# PAE patch updated for Windows 8.1

This patch allows you to use more than 3/4GB of RAM on an x86 Windows system. Works on Windows Vista SP2, Windows 7 SP0, Windows 7 SP1, Windows 8 and Windows 8.1. Instructions and source code included.

Before using this patch, make sure you have fully removed any other “RAM patches” you may have used. This patch does NOT enable test signing mode and does NOT add any watermarks.

Note: I do not offer any support for this. If this did not work for you, either:

• You cannot follow instructions correctly, or

## 162 thoughts on “PAE patch updated for Windows 8.1”

1. Bruce

I was usiing Patchpae2 fine on windows 8.1. Now I have upgraded to windows 10 and the program will not work anymore – say “wrong kernel level”. Will there be an update – or another way to use more that 2.75 GB on a 32 bit system?

1. P Sv Rns Srikanth

Thank you so much for this updated Patch for Windows 8.1. I am eagerly waiting for this. 100% works on Windows 8.1 (32-bits(X86)) all versions

2. alex

it wont boot after:

@echo off
TITLE …::: Win8 32-bit Unlocker Script :::… by: Wiwi-maX
color 30
echo Script use PatchPae v2.
cd %Windir%\system32

C:\PatchPae2\PatchPae2.exe -type kernel -o ntoskrnx.exe ntoskrnl.exe
echo.
bcdedit /copy {current} /d “Windows 8 (Unlocked)”
echo.
echo.
bcdedit /set {current} kernel ntoskrnx.exe
bcdedit /set {current} nointegritychecks 1
bcdedit /default {current}
bcdedit /set {bootmgr} timeout 2

shutdown.exe -r -f -t 5 -c “RAM 2GB’s Limit Removed.”

1. pao

can you teach me the step 5? “what should i put after /set? should i put “{current}”?

3. Andre

Works great – thank you so much!

After getting the new boot entry like {12345678-abcd-1234-abcd-123456789abc},
For example:
bcdedit /set {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} kernel ntoskrnx.exe
becomes
bcdedit /set {12345678-abcd-1234-abcd-123456789abc} kernel ntoskrnx.exe
Then work with copy&paste to insert 100% correct commands to your Command prompt window.

4. slalalavka

C:\Windows\System32>C:\WherePatchPaeIs\PatchPae2.exe -type kernel -o ntoskrnx.ex
e ntoskrnl.exe
Unsupported kernel version.

5. Jackson

I had the boot loop as well on 8.1. I just let it keep rebooting, eventually it worked after maybe 7 or 8 attempts. I made the mistake of having updates pending on the reboot. Thought that’s why it might have given problems. Seems fine now.

6. DavidB

Thank you very much.

But disabling the integrity checks is a stability and security risk.
Is there any way to patch the ntkrnlpa.exe/ntoskrnl.exe file so the digital signature would check out ok…?

Best regards, DavidB

7. PaVink

Thank you so much, Wen Jia!
Installation was simple and straightforward.

I had dug up a similar patch (albeit way more complicated than this one!) under Win 7, and I hated going back to 3-something GB under Win 8 when I switched over. I am so happy being back at 4 GB now. Great job – thank you for your efforts and proving (once again) that all the Microsoft language about the 4GB limitation is just bullshit.

8. Erik

Hola, probé el script en 8.1, y todo se ejecutó perfecto, pero al reiniciar empezó a dar pantallazos -como de incompatibilidad de driver o resolución de video- y apareció la linda pantalla azul de volcado de memoria. Alguién sabe si hay alguna corrección que realizar antes?
Atte,
Erik

9. Sepp Meier

d:\patchpae2\PatchPae2.exe -type kernel -o ntoskrnx.exe ntoskrnl.exe

Sorry, at the first command I get “Unable to copy file: access denied” (Win 8.1 pro)
Of course I started the cmd as administrator.
Only the TrustedInstaller has the right to write.

10. Sepp Meier

The patch works
But not with an on-board graphic card! I see only pixels on my screen.

It would be better for testing to change the wait time in the boot menu to 30 seconds to have enough time to select the normal boot if something goes wrong.

11. Caleb

I can patch but its not giving me the new boot code after I patch So I do not know what to use for: bcdedit /set {12345678-abcd-1234-abcd-123456789abc} kernel ntoskrnx.exe

How would I get the new boot code if this one does not give on patch & or the winload.exe patch?
Running windows 7 ultimate Sp1 on an AMD FX-8350 8 core 4.00 GHz with 8 gig ram 1TB HD.

