Jump to content

jaclaz

Member
  • Posts

    21,300
  • Joined

  • Last visited

  • Days Won

    53
  • Donations

    0.00 USD 
  • Country

    Italy

Everything posted by jaclaz

  1. Why not? IMDISK is normally used in PE's alright but if all you need is to mount a .iso and for *whatever reasons* you don't like IMDISK there are several alternatives, including filedisk and even the good ol' virtual CD control panel by MS could do (for 32 bit). A number of program of this kind are listed here (JFYI): http://reboot.pro/topic/1507-ramdisk-and-filedisk-drivers/ Specifically for IMDISK, you can install it on-the-fly (see FGA #13): http://reboot.pro/topic/15593-faqs-and-how-tos/ or plainly install the driver with SC, *like*: http://reboot.pro/topic/5531-install-and-uninstall-imdisk/?p=43137 (this will work with most of these drivers) jaclaz
  2. It doesn't work this way. If you know HOW to use the needed tool(s) you don't ask about WHICH is/are the needed tool(s). CATCH 22. You need to study and learn a lot about X86 assembly, Windows programming and interfaces, before starting to debug and disassemble successfully executables, and only once you will be familiar with all the mentioned topics, and I mean VERY familiar with all of them, you will be able to start some real reverse engineering, and finally you will be able to actually re-assemble and insert code "arbitrarily" in a pre-made executable. Of course by then you will be familiar with all the "tools of the trade" (and possibly also write/code your own ones). Anyway - usually AFAIK - codecaves are used instead, here is a good start for you: http://www.codeproject.com/Articles/20240/The-Beginners-Guide-to-Codecaves jaclaz
  3. You don't need to "extract" the .iso, you can mount it as a virtual drive with IMDISK or other similar tool/driver. jaclaz
  4. Dybia, that is perfectly "normal". If you INSERT *any* byte ALL jump (or similar) instructions pointing to *any* address after the insert point will need to be re-based/re-calculated. In any case you normally DO NOT insert 00's in an executable, but rather 90's (or NOP's). jaclaz
  5. First is an (ab)use of the PROMPT command (this is "rare" or "advanced"), see: http://ss64.com/nt/prompt.html http://superuser.com/questions/82929/how-to-overwrite-the-same-line-in-command-output-from-batch-file Second is due to expansion of parameter %1 (first parameter) in the CALLed subroutine (this is instead pretty much "common" or "simple"). When the batch CALLs the :to_HHMMShs subroutine as: CALL :to_HHMMShs Delta The "Delta" becomes %1 (and viceversa) so what will be executed will be: SET /A DeltaHH=!DeltahsVal!/360000 SET /A DeltaMM=(!DeltahsVal!-!DeltaHH!*360000)/6000 SET /A DeltaSS=(!DeltahsVal!-!DeltaHH!*360000-!DeltaMM!*6000)/100 SET Deltahs=0!DeltahsVal:~-2! SET DeltaHH=0!DeltaHH! SET DeltaMM=0!DeltaMM! SET DeltaSS=0!DeltaSS! SET Delta=!DeltaHH:~-2!.!DeltaMM:~-2!.!DeltaSS:~-2!,!Deltahs:~-2! jaclaz
  6. But on wednesdays nights? (only when the moon is full, of course) Anyway - not really important since the intended volatility of the tool (and of it's support, ending on 1st October 2016) - what you posted is titled documenation (as opposed to documentation). jaclaz
  7. NONE are "abandoned". ALL are past End of Support. https://blogs.msdn.microsoft.com/windows-embedded/2014/02/17/what-does-the-end-of-support-of-windows-xp-mean-for-windows-embedded/ PosReady 2009 extended support will end on April 9, 2019. jaclaz
  8. no, yes (if the XP is OEM), here: https://allanjsmithie.wordpress.com/2014/05/15/how-to-upgrade-from-xp-to-windows-7-oem/ You might be able to find a legal Windows 7 (or more likely 8) "System Builder" license , but that is not anyway an upgrade, it is a "ful install", see also here: http://www.howtogeek.com/198358/whats-the-difference-between-the-system-builder-and-full-version-editions-of-windows/ and of course the whole matter is a mess/it is clear enough/it is a mess again: http://www.howtogeek.com/197232/microsoft-is-misleading-consumers-with-windows-8.1-system-builder-licensing/ https://www.microsoft.com/OEM/en/licensing/sblicensing/Pages/windows-licensing-for-personal-use.aspx#fbid=yKQtWFuwIG0 It makes no sense to buy a proper 7 or 8/8.1 license if the idea is to upgrade downgrade to Windows 10, simply get a Windows 10 license. jaclaz
  9. What you report is really strange. I could understand if you could not see any folder in drive F: (which could be some misconfiguration related to the card format) or if you couldn't have F: at all, but you can access the top level folder and then inside it you cannot find the actual photos (files) is perplexing. Try the following as a test. 1) on one of the Windows machines that "sees" files inside \db\dcim\100OLYMP copy to the F: drive two files (any small sized .txt file will do), one in \db\dcim\ and one in db\dc\100OLYMP\ folders 2) move the camera to the non-working machine and verify you can (or cannot) see those two files Another thing that you can try is to clean the system from all USB devices (see here): but it applies to different symptoms. jaclaz
