Jump to content

Leaderboard

Popular Content

Showing content with the highest reputation on 11/09/2020 in Posts

  1. Summary: For a long time, there have been 2 choices for extended kernels and both of them have their exclusives that aren't present in the other extended kernel. WildBill's extended kernel has many exclusive ntdll functions, SxS support, and a few exclusive functions in other files. BlackWingCat's extended kernel has many exclusive kernel32 functions (and some in other files). The big issue is that ntdll and kernel32 cannot be mixed, forcing people to choose between a better kernel32 or a better ntdll. The main goal of KernelXE is to eliminate this issue. ⚠️ This is beta software. Don't expect it to be stable. ⚠️ KernelXE Lite: KernelXE Lite is a smaller and reduced version of KernelXE that only contains files that are stable and compatible with BlackWingCat's extended kernel. KernelXE Lite is not compatible with full KernelXE and is meant to be installed on top of BlackWingCat's extended kernel. rv1 changes: Added custom BlackWingCat ntdll.dll with RtlIpv6StringToAddressExW and RtlSetLastWin32Error. ⚠️ Make sure to install the WildBill Update Collection BEFORE KernelXE. It is required and your system will be unbootable if you install KernelXE first. ⚠️ Downloads: KernelXE v0.2.4.2 KernelXE v0.2.5-rv1 Lite WildBill Update Collection The future of KernelXE and what I have been doing: As kernel32 grew, problems started to occur, like blank spaces in code, bugged code, and not enough space to add certain things. I decided to re-extend kernel32. This means redoing the entirety of .patch, which is where all non-Microsoft code is stored. Specifically in kernel32, I haven't had enough space in .data to add the data needed for some LCID related functions that are extremely commonly used in programs. I have already re-extended gdi32, and I may re-extend some other file if I need to. There won't be a new release of KernelXE for a long time, but when it finally comes, KernelXE may actually be a suitable alternative to BlackWingCat's extended kernel. Changelog: Public Beta 1: Initial Public Release Public Beta 2: Exported real CreateActCtxW as CreateActCtxB to prevent explorer.exe crashing. Added CreateActCtxW stub to take care of programs that call it while fixing the real function. Moved QueryUnbiasedInterruptTime, SetThreadStackGuarantee, K32EmptyWorkingSet, and GetNativeSystemInfo to .text Added idndl.dll, normaliz.dll, and the nls files normaliz.dll uses to the update package. v0.2.3: First version of KernelXE with new versioning system Full changelog inside update installer. v0.2.3.1: Added updated DirectSound library Added updated hotplug.dll and stobject.dll Added Windows Server 2003 msvcrt.dll Added BlackWingCat's Reiwa compatible locale.nls v0.2.4: Added PAE Added this HAL Timer fix Added Windows Vista msvcrt.dll Added KeAcquireInStackQueuedSpinLockRaiseToSynch and HalConvertIdtToIrql to all HALs Added KernelXE branded bootscreens Added some ntoskrnl functions (list in full changelog) v0.2.4-rv1: Added exFAT stuff (update.inf was weird) v0.2.4.1: Removed exFAT stuff Fixed and cleaned up update.inf Replaced Vista msvcrt with Server 2003 msvcrt (Vista msvcrt causes a BSOD related to winsrv) Added Kernel Mode Driver Framework Added WinUSB v0.2.4.2: Added some user32 stubs requested by piotrhn Added a missing piece of code in CreateActCtxB Updated msvcrt to 7.0.6002.22755 (Vista) Changed version block to check if the NT major version is 5 and removed NT minor version checking. Fixed loading bar not appearing in bootscreen Lots of new files Programs: Relocation Section Editor - Only one that handles huge relocation tables like the one in ntoskrnl. Executable | Source Code
    1 point
  2. I have not tested UMDF 1.0 on Windows 2000, but it is something I plan to test at some point. The next thing planned after KernelXE R2 is a feature pack update for Windows 2000. UMDF 1.0 is one of these components I plan to add to this feature pack update. For Windows 2000 updates, my main priority right now is KernelXE R2 and that will be my main priority until sometime (hopefully) early next year.