12. Shenzie

Patch works great…with one small problem: When the PC starts, sound almost always has various patterns of static and/or hash. (Rarely, sound starts w/o this.) Resetting Windows Audi Service one or more times (not consistent) clears it—the hash pattern changes with every service reset. AudioSrv.dll is byte-for-byte identical to correct MS version.

This is 8 GB on Win7 Home Premium—all other programs and functions work perfectly.

Any advice on how to solve the audio problem?

Shenzie

13. miken

I’m seeing some folks talked about how they got stuck in a loop when they rebooted their machine after successfully installing the patch. I had the same problem. Never got it to work. I would get the blue screen with an error saying KMODE_EXCEPTION_NOT_HANDLED. Eventually, I would get lucky and have a chance to choose to start the non patch windows. Anyone have luck resolving this?

14. Terry

It would seem that the patch can be affected by video drivers. It did not work using intel HD onboard graphics, neither did it work with a new Nvidia GEForce 610 card using the supplied video driver. It would work however using basic 640×480 VGA mode driver.

I got the patch to work perfectly by installing an older 2 year old GEForce 610 driver from another computer running Windows 7 for which the patch worked perfectly.

The recent update to Windows 8.1 (April 8) did not cause any problems.

15. PaVink

Unfortunately, for me the patch stopped working after installing the 8.1 Update.

I had disabled/removed the patch before applying the 8.1 upgrade (just to be sure), then applied it again after the upgrade. When booting, I get a windows error (Windows 8-style blue screen) related to the video driver and the system freezes at that point.

I then downloaded the latest video drivers (nVidia GeForce), but that that doesn’t make any difference.

Too bad – I did like my 1 GB of extra memory! Anybody seeing same/similar issues …?

16. Terry

Hi PaVink, it may be worthwhile finding and installing older nvidia drivers, and see if the patch then works.
The Nvidia website has some older drivers.

If the patch works in safe mode, or when the Nvidia drivers are uninstalled and you use a standard VGA display, then it confirms a driver problem.

If you go through the comments on the Windows 7 page, (wj32 gives a link at the top of this page), the common failure theme is video drivers.

17. devDark

Hi.
After applying this patch to the new kernel ntkrnlpa.exe version 6.1.7601.18247 (win7sp1_gdr.130828-1532) Windows 7 after booting with the modified kernel goes to pseudo cyclo rebooting, specifically continuously displays shutdowning.
But this patch still works fine with the old kernel ntkrnlpa.exe version 6.1.7601.17514 (win7sp1_rtm.101119-1850) without any problems.

1. dimapvdevDark

Yes, above are attached link to the older version of patched and successful worked kernel, but this kernel was used with the older Nvidia driver, so I believe that this problem isn’t in the kernel, this is more like a bugs in the latest GPU drivers such as Nvidia / Intel.

18. Jeff

hi, can you please confirm this still works with win8.1 UPDATE 1, it was going fine for me until 1 day I got a bsod, so I was wondering if it had to be updated to make sure nothing changed in UPDATE 1, I wonder if the kernel version changed?!

19. Terry

The patch works ok for me with Win8.1 + update 1 and “old” Nvidia drivers but if you have automatic updates set then your system may download and install updated video drivers which may be the cause of the problem.

1. Jeff

thanks for the update, I only use AMD, nothing Nvidia in my system, but possibly updates overrode the patched kernel

20. Tpfumefx

Does this patch work only for ms windows, or along with practical apps like 3dsmax photoshop etc… I mean can other applications other than windows make the use of more than 4gb Like computer graphics apps for exemple?

1. Achraf52

Not really, any given application can only use maximum 4GB using this trick, because pointer address sizes are still 4 bytes long (not 8 bytes like in Windows 64 bit versions) which means a program like Adobe Photoshop can only access a maximum of 4.2 Billion memory addresses, even though there’s more left unused and can be assigned by Windows to other applications.
If you have 8GB and you use PAE then you can run Adobe Photoshop for example and use 4GB maximum and Adobe Illustrator and use the rest (roughly 3GB) at the same time.

21. Gabriel

I have applied the patch on a Windows 7 Ultimate SP1, but I cannot find a “PAE compatible” nVidia driver (I have a Quadro FX 580). Lots of artifacts and after a while BSODs appear (when using modified kernel), related to graphics drivers. I have read some were lucky with older nVidia drivers…so I would like to know which driver versions are confirmed to work perfectly while in PAE-enabled kernel mode. Thank you very much in advance, GABRIEL.

