Jump to content

Dubby

Member
  • Posts

    20
  • Joined

  • Donations

    0.00 USD 
  • Country

    Indonesia

Posts posted by Dubby

  1. So hello Guys, :D 

    Some of us might using windows XP as their main OS, and we know that windows XP lack of some cosmetics change that available in vista and later, which makes life more easier. 

    So I created this pack to bring the cosmetics change to xp, those customization are fully functional and usable.
    And some more interesting customization.

    Many other customization will comes.

    Without further ado, here it is:

    G0eqLG0m.jpgmMW98PWm.jpggQyxGUim.jpg
    oBSB04lm.jpg0NmDkScm.jpg3s0MaZXm.jpg
    Gmusp5wm.jpg73U2A6Lm.jpguL4u7vQm.jpg
    RozT6AQm.jpg7F2Nmn8m.jpg

    My main galleries is available Here.

    Download Here

    Instruction how to install is available inside readme.txt make sure you read it. Really you should read it.

    If you like it, use it, and want to support the development, consider a Donation.

    Thanks a lot guys...

  2. 19 hours ago, Dibya said:

    any of you know any tool for calculating offset to RVA ?

    CFF explorer->address converter

    1 hour ago, Dibya said:

    PSAPI.EnumProcessModulesEx
    PSAPI.GetWsChangesEx
    PSAPI.QueryWorkingSetEx

    these functions Buried inside kernel... by kernel I mean win32k.sys, if I recall correctly..

    Sorry for not replying to your pm, I have been playing with knowndlls hooking for few weeks, (also got several health related issues), but then I dropped it altogether, because it's causing too much hassle... sometimes it got succeed sometimes it doesn't... 
    it might be possible if I go through 'drivers path' (writing kernel module for hooking) I don't know, haven't got time yet..

    @TuMaGoNx
    I have been wondering about the keyed_event variable inside wine, in wine it might be get filled with wine's Ntxxx function, but what about the real xp's Ntxxx function? is it Ok to leave it empty?

  3. #include <Windows.h>
    #include <winternl.h>
    #include <stdio.h>
    
    typedef struct _CLIENT_ID
    {
        PVOID UniqueProcess;
        PVOID UniqueThread;
    } CLIENT_ID, *PCLIENT_ID;
    
    typedef LONG KPRIORITY;
    typedef struct _THREAD_BASIC_INFORMATION
    {
        NTSTATUS                ExitStatus;
        PVOID                   TebBaseAddress;
        CLIENT_ID               ClientId;
        KAFFINITY               AffinityMask;
        KPRIORITY               Priority;
        KPRIORITY               BasePriority;
    } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
    
    typedef NTSTATUS (NTAPI *NtQueryInformationThread_proc)(
        IN HANDLE ThreadHandle,
        IN THREADINFOCLASS ThreadInformationClass,
        OUT PVOID ThreadInformation,
        IN ULONG ThreadInformationLength,
        OUT PULONG ReturnLength OPTIONAL
        );
    
    DWORD __stdcall GetThreadID(HANDLE hThread)
    {
        static NtQueryInformationThread_proc NtQueryInformationThreadPtr
            = (NtQueryInformationThread_proc)GetProcAddress(GetModuleHandleW(L"ntdll"), "NtQueryInformationThread");
        THREAD_BASIC_INFORMATION threadInfo;
        threadInfo.ClientId.UniqueThread = 0;
        NtQueryInformationThreadPtr(hThread, (THREADINFOCLASS)0, &threadInfo, sizeof(threadInfo), 0);
        return (DWORD)threadInfo.ClientId.UniqueThread;
    }
    
    int main()
    {
        printf("%d\n", GetCurrentThreadId());
        //uncomment this line on vista or later
        //printf("%d\n", GetThreadId(GetCurrentThread()));
        printf("%d\n", GetThreadID(GetCurrentThread()));
    }

    @Dibya I assume, you know C...

    Something like that should work on XP as a GetThreadId replacement... 

