Double Feature: Windows XP IRQL_NOT_LESS_OR_EQUAL and Windows Server 2008 Boot Loop

[richardfrost]

Hello, and thanks for your help in advance.

I'm a student taking a network security class, and my setup involves a Kali VM as well as three exploitable VMs. One of these is Ubuntu - it's working fine. The other two are Windows-based and they are the problem children.

The Windows XP VM tries to load, but on the first few frames of the "flag logo" appearing, I get a blue screen with the error IRQL_NOT_LESS_OR_EQUAL. Safe Mode and Safe Mode with Networking seems to work but I can't seem to figure out what the problem is. (Stealth edit, sometimes it freezes at this point instead)

The Windows Server 2008 host gets to a "Windows is loading files..." page with a progress bar. When the progress bar is full, the guest reboots. This happens continuously.

I just want to add this disclaimer, because I'm an IT student - fixing the VMs is not part of the assignment. Running port scans and finding vulnerabilities is. These guests should be working out of the box and so I'm wondering if I messed up some settings or such.

Included is a zip containing both log files. Let me know if there is any more information I can help provide.

Thanks! I really appreciate your help.

[mpack]

Where did you get this XP image? It doesn't seem to have been installed from scratch, the VDI has been copied from elsewhere. That makes this a migration project, not a working VM. For a modern OS this isn't such a big deal, but with XP it has to be done carefully, since the OS predates the era where disk imaging was common.

It's unfortunate that your other choice is Windows 2008. There are two quite different OS commonly referred to using that name, those being the original Windows 2008, and then Windows 2008 R2. The former is basically Vista, the latter is basically Windows 7. The former, just like XP, will not particularly enjoy radical changes of hardware. Things get better around the Win7 era though you can still get a driver crash (IRQL_NOT_LESS_OR_EQUAL) when a non-native driver loads and tries to find hardware that doesn't exist.

[richardfrost]

I got these VMs from .zip files posted by my instructor in Canvas. They contain a .mf file, a .ovf file, and a .vmdk disk image. I've been importing the .ovf file and hoping it works - should I be using another way to import the VM?

Sorry for my ignorance, usually imports go a lot smoother than this.

[scottgus1]

The XP VM shows no troubles in the Virtualbox 'hardware' that I can see. I do see a reset & reboot that may correspond to the BSOD. The virtual drive's cylinder-head-sector count is:

00:00:05.380767 VMMDev: Guest Log: BIOS: ata0-0: PCHS=16383/16/63 LCHS=1024/255/63

There was some recent changes made in the Virtualbox legacy drive CHS sensing code, I don't know if this change is resulting in bad numbers here. The forum gurus might be able to say.

The 2008 VM has RAM config issues:

00:00:03.832423 Host RAM: 8097MB (7.9GB) total, 3804MB (3.7GB) available
00:00:04.079043 RamSize <integer> = 0x0000000100000000 (4 294 967 296, 4 096 MB, 4.0 GB)
00:00:04.079279 VRamSize <integer> = 0x0000000008000000 (134 217 728, 128 MB)

Windows wants all the RAM available at boot, so that RAM setting was a no-go.

This is the 2008 CHS, no idea if it's important:

00:00:37.201833 VMMDev: Guest Log: BIOS: SCSI 0-ID#0: LCHS=7830/255/63 0x0000000007800000 sectors

If these VMs did boot on other students' PCs, maybe the students were running an earlier version of Virtualbox before the CHS change. You might want to try rolling back to 6.1.32. See the Old Builds link on the Downloads page. If you do try a rollback, you may need to turn off Hyper-V on the host, see HMR3Init: Attempting fall back to NEM (Hyper-V is active).

Of course the CHS question may be the wrong idea. Ultimately, the VM 'hardware' was running, and the OS's were having the issues.

wondering if I messed up some settings or such.

Did you change any? You were importing VMs with previously-set settings. Changing something could have glitched the VMs.

[fth0]

There was some recent changes made in the Virtualbox legacy drive CHS sensing code, I don't know if this change is resulting in bad numbers here.

The PCHS/LCHS numbers are fine here. If there was any problem with disk geometry, the VM statistics under /Public/Storage/* wouldn't have had a chance to accumulate megabytes of read data.

I'd rather go for the NEM mode or the RAM (like you already did).

[richardfrost]

The 2008 VM has RAM config issues:

Makes sense. I seem to be running this on a shoestring RAM budget - my laptop's 8GB is not a lot to run Kali, a 4GB Windows Server, and the overhead of the host (Windows). I'll lighten up as much as I can. This assignment is certainly motivating me to save up for a new PC!

Did you change any? You were importing VMs with previously-set settings. Changing something could have glitched the VMs.

I reinstalled the XP guest and left the setting completely intact (didn't increase the (in my eyes) ridiculously low 16KB of VRAM) and it seems to be going a bit further. Goes to show how much I know about XP-era computing capabilities.

I'll definitely reach out to my instructor to see if other students are having these issues. Ah, the joys of remote learning and having no points of reference.