Leaderboard

To prevent user confusion, I strongly recommend disregarding the tutorials and contacting me directly instead about the extended kernel. The original post was removed as it was continuing to confuse users. There will be further discussion about the evolution of the extended kernel in the coming pages.

Oh yeah, I remember discussion on the use of .manifest files to redirect DLLs in XP, and I did try it a little bit in Vista where it worked, but forgot about it after it failed in 2000. Another method of redirection is explained here: https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection So instead of replacing kernel32.dll, you can simply create yyyyy.exe.local in the same directory as yyyyy.exe and plant the custom kernel32.dll in the directory as well, avoiding the effects of monthly updates.

Don't programs load DLLs that are available on the same path as the executable first? Would it be possible to put the modified kernel32 in the program folder so it could use the extra functions it needed? EDIT: Found this interesting article: https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order

Yes, that would definitely be possible; just change all references in the target program's import table from kernel32 to the modified kernel33. However, that may be very complex in the case of programs that have many dependencies on other files that in turn have unresolved dependencies on kernel32 (which would be resolved with a modified kernel32/kernel33). As it appears that putting the new code/stubs in separate tables from the original MS code maintains the OS' stability, I decided that modifying system files would work best, though it will prove somewhat undesirable for those who continue to update the OS. But I've been thinking about HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs, which seems to direct applications to system DLLs; perhaps I could have two entries for both kernel32 and kernel33 (kernel32 = kernel32.dll and kernel32 = kernel33.dll), thus rendering the reboot and replacement of system files unnecessary? But I'm booted into Windows 2000 right now, and I'm not sure if that key exists in Vista. UPDATE: it does exist in Vista, but I had to take ownership of it to edit. I'm going to try changing the kernel32 entry to say "kernel32.dll, kernel33.dll" and see what happens. another UPDATE: unfortunately the system and applications don't recognize the x86 kernel33.dll with the extra function.

@roytam1 thanks!

Yes, those are all correct.

You are on the right track. and what @Ximonite said. I forgot about section flags/characteristics. The 48 is part of the first function of course.

hmm, this is far more complicated than expected , i hope there will be an easier way in the future although this certainly opens up multiple possibilities and its really impressive what you have achieved here.

Unfortunately, it appears that starting with 6.0.6003.20731, they ate up most of the zeros in .txt. So the solution to that will be to add a new section, which I was intending on doing for later updates to the initial version. So right click in section headers view, click "Add Section (Empty Space)", make the size 0000B100 (looking forward to many new API functions!) and then name it .xdata. And then add the code in that section, though the offsets reset themselves per-section in section headers view so you will be telling ExportTableTester that your functions will be located at 00128E00, 00128E10, 00128E20... Given that kernel extending is typically seen as an "elite" activity in the world of Microsoft Windows, and this is the very first go of it for NT 6.x, I'm not surprised to see this level of questioning, considering that this could open up the art of kernel extension to a far wider audience than before. Though it will be for the greater good, as Vista has certainly been held back win2k-style by MS. NB: the procedure for modifying the file should be the same through 6.0.6003.20686 as in the OP though.

@TechnoRelic I just found out that there is a UA override for twitter in about:config Check for general.useragent.override.twitter.com and change it to something newer. Mozilla/5.0 (Windows NT 5.1;rv:60.0) Gecko/20100101 Firefox/60.0) seems to work fine in NM27.

