Hello, and thanks for your help in advance.
I'm a student taking a network security class, and my setup involves a Kali VM as well as three exploitable VMs. One of these is Ubuntu - it's working fine. The other two are Windows-based and they are the problem children.
The Windows XP VM tries to load, but on the first few frames of the "flag logo" appearing, I get a blue screen with the error IRQL_NOT_LESS_OR_EQUAL. Safe Mode and Safe Mode with Networking seems to work but I can't seem to figure out what the problem is. (Stealth edit, sometimes it freezes at this point instead)
The Windows Server 2008 host gets to a "Windows is loading files..." page with a progress bar. When the progress bar is full, the guest reboots. This happens continuously.
I just want to add this disclaimer, because I'm an IT student - fixing the VMs is not part of the assignment. Running port scans and finding vulnerabilities is. These guests should be working out of the box and so I'm wondering if I messed up some settings or such.
Included is a zip containing both log files. Let me know if there is any more information I can help provide.
Thanks! I really appreciate your help.
Double Feature: Windows XP IRQL_NOT_LESS_OR_EQUAL and Windows Server 2008 Boot Loop
-
- Posts: 3
- Joined: 28. May 2022, 05:35
Double Feature: Windows XP IRQL_NOT_LESS_OR_EQUAL and Windows Server 2008 Boot Loop
- Attachments
-
- logs.zip
- (50.49 KiB) Downloaded 9 times
-
- Site Moderator
- Posts: 39134
- Joined: 4. Sep 2008, 17:09
- Primary OS: MS Windows 10
- VBox Version: PUEL
- Guest OSses: Mostly XP
Re: Double Feature: Windows XP IRQL_NOT_LESS_OR_EQUAL and Windows Server 2008 Boot Loop
Where did you get this XP image? It doesn't seem to have been installed from scratch, the VDI has been copied from elsewhere. That makes this a migration project, not a working VM. For a modern OS this isn't such a big deal, but with XP it has to be done carefully, since the OS predates the era where disk imaging was common.
It's unfortunate that your other choice is Windows 2008. There are two quite different OS commonly referred to using that name, those being the original Windows 2008, and then Windows 2008 R2. The former is basically Vista, the latter is basically Windows 7. The former, just like XP, will not particularly enjoy radical changes of hardware. Things get better around the Win7 era though you can still get a driver crash (IRQL_NOT_LESS_OR_EQUAL) when a non-native driver loads and tries to find hardware that doesn't exist.
It's unfortunate that your other choice is Windows 2008. There are two quite different OS commonly referred to using that name, those being the original Windows 2008, and then Windows 2008 R2. The former is basically Vista, the latter is basically Windows 7. The former, just like XP, will not particularly enjoy radical changes of hardware. Things get better around the Win7 era though you can still get a driver crash (IRQL_NOT_LESS_OR_EQUAL) when a non-native driver loads and tries to find hardware that doesn't exist.
-
- Posts: 3
- Joined: 28. May 2022, 05:35
Re: Double Feature: Windows XP IRQL_NOT_LESS_OR_EQUAL and Windows Server 2008 Boot Loop
I got these VMs from .zip files posted by my instructor in Canvas. They contain a .mf file, a .ovf file, and a .vmdk disk image. I've been importing the .ovf file and hoping it works - should I be using another way to import the VM?
Sorry for my ignorance, usually imports go a lot smoother than this.
Sorry for my ignorance, usually imports go a lot smoother than this.
-
- Site Moderator
- Posts: 20945
- Joined: 30. Dec 2009, 20:14
- Primary OS: MS Windows 10
- VBox Version: PUEL
- Guest OSses: Windows, Linux
Re: Double Feature: Windows XP IRQL_NOT_LESS_OR_EQUAL and Windows Server 2008 Boot Loop
The XP VM shows no troubles in the Virtualbox 'hardware' that I can see. I do see a reset & reboot that may correspond to the BSOD. The virtual drive's cylinder-head-sector count is:
The 2008 VM has RAM config issues:
This is the 2008 CHS, no idea if it's important:
Of course the CHS question may be the wrong idea. Ultimately, the VM 'hardware' was running, and the OS's were having the issues.
There was some recent changes made in the Virtualbox legacy drive CHS sensing code, I don't know if this change is resulting in bad numbers here. The forum gurus might be able to say.00:00:05.380767 VMMDev: Guest Log: BIOS: ata0-0: PCHS=16383/16/63 LCHS=1024/255/63
The 2008 VM has RAM config issues:
Windows wants all the RAM available at boot, so that RAM setting was a no-go.00:00:03.832423 Host RAM: 8097MB (7.9GB) total, 3804MB (3.7GB) available
00:00:04.079043 RamSize <integer> = 0x0000000100000000 (4 294 967 296, 4 096 MB, 4.0 GB)
00:00:04.079279 VRamSize <integer> = 0x0000000008000000 (134 217 728, 128 MB)
This is the 2008 CHS, no idea if it's important:
If these VMs did boot on other students' PCs, maybe the students were running an earlier version of Virtualbox before the CHS change. You might want to try rolling back to 6.1.32. See the Old Builds link on the Downloads page. If you do try a rollback, you may need to turn off Hyper-V on the host, see HMR3Init: Attempting fall back to NEM (Hyper-V is active).00:00:37.201833 VMMDev: Guest Log: BIOS: SCSI 0-ID#0: LCHS=7830/255/63 0x0000000007800000 sectors
Of course the CHS question may be the wrong idea. Ultimately, the VM 'hardware' was running, and the OS's were having the issues.
Did you change any? You were importing VMs with previously-set settings. Changing something could have glitched the VMs.richardfrost wrote:wondering if I messed up some settings or such.
-
- Volunteer
- Posts: 5677
- Joined: 14. Feb 2019, 03:06
- Primary OS: Mac OS X other
- VBox Version: PUEL
- Guest OSses: Linux, Windows 10, ...
- Location: Germany
Re: Double Feature: Windows XP IRQL_NOT_LESS_OR_EQUAL and Windows Server 2008 Boot Loop
The PCHS/LCHS numbers are fine here. If there was any problem with disk geometry, the VM statistics under /Public/Storage/* wouldn't have had a chance to accumulate megabytes of read data.scottgus1 wrote:There was some recent changes made in the Virtualbox legacy drive CHS sensing code, I don't know if this change is resulting in bad numbers here.
I'd rather go for the NEM mode or the RAM (like you already did).
-
- Posts: 3
- Joined: 28. May 2022, 05:35
Re: Double Feature: Windows XP IRQL_NOT_LESS_OR_EQUAL and Windows Server 2008 Boot Loop
Makes sense. I seem to be running this on a shoestring RAM budget - my laptop's 8GB is not a lot to run Kali, a 4GB Windows Server, and the overhead of the host (Windows). I'll lighten up as much as I can. This assignment is certainly motivating me to save up for a new PC!The 2008 VM has RAM config issues:
I reinstalled the XP guest and left the setting completely intact (didn't increase the (in my eyes) ridiculously low 16KB of VRAM) and it seems to be going a bit further. Goes to show how much I know about XP-era computing capabilities.Did you change any? You were importing VMs with previously-set settings. Changing something could have glitched the VMs.
I'll definitely reach out to my instructor to see if other students are having these issues. Ah, the joys of remote learning and having no points of reference.