BadMemory icon indicating copy to clipboard operation
BadMemory copied to clipboard

Define problem

Open mirh opened this issue 8 years ago • 17 comments
trafficstars

Which kind of limitation in bootmanager would lead to STATUS_BUFFER_TOO_SMALL error?

I mean, it's not clear how one would trigger the issue. EDIT: specifying too many pages perhaps?

mirh avatar Mar 25 '17 13:03 mirh

Yes, too many pages.

prsyahmi avatar Mar 26 '17 00:03 prsyahmi

Do you have a precise figure?

mirh avatar Mar 26 '17 01:03 mirh

Hello, im sorry to bump into another conversation but it is relatively the same. Hoping you can help me finish something i started almost a year ago.

Almost a year ago, i tried getting an oldish laptop i use very rarely going again. This laptop has onboard soldered ram, which is unremovable. It had a slot for extra ram, so i decided to buy a slot of ram and installed it. Only thing is i believed windows will use the soldered ram first before my new stick. (EDIT- however looking at memtest address it looks like it is using my stick first, the address you will see below)

Windows would run but occasionally get a BSOD. I then did alot of google searching and found a way to block windows from using a specific address which is the bcd /set {badmemory} badmemorylist. The help i got was from here https://thecomputerperson.wordpress.com/2015/04/20/how-to-block-out-or-map-out-bad-ram-in-windows/

So i used memtest86 and got the address's, but i ran into a problems. According to memtest86

00106b65428 4203.3 to 00146b68ff8 5227.5 HAD BAD RAM Which is quite a large amount, however for excel spreadsheeting and basic use of laptop i doubt i would ever need some much, espicially considering the laptop now has an extra 4gb stick.

I then made a spreadsheet to calculate every page in that amount, which was a headache in itself but i managed to do it with the help of the page posted before. So at that point i then needed to convert it from DEC to HEX, which i did. Only problem was cause the amount of ram that was damaged was so large, i ended up with 262249 lines!

So the next problem was to get all the address's from the excel sheet to notepad or word in the right format for the command to work. So with abit more googling i used an addon for excel called KUTOOLS, and with that i was able to copy a whole column to word and add a "space" in between each value.

So now i had a word doc that had 648 paged of address's lol

So i select all and copied in notepad. Checked the first and last number if it matched the word doc. Nope... so ran into another obstacle, a max amount of characters for notepad. !!!!!!!!!!!!!!

Now this is where i get rusty.

I remember i was able to get past this hurdle aswell. I belive i was able to use another notebook editor which had unlimited amount of characters, however i cannot remember what i used, or can seem to find the notepad that has all the addresses with it (i only have the word doc with the addresses)

But i do remember entering the addresses in a bat file, entered the command. And it gave me command is to long for a single command.

I read up that if i commanded the bat file to open up another bat file using c++ or VB it would work. But this is where i just gave up. As my programming skills are crappy, only doing 1 year of java about 13 years ago i cant remember a single thing of it being in a completely diff field.

So i never got to the stage of STATUS_BUFFER_TOO_SMALL error.

But with your program do you think i will be able to do so many?. It would be a good test Please be aware my programming skills are next to none. I am pretty good with PC's however (a little outdated, age is gettin me).

Ive attached the file's i have used so far to get me where i am. bad ram.xlsx bad ramm!!.docx

Thankyou in advance, hoping to finally dust and finish this problem!

Charlie

horze21 avatar Mar 26 '17 21:03 horze21

I'm not sure what's "relatively the same" between a technical and practical question.. Anyway, given the extent of your problem (even though today I had bcdedit smoothly accepting like 80 values) possibly cmd is going to give you middle finger even before being able to display the error message. I.e. yes, this driver is for you.

You said you had > 5GB: this means you are using [whatever the specific release] a x64 Windows version. You'll need to enable testsigning mode to use this then.

And for the love of god, use notepad++.

mirh avatar Mar 26 '17 22:03 mirh

Thanks for your reply mirh. Sorry i thought your question was in relation to a similiar issue im having ahh it was notepad ++ i used... i just reopened it and sure enough the addresses are still in it!

Well according the the word doc i have 262249 values I have the address's in this format "0x106B4C"
Does it need to be in a different format to be using this program?

Thanks for the help mate

horze21 avatar Mar 26 '17 22:03 horze21

It seems like you didn't even try to open BadMemoryManager.exe.

mirh avatar Mar 26 '17 23:03 mirh

i have opened it and i know that it works within 2 brackets but wondering what format of the values to use

horze21 avatar Mar 27 '17 01:03 horze21

@mirh, I need around 8207 entries to map out around 33MB of bad memory region. So this is something windows cannot do. I didn't use bcdedit to add entry, but adding manually and this causes STATUS_BUFFER_TOO_SMALL error.

