Windows vista extended kernel x86

Main Extended Kernel Installer

The latest version of the Vista Extended Kernel was released on March 9, 2023.

Revision 2 includes a stable version of the User Profile Service, preventing any problems with the service when using the Extended Kernel on newer patch levels (2020+).

Download all necessary prerequisite updates here before installing.
Failure to do so may render your system inoperative!

The SHA checksum for the installer package named vistaexkernsetup_03092023_rev2.7z is:

6C1095AF0376DE8B75C335B82C91E524E369E46F

Main Download

MEGA Mirror

Yandex Mirror

Media Foundation Update Installer

The latest version of the Media Foundation Update was released on November 23, 2020.

The SHA-256 checksum for the installer package named mfplatsetup.7z is:

CFA956D44CC71153C5BE8766AAC4DF321B2F6B1B26DAC762A8DB6BFEB5E0D26A

Main Download

MEGA Mirror

Yandex Mirror

Modified NVIDIA Driver, version 378.66

This driver package is compatible with most GTX 1000 series GPUs except GT 1030, and is considered stable.

The SHA-256 checksum for the installer package named 378.66_Vista.7z is:

80a686b47d900f508022ad6b8dba9aa89bb2583652dfb9b6598fd5fdef23ad9c

Main Download

MEGA Mirror

Yandex Mirror

Modified NVIDIA Driver, version 398.11

Newer driver with support for GT 1030 and OpenGL 4.6. Full compatibility is not assured at this time.

There are presently conflicts with some other hardware such as NICs. If your system boots up to a frozen «orb»,
uninstall this driver in Safe Mode and replace with 378.66.

The SHA-256 checksum for the installer package named 398.11_Vista.7z is:

a95f91fcb7dbee3dd06f7ddc1da8f57575bfc346e24d0a80d8eb6bc8b4713457

Main Download

MEGA Mirror

Yandex Mirror

Modified Intel HD Driver, version 9.17

Modified driver package for Intel HD 4000 series integrated graphics by Ximonite.

Full support for OpenGL 4.0 features, among other optimizations are included in this package.

The SHA-256 checksum for the installer package named IntelHD_9.17.10.4459_Vista.7z is:

D14085FD20F4250A6830D45C41CA82C2A1C3D47B

Main Download

MEGA Mirror

Yandex Mirror

Modified AMD Catalyst Driver, version 15.6 (beta)

Modified driver package for AMD Radeon cards up to R9 series.

This driver is considerably more stable and performant than the antiquated 13.12 driver Vista users were officially served.

The SHA-256 checksum for the installer package named AMD_Catalyst_15.6_Beta_Windows_Vista.7z is:

C33212565B102BB7EDD1054AD39FDFD4DF2BC9FC

Main Download

MEGA Mirror

Yandex Mirror

Visit the file directory to see all download options.

About a month ago I started working on kernel extensions for Windows NT 6.0.

The x64 branch of the extended kernel is quite mature, running current versions of Firefox/Gecko-based browsers, GIMP 2.10.18 and PassMark PerformanceTest 10.0. A release of Brave browser based on Chromium 83 has a fault that points to an entry in the import table of kernel32 as of writing, but Electron-based applications like Visual Studio Code work.

The x86 branch is much younger and I’m just getting to grips with making x86 kernel extensions, though it will help with the many x86-native applications still floating around including Office 2013+ installers, as well as those who run Vista x86.

There are two ways to install the extended kernel files.

First Method
Replacement of Files in System Folders
Simply put, you copy the extended kernel files to the system32 and syswow64 (for x86 files on x64 systems) folders. Obviously you will have to do this from another OS. From another version of Windows, you will have take ownership of each file to be replaced. From Linux/BSD/etc. you don’t have to worry about permissions.

This method is necessary to ensure proper functioning of the address and search bars in Firefox 68+ based browsers. Otherwise search engine data is not downloaded and you will have to type in URLs manually, including extensions (like https://, ftp:// etc.).

All software will now rely on my files. Keep your original Vista files handy for when Vista-compatible applications exhibit unforseen behaviour; VMware WS 10-12 installers are one such example.
This method may also be undesirable if you make use of ESU updates.

Second Method
Local DLL Redirection
In this case, the system relies on the original MS DLLs and only user-specified programs will be able to use my DLLs and their extra functions. Preferred if you are concerned about malware using W7+ functions and/or use ESU updates.

Even if you use the first method, you can use this method to substitute extended DLLs with original Vista DLLs if Vista-compatible applications are broken.