22. Terry

You will probably need to go to the Nvidia website, driver downloads page, click on ‘Beta and Older Drivers’ put your Quadro FX 580 details into the boxes and click Search.

They appear to have Beta drivers for your card going back as far as 2009.
You could try these and see if the patch works.

It will be very much trial and error.

In my case I found the driver for the GE Force GT610, dated 2/10/2012 version 9.18.13.697 which I already had for an older version of GT610, worked OK, whereas the newer version which came on the disk with a new video card was dated sometime in 2013 didn’t work.

23. josrob21

hola se ve interesante el programa pero nose como utilizarlo no habló inglesh y por eso no lo entiendo nose si puden hacer un videoguia porfavor para W7 y W8 lo se agradeceria porfavor mucho lo necesito urgente.

in engles

hello program looks interesting but nose how to use Inglesh not speak and so do not get nose if puden videoguide please make a W7 and W8 to know much appreciate please I need urgent.

24. jacob

I cant get past step 3, with typing the cmd code: C:\WherePatchPaeIs\PatchPae2.exe -type kernel -o ntoskrnx.exe ntoskrnl.exe. –It keeps saying “The system cannot find the path specified”. What am I doing wrong?

1. Terry

You don’t actually type ‘WherePatchPaeIs’, instead of that you type the directory where you put PatchPae2.exe.
I assume that is why the system cannot find the path specified, but excuse me if I am wrong

In my case I put it in C:\Windows\System32, but you could put it anywhere, as long as it isn’t in a place where it could get deleted, such as a temporary folder.

25. PaVink

I previously reported that after upgrading to Win 8.1, the patch stopped working for me (pc would not boot). I finally got around to seek and download some older video drivers (nVidia, release 331.82 from November 2013), and now all is fine again. Windows 8.1 + PatchPae2 working great.

Again, thank you for making this available!

26. PaVink

If you don’t understand the instructions, you are probably not the right person to even attempt this… Better keep a good backup handy!

27. StGreg

After recent update of Win7Sp1 this patch is no longer working. System cannot boot with old patched files due to “winloadp.exe is corrupted. Also, when i started OS with normal kernel & loader and tried to patch it again i get “Failed” when patching loader. ;/

1. Giangi

http://wj32.org/wp/2011/02/23/pae-patch-updated-for-windows-7-sp1/#comment-3253

I had the same today after appling them… I have noticed that both ntkrnlpa.exe and winload.exe have been updated (mine are 6.1.7601.22736).
The first was patched correctly but winload not; the PatchPae2 output is “Failed.”
I think the offending one is http://support.microsoft.com/kb/2949927 (Availability of SHA-2 hashing algorithm) because it updates both files! I’ll remove it asap…

28. Al

Patch doesnt work with latest nvidia drivers, you get only reboot loop or bsod. Need old nvidia driver. However, this does not make sense, requiring older nvidia drivers unfit to W 8.1 Update 1

1. Chavez Clemons Jr.

“here is patched winload and kernel for win7sp1 october 15 update

Use this for March 2015 update. Got me back to a full 8GB of ram and full updates. I have an ATI HD5650.

29. gcalzo

MS has officially removed the KB294927!!!

https://technet.microsoft.com/en-us/library/security/2949927.aspx
Revisions
•V1.0 (October 14, 2014): Advisory published.
•V2.0 (October 17, 2014): Removed Download Center links for Microsoft security update 2949927. Microsoft recommends that customers experiencing issues uninstall this update. Microsoft is investigating behavior associated with this update, and will update the advisory when more information becomes available.

30. Terry

The patch works with Win 8.1 update 1, and may well work with an Intel graphics card, but you would need to try installing the patch to find out if it does.
It appears to be Intel HD onboard graphics that causes conflicts in the memory above 4GB.

31. Dragos

Thanks for replying Terry, I did tried it but had no success with it. It may be because of the integrated graphics .. I will try another driver as now I use a modified version of the Intel driver.

I’ll post back if this works.

1. Marinescu Ionuț-Dragoș

I did try another Intel driver version but to no avail, now I’m using an old ATI card and it is working on the latest 8.1 release (downloaded from MS a few days ago).

There is one update for Windows kernel (KB3035131) that I did not install yet.

