twice a month)
          or
          Check for updates but let me choose whether to download and install

          Reply
        1. Marinescu Ionuț-Dragoș

          This patch doesn’t replace the files, instead it copies them and patches the copies, then ads a new boot entry pointing to the patched files.

          You should re-read what this patch does and try to understand how it works before continuing.

          Reply
          1. Garbo

            I suggest you read my previous contributions before replying to my posts…

            I know what this patch does and I applied it successfully several times. My last question wasn’t about the patch itself but the patched versions of the kernel files (see above : http://rghost.net/58547303).

  46. Marinescu Ionuț-Dragoș

    Does anyone have a batch file to automate this patch ?

    Thanks

    I’ve tried to use this:

    TITLE RAM Patch for Windows 8.1 32-bit (PatchPAE2)
    color E0
    copy “%~dp0PatchPae2.exe” “%Windir%\system32\patchpae2.exe”
    echo.
    %systemdrive%
    cd\
    cd %Windir%\system32
    PatchPae2.exe -type kernel -o ntoskrnx.exe ntoskrnl.exe
    PatchPae2.exe -type loader -o winloadp.exe winload.exe
    echo.
    bcdedit /copy {current} /d “Windows 8.1 (PAE Patch)”
    echo.
    bcdedit /set description “Windows 8.1 (PAE Patched)”
    bcdedit /default {current}
    bcdedit /set {current} kernel ntoskrnx.exe
    bcdedit /set {current} path \Windows\system32\winloadp.exe
    bcdedit /set {current} nointegritychecks 1
    bcdedit /set {bootmgr} timeout 10
    del %Windir%\system32\patchpae2.exe
    echo.
    echo Done
    echo.
    echo RESTART PC!
    pause > nul

    But I get :
    “An error occurred while attempting to reference the specified entry”

    This reffers to the {current} part of the code …

    Reply
    1. Marinescu Ionuț-Dragoș

      Nevermind, I figured it out, so for Windows 8.1 this batch works:

      @echo off
      TITLE RAM Patch for Windows 8 32-bit (PatchPAE2)
      color A0
      ECHO.
      ECHO.PatchPae (v2) by wj32.
      ECHO.Tested on: Windows Vista SP2, 7 SP0, 7 SP1, 8, 8.1
      ECHO.
      copy PatchPae2.exe “%Windir%\system32\patchpae2.exe”
      %systemdrive%
      cd\
      cd %Windir%\system32
      ECHO.
      PatchPae2.exe -type kernel -o ntoskrnx.exe ntoskrnl.exe
      ECHO.
      PatchPae2.exe -type loader -o winloadp.exe winload.exe
      ECHO.
      bcdedit /copy {current} /d “Windows 8.1 BAK”
      ECHO.
      bcdedit /set {current} kernel ntoskrnx.exe
      ECHO.
      bcdedit /set {current} path \Windows\system32\winloadp.exe
      ECHO.
      bcdedit /set {current} nointegritychecks 1
      bcdedit /set {bootmgr} default {current}
      REM bcdedit /set {bootmgr} timeout 1

      pause > nul

      Make sure you have PatchPae2.exe in the same directory as this script.

      Reply
  47. Chavez Clemons Jr.

    From @john_doe

    “here is patched winload and kernel for win7sp1 october 15 update

    http://rghost.net/58547303”

    Use this for March 2015 update. Got me back to a full 8GB of ram and full updates. I have an ATI HD5650.

    Use the patch above and replace the files either using the Recovery Console, a Windows Recovery Disk, or booting into the non-patched Windows Kernel (you should have two boot entries: one with your non-patched kernel and one with the patched one).

    Reply
  48. Jhon

    we have removed KB3033929 update and successful patched system without effect :(
    usable memory from 6 gb memory is still 2.64 GB

    Reply
  49. Alexander S.

    This winloadp.exe did indeed work out for my Win7 SP1 with KB3033929 installed:
    http://rghost.net/58547303

    I first had to boot the unpatched Windows a few times, until the update was installed. Then i replaced the old winloadp.exe with the version above. And then patched ntkrnlpa.exe a second time (dont know if this is really necessary)

    Reply
  50. Boris

    Winload 6.1.7601.18649 failed to patch. I patched it manually, with help from PatchPae2 source and pdb symbols:
    00000130: 44 B2
    000282AE: 7D EB

    Reply
        1. Yury

          please don’t forget to save patched winload.exe. as winloadp.exe to the “%Windir%\system32\” directory, everything else will be done by Patchpae2 patcher. Hope that it’s author will release a PatchPae3 soon, with minor changes for winload.exe patching and some automation (as a batch file for Windows 7 32-bit in this archive http://rghost.ru/6HZbtkfj8)

          Reply
  51. istin

    winload.exe ver 6.1.7601.18649 failed to patch, windows7 could not boot (patched) after a recent windows update (I do not know which one)

    Reply
    1. Mike

      KB3045685 and KB3045999, both published on 4/14/2015 as part of MS15-038 broke the existing PAE patch (done manually a few years ago) on my Windows 7 computer resulting in BSOD errors on boot. Uninstalling these hotfixes fixed the PAE problem. Now I just have to add this to the Nvidia driver as something I can’t update for the foreseeable future.