To prepare for DLL redirection, create the following registry key and reboot:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
"DevOverrideEnable"=dword:00000001

Once you have done that, you can make programs use my modified files by creating a file or folder labelled xxxx.exe.local (where xxxx.exe is the program’s executable) in the program’s folder. If a .local file is created, then modfiied files are placed in the program’s folder. If a .local folder is created, then the modified files are placed in that folder.

Unfortunately, offering the download links in this thread would run afoul of the anti-XP+ policy, even after I badly scarred and abused the files. So contact me directly if you are interested or have questions.

14 hours ago, WindowsVista said:

I used a program called gimagex which is very useful.

all you have to do is extract install.wim from the .ISO file and mount it but be sure to select the ‘read and write’ check box.

you can directly replace the modified kernel32.dll file in the Windows directory without any permission issues.

once done, check ‘commit changes’ and then select unmount.

Very interesting. It’s nice to find out all of the ways to customize and modify NT 6.x much like we have been doing to NT 5.x for many years. Unfortunately that doesn’t mitigate the risk of it being overwritten by updates though.

Though I think that guy who was trying to get fully slipstreamed Vista install media with all updates-to-present would be interested.

On another note, this snippet of code is giving me a lot of trouble:

xdata:0000000078E6D07F loc_78E6D07F:                           ; CODE XREF: SetThreadErrorMode+4A↑j
.xdata:0000000078E6D07F                 lea     rdx, [rsp+30h]
.xdata:0000000078E6D084                 call    near ptr RtlSetThreadErrorMode
.xdata:0000000078E6D089                 nop
.xdata:0000000078E6D08A                 cmp     eax, ebx
.xdata:0000000078E6D08C                 jge     short loc_78E6D092
.xdata:0000000078E6D08E                 mov     ecx, eax
.xdata:0000000078E6D090                 jmp     short loc_78E6D056

GIMP crashes when it encounters the nop. I know that it should be

xdata:0000000078E6D07F loc_78E6D07F:                           ; CODE XREF: SetThreadErrorMode+4A↑j
.xdata:0000000078E6D07F                 lea     rdx, [rsp+30h]
.xdata:0000000078E6D084                 call    cs:RtlSetThreadErrorMode
.xdata:0000000078E6D08A                 cmp     eax, ebx
.xdata:0000000078E6D08C                 jge     short loc_78E6D092
.xdata:0000000078E6D08E                 mov     ecx, eax
.xdata:0000000078E6D090                 jmp     short loc_78E6D056

But IDA doesn’t like me patching that and turns it into this

.xdata:0000000078E6D07F ; ---------------------------------------------------------------------------
.xdata:0000000078E6D084                 db  9Ah ; š
.xdata:0000000078E6D085                 db 0C0h ; À
.xdata:0000000078E6D086                 db 0E8h ; è
.xdata:0000000078E6D087                 db 0DFh ; ß
.xdata:0000000078E6D088                 db  78h ; x
.xdata:0000000078E6D089                 db    6
.xdata:0000000078E6D08A                 db    0
.xdata:0000000078E6D08B ; ---------------------------------------------------------------------------

No better of course and it crashes on the shambolic non-code. I tried just placing the W7 version of RtlSetThreadErrorMode into my kernel32, but it called something in a completely unrelated function just above it (GetCurrentProcessorNumberEx+2) and failed there.

I also wonder why RtlSetThreadErrorMode was implemented in Vista but SetThreadErrorMode wasn’t until 7.

update: So I noticed two calls to the same import, CsrClientCallServer (78DFE090). The one at 78DA0B24 looks like this:

FF 15 66 D5 05 00

While the call to it at 78DA0BA1 is like this:

FF 15 E9 D4 05 00

Perhaps I need to deduce something from that. Putting these somewhere else will direct them to a completely different memory address, so I need to figure out how to get to call 78DFE8C0 (RtlSetThreadErrorMode).

update: Apparently, a call cs:* only will call memory addresses below it, using the FF 15 ** ** 0* 00 format. But a quick look at XP x64’s kernel32 reveals that the import table is at the beginning of the file, so call cs:* must refer to addresses above them. And the format for those is FF 15 ** ** FF FF (for close ones seemingly) or FF 15 ** F5 FF for ones very far away, with options for going in between. In the end, I was able to call RtlSetThreadErrorMode using hex code FF 15 36 18 F9 FF.

And it fixed everything SetThreadErrorMode! YIP YIP HOORRRRRRRRRRRAY!!!!!!!!!!!!!!!!!!! I will promptly correct the other functions.

10 hours ago I actually doubted myself enough that I briefly thought that I went in wayyyy over my head with this supposed vapourware project but now it is anything but!!! I even did a little editing of the photo in there. Still some missing functions so other components may not work well but I think I’ve got all figured out.

Картинка с сайта: msfn.org

Edited June 20, 2020 by win32