1. DeMoN

(KB3035131) does break this patch on WIndows 7. unfortunately, Im on a domain with a very persistent WSUS server and matching GP. Does anyone know a way to block a specific update from the registry? the “hide update” is greyed out.

32. Dragos

Well, I’ve tried another version (ie the Windows Update one, as I don’t have that many options to choose for the GMA X4500) and I cannot boot to desktop because Windows starts in autorecovery mode … I’ve disabled that and it seems that this driver doesn’t work because I get no video after the Windows logo … it stays at a blank screen (monitor turns off ) for a minute or so then reboots.

I’ll give it another go after I get a dedicated video card and I’ll post back

If you’re using Windows 8.1 update 1 and have this graphics card and the patched worked for you, please let me know by commenting here, thanks.

33. Dragos

Haha Terry, I doubt that would help my case. My system has only 4GB of RAM so this patch would have proved efficient to my setup.

If I switch to x64 it will be pointless cause from I’ve gathered, the x64 version will actually use more RAM, for example some folks were talking about x64 taking about 1.2/4 GB of RAM at idle, while the x86 takes around 6/700MB.

From my own conclusion I would suspect that to be true, because for an x86 app. to run on x64, there will be 2 instances in RAM? …

Anyway I will have tot test this out for sure.

34. Pietia

Can anyone help me ? I recently installed win7 32 professional and wanted to use this hack , I upgraded my system thought windows update so my winloadp is 6.1.7601.17514 and my ntkrnl is 6.1.7601.18409 I booted into pae patched kernel but there were 2 BSOD’s my laptop is acer v3 771G and here are .dmp files:
http://www.filedropper.com/dumps
caused by ntfs.sys and ntkrnlpx.exe
Thank you very much

35. Terry

After installing the latest Microsoft updates for Windows 8.1 (being careful not to accept the Nvidia video update), the computer would not boot using the patched kernel, and got the message ‘critical process died’ so I deleted patchpae using the boot option in msconfig.

When I get time I’ll investigate further and report back if PatchPae is successfully re-installed.

36. Terry

I should have re-read the text file that came with the patch and re-run step 3 after Windows Update

Re-patching the kernel restored enabling more than 4GB ram.

37. Garbo

Works perfectly for me. Windows 7 Ultimate 32 bits up-to-date, KB2949927 removed, 16 GB RAM and ATI Radeon graphic card. Many thanks!!

38. CpServiceSpb

Hi anybody.
Can somebody post “live” links to “magic” Barton88 intel video drivers which should allow to use intel hd (1st/2nd generation) with Windows 7/8 x32 (32-bit) and with 4+ Gb RAM patch ?

39. Keith Fukumoto

Wow, this patch rocks. So simple to apply and it WORKS. (Just copy and paste from the “read me” text file so little room for error.) The only “problem”, if you can call it that, is one of the two patches kept prompting windows to repair itself. (Deleted that patch since repair wasn’t successful.) The only thing that could be improved is being able to copy and paste the long { } string. I’ll know how much more improvement I’ve gained once my 8GB ram chips arrive. But for now, things seem to run faster than before.

Keithhf

1. Keith Fukumoto

Ah, thanks for the hint. The 8GB ram chips arrived. Windows 7 shows 8GB installed but only 3GB available. Regardless of what Windows 7 says, however, my laptop is running so much faster. So this may be a matter of not looking a gift horse in the mouth and just accepting the excellent results. Thanks again.

1. Terry

If Properties page says that only 3GB is available, then it means the patch has not been applied. It should just say “Installed memory (RAM): 8.00 GB”

It may pay you to go through the procedure again.

40. Terry

Keith, I would carefully go through the steps again for Windows 7, being sure you don’t inadvertently use any Windows 8 only instructions. I’d suggest you put PatchPae2.exe into C:\Windows\System32\, and that is what you type where it says “C:\WherePatchPaeis\”, ie the path to where you put PatchPae2.exe.

One or two people have thought that you type “WherePatchPaeis”

It is easy to make a mistake in typing out the commands, copying the string to the clipboard at step 5 is a great help as it has to be entered a few times.

If you get it right, then either the patch will work and you will get the full 8GB…hurrah…, or it wont and your computer may hang or get a black screen.

If it hangs try restarting in safe mode and remove the patch via msconfig as it describes in the readme file.

If it doesn’t work then there is probably some hardware conflict or a device trying to write into the memory space above 4GB. Have a read through the comments.

