Windows 95 build 224

Windows 95 build 224 is the official Beta 2 build of Windows 95. It is available in both free and check/debug versions. However, the check/debug version of the build is not usable and refuses to boot due to a missing USER32.DLL.
In spite of date printed on CDs which were sent to testers, as well as content files' timestamp are set to 1994-10-28, however the layout.inf file in PRECOPY2.CAB suggests that the build was actually built on 1994-11-03, and thus it is possible that Microsoft decided to intentionally change the timestamps of the media files for an unknown reason.
== NFO file ==
The following NFO file was included as part of the PWA release.https://www.krnl386.com/leakdb/?query=224
== Bugs ==
=== Checked/debug version ===
Before getting into the reason of the problem, let's first get some more information about both free and checked/debug USER.EXE, since the blue screen of death error is occurring in USER.EXE's memory range.
It is worth saying that all other debug files operate properly and the system can boot with the checked/debug USER.EXE being replaced with the free/retail one. But we're not going to get any statement mentioning that the build is (Debug), nor we will see a desktop watermark saying "Debug Windows 4.00.224" at the right-bottom side of the screen since these strings are located in USER.EXE itself.
So, by measuring a lot of activity happening in the system during booting using the checked/debug USER.EXE by attaching terminal to WDEB386, and tracing where it might be faulting in, we ended into the following code in USER32.DLL:
013F:BFF64320  MOV     EAX,DWORD PTR [BFF6614E]
013F:BFF64325  MOV     AX,WORD PTR [EAX+0000024E]
013F:BFF6432C  SUB     AX,0EAA
013F:BFF64330  CMP     AX,0001
013F:BFF64334  SBB     EAX,EAX
013F:BFF64336  NEG     EAX
013F:BFF64338  RETD
Looking at the code in kernel-debugger, the area where it gets information from (i.e. address stored in DS:BFF6614E + 0x24E to it) was figured to be from a text: "Status = .Terminate =", and then subtracting 0xEAA from it and negation, looks like it's where the issue is located since before it returns, AX is 00000000. When we set it to 1 manually (r ax=1) and continuing booting the build, it showed the GUI.
But we still have encountered a Trap14 (0x0E). This time it was due to invalid address:
Trap 14 (0EH) - Page Fault 0004, Not Present, Read Access, User Mode
AX=91EFA600  BX=0066FA96  CX=815E173C  DX=00040990  SI=00540494  DI=0066FBA0
IP=BFF6467E  SP=0066F7B8  BP=0066FA18  CR2=91EFA646  CR3=003EE  IOPL=0  F=-- --
CS=013F  SS=0147  DS=0147  ES=0147  FS=1CBF  GS=1B57 -- NV UP EI NG NZ NA PE NC
013F:BFF6467E  MOVZX   EAX,WORD PTR [EAX+46]                DS:91EFA646=INVALID
Looking back into code that was prior to this line, we saw this:
013F:BFF6468D  MOV     EAX,DWORD PTR [BFF6614E]
So now we knew that this address (BFF6614E) has something important to do with the issue, if it is not even the case.
This address was later recognized to be the Shared Table address of USER32.DLL, and its pointer is to code segment 21 in USER.EXE, so now we need to do a comparison between the two USER.EXEs.
Thanks to Watcom Binary files dumper (wdump.exe) for its detailed report about USER.EXE. We have got the following information about this specific segment:
* Segment 21h in free USER.EXE starts at offset 0x67440 in the file and has a size of 0x452 and allocation of 0xEAA.
* Segment 21h in check/debug USER.EXE starts at offset 0x7E080 in the file, and has a size of 0x992 and allocation of 0x13EA.
By the help also of HxD, we copy/pasted segments from the files and compared them, and we discovered that the beginning of reserved area for data in the segment itself in the free USER.EXE starts at 0xAD, while in the check/debug one, it starts at 0x37B. So now we have the following two clues:
* The difference between allocations of free and checked/debug USER.EXE is 0x13EA - 0xEAA = 0x540.
* The difference between data locations between the two USER.EXEs is 0x37B - 0xAD = 0x2CE.
Now, by looking into the code, we can imagine the following: If all pointers between 0xAD and 0x452 in free USER.EXE should point to a location in the spare area in the segment, and between 0x452 and 0xEAA should point in the additional allocation by the operating system outside the segment's data, then in Check/debug USER.EXE should has its corresponding locations.
Now we switch over to IDA. We loaded USER32.DLL into it and searched for all codes that have BFF6614E into it, and we got around 20 results. What we are going to do now is the following:
* We look for any code with this layout:
MOV reg, DWORD PTR [BFF6614E]
ADD reg, offset
Or
MOV reg1, DWORD PTR [BFF6614E]
MOV reg2, (D)WORD PTR [reg1+offset]
* Now we look into the 'offset' value. If it was between 0xAD and 0x452, we need to add 0x2CE to it. If it was between 0x452 and 0xEAA, we should add 0x540 to it, and if it's beyond 0xEAA (e.g. 0x10000 was one of our results) then this should be left unchanged since it now points to another segment, which might be correct.
* By using HxD to edit manually most of the results that can satisfy our needs, this build can be brought to boot and work without any issue.
== Gallery ==
Windows95-4.00.216-Boot.png|Boot screen
20190202 174205.png|Setup initializes
20190202 174232.png|Installation prepares the Windows directory
20190202 174605.png|Begin copying files
20190202 174735.png|Copying Files 1
20190202 175053.png|Copying Files 2
20190202 183438.png|Freshly installed desktop on first startup
20190202 182549.png|Demo
Win95_224.png|System Properties
Chicago224chk-demo.png|Checked/debug build
Windows95-4.00.189-Safe.png|Safe to shutdown screen
=== Miscellaneous ===
WIN95 M7DDK.png|Driver Development Kit CD
WIN95 M7.png|English Retail Kit CD
Windows95-4.00.224-CD.jpg|International Version CD
Windows95Build224Disc.png|Software Development Kit CD
Windows95-4.0.224-StructuredTrialProgram.jpg|Structures Trial Program CD
Windows95-4.0.224-IncludesDevTools.jpg|Beta 2 with Development Tools (undumped)
==== Floppy disk scans ====
File:Windows95-4.00.224-Floppy1.png|Disk 1
File:Windows95-4.00.224-Floppy2.png|Disk 2
File:Windows95-4.00.224-Floppy3.png|Disk 3
File:Windows95-4.00.224-Floppy4.png|Disk 4
File:Windows95-4.00.224-Floppy5.png|Disk 5
File:Windows95-4.00.224-Floppy6.png|Disk 6
File:Windows95-4.00.224-Floppy7.png|Disk 7
File:Windows95-4.00.224-Floppy8.png|Disk 8
File:Windows95-4.00.224-Floppy9.png|Disk 9
File:Windows95-4.00.224-Floppy10.png|Disk 10
File:Windows95-4.00.224-Floppy11.png|Disk 11
File:Windows95-4.00.224-Floppy12.png|Disk 12
File:Windows95-4.00.224-Floppy13.png|Disk 13
File:Windows95-4.00.224-Floppy14.png|Disk 14
File:Windows95-4.00.224-Floppy15.png|Disk 15
File:Windows95-4.00.224-Floppy16.png|Disk 16
File:Windows95-4.00.224-Floppy17.png|Disk 17
== References ==
Category:Windows 95 builds