Windows 7 Starter with (up to) 128GB RAM

So most of my computers run a version of Ubuntu, Debian or Android. Used to be contrarian, but these days seems more devices are built on Linux kernels than almost any other type, so I’m just part of the mainstream.

Unfortunately, I also love the occasional First Person Shooter video game, or spend hours in an immersive Virtual Reality environment. It is an addiction, which I can mostly control. But sometimes, well, game on.

The one thing that Linux doesn’t do well is gaming. All the best games these days are released on the DX10 or DX11 platform on Microsoft Windows 7. So, like an alcoholic with a whiskey stash, I need to keep a Windows version stashed somewhere to appease the addiction.

Recently, I purchased a HP Netbook. The Windows 7 system it came loaded with was erased within 90 minutes of unboxing, and that was that.

When it came to rebuilding and upgrading my gaming machine, I thought why not repurpose that Windows 7 Starter licence as my DX11 gaming platform. A few hours later, with my shiny new Windows 7 Starter SP1 was installed, validated, and perfectly legal, I found only two issues with the Window 7 Starter SP1 operating system.

  1. No Aero. Being used to Compiz on Ubuntu, being stuck on one screen with few decorations seemed pretty last millennium. But since this is a gaming stash, that I will always be playing full screen, there is really no downside.
  2. Limit to 2GB RAM. The Windows 7 Starter version does not support more than 2GB of RAM, though other versions reportedly support up to 4GB. This was a problem for me, as my machine runs much more RAM, and I hate waste.

Microsoft provides this table describing the limits on X86 (32bit) Windows 7.

Version Limit on X86 Limit on X64
Windows 7 Ultimate 4 GB 192 GB
Windows 7 Enterprise 4 GB 192 GB
Windows 7 Professional 4 GB 192 GB
Windows 7 Home Premium 4 GB 16 GB
Windows 7 Home Basic 4 GB 8 GB
Windows 7 Starter 2 GB 2 GB

The dirty little secret

The secret that Microsoft doesn’t want to tell you is that 32-bit editions of Windows 7 are limited to 4GB is not because of any technical constraint on 32-bit operating systems. All the 32-bit editions of Windows 7 contain the code required for using physical memory above 4GB. Microsoft just doesn’t license you to use that code.

I sourced the information I’m quoting from Geoff Chappell’s web site, and I’ve found it to be completely true.

There are other resources on the Internetz and Torrentz that provide some patch code together with mysterious installers that may or may not address the memory limitation issue, too. But, since we’re dealing with the Kernel of my operating system, I was not sure that they would or would not add any Trojans, Malware, or similar. So let’s stay away from that stuff.

Following the recipe

Following Greg’s recipe to create a kernel is relatively simple. He lists all the things to do very clearly. I have extracted some of his words below, and modified them for my simple minded clarity.

The only executable that we’re going to touch is the PAE kernel, named NTKRNLPA.EXE, from 32-bit editions of Windows 7 SP1. The known builds have a routine named MxMemoryLicense in which there are two sequences of nearly identical code, one for each relevant license value. Each sequence calls the undocumented function ZwQueryLicenseValue and then tests for failure or for whether the data that has been read for the value is zero. In the known builds, each sequence has the following instructions in common:

Opcode Bytes Instruction
7C xx
jl      default
8B 45 FC
mov     eax,dword ptr [ebp-4]
85 C0
test    eax,eax
74 yy
je      default

So the idea is to get A COPY of your NTKRNLPA.EXE and rename it ntkr128g.exe This is the file you are going to patch. Use a Hex/Byte editor to search for the byte string 8B 45 FC 85 C0 74. You will find approximately 25 occurrences of this byte string within the ntkr128g.exe file found in my Windows 7 Starter SP1 system. You need the PATCH THE LAST TWO OCCURRENCES ONLY.

Both occurrences are to be patched the same way. The patch is designed to vary the ordinary execution as little as possible. The kernel is left to call ZwQueryLicenseValue as usual and to test for failure, but the last three of the above instructions are changed so that the kernel proceeds as if the retrieved data is the value that represents 128GB (which is the least value that removes licensing from the kernel’s computation of maximum physical address). Change the 7 bytes starting from 0x8B so that you now have the following instructions:

Opcode Bytes Instruction
B8 00 00 02 00
mov     eax,00020000h
90
nop
90
nop

This means that you replace the last two occurrences of 8B 45 FC 85 C0 74 yy with B8 00 00 02 00 90 90 in the file. Great. You’re done. Well not really. You have to follow Greg’s instructions to add a digital signature to the kernel, so that it can boot properly.

To add the digital signature, you need to download the Microsoft Software Development Kit, and install the tools (only tools required) to get access to the certification and signing tools to enable the kernel to boot. I did it. It is not hard. Just a little time consuming.