1. keith fukumoto

Thanks again, will repeat step. Patch is in Windows\system 32 already. For whatever reason, the addition of another 4GB of RAM and your patch does seem to make my laptop a lot snappier. Dell e4300, 64GB SATA 3, SSD and 300GB SATA 3, HDD. Windows 7 SP1, OEM version. No BSODs in any event.

41. Garbo

Unfortunately, the last Microsoft updates (march 2015) broke this excellent patch It’s not possible to apply it anymore, it fails when applying the loader part… Too bad !

1. Garbo

Well, removing the update KB3033929 does the trick for me (this patch updates the kernel for SHA-2 code signing support).

1. Marinescu Ionuț-Dragoș

If Windows reinstall the update automatically, you need to set Windows Updates to notify you before installing updates instead of automatically installing them.

To do this follow these steps:

Control Panel > System and Security > Windows Update : Change Settings (upper left) then select either:

Never check for updates (and you will have to manually do this once in a while, like once or twice a month)
or

1. Marinescu Ionuț-Dragoș

This patch doesn’t replace the files, instead it copies them and patches the copies, then ads a new boot entry pointing to the patched files.

You should re-read what this patch does and try to understand how it works before continuing.

1. Garbo

I suggest you read my previous contributions before replying to my posts…

I know what this patch does and I applied it successfully several times. My last question wasn’t about the patch itself but the patched versions of the kernel files (see above : http://rghost.net/58547303).

2. Achmed

I wouldn’t use kernel files of unknown origin. Or do you like NSA, hackers and this kind of people ?

42. Marinescu Ionuț-Dragoș

Does anyone have a batch file to automate this patch ?

Thanks

I’ve tried to use this:

TITLE RAM Patch for Windows 8.1 32-bit (PatchPAE2)
color E0
copy “%~dp0PatchPae2.exe” “%Windir%\system32\patchpae2.exe”
echo.
%systemdrive%
cd\
cd %Windir%\system32
PatchPae2.exe -type kernel -o ntoskrnx.exe ntoskrnl.exe
echo.
bcdedit /copy {current} /d “Windows 8.1 (PAE Patch)”
echo.
bcdedit /set description “Windows 8.1 (PAE Patched)”
bcdedit /default {current}
bcdedit /set {current} kernel ntoskrnx.exe
bcdedit /set {current} nointegritychecks 1
bcdedit /set {bootmgr} timeout 10
del %Windir%\system32\patchpae2.exe
echo.
echo Done
echo.
echo RESTART PC!
pause > nul

But I get :
“An error occurred while attempting to reference the specified entry”

This reffers to the {current} part of the code …

1. Marinescu Ionuț-Dragoș

Nevermind, I figured it out, so for Windows 8.1 this batch works:

@echo off
TITLE RAM Patch for Windows 8 32-bit (PatchPAE2)
color A0
ECHO.
ECHO.PatchPae (v2) by wj32.
ECHO.Tested on: Windows Vista SP2, 7 SP0, 7 SP1, 8, 8.1
ECHO.
copy PatchPae2.exe “%Windir%\system32\patchpae2.exe”
%systemdrive%
cd\
cd %Windir%\system32
ECHO.
PatchPae2.exe -type kernel -o ntoskrnx.exe ntoskrnl.exe
ECHO.
ECHO.
bcdedit /copy {current} /d “Windows 8.1 BAK”
ECHO.
bcdedit /set {current} kernel ntoskrnx.exe
ECHO.
ECHO.
bcdedit /set {current} nointegritychecks 1
bcdedit /set {bootmgr} default {current}
REM bcdedit /set {bootmgr} timeout 1

pause > nul

Make sure you have PatchPae2.exe in the same directory as this script.

43. Chavez Clemons Jr.

From @john_doe

“here is patched winload and kernel for win7sp1 october 15 update

http://rghost.net/58547303”

Use this for March 2015 update. Got me back to a full 8GB of ram and full updates. I have an ATI HD5650.

Use the patch above and replace the files either using the Recovery Console, a Windows Recovery Disk, or booting into the non-patched Windows Kernel (you should have two boot entries: one with your non-patched kernel and one with the patched one).

