Patch Vista’s Kernel to Address more than 4 GB of Memory

As you may know the 32 bit, also called x86, editions of Windows Vista cannot address more than 4 GB of memory. You may think this 4 GB is a limit of the processor but this isn’t true; using Physical Address Extension (PAE) it’s possible to address more memory

Enterprise Server versions of Windows (2003 and 2008) can already address more than 4 GB of memory so why can we not do that with Vista? The answer is: Microsoft doesn’t want that! It is all just a licensing matter, we can see this in the registry. Take RegEdit and goto HKLM\CurrentControlSet\Control\ProductOptions and doubleclick the Value ProductPolicy, scroll down a little until you see the value “Kernel-PhysicalMemoryAllowedx86″, next to it is the value 01 00 which corresponds to 4096 (1000 is the Hex of 4096):

RegEdit1

We can also see where this (and other licensing values) come from: if we look in %systemroot%\system32\licensing\ppdlic al license values are in XML files. The memory value is in Kernel-ppdlic.xrm-ms:

LicenseXML

We cannot make alterations to the registry values or to this xml file; the registry values are rebuild on every reboot and the xml file is protected with a signature

Unlike other licensing values (like activation) which are checked through slc.dll this particular value is checked and enforced in the Kernel. I though that patching the kernel was not possible due to Vista’s integrity checks. But then I read Geoff Chappell’s article about Vista’s Memory Limit. Geoff describes in detail how and where the check is done and even shows us what to patch.

I followed Geoff’s description and patched my kernel (carefully read Geoff’s instruction about checksum, signing and so on!) and I can confirm that his patch works perfectly!

I also noticed something else: my Dell Laptop has 4 GB of memory of which I was only able to use about 3,5 GB. This is due to a portion of the address space that is allocated to my video card (address space, not memory!). We can see with Alex Ionescu’s MemInfo tool there’s a gap between 9F0000 and 100000:

MemInfo1

We can also see in TaskManager that only 3581 MB is available:

TaskMgr1

Let’s see what that looks like after the patch:

meminfo2

We gained the missing memory ;-)

TaskManager confirms that:

taskmgr2

If you would like to patch your kernel you can download the dUP2 file below. Please check if creating and/or using this patch is legal according to your country’s laws and your license agreement and of course carefully read Geoff’s instructions.

The patch was tested on both SP1 and SP2.

Vista NT Kernel Patch (8618)

Leave a Reply

  1. I didn’t test it on Windows 7 but it’s likely to work if the bytes match (if dUP2 accepts the 7 kernel because the byte pattern is found then you should try it).

  2. sounds interesting, although i never had vista installed for more than a day. but maybe for Windows 7 this could prove useful =)

    found a little typo:
    “next to it is the value 01 00 which corresponds to 4096 (1000 is the Hex of 4096):” 01 00 10 00

    lector

  3. @lector: actually the value is a DWORD so (as Geoff also pointed out) the value includes the 00 before and the 00 after the marked area.

  4. The same rule could be applied on WinXP? (for override the 4GB memory limit)

  5. Why not using 64 bits edition of Vista directly? I’m having Vista x64 edition installed on my laptop and I can see 4Gigs of RAM direcly without patching.

    My 32 bits applications are working too (like Office 2007, or VMware Workstation etc….)

    Cheers
    Vladan

  6. Vladan,

    Using x64 versions restricts you to use only singed drivers, and can have some compatibility issues with native or low/level x86 application. But, in general, using x64 versions is of course a preferrable choice.

  7. hi, i have for some time been watching with bated breath…lol..

    When the is a patch for xp pro to read more than 3.5 gb memory..would you please either send it or post a download link..
    regards and best wishes in anticapation..

  8. yes, please help on XP. I want to fully make use my 4GB memory. Thanks again.

  9. Pingback: Memory Remapping on this Motherboard? - Page 2 - HardwareLogic

  10. Great! I was talking to Geoff and I am interested in modifying my kernel, and Geoff referred me to your website. *and yes, some people don’t understand the why PAE “does not work”. It’s not just about adding /force PAE or something. Ü

  11. Pingback: Maximum Windows 7 memory allowed? - Page 2

  12. the patch doesn’t work with Vista Ultimate sp2 ntkrnlpa version 6.0.6002.18005

  13. A Russian origin patch enabling 4Gb usable on Windows 7 x86. Just press “Разблокировать” button, and then Yes, and will proceed automatic restart. If you don’t like the patch, you can uninstall it (or edit) by viziting menu START > MSCONFIG > and then booting options. Or via EasyBCD. The pacth just adds an alternative boot option with modified kernel supporting full 4Gb RAM support with PAE enabled. See what is PAE in the archive.
    P.S. No viruses inside, you can check by any antivirus software.