In Test Mode, the loader relaxes its integrity checking such that any root certificate is accepted. For suitable tools, with documentation, look in either the Windows Software Development Kit (SDK) or the Windows Driver Kit (WDK). To make your own certificate, run some such command as

makecert -r -ss my -n "CN=On My Authority"

This creates a root certificate for an invented certification authority named “On My Authority” and installs it in the Personal certificate store, which is represented by “my” in the command. You can view the new certificate by starting the Certificate Manager (CERTMGR.MSC), which also lets you set a Friendly Name for the certificate if you want to keep it. To sign your modified kernel with this certificate, run the command

signtool sign -s my -n "On My Authority" ntkr128g.exe

If you want to save some time, you can get a signed kernel here.

Once you have a kernel, then the rest is pretty straight forward. You need to use the bcdedit command to create an alternative booting information, following Greg’s instructions.

bcdedit /copy {current} /d "Windows 7 128GB"

Interesting commands to add to the kernel (which you put back in the same directory as the original NTKRNLPA.EXE, of course) are below

{guid} refers to the id of the BCD entry that you’re editing.

bcdedit /set {guid} kernel ntkr128g.exe
bcdedit /set {guid} testsigning on
bcdedit /set {guid} pae ForceEnable
bcdedit /set {guid} increaseuserva 3072

These instructions tell the BCD boot loader to:

  • Load the ntkr128g kernel.
  • Ignore that Microsoft has not signed it. Treat it as a test kernel.
  • Force on PAE (Physical Address Extension). Which is irrelevant really, as it is automatically turned on when DEP (Data Execution Prevention) is enabled, which is the default case for Windows 7.
  • Increase the maximum amount of memory that a single application can address to 3072kB (up from 2048kB).

Update

On December 13 2011 Microsoft released an advisory that updates the kernel.

The above kernel has been updated to reflect this change and is now version 6.1.7601.17713.

Everything is working as usual.

Update

On April 10 2012 Microsoft released an advisory that updates the kernel.

The above kernel has been updated to reflect this change and is now version 6.1.7601.17790.

Everything is working as usual.

Update

In August (around the 16th) Microsoft updated the kernel.

The above kernel has been updated to reflect this change and is now version 6.1.7601.17803.

Everything is working as usual.

Update

Around 24th October 2012 Microsoft released an an advisory that updates the kernel.

The above kernel has been updated to reflect this change and is now version 6.1.7601.17944.

Everything is working as usual.

Update

Around 13th April 2013 Microsoft updated the kernel.

Update

Around 2nd November 2013 Microsoft updated the kernel.

Right click and “Save link as…”  ntkr128g

The above kernel has been updated to reflect this change and is now version 6.1.7601.18247.

Everything is working as usual.

Update

Around June 2014,  I’ve converted my machine to Windows7 x64. Blame Titanfall requiring x64. So, sorry I’m not maintaining this kernel any further. As of June 2014 everything was working as normal.

Presto up to 128GB RAM

Once this kernel is booted, you will note that the screen comes up with a small note in the lower right corner of the Desktop that Windows 7 is in “Test Mode”, which is to no
te that you’re testing your own kernel. Well great. Thanks.

Test_mode

But the good news can be seen on the Resource Monitor, with 8GB of RAM showing.

Resource_monitor

That’s it. Testing with real games (eg Battlefield 3) show that over 2.3GByte can be allocated to one application. Game on!

24 thoughts on “Windows 7 Starter with (up to) 128GB RAM

  1. Seriously? First, read this http://en.wikipedia.org/wiki/Hexadecimal “yy” is a substitute for an irrelevant hexadecimal value. Clearly, you can’t search for “yy” in a binary/hexadecimal file. But, you need to replace “yy” with 0x90, when you edit the file. What should you do? Read the instruction, carefully. It is correct. Good luck.

  2. Hey,
    Can you help me find ntkr128g.exe for this?
    I’m trying to fix this computer which runs 32bit Windows 7 and ntkr128g.exe was corrupted according to the Windows Startup Repair program as the root cause of the problem.
    What I want to do is replace the file by booting Linux off a USB and fixing the computer.
    If you can, upload the file onto a free file host that does direct downloads and reply with a link.
    Thanks

    • The provided file shouldn’t be (isn’t) corrupted.

      If the version numbers on your existing kernel and this kernel don’t match then it is possible Windows is calling out a problem it sees.
      The current kernel version, as reported by “Properties” is 6.1.7601.18113
      Please check and let me know.
      Thanks.

      • I can’t download the file. It says “not acceptable” in IDM and “file not found” in Chrome. Could you reupload it? Thanks a lot!