44. Jhon

we have removed KB3033929 update and successful patched system without effect
usable memory from 6 gb memory is still 2.64 GB

45. Alexander S.

This winloadp.exe did indeed work out for my Win7 SP1 with KB3033929 installed:
http://rghost.net/58547303

I first had to boot the unpatched Windows a few times, until the update was installed. Then i replaced the old winloadp.exe with the version above. And then patched ntkrnlpa.exe a second time (dont know if this is really necessary)

46. Boris

Winload 6.1.7601.18649 failed to patch. I patched it manually, with help from PatchPae2 source and pdb symbols:
00000130: 44 B2
000282AE: 7D EB

1. Yury

please don’t forget to save patched winload.exe. as winloadp.exe to the “%Windir%\system32\” directory, everything else will be done by Patchpae2 patcher. Hope that it’s author will release a PatchPae3 soon, with minor changes for winload.exe patching and some automation (as a batch file for Windows 7 32-bit in this archive http://rghost.ru/6HZbtkfj8)

47. istin

winload.exe ver 6.1.7601.18649 failed to patch, windows7 could not boot (patched) after a recent windows update (I do not know which one)

1. Mike

KB3045685 and KB3045999, both published on 4/14/2015 as part of MS15-038 broke the existing PAE patch (done manually a few years ago) on my Windows 7 computer resulting in BSOD errors on boot. Uninstalling these hotfixes fixed the PAE problem. Now I just have to add this to the Nvidia driver as something I can’t update for the foreseeable future.

48. Tung Bach

winload.exe ver 6.3.9600.17238 for Windows 8.1 could not patched. Windows update 15/04/2015. THANKS

49. PaVink

This patch has always worked and is still working on my fully updated 8.1 system.
Just follow the instructions provided. Of course, if you have no idea what is happening here, you probably should not even attempt this!

50. DeMoN

(KB3035131) breaks this patch and trying to re-patch fails the winload step. This is with current Nvidia Drivers if it matters. If you are having issues, try to uninstall this recent patch (i think it said it was published 4/10/2015 so not very old. If anyone finds a work around besides uninstalling this patch. I’m on a corporate domain with a very persistent WSUS server and i have no way to permanently keep this update away…

1. DeMoN

doing it the old fashioned way with a hex editor also does not end well. the 7C11 8B45 & 7C10 8B45 flags are still there, but the rest of the string is significantly different. It still signs and It all looks well and good though until you get to windows. Windows boots slowly, shows even less available ram, and does not “have enough free memory to open” ANYthing… even notepad…

51. alexio

I used this for the win8 install of my dual boot win8/vista, which win8 manages with its boot loader. It got stuck in a repair loop, I fixed the bmr with a live cd. I do have nvidea drivers for a 5 year old nvidea card. Can someone with a working install provide a list of updates I have to remove?

52. theclubpenguineherald

The third step fails ..
Some windows updates got installed overnight..
Cannot boot onto the the patched version anymore.
I have tried Patching it again ..
but it fails at the the below step

An error is displayed as “failed”..

Thanks,
Harry

53. Frank Shashaty

Dear Mr. Liu,

First, Thank You for providing the patch; it works perfectly on our 7 and 8x systems.

We are planning to upgrade to windows 10 in the near future and we assume the new OS will change/upgrade the kernel. Is that correct?

If yes, can we use the patch on the windows 10 OS?

If not, will you be releasing a windows 10 version?

54. Rikky Citra

hi, does the patch support windows 10 32bit? can you update the patch to support windows 10 32bit? my machine has problems with 64bit so i have to use 32bit windows 10. but i have more than 3GB Ram.
Thank you

55. evgeny

patchpae2 modified xttp://rutracker.org/forum/viewtopic.php?t=4694409
for Windows XP, 2003, Vista, 2008, 7 (supports KB3035131), 8/8.1, 10
with GUI (russian only, sorry), balalaika, vodka and bear.

56. mudakun

Trouble with bcdedit /copy {current} /d “Windows7Patched” ???
A DESCRIPTION FOR THE NEW ENTRY MUST BE SPECIFIED….

Using real double quotes in ascii, not some weird variant you got by cutting and pasting from a blog page.
Copy the lines into notepad, go over the { ” ] quotes with fresh ones try again..

I think some web publishing blog engines try to pretty up the double quote by turning it
into the leading and inverted ones in pairs.

After they were excised and replaced with real ones, it worked like a charm! Many thanks
Pavilion DV2412ca 4gb ram installed Windows 7 ultimate N, SP1 clean install.

57. Gabriel

The patches above for Windows 10 are infected, says Windows Defender. I really hope an official one release soon.