      Reply
  52. PaVink

    This patch has always worked and is still working on my fully updated 8.1 system.
    Just follow the instructions provided. Of course, if you have no idea what is happening here, you probably should not even attempt this!

    Reply
  53. DeMoN

    (KB3035131) breaks this patch and trying to re-patch fails the winload step. This is with current Nvidia Drivers if it matters. If you are having issues, try to uninstall this recent patch (i think it said it was published 4/10/2015 so not very old. If anyone finds a work around besides uninstalling this patch. I’m on a corporate domain with a very persistent WSUS server and i have no way to permanently keep this update away…

    Reply
    1. DeMoN

      doing it the old fashioned way with a hex editor also does not end well. the 7C11 8B45 & 7C10 8B45 flags are still there, but the rest of the string is significantly different. It still signs and It all looks well and good though until you get to windows. Windows boots slowly, shows even less available ram, and does not “have enough free memory to open” ANYthing… even notepad…

      Reply
  54. Pingback: Техническая не для профессоров - Форумы otstrel.ru

  55. alexio

    I used this for the win8 install of my dual boot win8/vista, which win8 manages with its boot loader. It got stuck in a repair loop, I fixed the bmr with a live cd. I do have nvidea drivers for a 5 year old nvidea card. Can someone with a working install provide a list of updates I have to remove?

    Reply
  56. theclubpenguineherald

    The third step fails ..
    Some windows updates got installed overnight..
    Cannot boot onto the the patched version anymore.
    I have tried Patching it again ..
    but it fails at the the below step

    PatchPae2.exe -type loader -o winloadp.exe winload.exe

    An error is displayed as “failed”..

    Please help.

    Thanks,
    Harry

    Reply
  57. Frank Shashaty

    Dear Mr. Liu,

    First, Thank You for providing the patch; it works perfectly on our 7 and 8x systems.

    We are planning to upgrade to windows 10 in the near future and we assume the new OS will change/upgrade the kernel. Is that correct?

    If yes, can we use the patch on the windows 10 OS?

    If not, will you be releasing a windows 10 version?

    Many thanks again for your service.

    Reply
  58. Rikky Citra

    hi, does the patch support windows 10 32bit? can you update the patch to support windows 10 32bit? my machine has problems with 64bit so i have to use 32bit windows 10. but i have more than 3GB Ram.
    Thank you

    Reply
  59. evgeny

    patchpae2 modified xttp://rutracker.org/forum/viewtopic.php?t=4694409
    for Windows XP, 2003, Vista, 2008, 7 (supports KB3035131), 8/8.1, 10
    with GUI (russian only, sorry), balalaika, vodka and bear.

    Reply
  60. mudakun

    Trouble with bcdedit /copy {current} /d “Windows7Patched” ???
    A DESCRIPTION FOR THE NEW ENTRY MUST BE SPECIFIED….

    Using real double quotes in ascii, not some weird variant you got by cutting and pasting from a blog page.
    Copy the lines into notepad, go over the { ” ] quotes with fresh ones try again..

    I think some web publishing blog engines try to pretty up the double quote by turning it
    into the leading and inverted ones in pairs.

    After they were excised and replaced with real ones, it worked like a charm! Many thanks
    Pavilion DV2412ca 4gb ram installed Windows 7 ultimate N, SP1 clean install.

    Reply
  61. Gabriel

    The patches above for Windows 10 are infected, says Windows Defender. I really hope an official one release soon.

    Reply
    1. evgeny

      Yes. Windows Defender already know that fix128 patched windows kernel and loader. I really hope you understand micro$oft politic for software activated or patched Windows. Windows Defender must delete it, of course. NOD32, Kaspersky, Avast, Avira, DrWeb, McAfee no says infected. fix128 is 7zip-sfx, it packed with upack. there are patchpae2 modified to support new windows and vbs-script for GUI in sfx archive.

