Windows IT Pro is the leading independent community for IT professionals deploying Microsoft Windows server and client applications and technologies.
  
  
  Advanced Search 


Return to article

Optimizing NT's WOW Subsystem
 

Put a little WOW in your 16-bit Windows applications

In the midst of a 32-bit software era (with 64-bit applications on the horizon), a surprising number of organizations continue to run legacy 16-bit Windows applications. Some of these applications are mission-critical utilities, whereas others are ancillary components that still perform useful functions. These applications might be hanging around for various reasons. For example, the software manufacturer (usually a vertical-market developer) might be behind in updating the application to a 32-bit version. Worse, the software developer might have gone out of business, which might make a migration or conversion to a competitive product cost-prohibitive for the company using the original software. Whatever the reason, many Windows NT systems administrators must deal with 16-bit Windows applications daily. If you're in this situation, you can use a few tips to optimize NT's Win16 on Win32 (WOW) subsystem and the applications that use it.

The Anatomy of WOW
The WOW subsystem is closely related to the Virtual DOS Machine (VDM) that NT uses to execute 16-bit DOS applications. WOW is an application environment that runs as a user-mode program (the filename is wowexec.exe) and invokes one VDM for all Win16 applications to run in. On RISC-based systems, you can alter the amount of memory WOW allocates for its VDM. On Intel or RISC-based systems, you can edit the command-line parameters the system issues when NT initializes the WOW environment and VDM. By default, all Win16 applications run in the same VDM, using separate threads. This behavior differs from that of standard DOS applications, each of which runs in a separate VDM.

Microsoft designed the WOW subsystem to make the differences between 16-bit and 32-bit applications transparent. WOW, combined with NT's native x86 emulation, lets RISC-based systems (i.e., Alpha, MIPS, and PowerPC) run Win16 applications without specialized hardware or advanced emulation software such as Digital Equipment's FX!32 (for information about FX!32, see Brian Gallagher, "FX!32," page 80). A Win16 VDM includes two system threads: the wowexec.exe thread that starts Win16 applications and a heartbeat thread that emulates timer interrupts to WOW-based applications. Each Win16 VDM also includes a separate thread for each Win16 application running within the WOW process.

Controlling WOW Behavior
To reduce system overhead and increase efficiency, NT waits to load the WOW subsystem until the first time the operating system (OS) invokes a Win16 application. As a result, the first Win16 application takes longer to start than subsequent Win16 applications you execute during the same session. You can reduce the start time for the first Win16 application by forcing NT to preload WOW (use this tip only if you frequently run Win16 applications). To force NT to preload WOW, add a wowexec.exe file shortcut to the Startup group. If you place the wowexec.exe in the per-machine (i.e., common) program group, WOW automatically loads for all users on the machine. If you place the wowexec.exe in the per-user (i.e., personal) program group for one user, WOW automatically loads for just that user.

One of WOW's shortcomings is that WOW remains in memory (even after you close all Win16 applications) until you shut down the system or log off. You can free up the memory and CPU resources NT has allocated to WOW by manually terminating the wowexec.exe process after you finish running all Win16 applications during a session. To terminate the wowexec.exe process, press Ctrl+Alt+Del or right-click an empty space on the taskbar and click Task Manager to run the NT Task Manager. On the Processes tab, locate the instance of the ntvdm.exe process containing wowexec.exe (no other applications should appear under this instance of ntvdm.exe; if they do, you need to close them before proceeding), as Screen 1 shows. Finally, select this instance of the ntvdm.exe process, and click End Process. NT will issue a warning about terminating processes this way; click Yes to terminate the wowexec.exe process. (You can use other methods to kill processes. For example, the kill.exe utility from the Microsoft Windows NT Server 4.0 Resource Kit lets you kill a process by name or process ID.) Shutting down the wowexec.exe process can free a significant amount of memory (a basic VDM plus wowexec.exe session takes about 3MB of system memory). If you won't be running any other Win16 applications soon, the system or other applications can make better use of this memory.

If one or more Win16 applications are running in their memory spaces, multiple instances of ntvdm.exe and the wowexec.exe process will appear in the Processes window. However, only one instance will remain after you exit all Win16 applications.

Never terminate the ntvdm.exe process (and its child wowexec.exe process) unless you are positive that no active applications are running within the WOW subsystem. Applications running within WOW appear as indented entries underneath ntvdm.exe in the Processes window.



Running Win16 Applications in Separate Memory Spaces
Like the DOS VDM, the Win16 VDM is a multithreaded process wherein each Win16 application is a different thread of execution. The Win16 VDM is multitasked, so you can run a shared WOW VDM concurrently with threads from other system processes (e.g., Win32 processes). However, because of the Win16 VDM design, the system can service only one thread representing one Win16 application within one VDM and WOW process at a time. While the system is servicing the thread for one Win16 application, the NT thread dispatcher (or scheduler) blocks the other threads within the same WOW environment. Whenever some process (e.g., a higher priority thread) preempts this thread, the thread dispatcher resumes with the thread that was last preempted.