1. evgeny

Yes. Windows Defender already know that fix128 patched windows kernel and loader. I really hope you understand micro$oft politic for software activated or patched Windows. Windows Defender must delete it, of course. NOD32, Kaspersky, Avast, Avira, DrWeb, McAfee no says infected. fix128 is 7zip-sfx, it packed with upack. there are patchpae2 modified to support new windows and vbs-script for GUI in sfx archive. 1. evgeny However, Micro$oft also says that 32-bit windows can’t support more than 4 Gb of memory. Hah!

58. evgeny

Deleted patch is beta-version fix128. You may read the thread before write.
If f*ck_ng Kaspersky blocked the file, you may add the item to exception list.
A can release new version of fix128? but in some days some antivirus delete it. Sooner or later. Welcome to Windows-10 Era!
If you want to use fix128, you will find method to download it. If you don’t, you may f*c_k my mind and your mind and all minds around.
Opening ZIP in my Windows 8.1 in Explorer do not starts program.

CLI version only: http://rghost.ru/8KFT4tSJw

1. Neal

In case it needs repeating: the links by evgeny above, supposedly to a Win10 PAE patch, ARE INFECTED WITH A TROJAN. DO NOT USE THEM. 32 separate malware scanners confirm it.

Here’s hoping a real Win10 PAE patch arrives soon

59. Neal

Don’t be coy. Any scanner you run on it will tell you it’s a trojan — Microsoft shows it as Trojan:Win32/Skeeyah.A!bit.

1. evgeny

If some s_t*pid antimalware see upack or VBS, will be false alarm. All small malware scanners buy single antivirus base from larger antivirus developers.

https://www.virustotal.com/ru/file/23bd6be9d26e9a9ba5e2e51a74da394c57e981673e9d15289b9803e2e914f5b1/analysis/1439241706/
upack, Trojan.Win32.Packer.Upack0.3.9 (ep), HW32.Packed.90A4, Trj/Pupack.A, Cryp_Xed-12
See you word “upack”? IT IS UPACK. It is crypt packer i use.
VBS:VBS.Trojan.Alal!35714
See you word “VBS”? IT IS GUI.

2. evgeny

What problem? Run 7-zip archiver and extract all files from fix128.
Open ntk128gb.vbs from SFX in notepad. Then show me line in open source code with malware.
You can say bla-bla-bla only, NO FACTS.
You say Trojan:*. What do this trojan? What files it damage, what process it run, what about network activity? Nothing! It’s false alarm. There is no malware. Never.

60. Neal

So, you say I should trust your code. Let’s have a look.

Chrome and IE refuse to download it, because of the trojan alert. Using wget, I can retrieve the file; again the scanner detects the trojan and deletes the .exe from inside the zip. Disabling that, 7zip then refuses to unzip the enclosed .exe, because it too detects the trojan.

Shutting down all scans, I finally uncompress everything. Here’s what I get:

6 DLL’s, all of which begin with HAL.
31 SYS files, 27 of which begin with USB, and the rest with HID.
A handful of other files and directories — 4 EXE’s, and directories named 2003 and 2008__.

And: your VBS file — 8100+ lines of code, a thousand of which are in Russian.

You *must* be joking me.

1. evgeny

Ok. 31 *.sys files.

They are in ZIP 2003\SYSTEM32\drivers\ directory (not SFX!).
Windows XP has some troubles with USB 2.0 in PAE-mode. This drivers from server 2003 for replace XP drivers when fix128 installed on XP. After uninstall fix128 on XP, it replace with original backup XP files. You can read http://www.overclock.net/t/77229/windows-xp-ram-limit/50 for more information about usbvideo.sys, usbstor.sys, etc. Heh, you say Server 2003 is malware. You are joking too.

Similar to 2008\SYSTEM32\drivers\ directory. But 2008 is renamed to ___2008 and is not used. I found some windows-7 with beta-SP1 systems needing replacement of original usb2 drivers too. it’s experimental future and in russian manual it isn’t recommended (and 2008 is renamed to ___2008). This *.sys files from… Server 2008. You just say Server 2008 is malware. Great.

at installation the fix128 copies files from 2003|2008 automatically in windows.

next, 6 DLL…

2. evgeny

continue… 6 DLLs
When you patch Windows XP, you need to patch HAL. And modified patchpae2 can do it.
Another way is to copy HAL DLL from XP SP1, wich supports more then 4 Gb of memory.
http://www.overclock.net/t/77229/windows-xp-ram-limit/60#post_22142268. I tested this method, but it’s not working with my system. And it isn’t recommended in russian manual. This method activated only if you run fix128.exe with +XPSP1HAL key in command line.
6 DLL’s in xpsp1hal directory, all of which begin with HAL is HAL drivers from XP SP1. And you just say Windows XP SP1 is malware. You are more joking.