    Uploaded here for maximum spread:
    http://www.kiloupload.com/file/2a3ae72e3cacdf4d397ad92a249bd367/4GB7600RTM8604082009.7z

  14. Pingback: Make Windows 7 and Vista 32-bit (x86) Support More Than 4GB Memory » Raymond.CC Blog

  15. my memmory is 4GB RAM. bad it my PC read it only 3000+ MB. Can you help totally read all 4GB in my laptop. I’m using Windows Vista SP1

  16. Just question.
    Did anybody tried to allocate even “recovered” memory?
    And had anybody tried writting into that address range allocated to video drivers? And had it any effect?

    One note,this is not licensing.(That’s mostly for x64-limited eds) But x86 cannot address more then 4GB.
    The only partiall extension is through AWE and PAE.
    To use AWE a programm has to be written for it and PAE requires activeted flag in executable image.

    This sounds as not good idea at all…
    Absolutely not recommended for anybody!

  17. Pingback: ویندوز ویستا و سون نسخه 32 بیتی و داستان پشتیبانی نکردن از 4 گیگ رم | ايران گت :: IranGet

  18. Hi Klimax,

    You’ll be able to get 4GB (or even more – you can use up to 64 GB in x86) of usable memory ONLY if your motherboard supports memory remapping feature. “x86 cannot address more then 4GB.” – this is completely wrong. As i remember, from Pentium or maybe Pentium pro processor can address up to 2^36 = 64 GB of physical memory in PAE mode, so the only thing which is needed – is OS support. Windows 2000 (server version) can support more than 4 Gb of physical memory (http://www.microsoft.com/whdc/system/platform/server/PAE/PAEmem.mspx)
    – and Windows 2000 Professional cannot. Why? The only difference is in licensing. If you patch Windows 2000 kernel, it will allow you to use all of your physical memory.

    Also please note that all processes are using virtual memory, not physical. Yes, even if you have got 8 GB of physical memory installed, EACH process can still access only 2 GB of virtual memory (or 3 if you boot with /3GB switch). But you can run 4 processes and each of them will be able to access 2 GB of virtual memory, giving you utilization of 8 Gb of physical memory.

    In case you’re still doubting, you can boot your windows with /nolowmem parameter (http://msdn.microsoft.com/en-us/library/ms791499.aspx), which restricts windows from using the lower 4GB of physical memory and test your system. However, at least, in Windows XP/2003, you must have 5 GB or more (or patch kernel :-) ) to successfully execute this switch.

  19. Is there a reason why we shouldnt use 64bit? As far as i have read, it doesnt have the xp64bit-like compatibility issues…

  20. Pingback: Make Windows 7 and Vista 32-bit (x86) Support More Than 4GB Memory | PC Index

  21. Paren,

    There is almost no reason; however, drivers’ support for x64 is much lower than for for x86, some low-level applications will not work, so if you have old hard and/or software, you should test all of your needed apps and hardware to work correctly with x64 OS before moving.

  22. Pingback: Hack your Windows Vista 32 bits to address 4GB or more of RAM - Kartones Blog

  23. Pingback: Il meglio della settimana dal web #2 | Simo Blog

  24. Pingback: Windows 32bit vs 64bit e la RAM | Simo Blog

  25. Pingback: Wndows Vista and Seven | Information India

  26. Thanks Remko, it took me some time to fully understand what needs to be done and I read yours and Geoff Chappell’s article several times. One must really point out that a copy of the file is needed and the safest way is to create a new bcd profile via bcdedit. I will test it for some time and I might even consider adding more memory, so I can run a virtal machine without a fear of performance issues :) Geoff and Remko, nice work.

  27. Pingback: Acer TravelMate 7730-844G50BN maximaler Arbeitsspeicher - Seite 2 - Acer-Userforum.de

  28. When I launch your patch on windows vista 32bit sp2, it states the “ntkrnlpa.exe” is in use and refuses to patch it. I have administrator privileges, what can I do?
    Thank you in advance.

  29. @Nico: You can never patch a file that’s in use (and the Kernel is really in use ;-) so you need to make a copy of the kernel, patch it and make a seperate entry in your boot configuration as per Geoff’s instructions.

  30. Remko,

    how exactly do you make a seperate entry in your boot configuration?

