heretical.com

    
 

Solving the Windows NT4 Crash Problem


Part of a collection of arcane technical topics in computing and printing
Simon Sheppard



Problem: Windows NT Setup crashes during installation.

Solution 1: Following a feature added by Intel and their recommendation, many motherboards have an option in the BIOS ‘Limit CPUID to 3’ or similar. Enable this.

To clarify: Once SP6 is installed, NT runs fine whether ‘Limit CPUID’ is enabled or not. The difficulty is that SP6 can only be installed after NT4 is installed.

Solution 2: See below.

Solution 3: NT4 will install in VirtualBox.



Installing Windows NT4 without ‘Limit CPUID’ in BIOS

You will need:

Following these steps is not much more involved than a normal NT installation.

First stage

Create an active FAT partition 500MB-2GB with DOS on it (e.g. using FORMAT /S). Copy SETCPUID.COM onto it.

Second

Boot DOS and change to the CD-ROM drive (e.g. F:), change to the I386 directory and run WINNT /B. This will extract and copy the installation files to C:. At the end will be ‘The MS-DOS based portion of Setup is complete...’

Third

Before booting to the next stage (pressing Enter or resetting), insert the separate DOS boot device. When DOS has booted, change to the C: drive and run SETCPUID. The program will do a ‘very warm’ reboot whereupon NT Setup will resume.

Fourth

Again, before booting to the next stage, insert the DOS boot device. When DOS has booted, change to the C: drive and run SETCPUID. NT Setup will resume.

Fifth

NT4 is now installed. With each boot, BOOT.INI in the root directory gives time to select DOS boot. SETCPUID must be run every time NT is started, until SP6 is installed.



SETCPUID running in the Windows NT DOS box
Executed in a Windows DOS box, SETCPUID.COM appears well-behaved but exits prematurely, because it calls functions requiring a lower privilege level than the DOS box affords. It can be useful to report the CPU maximum leaf. However this behaviour is incidental; it is a real mode DOS program.


Notes and discussion

Whether this SETCPUID program will be of any use is unknown. Writing it involved bewildering cycles of processor modes, privilege levels and exception handlers but in the end most of the problems came down to programming in 32 bits using a 16-bit assembler and debugger. It was an academic exercise which became a challenge to complete.

The delay allowing the user to select which OS to boot can be changed by editing BOOT.INI. If BOOT.INI is hidden it can be made visible with ATTRIB. The trickiest part is stage four above, because there is no delay at all, hence it is essential to use the separate DOS boot device. Each Setup stage has a different BOOT.INI, it is only fixed once NT is installed.

If a DOS boot is missed, NT4 will shortly crash and the DOS boot device should be made available for the resulting reboot.

While testing it was discovered that a Dell Dimension 3100 with Leaf 5 CPU actually boots with the Limit CPUID bit set, which is odd. There was no BIOS option. Hence the CPU always reports a maximum leaf of 3.

Leaf 3 is something of a ‘lame leaf’ because this leaf returns the unique processor serial number, a feature which was abandoned after the Pentium III because of its unpopularity. According to current Intel documentation, setting MSR:1A0h bit 22 limits the reported maximum leaf to 2. Older computers (certainly those with max. leaf 5) return 3 when bit 22 is set.

The DOS version used was 6.22 with Oak CD-ROM driver. At one point I lost track of the CD-ROM driver and resorted to a ‘Windows 98 Startup Disk’ which had CD-ROM support but booting this resulted in a mysterious LOCK error during WINNT /B.

Earlier, an attempt was made to patch the NT installation files on the C: drive after running WINNT /B. The code being patched was:

push   ebx
push   esi
mov    eax,DWORD PTR [esp+0xc]
cpuid
mov    esi,DWORD PTR [esp+0x10]
mov    DWORD PTR [esi],eax
mov    esi,DWORD PTR [esp+0x14]
mov    DWORD PTR [esi],ebx
mov    esi,DWORD PTR [esp+0x18]
mov    DWORD PTR [esi],ecx
mov    esi,DWORD PTR [esp+0x1c]
mov    DWORD PTR [esi],edx
pop    esi
pop    ebx

For reference the 34-byte sequence is:

53 56 8b 44 24 0c 0f a2 8b 74 24 10 89 06 8b 74
24 14 89 1e 8b 74 24 18 89 0e 8b 74 24 1c 89 16
5e 5b

This sequence occurs in thirteen files, of which five are exact duplicates (appearing in both the $WIN_NT$.~BT and $WIN_NT$.~LS directories). However changing the files resulted in an error, presumably a checksum failure, again preventing installation.

Attention may be given in the future to a simple way of booting DOS. As it presently stands, installing an old floppy drive can be the easiest method.

May NT4 live on!




After-notes (April 2021)

A couple of points have arisen since January when SETCPUID.COM was uploaded. I have seen some strange BIOS-reported CPUID’s, but am not sure these are actual CPUID’s as returned by the CPUID instruction. SETCPUID.COM only displays the least significant byte of the CPUID value returned by the CPU but tests the least significant word. That is, if the returned CPUID is 00000a01h say, this will be interpreted as >3 and SETCPUID will proceed to set MSR:1A0h bit 22 and soft reboot.

The documentation for maximum leaf I have seen only involves the LSB, but what AMD and later Intel CPU’s are doing with CPUID I don’t know. In the future, if circumstances permit, I would like to update SETCPUID.COM to display the full 32-bit value returned by CPUID:0 in EAX. Also test several more recent motherboards to see if NT4 can be installed, using SETCPUID.COM if necessary.




      Main Directory      

–– The Heretical Press ––