3. evgeny

continue, 4 *.exe

There is 2 way to load patched (i.e. with damaged signature) kernel. 1 – you can patch loader to disable signature verification (PatchPae2.exe -type loader …). 2 – original method by Geoff Chappell based on test-signing. http://www.geoffchappell.com/notes/windows/license/memory.htm And fix128.exe has key +TestCert to use this method. You need some utils from Visual Studio for 2nd method: makecert.exe, certmgr.exe and signtool.exe. It is in utils directory of SFX archive. You just say Visual Studio is malware. You are more and more by more joking.

4. evgeny

Oh! We lost 1 *.exe in SFX archive : utils\PatchPae2.exe

It is modified patch with support for win xp, win 7 with KB3033929, win 10, serv 2003.
I posted links for this file and virustotal earlier. 0/56. no malware.

5. evgeny

I need to have a rest a little…
I will explain 8100+ lines of VBS code later=)

summing up the result. 6 files + 31 files + 4 files = 41 files. Neal, you are alarmist of 0x29h Level. Panic-monster.

1. Achmed

Maybe something on the download server modified your zip – this would explain the start of a program while extracting it…

61. Terry

evgeny,

I used your patchpae2 to patch Windows 10 32 bit Home Edition.
Very successful, no trojans, repeat no trojans

I am using an old Nvidia graphics driver as newer ones caused problems when patching Windows 7 and 8.1 with wj32’s patch. That is a problem in itself, Windows 10 has to be set so that it doesn’t automatically install the latest drivers.

Next test will be to see if up to date video drivers will work, though I am not too hopeful.

Many thanks

62. Gecata

So… patch v.039 working fine and smooth. After few days of test and experiments i can say it’s GREAT and WORKING ! So i made and test this scenario:

1. Make virtual machine KVM on CentOs 7.1 Linux and patched Windows 10 Enterprise 32bit-10240RTM
2. Make full machine backup with EaseUs ToDo Backup 6.1
3. Restored backup to VmWare virtual machine on Windows 8.1
4. Restored backup on VirtualBox machine on Windows 7 32 bit
5. Restored machine on bare metal

Patch is there all the time and work great, even different video drivers on different VM’s.
Today tested patched machine with 7 all day connected user over RDP /thinstation clients/ and it working fine and stable!

Many thanks to evgeny for great work and sharing knowledge!

63. Gabriel

However, I still can’t trust it, until reasonable explanation why ALL of the used software says it is infected. There’s obviously something in the code, which is causing it. C’mon man, just reveal it and we’ll use your patch.

64. Luciano

evgeny, why not simply uploading the _source code_ of PatchPae2 CLI, enhanced for Windows 10 too? The code is well structured, well documented for all supported different kernel versions.

Then, you could also simply use the old plain safe .zip format instead of SFX if you don’t have nothing to hide…

1. evgeny

What problem?
You can open sfx-archive fix128.exe by 7zip.
You can extract the file fix128.exe\utils\main.c with _source code_ of PatchPae2 CLI, enhanced for Windows 10
You can extract the file fix128.exe\utils\PatchPae2.exe CLI binary, enhanced for Windows 10, which I uploaded above
You can extract the file fix128.exe\ntk128gb.vbs with _source code_ of GUI
I could encrypt VBS, archive, etc, but I didn’t.
You may read all, but you didn’t.
Why?
You are f_ck*ng Writer, not reader.
Why are you can’t read the _source code_? You have not a notepad? Are you banned on 7zip download page? Maybe you’re too lazy?
What problem?
The _source code_ always was here.

1. Gabriel

Well, if you keep answering like this and you keep insisting to us to download your file without any explanation why, then trust me, no one’s going to do it. Your comments are now becoming a spam without a purpose. If you really want to help, then do it. EXPLAIN. Give us a reason. So we can believe that 99% of anti-malicious software is wrong. Don’t expect anyone to read 8100+ lines of code. Or simply make a clean new patch when you know what is causing it.