    • WordPress seems to fail in regularly hosting this file. As seen from comments above. Since it is a critical system file, for security and piece of mind, it is best to make it yourself.

  3. Hi Felipu.
    I’ve got an original “w7 starter” code-sticker, off a dead Toshiba nb200 netbook, and i wanted to use it for my i3/4g ram desktop. Installed it, activated it, but the “2g limitation” is a kill because i dont have access to a whole 2g of ram.
    I think i’ve done everything (fairly) right, but somehow i cant give it a go.
    After selecting “Windows 7 128g” at the boot-menu, goes straight to repair.
    The only “pickle” of the whole procedure (thats why i wrote “fairly right” :)), is the fact that while signtool gives a signature to ntkr128g.exe (according to “PROPERTIES”, its 6.1.7601.18247) still gives a “cant find file” error at cmd.
    Do you think that its not giving the right signature or something?
    Maybe i could try to force the “6.1.7601.18113” signature that you mentioned earlier manually?
    Thanks in advance for any help

    • I think the issue might be something to do with enabling a “test kernel” during the boot process (from memory. I’m working on something else right now, and will come back to this later).

      Make sure that this is the case in the bcd entry, as this command:
      bcdedit /set {guid} testsigning on.

      It is important to use the guid correctly for the new kernel file. It is different for every kernel.
      There is a bcdedit command to find the guid of the new kernel you’re working on, but I can’t remember it right now.
      Google is your friend.

      • Thanks for the immediate answer Felipu and i’m really sorry if i’m destracting you from your work:)
        Just two quick questions:
        Are you talking about the testsigning option? Its “on” as instructed.
        What do you mean by “boot config file”? Where can i find that?

  4. I have kernel 6.1.7601.17514 Win 7 Ultimate x86. My cpu does not support Nx bit or DEP but it does support PAE. I didn’t quite understand to replace 8B 45 FC 85 C0 74 yy with B8 00 00 02 00 90 90… Since I found the last two instances of 8B 45 FC 85 C0 74… which show as 2nd to last 8B 45 FC 85 C0 74 0A and last one being 8B 45 FC 85 C0 74 09. Should I replace the 0A or 09 with the 90? I’m guessing so… I’m downloading the 650MB iso of GRMWDK_EN_7600_1.ISO to sign it… guess ill mount the ISO and install it I guess…

    Will this work on a cpu that doesn’t support DEP or Nx bit? Yet does support PAE?

    Bios reports 4096MB, windows reports Installed 4096MB, yet total is 3326MB… Which leaves the 769MB as hardware reserved. Which is what I’m trying to resolve…

    THANKS!

    • There is no issue with Windows 7 Ultimate RAM at 4096MByte.
      The issue is caused by your hardware reserving RAM for GPU usage, or similar issue.
      The limitation is not a Windows related issue, IMHO.

      Yes, you need to change the two last occurrences as you point out. They are only the same in the bytes that you search. Following bytes are different, but are both replaced as indicated.

      Good Luck.

  5. Thanks I appreciate it. I’ll try it, did it resolve the same issue for you?
    What I feel is this patch is for people with 64 bit processors who have 32 bit windows and want to use all their ram.

    Which may not be the same case for a 32 bit processor in 32 bit windows.

    It is a server though with two xeon’s which support the 36-bit page size extension for this reason.

    This website shows the same 3.25gb usable and after patched, minimal hardware reserved… http://www.de-compiler.me/windows8rampatch.htm

    Thanks!

  6. If you’d like to understand the detail, please refer to Geoff Chappell’s website linked. It is fully explained there.

    The patch noted by Geoff Chappell is for any CPU that can run x86 mode Windows 7 Starter (or any other x86 version). It is irrelevant whether the CPU can do x64 mode.

    The web site that you refer to has an installer, and a more sophisticated mechanism. Something like that, I’d never let near my Kernel. Who knows what features it is adding, beside what it claims?

  7. Sorry to re-post but I didn’t read your above post. In regards to pulling a usable amount out that hardware reserved may have an effect on an x64 cpu. Since x64 cpu’s support Nx bit and DEP by hardware. A true x86 cpu typically will not support Nx bit or DEP which these operating systems appear to rely on for memory addressing.

    If what you say is correct about no difference in this mod in regards to applying it to a true x86 system, then that tells me there’s no reason why modding the kernel will not unleash that 769MB of hardware reserved.

    Thanks 😀

  8. Sorry but when I download the kernel file (left click and select save as..) it seems that it is corrupted..(!)
    Can someone upload a signed 6.1.7601.18247 kernel,for us?
    Thanks!

    • Gunter,
      good reference post, but I’d still not advise using some random tool on the internet.
      The DIY solution ensures that you’re not compromising on the security of your environment.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s