    I take no credit to the code.. I found the it as a snippet somewhere a while ago (forgot, sorry..) and modified it a bit...

  4. l'm really sorry, currently I'm away from my development PC, where I store the logs. I have also confirmed that the file is indeed corrupt. I managed to extract only a single file. here the log I managed to extract.. the log produced while I'm attaching olly into explorer processes..

    Loading function descriptions from 'common.arg'

    File 'C:\WINNT\explorer.exe'

    New process with ID 000003AC created

    Main thread with ID 000002D4 created

    New thread with ID 0000036C created

    New thread with ID 000003B0 created

    New thread with ID 000003EC created

    New thread with ID 00000450 created

    New thread with ID 000002F0 created

    New thread with ID 000004A0 created

    New thread with ID 000002F4 created

    New thread with ID 00000120 created

    New thread with ID 000003B4 created

    New thread with ID 000003C8 created

    New thread with ID 000004A4 created

    New thread with ID 00000424 created

    New thread with ID 00000278 created

    New thread with ID 000002C8 created

    New thread with ID 000003E8 created

    New thread with ID 0000031C created

    New thread with ID 000003A8 created

    77F91A76 Debug string: [757500] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    7C584A20 New thread with ID 00000294 created

    00400000 Module C:\WINNT\explorer.exe

    CRC changed, discarding .udd data

    00DC0000 Module C:\WINNT\system32\SHDOCVW.DLL

    01080000 Module C:\WINNT\System32\vmhgfs.dll

    024D0000 Module C:\WINNT\system32\MSI.DLL

    1A400000 Module C:\WINNT\system32\urlmon.dll

    23000000 Module C:\WINNT\AppPatch\AcLayers.DLL

    63000000 Module C:\WINNT\system32\WININET.dll

    63580000 Module C:\WINNT\system32\mshtml.dll

    658F0000 Module C:\WINNT\system32\webvw.dll

    66650000 Module C:\WINNT\system32\USP10.DLL

    6A8F0000 Module C:\WINNT\system32\MSVFW32.DLL

    6DE80000 Module C:\WINNT\system32\TxfAux.Dll

    70020000 Module C:\WINNT\system32\faxshell.dll

    70340000 Module C:\WINNT\system32\webcheck.dll

    70440000 Module C:\WINNT\system32\mlang.dll

    70510000 Module C:\WINNT\system32\imgutil.dll

    70A70000 Module C:\WINNT\system32\SHLWAPI.dll

    70F30000 Module C:\WINNT\system32\mshtmled.dll

    71500000 Module C:\WINNT\system32\browseui.dll

    71710000 Module C:\WINNT\system32\COMCTL32.dll

    718C0000 Module C:\WINNT\system32\shdoclc.dll

    71960000 Module C:\WINNT\system32\browselc.dll

    71F00000 Module C:\WINNT\system32\docprop2.dll

    732E0000 Module C:\WINNT\system32\shim.dll

    74870000 Module C:\WINNT\system32\AVIFIL32.DLL

    75020000 Module C:\WINNT\system32\WS2HELP.DLL

    75030000 Module C:\WINNT\system32\WS2_32.DLL

    75050000 Module C:\WINNT\system32\WSOCK32.dll

    75150000 Module C:\WINNT\system32\SAMLIB.dll

    75160000 Module C:\WINNT\System32\ntlanman.dll

    751C0000 Module C:\WINNT\system32\NETRAP.dll

    751D0000 Module C:\WINNT\System32\NETUI1.dll

    75210000 Module C:\WINNT\System32\NETUI0.dll

    759B0000 Module C:\WINNT\system32\LZ32.DLL

    75AC0000 Module C:\WINNT\system32\MSLS31.DLL

    75D40000 Module C:\WINNT\system32\msadp32.acm

    75E60000 Module C:\WINNT\system32\IMM32.DLL

    76290000 Module C:\WINNT\system32\es.dll

    76620000 Module C:\WINNT\system32\MPR.DLL

    766D0000 Module C:\WINNT\system32\stobject.dll

    766F0000 Module C:\WINNT\system32\POWRPROF.DLL

    76710000 Module C:\WINNT\system32\LINKINFO.DLL

    76740000 Module C:\WINNT\system32\BATMETER.DLL

    76DF0000 Module C:\WINNT\system32\mydocs.dll

    76F20000 Module C:\WINNT\system32\NETSHELL.dll

    76FA0000 Module C:\WINNT\system32\ntshrui.dll

    770B0000 Module C:\WINNT\system32\CfgMgr32.dll

    770C0000 Module C:\WINNT\system32\CSCDLL.dll

    773E0000 Module C:\WINNT\system32\ATL.DLL

    77400000 Module C:\WINNT\system32\msacm32.drv

    77410000 Module C:\WINNT\system32\MSACM32.dll

    77430000 Module C:\WINNT\system32\MSASN1.dll

    77560000 Module C:\WINNT\system32\wdmaud.drv

    77570000 Module C:\WINNT\system32\WINMM.DLL

    77820000 Module C:\WINNT\system32\VERSION.dll

    77840000 Module C:\WINNT\system32\cscui.dll

    77880000 Module C:\WINNT\system32\SETUPAPI.DLL

    77950000 Module C:\WINNT\system32\WLDAP32.DLL

    77980000 Module C:\WINNT\system32\DNSAPI.DLL

    779B0000 Module C:\WINNT\system32\OLEAUT32.dll

    77BF0000 Module C:\WINNT\system32\NTDSAPI.dll

    77D30000 Module C:\WINNT\system32\RPCRT4.dll

    77E10000 Module C:\WINNT\system32\USER32.dll

    77F40000 Module C:\WINNT\system32\GDI32.dll

    77F80000 Module C:\WINNT\system32\ntdll.dll

    78000000 Module C:\WINNT\system32\msvcrt.dll

    7C0F0000 Module C:\WINNT\system32\USERENV.DLL