Ok, updated list: (Microsoft .NET Framework 1.1) (with this you don't need v1.0) (Microsoft .NET Framework 1.1 SP1 KB867460-X86) (Microsoft .NET Framework 1.1 SP1 KB2572067-X86) (Microsoft .NET Framework 1.1 SP1 KB2604044-X86) (Microsoft .NET Framework 1.1 SP1 KB2742597-X86) Microsoft .NET Framework 3.5 SP1 (autoinstalls 2.0 SP2, and 3.0 SP2, 3.5 SP1 too) Microsoft .NET Framework 2.0 SP2 KB958481-x86 Microsoft .NET Framework 2.0 SP2 KB2656352-x86 Microsoft .NET Framework 2.0 SP2 KB2604092-x86 Microsoft .NET Framework 2.0 SP2 KB2729450-x86 Microsoft .NET Framework 2.0 SP2 KB2742596-x86 Microsoft .NET Framework 3.0 SP2 KB958483-x86 Microsoft .NET Framework 3.0 SP2 KB977354-v2-x86 Microsoft .NET Framework 3.0 SP2 KB982168-x86 Microsoft .NET Framework 3.0 SP2 KB2604110-x86 Microsoft .NET Framework 3.0 SP2 KB2656407-x86 Microsoft .NET Framework 3.0 SP2 KB2756918-x86 Microsoft .NET Framework 3.5 SP1 KB958484-x86 Microsoft .NET Framework 3.5 SP1 KB953595-x86 (unavailable) Microsoft .NET Framework 3.5 SP1 KB963707-x86 *(NET Framework Assistant 1.0 for Firefox) Microsoft .NET Framework 3.5 SP1 KB982524-x86 (also includes a fix for .NET 2.0) Microsoft .NET Framework 3.5 SP1 KB2604111-x86 Microsoft .NET Framework 3.5 SP1 KB2657424-x86 Microsoft .NET Framework 3.5 SP1 KB2736416-x86 (+3.5 SP1 Language pack if wished) (Microsoft .NET Framework 4.0) (patch list to do)

thank you! I finally didn't make the silent installer because the SNM tool is outdated and requires some modifications that I unknow. Also I'm not sure whether it would shorten the .net installation time since I read it just executes at T-13 install (so no real slipstream is performed in any case). I post the updated list: (Microsoft .NET Framework 1.1) (with this you don't need v1.0) (Microsoft .NET Framework 1.1 SP1 KB867460-X86) (Microsoft .NET Framework 1.1 SP1 KB2572067-X86) (Microsoft .NET Framework 1.1 SP1 KB2604044-X86) Microsoft .NET Framework 3.5 SP1 (autoinstalls 2.0 SP2, and 3.0 SP2, 3.5 SP1 too) Microsoft .NET Framework 2.0 SP2 KB958481-x86 Microsoft .NET Framework 2.0 SP2 KB979909-x86 Microsoft .NET Framework 2.0 SP2 KB2604092-x86 Microsoft .NET Framework 2.0 SP2 KB2656352-x86 Microsoft .NET Framework 2.0 SP2 KB2656369-x86 Microsoft .NET Framework 3.0 SP2 KB958483-x86 Microsoft .NET Framework 3.0 SP2 KB977354-v2-x86 Microsoft .NET Framework 3.0 SP2 KB982168-x86 Microsoft .NET Framework 3.0 SP2 KB2604110-x86 Microsoft .NET Framework 3.0 SP2 KB2656407-x86 Microsoft .NET Framework 3.5 SP1 KB958484-x86 Microsoft .NET Framework 3.5 SP1 KB953595-x86 (can't find) Microsoft .NET Framework 3.5 SP1 KB963707-x86 *(includes NET Framework Assistant 1.0 for Firefox) Microsoft .NET Framework 3.5 SP1 KB982524-x86 (also includes a fix for .NET 2.0) Microsoft .NET Framework 3.5 SP1 KB2604111-x86 Microsoft .NET Framework 3.5 SP1 KB2657424-x86 (+3.5 SP1 Language pack if wished) (Microsoft .NET Framework 4.0) (patch list to do) edit: fixed two 3.5 entries that were really 3.0, below, updated list.