For better performance, memory isolation, and application protection, you can run each 16-bit Windows application in its own VDM. Using a separate VDM for each application lets you run simultaneous Win16 application threads and provides better application stability by isolating the memory space of each 16-bit application. Running multiple application threads is of particular benefit on multiprocessor machines, which can execute these threads simultaneously. However, memory usage is a major disadvantage of using separate VDMs. Because you're launching a separate VDM (and WOW environment) for each Win16 application, you use more memory than if you run all Win16 applications in one shared VDM and WOW process. Therefore, you want to launch separate VDMs for each Win16 application only if your system has plenty of available RAM.

Another concern with running each Win16 application in its own memory space is that the application can cause interoperability problems for other applications that use shared memory to communicate. Although most applications use methods such as Dynamic Data Exchange (DDE) and Object Linking and Embedding (OLE) to share data, old applications might use shared memory and fail to communicate properly. If you encounter such applications, configure them to run in a shared memory space rather than a separate one.

To make each 16-bit application (including Win16 and DOS applications) run it its own memory space, you must edit the shortcut that launches the application. Start by right-clicking the application's shortcut icon and choosing Properties from the context menu. Next, select the Run in Separate Memory Space check box. After you make these changes, the application will run in a separate memory space every time you run the application. You can accomplish the same goal for dynamic executions of an application by selecting the Run in Separate Memory Space check box in the Start menu's Run window, as Screen 2 shows, or by entering the following command-line option:

start /separate <application filename>

Alternatively, you can run a Win16 application in a shared memory space with other Win16 applications by typing

start /shared <application filename>

Always configure crash-prone applications or those requiring maximum stability to run in separate memory space. If you avoid sharing memory address space (which errant applications in the same shared environment can violate) and system resource pools (memory heaps) with other Win16 applications, the application will be less likely to experience problems. You might want to create two shortcuts for each of your 16-bit applications: one to run the application in a separate memory space and another to run the application in a shared memory space.

Configuring WOW to Use Separate Memory Spaces by Default
Configuring Win16 applications on a case-by-case basis using shortcuts or command-line entries is useful only if you want to run some of your applications in separate memory spaces. To run all your Win16 applications in separate memory spaces all the time, you can edit the Registry so that your system defaults to using a separate memory space for each Win16 application. To enable this behavior, use a Registry editor (e.g., regedt32) to set the DefaultSeparateVDM value to yes in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WOW. DefaultSeparateVDM specifies whether each Win16 application runs its own instance of ntvdm.exe and wowexec.exe in its own memory space. Setting the value to yes ensures that all future Win16 applications start with a separate memory space by default. Screen 3 shows this value in the Registry.

Other WOW-related Registry Entries
In addition to setting the DefaultSeparateVDM value, you can use the Registry to configure other aspects of the WOW application environment. Some values, such as the size of the WOW environment (for RISC machines) or the command-line options, are in the same WOW subkey as the DefaultSeparateVDM value. Other values are in different subkeys in the SOFTWARE hive.

To change the size of the WOW environment, locate the wowsize value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WOW. This setting applies to only RISC-based systems. Intel-based systems ignore this setting because NT provides all memory on Intel systems on an as-needed basis. This value (ranging from 0MB to 16MB) sets the size of the WOW environment, and NT determines the default value according to the system configuration. Because of the overhead associated with the WOW VDM, for each megabyte that you specify in this setting, NT allocates 1.25MB of memory. Therefore, a wowsize value of 4MB uses 5MB of memory, even though applications can access only 4MB.

Table 1 shows the recommended WOW VDM sizes for various systems according to the amount of installed memory. You can use this table as a guide for selecting the wowsize value for your RISC-based NT machine. Most applications will fail if you set the wowsize value to less than 3MB. Therefore, always set this value to at least 3MB, and set it higher if possible.

Most NT RISC system users don't have to worry about the wowsize value because most RISC-based computers have at least 32MB of memory. A large wowsize value will cause problems only when memory resources are limited and little or no memory is available for other applications or the system. Also, remember that the WOW VDM continues to run even after the Win16 application that invoked it has terminated.

Another Registry value in the WOW subkey that you can set for the WOW subsystem is wowcmdline. Only the WOW VDMs (those processes that Win16 applications invoke) use this value, which specifies the command-line parameters that NT issues when you invoke a 16-bit Windows application. You specify the path to ntvdm.exe and any of the following optional switches: -a, which specifies a command to pass to the VDM; -f, which specifies the directory to find ntvdm.exe; -m, which hides the VDM console window; or -w, which specifies the WOW VDM. The default value is %SystemRoot%\system32\ntvdm.exe -a%SystemRoot%\system32\krnl386.

You can find other WOW-related Registry entries at HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Windows NT\CurrentVersion\WOW. This Registry location references the Windows 3.x system.ini file. The values in the subkeys at this location are the same items you might find under the corresponding system.ini headings (NT maintains these settings for backward compatibility with Win16 applications).