      Reply
  62. evgeny

    Deleted patch is beta-version fix128. You may read the thread before write.
    If f*ck_ng Kaspersky blocked the file, you may add the item to exception list.
    A can release new version of fix128? but in some days some antivirus delete it. Sooner or later. Welcome to Windows-10 Era!
    If you want to use fix128, you will find method to download it. If you don’t, you may f*c_k my mind and your mind and all minds around.
    Opening ZIP in my Windows 8.1 in Explorer do not starts program.

    CLI version only: http://rghost.ru/8KFT4tSJw
    Support thread: http://rutracker.org/forum/viewtopic.php?t=4694409

    Reply
    1. Neal

      In case it needs repeating: the links by evgeny above, supposedly to a Win10 PAE patch, ARE INFECTED WITH A TROJAN. DO NOT USE THEM. 32 separate malware scanners confirm it.

      Here’s hoping a real Win10 PAE patch arrives soon

      Reply
  63. Neal

    Don’t be coy. Any scanner you run on it will tell you it’s a trojan — Microsoft shows it as Trojan:Win32/Skeeyah.A!bit.

    Reply
    1. evgeny

      > CLI version only: http://rghost.ru/8KFT4tSJw
      https://www.virustotal.com/ru/file/cca573bc2ae8dab289f569a54c616a955fc90a2cdc106269eca78aa36d7f555d/analysis/1440134892/
      > In case it needs repeating…
      Are u p*ranoi_d? 0/56, Karl.

      new patchpae is included in 7-zip SFX irchive in fix128, that was packed with upack. I already wrote this, no secrets.
      You can extract Visual Basic Script file of GUI from SFX archive and read it in notepad.
      Where are malware?

      Reply
    2. evgeny

      If some s_t*pid antimalware see upack or VBS, will be false alarm. All small malware scanners buy single antivirus base from larger antivirus developers.

      https://www.virustotal.com/ru/file/23bd6be9d26e9a9ba5e2e51a74da394c57e981673e9d15289b9803e2e914f5b1/analysis/1439241706/
      upack, Trojan.Win32.Packer.Upack0.3.9 (ep), HW32.Packed.90A4, Trj/Pupack.A, Cryp_Xed-12
      See you word “upack”? IT IS UPACK. It is crypt packer i use.
      VBS:VBS.Trojan.Alal!35714
      See you word “VBS”? IT IS GUI.

      Reply
    3. evgeny

      What problem? Run 7-zip archiver and extract all files from fix128.
      Open ntk128gb.vbs from SFX in notepad. Then show me line in open source code with malware.
      You can say bla-bla-bla only, NO FACTS.
      You say Trojan:*. What do this trojan? What files it damage, what process it run, what about network activity? Nothing! It’s false alarm. There is no malware. Never.

      Reply
  64. Neal

    So, you say I should trust your code. Let’s have a look.

    Chrome and IE refuse to download it, because of the trojan alert. Using wget, I can retrieve the file; again the scanner detects the trojan and deletes the .exe from inside the zip. Disabling that, 7zip then refuses to unzip the enclosed .exe, because it too detects the trojan.

    Shutting down all scans, I finally uncompress everything. Here’s what I get:

    6 DLL’s, all of which begin with HAL.
    31 SYS files, 27 of which begin with USB, and the rest with HID.
    A handful of other files and directories — 4 EXE’s, and directories named 2003 and 2008__.

    And: your VBS file — 8100+ lines of code, a thousand of which are in Russian.

    You *must* be joking me.

    Reply
    1. evgeny

      Ok. 31 *.sys files.

      They are in ZIP 2003\SYSTEM32\drivers\ directory (not SFX!).
      Windows XP has some troubles with USB 2.0 in PAE-mode. This drivers from server 2003 for replace XP drivers when fix128 installed on XP. After uninstall fix128 on XP, it replace with original backup XP files. You can read http://www.overclock.net/t/77229/windows-xp-ram-limit/50 for more information about usbvideo.sys, usbstor.sys, etc. Heh, you say Server 2003 is malware. You are joking too.

      Similar to 2008\SYSTEM32\drivers\ directory. But 2008 is renamed to ___2008 and is not used. I found some windows-7 with beta-SP1 systems needing replacement of original usb2 drivers too. it’s experimental future and in russian manual it isn’t recommended (and 2008 is renamed to ___2008). This *.sys files from… Server 2008. You just say Server 2008 is malware. Great.

      at installation the fix128 copies files from 2003|2008 automatically in windows.

      next, 6 DLL…

      Reply
    2. evgeny

      continue… 6 DLLs
      When you patch Windows XP, you need to patch HAL. And modified patchpae2 can do it.
      Another way is to copy HAL DLL from XP SP1, wich supports more then 4 Gb of memory.
      http://www.overclock.net/t/77229/windows-xp-ram-limit/60#post_22142268. I tested this method, but it’s not working with my system. And it isn’t recommended in russian manual. This method activated only if you run fix128.exe with +XPSP1HAL key in command line.
      6 DLL’s in xpsp1hal directory, all of which begin with HAL is HAL drivers from XP SP1. And you just say Windows XP SP1 is malware. You are more joking.

