From: "The Owl" <theowl AT freemail DOT c3 DOT hu>
To: Eli Zaretskii <eliz AT is DOT elta DOT co DOT il>
Date: Fri, 4 May 2001 11:37:39 +0200
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: Re: win2000/ntvdm/djgpp (fwd)
CC: djgpp-workers AT delorie DOT com, sandmann AT clio DOT rice DOT edu
Message-ID: <3AF29483.25527.47F6564@localhost>
In-reply-to: <8011-Fri04May2001102913+0300-eliz@is.elta.co.il>
References: <3AF1D04F DOT 23054 DOT 180FCC1 AT localhost> (theowl AT freemail DOT c3 DOT hu)
X-mailer: Pegasus Mail for Win32 (v3.12c)
Reply-To: djgpp-workers AT delorie DOT com
Errors-To: nobody AT delorie DOT com
X-Mailing-List: djgpp-workers AT delorie DOT com
X-Unsubscribes-To: listserv AT delorie DOT com
Precedence: bulk

> > Windows Version: 00.16h
> 
> The last one puzzles me: is the major Windows version indeed zero?
> What happens if you modify the last printf like so:
> 
>   printf ("Windows Version: %X.%.2Xh\n", r.h.al, r.h.ah);

Windows Version: 0.16h

on w2k/sp1, ie. it appears to be really 0.

> > i'm not sure how i can get them to execute (load into a ntvdm process)
> 
> Try putting something in config.nt or autoexec.nt?  Maybe search the
> MS Knowledge Base for these names?

well, these files are supposed to be the equivalent of msdos.sys which
is loaded before any of those two files is consulted (or so would i think).

from a quick look at ntvdm it seems that it is ntvdm that decides which
one to load, based on the return value from GetSystemDefaultLangID
(it is in kernel32.dll). also, i looked at some of these files and how
they setup the PSP at offset 40 (dos version) and it always seemed to
be 0005 (ie. 5.0).

> I hope that the "True DOS Version" should remain unchanged.  If it
> does change, we are in trouble.

this brings up another possibility for detecting NT (and even various
versions of it), provided you are willing to use certain Bop interfaces:
you would do this by 'executing' an specific invalid opcode and detect
if you trigger an invalid opcode exception or get back some result. in
the latter case you would then know that you are under NT, and examining
the result would give you very specific ntvdm build info as there is
one specific Bop function that returns a flat address inside ntvdm which
i think is different for each build.