    1 point
  3. Which version of CAA are you on? ... And on which browser? The XPI files are actually hosted on a "storage-waterfox.netdna-ssl.com" domain name, over HTTPS, https://storage-waterfox.netdna-ssl.com/amo/xul/239/239381/proxy_tool-1.19-fx+sm.xpi?origin=caa&action=download , so your system does have to be able to access that domain; check your DNS, firewall, AV suite, content-blockers, etc. Also, ATN still has v1.17 of Proxy Tool (not v1.19 that you seek, but you may still try it despite...): https://addons.thunderbird.net/en-us/firefox/addon/proxy-tool/versions/
    1 point
  4. Office 2016 can be either x86 or x64, it depends on which way it is installed.
    1 point
  5. @soggi : A small inconsistency I'm seeing at your "mirror" : The link to Serpent 55/moebius 64-bit package should be modified accordingly (to be uniform with the rest of the links to 64-bit browser packages ...) ; other than this, many thanks for carrying the torch...
    1 point
  6. Thanks, yes Stunnel has been around a long time, and I know that many people use it. Personally I use ProxHTTPSProxy, which has been ported to XP my @heinoganda. I don't know what the pros and cons are of one program over the other, but HTTPSProxy seems to do everything I need at the moment. Welcome to the forum BTW!
    1 point
  7. Summary: This project is a combination of NTDLL from BlackWingCat's Extended Kernel and NTDLL from WildBill's KB2479629-v3. How this began: This project began when I needed to run a program that required some functions that were only present in NTDLL from BlackWingCat's Extended Kernel and some functions that were only present in NTDLL from WildBill's KB2479629-v3. The NTDLL file: The first 3 versions of NTDLL-XEC (NTDLLx1-3(B)) are based on NTDLL from BlackWingCat's Extended Kernel v30e (latest version as of writing this) and contain some functions from WildBill's KB2479629-v3. NTDLLx4 is based on NTDLL from WildBill's KB2479629-v3 and contains functions from BlackWingCat's Extended Kernel. Downloads: NTDLLx4: DLL | Installer Changelog: NTDLLx1: Initial Release NTDLLx2: Code for new functions now stored in .xdata ZwQueryDebugState no longer uses same code as NtQueryDebugState Error in LdrCreateOutOfProcessImage fixed NTDLLx3: Test release for adding exports with PEMaker NTDLLx3B: Fixed issues in NTDLLx3 Changed file version to 5.0.2195.7133 to follow new file version rules NTDLLx4: File is now based on NTDLL from WildBill's KB2479629-v3. Added ALL functions from NTDLL from BlackWingCat's Extended Kernel v30e. Added Functions: Click on each version to view the list of added functions in semi-alphabetical order. NTDLLx1 | NTDLLx2/3(B) | NTDLLx4 File modification process: Find required subroutines for functions with IDA Move export table to new section before .rsrc (if needed) Increase size of .patch with PEMaker (if needed) Add code to blank space in .text and if needed, add code at end of .patch with HxD Add exports to export table with PEMaker Fix errors in code with IDA Change file version and fix red text on main page of PEMaker Name and version number info: NTDLL-XEC: X - Ximonite E - Extension C - Combo File Version: 5.0.2195.71## ## = My version number + 30 Examples: NTDLLx4 - 5.0.2195.7134, NTDLLx12 - 5.0.2195.7142 IDA Tips and Tricks: Press F2 while in Hex View to edit hex values. Right click a location a function is calling and click "Manual" to change the location. Go to Edit > Patch program > Assemble... to have IDA automatically modify hex values after changing location with Manual. Save modifications made in IDA in Edit > Patch program > Apply patches to input file... Archive: NTDLLx3B: DLL | Installer Older files: NTDLLx1 | NTDLLx2 | NTDLLx3 (no download on my website because of major issue in file) | NTDLLx3B First Installer
    1 point
×
×
  • Create New...