Believe it or not

I was having the same issue, pounding my head against the wall in Windows 7. Believe it or not this fix is still relevant. The instructions are in a different location within the file but doing the find and replace worked perfectly!

Wouldn't have gotten this myself in 10 years, very nice work sir!

> On Saturday, December 01, 2007 12:34 PM djrob wrote:

> Problem:
>
> On my Mac Pro with 5GB of system memory, Aero intermittently shuts
> down. Balloons appear in the lower right reporting that "Windows has
> detected that performance is low" or that it has "exceeded dedicated
> memory". The same behavior occurs with a NVidia 6300GT with 256mb,
> or an ATI X1900XT with 512mb.
>
> Additionally, Desktop Window Manager will make log entries:
>
> 9025: The Desktop Window Manager has stopped locking system memory due
> to passing its working set threshold
>
> 9024: The Desktop Window Manager has been disabled automatically by
> the system due to too much system memory in use
>
> The amount of windows that need to be open to trigger the problem
> varies. You might be able to open dozens of windows and have it be
> OK, and later find Aero shut down with only 10 windows on the
> screen.
>
> I can consistently cauase Vista to trigger the bug by sleeping and
> waking the machine.
>
> I am fairly certain this is a bug in DWM pertaining to the large
> amount of system memory overflowing a 32 bit integer somewhere.
> According to Microsoft's Aero documentation, these events should be
> triggered when Aero uses more than 25% and 30% of system memory,
> respectively. But on my system, this happens when extremely small
> percentages of the system memory is in use.
>
> I have reported the incident to Microsoft. They provided a hotfix
> which did not work.
>
> Taking matters into my own hands, I attempted a patch to DWM.EXE. My
> aim was simply bypass the performance check. I found this section in
> the assembly code.
>
> 00003062 (03) 83f8 1e CMP EAX, 0x1e
> 00003065 (02) 8bfb MOV EDI, EBX
> 00003067 (02) 76 30 JBE 0x3099
> 00003069 (02) 33c9 XOR ECX, ECX
> 0000306b (05) e8 68fdffff CALL 0x2dd8
> 00003070 (02) 3bc3 CMP EAX, EBX
> 00003072 (02) 8bf8 MOV EDI, EAX
> 00003074 (02) 7d 57 JGE 0x30cd
> 00003076 (01) 44 INC ESP
> 00003077 (03) 8d43 02 LEA EAX, [EBX+0x2]
> 0000307a (01) 48 DEC EAX
> 0000307b (06) 8d15 07deffff LEA EDX, [0xffffde07]
> 00003081 (03) 8d4b 15 LEA ECX, [EBX+0x15]
> 00003084 (01) 44 INC ESP
> 00003085 (02) 8bc8 MOV ECX, EAX
> 00003087 (08) c74424 20 86010000 MOV DWORD [ESP+0x20], 0x186
> 0000308f (05) e8 ac690000 CALL 0x9a40
> 00003094 (05) e9 9a000000 JMP 0x3133
> 00003099 (06) 381d 353e0100 CMP [0x13e35], BL
> 0000309f (02) 74 48 JZ 0x30e9
> 000030a1 (03) 83f8 19 CMP EAX, 0x19
> 000030a4 (06) 0f86 89000000 JBE 0x3133
> 000030aa (02) 33c9 XOR ECX, ECX
>
> Guessing that the CMP EAX, 0x19 and CMP EAX, 0x1E are the 25% and 30%,
> I substituted the values for 7F (127%), attempting to be as minimally
> invasive as possible. Since changing the values, my system is able to
> sleep and wake and open windows with no more performance errors.
>
> So if anyone else runs into this before Microsoft fixes it, copy dwm
> to a work file, open a hex editor and search for:
>
> 83 F8 1E
>
> Replace with:
>
> 83 F8 7F
>
> Then search for:
>
> 83 F8 19
>
> Replace with
>
> 83 F8 7F
>
> Take ownership and give yourself permissions to DWM.EXE and replace
> it:
>
> cd\windows\system32
> takeown /f dwm.exe
> cacls dwm.exe /G yourusername:F
> ren dwm.exe dwm.bak
> copy dwmhacked dwm.exe
>
> Then reboot.


> Submitted via EggHeadCafe - Software Developer Portal of Choice
> Make The WebClient Class follow redirects and get Target Url
> http://www.eggheadcafe.com/tutorials...arget-url.aspx