Vista x64 and 5gb of memory, Aero shuts down intermittently withperformance errors

[Guest djrobx@gmail.com]

Problem:

 

On my Mac Pro with 5GB of system memory, Aero intermittently shuts

down. Balloons appear in the lower right reporting that "Windows has

detected that performance is low" or that it has "exceeded dedicated

memory". The same behavior occurs with a NVidia 6300GT with 256mb,

or an ATI X1900XT with 512mb.

 

Additionally, Desktop Window Manager will make log entries:

 

9025: The Desktop Window Manager has stopped locking system memory due

to passing its working set threshold

 

9024: The Desktop Window Manager has been disabled automatically by

the system due to too much system memory in use

 

The amount of windows that need to be open to trigger the problem

varies. You might be able to open dozens of windows and have it be

OK, and later find Aero shut down with only 10 windows on the

screen.

 

I can consistently cauase Vista to trigger the bug by sleeping and

waking the machine.

 

I am fairly certain this is a bug in DWM pertaining to the large

amount of system memory overflowing a 32 bit integer somewhere.

According to Microsoft's Aero documentation, these events should be

triggered when Aero uses more than 25% and 30% of system memory,

respectively. But on my system, this happens when extremely small

percentages of the system memory is in use.

 

I have reported the incident to Microsoft. They provided a hotfix

which did not work.

 

Taking matters into my own hands, I attempted a patch to DWM.EXE. My

aim was simply bypass the performance check. I found this section in

the assembly code.

 

00003062 (03) 83f8 1e CMP EAX, 0x1e

00003065 (02) 8bfb MOV EDI, EBX

00003067 (02) 76 30 JBE 0x3099

00003069 (02) 33c9 XOR ECX, ECX

0000306b (05) e8 68fdffff CALL 0x2dd8

00003070 (02) 3bc3 CMP EAX, EBX

00003072 (02) 8bf8 MOV EDI, EAX

00003074 (02) 7d 57 JGE 0x30cd

00003076 (01) 44 INC ESP

00003077 (03) 8d43 02 LEA EAX, [EBX+0x2]

0000307a (01) 48 DEC EAX

0000307b (06) 8d15 07deffff LEA EDX, [0xffffde07]

00003081 (03) 8d4b 15 LEA ECX, [EBX+0x15]

00003084 (01) 44 INC ESP

00003085 (02) 8bc8 MOV ECX, EAX

00003087 (08) c74424 20 86010000 MOV DWORD [ESP+0x20], 0x186

0000308f (05) e8 ac690000 CALL 0x9a40

00003094 (05) e9 9a000000 JMP 0x3133

00003099 (06) 381d 353e0100 CMP [0x13e35], BL

0000309f (02) 74 48 JZ 0x30e9

000030a1 (03) 83f8 19 CMP EAX, 0x19

000030a4 (06) 0f86 89000000 JBE 0x3133

000030aa (02) 33c9 XOR ECX, ECX

 

Guessing that the CMP EAX, 0x19 and CMP EAX, 0x1E are the 25% and 30%,

I substituted the values for 7F (127%), attempting to be as minimally

invasive as possible. Since changing the values, my system is able to

sleep and wake and open windows with no more performance errors.

 

So if anyone else runs into this before Microsoft fixes it, copy dwm

to a work file, open a hex editor and search for:

 

83 F8 1E

 

Replace with:

 

83 F8 7F

 

Then search for:

 

83 F8 19

 

Replace with

 

83 F8 7F

 

Take ownership and give yourself permissions to DWM.EXE and replace

it:

 

cd\windows\system32

takeown /f dwm.exe

cacls dwm.exe /G yourusername:F

ren dwm.exe dwm.bak

copy dwmhacked dwm.exe

 

Then reboot.