That's All the WOW for Now
Although computer users running applications in a 32-bit environment often overlook the WOW subsystem, it is still an important part of NT for 16-bit Windows applications users. By following the tips outlined in this article, you can gain control over WOW's behavior and optimize the subsystem's configuration for your machine and application environment.







Reader Comments

Clear, insightful and concise. Article was a real help; I was just getting suspicious about the name of WOWEXEC.EXE and its behaviour.

Rob -October 16, 2003

I would be interested in WOWEXEC errors - ie how to diagnose and rectify a problem where a WOWEXEC operation error on a WindowsNT machine when it is left alone for a couple of minutes.

John Armagh -October 20, 2003

yes, i have a problem with my wowexec.exe....everytime i try and run a 16 bit application...the wowexec.exe opens up in the taskmanager and hangs there....and the program never opens...i have to kill it manually if i want it to go away...i was wondering if anyone knew anything about this...i have researched it..and i do not have a corrupt wowexec.exe file....and it seems other people have this problem too sometimes

drew -December 31, 2003

I deleted my wowexec.exe after a virus corrupted it, or I got a virus called wowexec. Anyway, now I cant run a bunch of programs so how can I get it back? Thanks.

brad -February 21, 2004

have anyone had any problems with 16-bit applications that seam to eat a steady percentage of the processor? I have an application that runs great in windows 98 but in 2000 it pins the processor at about 50%. if i run multiple instences of the application, i can run about 5 and they will all take a steady 20%. Any suggestions on how i can resolve this? thanks

joe -March 30, 2004

clear, insightful, consise, helpful .. couldn't agree with Rob more

Jay -April 09, 2004

Would anyone have ANY idea why, when I run Cakewalk 3.01 MIDI sequencing software on a Sony laptop w/ WinXP (2.4G Celeron), my CPU usage jumps to 100% and stays there??!! Is it something to do with that "wowexec.exe" and "ntvdm.exe" that I see in the Processes tag in Task manager? I didn't actually "install" Cakewalk, I just copied the CPWPro folder from another computer into C drive - I've been using it this way in W95 and W96SE for years. BTW, the reason I use CWPro 3.01 is that I can run multiple instances at the same time - good if you in a MIDI'd duo that does dance gigs, where there can't be any lags between songs. Thanks to anyone who can help!

J Nilsen -April 19, 2004

my wowexec.exe has a space in front of it....is this the way it should be or is this virus related????

Michael -May 15, 2004

I also have an application that works perfect in win98, and in winxp just hangs.... It completely freezes for a while, and then comes back to life. Anyone know how to solve this?

João Costa -June 01, 2004

www.tamedos.com You can use this program to control CPU usage of 16 bit apps running under NT based OS

Kevin -June 03, 2004

I had a similar problem. i think my virus buster deleted my wowexec.exe file. and now when i try to install programs that are using the 16-bit thing, it pops up with the error. i'm not really sore how to fix this. could the file be replaced ? or reinstalled ? Also i think it comes with another one called NTVDM.EXE - > I don't think i have that one as well !!! Thanks, Chris.

Chris -June 10, 2004

Well, my IE window starting appearing with about:blank every time I opened IE, even when I changed the home page setting in internet options. I thought it might be a home page hijacker and ran Norton Anti-Virus, looked in Symantec's site for home page hijacking but didn't find anything. I looked in the Task Manager and it had _wowexec.exe so I looked up the name and I want to know if you think it has anything to do with my about:blank my home page keeps being reset to. Thank you for your help

Elkis -June 21, 2004

I've accidentally deleted wowexec.exe from my comp. How do i get it back? help!

Catherine: -June 26, 2004

I've accidentally deleted wowexec.exe too!!

Matthew -July 06, 2004

did we decide that wowexec.exe with a space in front was good or bad?

Anonymous User -November 14, 2004

excellent explanation. Thankyou for your expertise.

Anonymous User -December 05, 2004

yes we did conclude the space in front is okay: "Applications running within WOW appear as indented entries underneath ntvdm.exe in the Processes window."

Anonymous User -December 14, 2004

Indented wowexec is normal, however _wowexec is a trojan.

Anonymous User -January 14, 2005

Do we know for sure that _wowexec.exe is a trojan? Because Ad-aware and SpyS&D didn't find it. I found a copy of it in the Taskmgr processes list. How can I get rid of it for good? Many thanks.

Anonymous User -February 09, 2005
Windows IT Pro Home Register FAQ for Windows WinInfo News
Europe Edition About Us Contact Us/Customer Service Media Kit Affiliates / Licensing  
SQL Server Magazine Office & SharePoint Pro DevProConnections IT Job Hound
Left-Brain.com Technology Resource Directory asp.netPRO ITTV Windows SuperSite 
 
 Windows IT Pro is a Division of Penton Media Inc.
 © 2009 Penton Media, Inc. Terms of Use | Privacy Statement