    Geoff’s instructions might be great but they are very long

  31. Hello! is it possible to have the istruction in italian?
    I need to understand the way to create a second o.s that can be changed by the patch..because if i do’nt do it the patch does’nt work…..
    Thank for eventually answars!=)
    Bye

  32. Hi Remko,

    Are you still working on a XP patch? If so can you please let us know the progress.
    Thanks a lot in advance.

  33. I dont know where to look for the instructions by geoff explaining the separate boot entryies. If i slaved the drive that has the ntkrnlpa.exe and patched it from a separate machine would that work… scuse the grammar… rough day.

  34. Hi!
    is it possible to have an italian version of the geoff’s tutorial…?
    Thanks bye

  35. Pingback: GUIDE: Make Vista and Windows 7 x84 Support More Than 4GB of RAM - Overclock.net - Overclocking.net

  36. Not my own work, found from another forum, for XP SP3 but cannot use any USB devices (you have to use PS2 mouse/keyboard):

    1. Look for C:\WINDOWS\SYSTEM32\NTKRNLPA.EXE

    Original : BB 00 00 10 00 33 FF 6A 07 8B F0
    Modify To : BB 00 00 40 00 33 FF 6A 07 8B F0

    2. Save the modified kernel as mykernel.exe, put it under C:\WINDOWS\SYSTEM32\

    3. Open C:\BOOT.INI

    Copy and paste your original boot option, but add /PAE /KERNEL=mykernel.exe

    example:
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=”Microsoft Windows XP SP3 OVER 4G”
    /fastdetect /usepmtimer /NoExecute=OptOut /PAE /KERNEL=mykernel.exe

    4. Reboot, choose “Microsoft Windows XP SP3 OVER 4G” from the boot menu

  37. Hi Remko!
    i hope tath the patch willl be released soon because i don’t wont use vista…
    However i really tanks you for great work that you are doing.
    Bye
    Tziu

  38. How soon is soon for the XP SP3 patch? Please tell how much donation we need to make but we’d really like the XP kernel patch.

  39. Pingback: Windows 7 Starter Edition Problems Help Needed! - Page 2

  40. To those who are asking for an XP patch: Unfortunately the way the HAL was changed in XP SP2 would make a simple XP patch impossible. Read the section “Windows XP SP2″ of Geoff Chappell’s article.

  41. Pingback: Patch Vista

  42. Pingback: Make Windows 7 and Vista 32-bit (x86) Support More Than 4GB Memory « Anuranga

  43. Does any one have a clear instructions for me how I can make Windows 7 (Ultimate 64 bit) to see and make use of the 16 GB instead of the 3 GB

    regards
    Hans

  44. Pingback: Dear Visitor | Remko Weijnen's Blog (Remko's Blog)

  45. WOW – this one works! Sweet.


    Not my own work, found from another forum, for XP SP3 but cannot use any USB devices (you have to use PS2 mouse/keyboard):

    1. Look for C:\WINDOWS\SYSTEM32\NTKRNLPA.EXE

    Original : BB 00 00 10 00 33 FF 6A 07 8B F0
    Modify To : BB 00 00 40 00 33 FF 6A 07 8B F0

    2. Save the modified kernel as mykernel.exe, put it under C:\WINDOWS\SYSTEM32\

    3. Open C:\BOOT.INI

    Copy and paste your original boot option, but add /PAE /KERNEL=mykernel.exe

    example:
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=”Microsoft Windows XP SP3 OVER 4G”
    /fastdetect /usepmtimer /NoExecute=OptOut /PAE /KERNEL=mykernel.exe

    4. Reboot, choose “Microsoft Windows XP SP3 OVER 4G” from the boot menu

  46. ouay,

    XP patch is a more difficult task to do, as not only ntoskrnl should be patched, hal.dll also has problems with using it. Of course, you can use hal.dll from XP SP1, but it produces much incompatibility as well.

  47. daNIL!

    Thanks for answer! Well… I did it and XP SP3 can see all my 6 GB of RAM. All works really faster… Unfortunately i have many diff. problems with USB devices (pendrives and external usb hdd).
    I guess maybe we could use usbstor.sys from server 2003 or so (http://support.microsoft.com/kb/873402/EN-US) as well as other files needed to proper work of hex fixed XP SP3.

    How looks hal.dll issues? I can made tests. I did not noticed more problems than with usb.

    Hex trick is mentioned only on chineese sites till now – so not many infos. I found somewhere that using Gavotte Ramdisk fixing USB problems but can’t find this chinese site anymore (opera tabs gone when using portable Opera from… USB HDD). ;)

    IMO this hex way is worth to give it a try as looks till now very promising, and I hope USB problems may be fixed by using server drivers.