@horze21 It accepts HEX values. So let's use this image as an example (I got it somewhere online): http://i55.tinypic.com/mm95jm.jpg

Failing address:

445fd70
445fd88
445fd98
445fe70
445fe88
445fe98
445fef0
445ff08
445ff18
...
4460000

The failing address looks continuous, so you just need to fill those two box on BadMemoryManager.exe with 445fd70 - 4460000. No need to prefixed it with 0x in front. For safety, I like to extend it a bit so it will be like 445e000 - 4461000.

Also please note its granularity = page size (0x1000 or 4096), so if your failing address entry is like below page size, eg 445fd70 - 445fd88 it will interpret both to 445f000 - 445f000, so make sure to extend it.

In your case, 00106b65428 4203.3 to 00146b68ff8 5227.5 HAD BAD RAM just enter 106b65000 - 146b69000, this should do it.

The second release is already signed, testsigning mode isn't needed.

prsyahmi avatar Mar 27 '17 04:03 prsyahmi

Thankyou for your reply prsyahmi, im about to reinstall windows on that laptop and enter the values. Just curious however, just for my knowledge.. how did you get the values 4203.3 to be 00106b65428 and also 5227.5 to be 00146b68ff8 Thanks again

horze21 avatar Mar 27 '17 07:03 horze21

I need around 8207 entries to map out around 33MB of bad memory region. So this is something windows cannot do.

Ok, soo.. Guess like our magic number (measured in entries or "values length") reside somewhere between 80 and 8000 😛 EDIT: found in reactos sources

how did you get the values 4203.3 to be 00106b65428 and also 5227.5 to be 00146b68ff8

One is base-10 (aka decimal), the other base-16 (hexadecimal). Remember first value is provided in MBs for your convenience while computer reason on bare bytes.

mirh avatar Mar 27 '17 08:03 mirh

ignore my post, i forgot i had stated the hexadecimal value!.. sorry long day:).. so keen on solving this tonight. thankyou:)

horze21 avatar Mar 27 '17 09:03 horze21

Just hoping windows will install fine before i enter the memory bracket to ignore.. Its let me once before so i hope it will again!

horze21 avatar Mar 27 '17 09:03 horze21

https://thecomputerperson.wordpress.com/2015/04/20/how-to-block-out-or-map-out-bad-ram-in-windows/

As suggested here, it should still be possible to just install Windows on another computer (plus this driver and other stuff), then swap it.

mirh avatar Mar 27 '17 09:03 mirh

i dont believe from windows xp onwards would let you do that as it binds itself to the drivers of the system. (eg northbridge etc etc). Drivers like sound and etc it not a problem, but the main drivers i belive it binds itself to it and when you flip the drive to another pc, it will not boot up. Apparently there are ways around it but very touch and go apparently

horze21 avatar Mar 27 '17 09:03 horze21

The only real blocker to the best of my knowledge is ahci/ide drivers being mutually exclusive. For the remainder, you should almost certainly be able to boot at least in safe mode for default stuff to re-initialize.

But anyway imo, it's a last chance that shouldn't be required given your corrupted memory blocks are pretty "far ahead".

mirh avatar Mar 27 '17 11:03 mirh

Laptop working brilliant, Thanks for your help mirh. And special thanks to prsyahmi for creating and sharing this program with us and also your advice on your post for blocking my ram. I did the address you specified and its working brilliant and has allowed to me install win 7 sp1, which i couldnt do before blocking the ram. And a great tester aswell, as I'm blocking out over 1 gb of ram

Thanks again mate:)

horze21 avatar Mar 29 '17 11:03 horze21

Cool. Soo.. It'd be just to find what's this magic number 🙃 ~~If my rusty c isn't wrong.. It is checking if the sizeof(BCD_DEVICE_OPTION of BcdDevice) plus the BcdDevice BCD_ELEMENT_HEADER's size is greater than where "ElementSize" (which I think should be something on the 4 billions) points. Thus, given bcd stores this kind of info in a REG_BINARY, assigning 8 bytes to each entry, that makes.. Like almost 70M, which means I'm wrong .-. Even assuming the limit was actually a registry one.. 15K still is more than expected. Guess somebody will have to test on a VM.~~

Ok, it seems like I had miss to see this error is also returned in other points of the file and files. So yeah, **** it, better to do some blind testing.

mirh avatar Mar 29 '17 19:03 mirh