Page 1 of 1

[Solved] Do I have a Windows DLL hardening error?

Posted: 10. Mar 2021, 10:36
by dtpoirot
I have a Win10 laptop, which I keep up to date.
In the past few days, VirtualBox performance, running Linux VMs, has been severely impacted - to the point where I have switched to a different machine.

VBoxHardening.log shows SO many entries, but these two are suspect:
374c.37dc: supR3HardenedMonitor_LdrLoadDll: error opening 'C:\WINDOWS\system32\wintab32.dll': 0 (NtPath=\??\C:\WINDOWS\system32\wintab32.dll; Input=C:\WINDOWS\system32\wintab32.dll; rcNtGetDll=0x0

and:
374c.37dc: supR3HardenedMonitor_LdrLoadDll: error opening 'C:\WINDOWS\System32\edgegdi.dll': 0 (NtPath=\??\C:\WINDOWS\System32\edgegdi.dll; Input=edgegdi.dll; rcNtGetDll=0xc0000135

Edge? Really? Come on, Microsoft... Edge has just recently snuck back on my machine, so its going again. I am running an analysis which is taking all day but will reboot after to test...

Any confirmation out there?
Thank you!

Re: Do I have a Windows DLL hardening error?

Posted: 10. Mar 2021, 12:47
by mpack
Neither of those is suspicious. Zip the log and attach it here if you want further comment.

Re: Do I have a Windows DLL hardening error?

Posted: 10. Mar 2021, 17:09
by dtpoirot
These are the logs from a clean directory, load Ubuntu 18, and clean shutdown.

Re: Do I have a Windows DLL hardening error?

Posted: 10. Mar 2021, 18:02
by mpack
The exit code in your hardening log is 0, so you do not have a hardening problem.

Turning to the VM log...

Try not using 100% of available host cores, i.e. reduce the VM allocation to 2 cores. And increase graphics RAM to 128MB.

I also have a vague memory that there may also be a problem with a recent Ubuntu, but I don't remember details. Wrong forum for that discussion anyway.

Re: Do I have a Windows DLL hardening error?

Posted: 10. Mar 2021, 20:21
by dtpoirot
Thank you for the confirmation!

First, this was all working quite well last week. There are many folks in my company who see the same issues with Windows hosts. Linux and Mac, not so much.

I also have VMs for Windows 10 and FreeBSD. All see the same unusable level of slow down.

I have a few VMs with 2 cores. None of my Linux or FreeBSD VMs use any graphics at all - just console. I will play with configurations, but it seems to be limited to this Windows host...

Thanks again!

Re: Do I have a Windows DLL hardening error?

Posted: 10. Mar 2021, 20:34
by scottgus1
I don't see much of anything indicating a slowdown in the execution of the VM in the log. No heartbeat flatlines or anything.

Your host doesn't have Hyper-V enabled, which is good. Hyper-V causes slowdowns at times.

You have a really old fork of the Guest Additons installed:
00:03:58.554037 VMMDev: Guest Additions information report: Version 5.2.8 r120774 '5.2.8_KernelUbuntu'
maybe an influence, maybe not.

Total agreement with Mpack on the core count, 2 is better until you have 4 cores' worth of data to process at once. More cores slow down a VM because the host has to schedule the extra threads. The speed hit is only worth it when there's data to crunch.
dtpoirot wrote:There are many folks in my company who see the same issues with Windows hosts
As mentioned above, Hyper-V on the Windows host can cause issues, Your colleagues can look for the little green turtle with the V on its back in the VM's status bar, or search their vbox.logs for the words "Attempting fall back to NEM". If the turtle shows or that phrase is in the log, Hyper-V is enabled, see I have a 64bit host, but can't install 64bit guests and HMR3Init: Attempting fall back to NEM (Hyper-V is active).
You don't have this problem, though.

Re: Do I have a Windows DLL hardening error?

Posted: 11. Mar 2021, 01:55
by fth0
Why did you disable System > Acceleration > Nested Paging? ;)

Without nested paging (EPT/SLAT), the performance of a VM is expected to be considerably slower (e.g. by a factor of 5 to 10).

Re: Do I have a Windows DLL hardening error?

Posted: 11. Mar 2021, 11:58
by dtpoirot
Re: Guest Additions, the Ubuntu 18 system is a console-only VM. I don't recall installing the Guest Additions, but I will look into it.

Re: Disable Nested Paging. ...because I have been trying EVERYTHING to get this FreeBSD VM to come back from really poor performance.

Regarding cores, I have a i7-7820HQ CPU with four cores and 8 threads. When configuring a VM, do I consider my host has 4 cores or 8???

Thank you all for your kind attention to my issue!

Re: Do I have a Windows DLL hardening error?

Posted: 11. Mar 2021, 15:26
by scottgus1
dtpoirot wrote:do I consider my host has 4 cores or 8???
4 is the number to consider in your case. https://ark.intel.com/content/www/us/en ... 0-ghz.html

Your processor has 4 hyperthreaded cores. Word from the forum gurus is that hyperthreading does not help Virtualbox. Though there are a few esoteric uses where overprovisioning processors works, most usage benefits from less cores but not just one. Most modern OS's buzz happily on two, and some forum posters reporting slow processing with maximum VM processor count settings saw return to normal operation with just 2.

Re: Do I have a Windows DLL hardening error?

Posted: 11. Mar 2021, 17:37
by dtpoirot
Good to know. I thought I was choosing 4 threads of 8 and VirtualBox was smart enough to only let me have half of the available threads.

I see the "3 is better than 4, 2 is better than 3" case on my Mac VMs for sure!

Re: Do I have a Windows DLL hardening error?

Posted: 19. Mar 2021, 11:14
by dtpoirot
Ain't it always the way...

After chasing all manner of software issues, I finally came across the Intel Processor Identification Utility. This little gem let me know my CPU was in Temperature Throttling mode. It reported my i7 was running at 0.80 Ghz, or 800 MHz.

Further scouring of the interwebs unveiled a long-standing issue with Dell hardware. The fix was to remove the CMOS battery. That was a trip, as Dell starts with that battery and builds the Latitude (and XPS) machines from there. ...I got all of the dust out too!

I am back, rocking at 3.52 GHz and VirtualBox is running in a fantastic manner!

Stupid hardware...

Re: Do I have a Windows DLL hardening error?

Posted: 19. Mar 2021, 11:34
by mpack
Good catch. I had a similar problem a while back, due to dust buildup inside my desktop case: not throttling, just running hot and noisy. I gave the insides a thorough clean, and later on I renewed the thermal paste between CPU and cooler. Runs nicely now.