  48. “Of course, you can use hal.dll from XP SP1″

    I see – anyway – I will try to use hal.dll from Windows Server 2003 SP2. Well, maybe this one’ll fix USB errors without special efects.

  49. It is me again. :)
    Unfortunately hal.dll from XP SP1 not work at all (freez during boot), same problems with hal.dll from Windows Server 2003 SP2 (msg about missing dll during boot).

    So – just re-change hal.dll will not work. I do not use USB mouse/keyboard – so it is not problem, but need to use pendrives and ext. USB HDD. So if someone is reading this – please give me some more ideas.

    Maybe someone knows what (techincaly) is making such issues with USB drives? And why it is not problem for other 32bit systems with more than 4GB of RAM (like Windows Server 2003)?

  50. Hi quay,

    Are you sure you’re using the correct hal.dll? There are many versions of them, to detect the correct one you need to open your original hal.dll in explorer (rightclick-properties) and look for the original name.

    In the Version tab, look for the original file name property. For example, on my PC it’s halmacpi.dll. So, you need to extract halmacpi.dll from XP SP1 distributive to system32 folder, and modify/add the boot.ini menu to include it like this

    multi(0)disk(0)rdisk(0)partition(1)\WINNT=”Windows XP Professional patched halsp1″ /pae /fastdetect /kernel=ntkrnlp2.exe /hal=halmacpi.dll

    Not sure which hal.dll you’re using, but it works ok on my pc, usb drives and DMA are working.

    Do not try Server 2003 SP2 halls, as they are not binary-compatible with XP (different set of imported/exported functions)

  51. Uh. Shame. I just replaced hal.dll with this one from SP1. :|
    Will test proper way now! Have you USB issues with original SP3 hal? Or it is just me?

    “[...] but it works ok on my pc, usb drives and DMA are working.”

    So? You think such tweaked XP (patched NTKRNLPA.EXE + halmacpi.dll from SP1) is OK for smooth using 4GB+? Or there are/will be other (yet hidden) problems?

    It is great challenge to do it. Even it is not needed prolly. ;)

  52. whooooooaaaa it works now!
    I’ve never seen so fast windows in my life! (Since old days of XP SP1 maybe).

    Awesome. Thank you for your support! WD!

  53. Well, on my pc, usb camera is not working correctly (seems that palette/camera data is completely wrong), but this may be the problem of the poorly written driver. Sometimes I’m also facing the bugcheck (blue screen) if I try to shadow the console session from the RDP session. Apart that, everything seems to work ok. I would recommend you to do a very proper testing of the system before using it in your home/dev environment.

  54. quay,

    You’re free to write it yourself :-) Actually i do not think that using SP1 hal.dll on SP3 machine is a good idea – that’s why i never published it. The proper way is to patch hal.dll from SP3, but, as it cannot be simply patched (the function code was simply removed, so it requies something like full decompilation – change implementation – full recompilation), i cannot offer this solution.

  55. I am trying to patch Windows Home Server 2011 to allow more than 8 GB, as i have 16 GB installed and want to use those for VMs as well.

    I have put the Kernel into IDA and I can Find ZwQueryLicenseValue/ExVerifySuite, but the references are quite different different on this (x64) kernel. There are no such xmls and it seems different in the registry too. The Kernel seems to do it in a different way. Also the function MxMemoryLicense does not exist…

    Anybody has a clue how to get the Kernel to allow all the memory ? I have studied Geoff’s article as well but it is a dead lead for x64 as well it seems …

  56. 1. Look for C:\WINDOWS\SYSTEM32\NTKRNLPA.EXE

    Original : BB 00 00 10 00 33 FF 6A 07 8B F0
    Modify To : BB 00 00 40 00 33 FF 6A 07 8B F0

    2. Save the modified kernel as mykernel.exe, put it under C:\WINDOWS\SYSTEM32\

    3. Open C:\BOOT.INI

    Copy and paste your original boot option, but add /PAE /KERNEL=mykernel.exe

    example:
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=”Microsoft Windows XP SP3 OVER 4G”
    /fastdetect /usepmtimer /NoExecute=OptOut /PAE /KERNEL=mykernel.exe

    4. Reboot, choose “Microsoft Windows XP SP3 OVER 4G” from the boot menu

    not working, still 3gb ram

  57. Hello pp03@o2.pl,
    “Remap memory”, “memory swap”, or “swap memory above 4G” bios setting must be also activated. If the memory is not swapped, nothing will give you your memory, since these addresses (between 3 and 4 GB) are usially used to connect to hardware.