    7C2D0000 Module C:\WINNT\system32\ADVAPI32.dll

    7C340000 Module C:\WINNT\system32\Secur32.dll

    7C570000 Module C:\WINNT\system32\KERNEL32.dll

    7C740000 Module C:\WINNT\system32\CRYPT32.dll

    7C950000 Module C:\WINNT\system32\CLBCATQ.DLL

    7CDC0000 Module C:\WINNT\system32\NETAPI32.DLL

    7CE20000 Module C:\WINNT\system32\OLE32.DLL

    7CF30000 Module C:\WINNT\system32\SHELL32.dll

    77F9193C Attached process paused at ntdll.DbgBreakPoint

    77F91A76 Debug string: [762593] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [762593] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [762593] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [762609] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    Thread 000003C8 terminated, exit code 0

    Thread 00000294 terminated, exit code 0

    77F91A76 Debug string: [763515] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [764531] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [764593] FileTimeToDosDateTime(): Year is less than 1980

    77F91A76 Debug string: [764593] FileTimeToDosDateTime(): Year is less than 1980

    77F91A76 Debug string: [764593] FileTimeToDosDateTime(): Year is less than 1980

    77F91A76 Debug string: [764593] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764593] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764593] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764593] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764593] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764593] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764625] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764625] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [764625] CloseHandle(): NtClose failed, status = 0xC0000008

    77F91A76 Debug string: [765546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [766546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [767546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [768546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [769546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [770546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [771546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [772546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [773546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [774546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [775546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [776546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [777546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [778546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [779546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [780546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [781546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [782546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [783546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [784546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [785546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [786546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [787546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [788546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [789546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [790546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [791546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [792546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [793546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [794546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [795546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [796546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [797546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [798546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [799546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    Thread 000004A0 terminated, exit code 0

    77F91A76 Debug string: [800546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [801546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [802546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [803546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [804546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [805546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [806546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [807546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [808546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [809546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [810546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [811546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    77F91A76 Debug string: [812546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135

    Log file closed

    hope this helps..

