Each MS-DOS application runs in its own NTVDM process on Windows NT. If you have been following along carefully you will realize that this creates a bit of a challenge for us, because we can only monitor one program of a given name at a time. Not only are all MS-DOS applications given the same name, they have the same name as the process running all the 16-bit Windows applications. Could it get any worse than this?
Figure 3.34 16-bit MS-DOS applications on Windows NT
Yes, it could, because this isn't really so bad. What we can do is change the name of the program used to execute MS-DOS applications. Go to the directory %SystemRoot%\SYSTEM32 on the volume holding your copy of Windows NT. Copy NTVDM.EXE to a file name of your choice. (Be sure to copy it to another filename instead of renaming it, because you want to leave NTVDM.EXE around for WowExec to work with.) You then tell Windows NT to use the new program copy for executing MS-DOS programs. You do this by making a slight change in the Configuration Registry using the Registry Editor, REGEDT32.EXE. You can do this between starting the applications, and you do not have to shut down the system to have this change take effect. The value to change is
HKEY_LOCAL_MACHINE
SYSTEM
CurrentControlSet
Control
WOW
cmdline:
Double-click the cmdline entry to change it. Modify the spelling of NTVDM.EXE to that of your copied NTVDM.EXE. Then start an MS-DOS application. If you need to start another one and measure it separately, you can repeat this process. You can leave the Registry Editor running and positioned at the cmdline value to make repeated changes easy. Figure 3.35 shows the Registry Editor in this position.
Figure 3.35 Registry Editor set to change name of NTVDM for running MS-DOS programs
Note We recommend that you set cmdline back to NTVDM.EXE when your experiment is over. If you are very ambitious and this is a big issue for you, you might want to write an application to perform these changes before and after the execution of your MS-DOS applications.
Figure 3.36 shows two MS-DOS applications being monitored concurrently by Performance Monitor using this technique. The threads in one of them are shown in Figure 3.37. There are two worker threads and one for the application. By stimulating the application you might be able to distinguish between them, but this is not really crucial because unlike in WowExec, there is only one application per process, and you know what the process is.
Figure 3.36 Two MS-DOS applications monitored using renamed NTVDMs
Figure 3.37 Threads in a renamed NTVDM executing an MS-DOS application
See? Piece of cake.