  58. It is worth to note, that some older Mainboard chipsets, just can not do this, they are limited to 3+ GB by Hardware, like certain intel chipset (mobile 845 and others i believe, i have this issue on Sony Napa based Notebooks for instance). Nothing you will go will give you more ram on those, even you run x64 will not give you the full ram inserted.

  59. thx for info, but i have acer 5738. where i can find bios with that option?

  60. 1. Look for C:\WINDOWS\SYSTEM32\NTKRNLPA.EXE

    Original : BB 00 00 10 00 33 FF 6A 07 8B F0
    Modify To : BB 00 00 40 00 33 FF 6A 07 8B F0

    (1000 is the Hex of 4096)
    (4000 is the Hex of 16384)

    2. Save the modified kernel as mykernel.exe and put it under C:\WINDOWS\SYSTEM32\

    3. Look for C:\WINDOWS\SYSTEM32\HALMACPI.DLL(from WindowsXP SP1 x86)

    4. Take the HALMACPI.DLL(from WindowsXP SP1 x86) and put it under C:\WINDOWS\SYSTEM32\

    5. Open C:\BOOT.INI

    Copy and paste your original boot option, but add the new parameter

    example:
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=”Microsoft Windows XP SP3 X86 OVER 4GB RAM”
    /fastdetect /NoExecute=OptOut /pae /kernel=mykernel.exe /hal=halmacpi.dll

    6. Reboot, choose “Microsoft Windows XP SP3 OVER 4GB RAM” from the boot menu

  61. Hello TomyLee,

    You shouldn’t always take the HALMACPI.DLL, you should follow my procedure and identify the correct hal.dll for your particular system before patching. Using incorrect hal.dll can prevent your system from booting in this configuration.

    And again, if you doubt about this procedure (windows xp patching), just create a bootable windows xp x64 or any 64 bit operating system partition/usb/cd drive, and try to boot it. If it shows you all of your memory, then something is wrong with the patching.

    If it still cannot use all of your memory, then there is nothing you can do, as it’s a hardware problem.

  62. Mauro, isn’t it a trojan? Is there a more detailed information on that lone “exe”?

  63. the methd is same
    boot.ini
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=”Microsoft Windows XP Professional 8gb” /noexecute=optin /fastdetect /KERNEL=mykernel.exe /hal=halmacpi.dll /PAE

    mykernel.exe is NTKRNLPA.EXE patched
    using
    Original : BB 00 00 10 00 33 FF 6A 07 8B F0
    Modify To : BB 00 00 40 00 33 FF 6A 07 8B F0

    c:\windows\system32\HALMACPI.DLL is last version 5.1.2600.5687

    and

    VSuite Ramdisk (Server Edition)
    using for create system bus extension
    in device manager using for USB work correctly

    this is it
    not a trojan in my files :)
    i using perfect here

    VSuite Ramdisk (Server Edition)

  64. Mauro, tested your patch. Few comments:

    - it’s better to use %windir% variable, cause not everyone uses c:\windows.
    - it’s better to add a string to boot.ini, then overwriting it completely.
    - it’s better to patch user’s ntkrnlpa.exe, then using one from patcher’s machine. F.e. I had the same version (5.1.2600.6055) but somehow it had a different size and yours didn’t work for me, I had to patch my file manually.

    And finally, this VSuite RAMdisk didn’t help to solve USB unavailability for me out of the box. Trying now to fix it somehow…

  65. And Mauro, why do you put halmacpi.dll in your distribution? Is it kinda special? I’ve read that some people put halmacpi.dll from XP SP1, but yours is from XP SP3 according to file version (5.1.2600.5687 (xpsp_sp3_qfe.080930-1426)).

  66. System Bus Extension from Romex installed and functioning correctly, but USB doesn’t work. Nor USB mice, nor storage USB Flash cards.

  67. Remko, plz, could you share your opinion about why USB is not working after patching windows XP kernel?

  68. Give me an error hal.dll … (WinXP patch) what can I do? I use WinXP italian version.

  69. i investigate driver video depends not work i us geforce and 295.51 beta is works installl this my usb recognize ok
    if install 285.66 no work usb no function driver in kernelpach peaple test if you using geforce

  70. Pingback: Vraagje RAM - 9lives - Games Forum

  71. Pingback: Intrebare upgrade win32 la win 6 4 - windows7

  72. Any idea, why usb only working for external USB3 controller? Trying on-board controller, but vid/pid=0 and device not working