  5. I have tried your kernel... and I was unable to debug anything using ollydbg... so I pick another way... I'm attaching the olly to explorer process.

    here is the LOG file produced by olly.. there are two LOGs files.. the name of the file should be obvious...

    I have no idea whether this is useful or not... :blushing:

    btw you have done such an impressive work... :thumbup

    hope this helps...

    log.zip

  6. I'm sorry but I'm curious, about the merging two files or maybe more. so the main goal is merging the inf(s) and collecting all the listed files into single updates, right? so the structure is exactly the same of each update? is there any "qfe" or "gdr" branch like the XP ones? is it different from service pack?

    so why we're not write a program/software to automate it..? err sorry just my personal thought..

  7. I only have a png of my favorite start orb, so I must wait for Beta3 or the Final.

    Just load it into Paint included with Windows (desktop) and save it as BMP.

    BMP images need alpha channels for transparency when PNG doesn't therefore doing that will remove the transparency.

    Oh well. :) Hopefully SiB will support PNG later.

    just use "alpha image convertor" for converting PNG -> BMP and vice versa for keeping the alpha channel..

    google it with the exact phrase including the quotes. It should be somewhere in the internet...

  8. hello...

    Actually I have take a look on it.. but unfortunately I have no win2k system ATM (its still being repaired..),, and I have only vc2010 express MASM32 package..

    so I just tried to recompile them..

    the first is csrsrv... I got it succeed..

    but when I tried to recompile basesrv...

    it complain that I'm missing for some import from csrsrv, I have copied the produced LIB from csrsrv... but still did not succeed....

    because the basesrv need functions from csrsrv as Stdcall...

    because of curiosity I open up the csrsrv .lib with Hex editor then tried to search the missing export..

    And I don't know is it right or not but adding extern "C" before exported function solve my problem... --> the produced lib contain correct export lists...

    since I have not programming in C/C++ for a long time, I almost forgot the languages.. :blushing: (I'm still trying to starting over)

    well I don't know its help or not... anyway you have done such a great job... :thumbup

  9. Hello all....

    Most of us knows that when we right click the drive and choose

    properties there will always a pie chart

    (except you've remove them...hehe..).

    I don't like the color of it...

    So I manage to change it...

    Searching it everywhere and I found this thread about 1,5 years ago...

    Still couldn't solve my problem though :no: ...

    But yesterday... It inspiring me.. :D

    then I start searching through system file and

    WOW I Found It.....!!! :lol:

    here is my mod...

    propdialogmod.th.png

    Here is what to do....

    open shell32.dll with any hex editor... (you better copy it somewhere else before open it...)

    and then...

    [Pie chart]
    Original
    90 00 00 FF 00 FF 00 FF 00 00 00 80 00 80 00 80 00

    Replace with
    90 0F 63 FF 00 1B A9 1B 00 01 31 8C 00 01 57 01 00


    [Free Space]
    Original
    68 FF 00 FF 00 EB 09

    Replace with
    68 1B A9 1B 00 EB 09


    [Used Space]
    Original
    68 00 00 FF 00 FF 71

    Replace with
    68 0F 63 FF 00 FF 71

    Note: search the original hex code and replace with reserved code...

    Replace Back to system32 folder...

    (use replacer for the easiest way... but it's better to make backup first...)

    Done.... that's it....

    Enjoy.... B)

    Huge thanks to Mr. Peteski... for his hex color code and his color suggestion....

    but the rest I did it myself..... :whistle:

    PS: sorry for my (bad) english....

  10. Hello,,

    Firstly sorry for such a bump..

    Actually the color of the pie chart can be altered..

    But I don't know about how to change the antialiazing think..

    And yes it paints itself using gdi..

    The color code is not located in explorer.exe but in shell32,,

    I have change the color of my own pie chart..

    Maybe tomorrow or the day after tomorrow, when I got my computer, I will show you how it can be done..,

    PS: Sorry for my bad English..

×
×
  • Create New...