In case someone is reading this old thread... April 2012 Patch Tuesday New updates: KB2656369 (MS12-025, Download) | ndp2.0sp2 | May 2012 Patch Tuesday New updates: KB2604092 (MS12-035, Download) | ndp2.0sp2 | KB2604110 (MS12-035, Download) | ndp3.0sp2 | KB2656407 (MS12-034, Download) | ndp3.0sp2 | KB2604111 (MS12-035, Download) | ndp3.5sp1 | Obsolete: KB2518864 (MS11-044) is replaced by KB2604092 (MS12-035). KB2572073 (MS11-078) is replaced by KB2604092 (MS12-035). KB2633880 (MS12-016) is replaced by KB2604092 (MS12-035).

So is this the right order after a 3.5 SP1 install? Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 2.0 SP2 KB958481-x86 Microsoft .NET Framework 2.0 SP2 KB979909-x86 Microsoft .NET Framework 2.0 SP2 KB2518864-x86 Microsoft .NET Framework 2.0 SP2 KB2572073-x86 Microsoft .NET Framework 2.0 SP2 KB2633880-x86 Microsoft .NET Framework 2.0 SP2 KB2656352-x86 Microsoft .NET Framework 3.0 SP2 KB958483-x86 Microsoft .NET Framework 3.5 SP1 KB958484-x86 Microsoft .NET Framework 3.5 SP1 KB963707-x86 Microsoft .NET Framework 3.5 SP1 KB982168-x86 Microsoft .NET Framework 3.5 SP1 KB982524-x86 Microsoft .NET Framework 3.5 SP1 KB2657424-x86 (+3.5 SP1 Language pack) I would probably make an add-on, or integration to XP install, as installing 3.5 SP1 with its KB alone takes up more than half an hour to complete.

MS11-100 bulletin and updates have been released (http://technet.microsoft.com/en-us/security/bulletin/ms11-100.mspx) For .NET 2.0, KB2418241 (MS10-070) is replaced by KB2656352 For .NET 3.5, KB2416473 (MS10-070) is replaced by KB2657424

Sorry for late reply. I do not actively check the .NET 3.5 updates now, so my list about these updates might be outdated. My computer have Windows XP and .NET 3.5 SP1, so anyone using .NET 3.0 (only) might get additional updates not mentioned below. Anyway, here's the list: (last update 2012-05-09) Updates | Patched component | Notes (All .NET 2.0 SP2 updates are needed for .NET 3.5 SP1) | ndp2.0sp2 | KB958481 (Download x86 x64 IA64) | ndp2.0sp2 | Note 1 KB958483 (Download x86 x64) | ndp3.0sp2 | Note 1 KB976769-v2 (Download) | ndp3.0sp2 | Note 2 KB977354 (Download) | ndp3.0sp2 | Note 3 KB2604110 (MS12-035, Download) | ndp3.0sp2 | KB2656407 (MS12-034, Download) | ndp3.0sp2 | KB958484 (Download x86 x64) | ndp3.5sp1 | Note 1 KB963707 (Download) | ndp3.5sp1 | KB2657424 (MS11-100, Download) | ndp3.5sp1 | KB2604111 (MS12-035, Download) | ndp3.5sp1 | Note 1: KB958481, KB958483, and KB958484 are offered to people who did a fresh install of .NET 3.5 SP1 . Those who updated from 3.5 to 3.5 SP1 (via KB951847) do not need these updates. These should be installed in this order: KB958481 -> KB958483 -> KB958484. Note 2: KB976769-v2 is contained in KB982168 so install KB982168 instead. (The rest of the KB982168 update is the same as KB982167 -- containing KB976765 and KB980773 which are both replaced) Note 3: KB982524 contains KB977354 but KB977354 may be downloaded separately. (The file name says NDP30SP2-KB977354-v2-x86.exe but the "v2" word does not appear in the update list after installation.) Update 2012-03-12 : Removed KB953595 - this hotfix is included in the .NET 3.5 installer. Update 2012-05-09 : May 2012 Patch Tuesday. Add KB2604110, KB2656407 and KB2604111.