      Reply
    3. evgeny

      continue, 4 *.exe

      There is 2 way to load patched (i.e. with damaged signature) kernel. 1 – you can patch loader to disable signature verification (PatchPae2.exe -type loader …). 2 – original method by Geoff Chappell based on test-signing. http://www.geoffchappell.com/notes/windows/license/memory.htm And fix128.exe has key +TestCert to use this method. You need some utils from Visual Studio for 2nd method: makecert.exe, certmgr.exe and signtool.exe. It is in utils directory of SFX archive. You just say Visual Studio is malware. You are more and more by more joking.

      Reply
    4. evgeny

      Oh! We lost 1 *.exe in SFX archive : utils\PatchPae2.exe

      It is modified patch with support for win xp, win 7 with KB3033929, win 10, serv 2003.
      I posted links for this file and virustotal earlier. 0/56. no malware.

      Reply
    5. evgeny

      I need to have a rest a little…
      I will explain 8100+ lines of VBS code later=)

      summing up the result. 6 files + 31 files + 4 files = 41 files. Neal, you are alarmist of 0x29h Level. Panic-monster.

      Reply
      1. Achmed

        Maybe something on the download server modified your zip – this would explain the start of a program while extracting it…

        Reply
  65. Terry

    evgeny,

    I used your patchpae2 to patch Windows 10 32 bit Home Edition.
    Very successful, no trojans, repeat no trojans :)

    I am using an old Nvidia graphics driver as newer ones caused problems when patching Windows 7 and 8.1 with wj32’s patch. That is a problem in itself, Windows 10 has to be set so that it doesn’t automatically install the latest drivers. :(

    Next test will be to see if up to date video drivers will work, though I am not too hopeful.

    Many thanks

    Reply
  66. Gecata

    So… patch v.039 working fine and smooth. After few days of test and experiments i can say it’s GREAT and WORKING ! So i made and test this scenario:

    1. Make virtual machine KVM on CentOs 7.1 Linux and patched Windows 10 Enterprise 32bit-10240RTM
    2. Make full machine backup with EaseUs ToDo Backup 6.1
    3. Restored backup to VmWare virtual machine on Windows 8.1
    4. Restored backup on VirtualBox machine on Windows 7 32 bit
    5. Restored machine on bare metal

    Patch is there all the time and work great, even different video drivers on different VM’s.
    Today tested patched machine with 7 all day connected user over RDP /thinstation clients/ and it working fine and stable!

    Many thanks to evgeny for great work and sharing knowledge!

    Reply
  67. Gabriel

    However, I still can’t trust it, until reasonable explanation why ALL of the used software says it is infected. There’s obviously something in the code, which is causing it. C’mon man, just reveal it and we’ll use your patch.

    Reply
  68. Luciano

    evgeny, why not simply uploading the _source code_ of PatchPae2 CLI, enhanced for Windows 10 too? The code is well structured, well documented for all supported different kernel versions.

    Then, you could also simply use the old plain safe .zip format instead of SFX if you don’t have nothing to hide…

    Reply
    1. evgeny

      What problem?
      You may download 7zip
      You may download fix128.exe from link above
      You can open sfx-archive fix128.exe by 7zip.
      You can extract the file fix128.exe\utils\main.c with _source code_ of PatchPae2 CLI, enhanced for Windows 10
      You can extract the file fix128.exe\utils\PatchPae2.exe CLI binary, enhanced for Windows 10, which I uploaded above
      You can extract the file fix128.exe\ntk128gb.vbs with _source code_ of GUI
      I could encrypt VBS, archive, etc, but I didn’t.
      You may read all, but you didn’t.
      Why?
      You are f_ck*ng Writer, not reader.
      Why are you can’t read the _source code_? You have not a notepad? Are you banned on 7zip download page? Maybe you’re too lazy?
      What problem?
      The _source code_ always was here.

      Reply
      1. Gabriel

        Well, if you keep answering like this and you keep insisting to us to download your file without any explanation why, then trust me, no one’s going to do it. Your comments are now becoming a spam without a purpose. If you really want to help, then do it. EXPLAIN. Give us a reason. So we can believe that 99% of anti-malicious software is wrong. Don’t expect anyone to read 8100+ lines of code. Or simply make a clean new patch when you know what is causing it.

        Reply

Leave a Reply