  10. Sure, here it is : http://reboot.pro/topic/21116-how-to-convert-emmc-hdd-from-removable-disk-to-local-disk-to-install-windows/ though I don't think you are in this case, your issue is seemingly the lack of appropriate Windows 7 drivers for the specific hardware, maybe the "generic" Intel drivers? http://h30434.www3.hp.com/t5/Notebook-Operating-System-and-Recovery/Windows-7-Drivers-for-HP-Stream-Notebook-11-d010nr-ENERGY/td-p/5019111 About the USB, besides the (good as always :)) advice by cdob to enable the drivers: http://reboot.pro/topic/14186-usb-hdd-boot-and-windows-7-sp1/#entry127772 the note was about the fact that if you manage to have USB 3 working the system will be noticeably faster, but for the moment just test the USB 2 booting from external disk. jaclaz
  11. All these years thinking that paying to access a news article was to actually get some news, as opposed to some lame late excuses about how she was wrong in a previous non-news article (BTW likely originally also behind a paywall). She should give back some of the money ;). jaclaz
  12. Yep , but you also failed to read the given link or the comment about the need of 0x08 hex characters (backspaces) in the batch (they cannot be posted), everyone has been (before or later) a newbie at batch scripting (or at something else), but in order to learn one needs to try and solve problems. What would you learn if I fix your time subtraction batch? Maybe you would learn more if you read and understand my time subtraction batch. (it is written in a very "linear" fashion and should be very easy to follow) Anyway the posted snippet has at least one more issue, using TASKLIST to monitor the running program *somehow* makes the line flash AND there is anyway an (intentional) typo in the (just to see if readers are paying attention ) in the :to_hs subroutine. And in the meantime I found a clever way to create the 0x08's "on the fly", so here is an updated little batch. Still you will need to find the typo in the math subroutine. So here it is: I have a couple "better" batches, but I will post them only once you will have had time to test the above and fix the small mis-calculation. jaclaz
  13. @Tsundere Which EXACT model of the HP Stream is it? And is that 32 bit or 64 bit Windows that you are trying to install? You need anyway - as Tripredacus said - a specific driver slipstreamed, but there can be an additional issue, there was recently a case of a (Dell) thingie that needed a BIOS update to have the EMMC be seen as "fixed". BUT wait a minute, is this still the same as this: http://www.sevenforums.com/installation-setup/376325-installing-win-7-new-laptop-emmc.html and you are looking for a "second opinion"? The "external" USB approach should however work fine, still you will probably need USB 3 drivers for Windows 7. jaclaz
  14. There are reports of these issues when one attempts to install the printer AND attempts to share it BUT there is some generic network/firewall/domain misconfiguration. See: https://social.technet.microsoft.com:443/Forums/office/en-US/4e7f2d47-8808-4acc-9c51-cc222acc3f81/when-adding-a-printer-share-within-print-management-receive-there-are-no-more-endpoints-available?forum=winserverprint Particularly see if this is your case: https://asifkhandevadi.wordpress.com/2014/04/24/ws2012-windows-could-not-share-your-printer-there-are-no-more-endpoints/ If you cannot actually start the Add Printer it may be a different issue, still doing an SFC /scannow and rechecking the mentioned services won't do any harm. There also reports of the issue being connected with the spooler service stopping itself and/or some mixup with the RPC service and RPCSS and HTTP services as dependencies, see: http://answers.microsoft.com/en-us/windows/forum/windows8_1-hardware/printer-spooler-wont-start-at-startup-windows-81/207fd102-f5cf-4881-bf2c-be5568a75087?page=3 https://www.reddit.com/r/windows/comments/166t0g/print_spooler_service_broken_wont_start/ jaclaz
  15. I don't know , it may *sometimes* undermine confidence in the perceived uniqueness of one's vision ... jaclaz
  16. Just to confirm that it happens here also with Opera (Presto/2.12.388 Version/12.15), should be reproducible. jaclaz
  17. Yep, I understand your desire to not reveal your script contents, but this (respectable) choice makes it impossible for anyone to help/assist you, so your post can only be a (again perfectly understandable) form of ranting. To me it seems evident (but maybe it is just me ) from what you report that *somehow* what actually "arrives" to decrypt when sent "manually" is different from what "arrives" to it when sent through your script. What I would suspect would be that (still *somehow*) what your script is passing is different because it is (say) in a different encoding or format (think - as an example - to ASCII, Unicode or UTF) and I would use a hex editor to verify (after having dumped both the "manual" and "through script" password to file) if such a difference exists. And same goes if the procedure includes a clipboard copy/paste. At least you could describe the procedure and enumerate WHICH versions of Windows create the issue. To give you an example of what can happen (not necessarily your current issue, of course): http://bavih.blogspot.it/2008/07/notepad-bug.html jaclaz
  18. Sure, like sneakingly removing access to more than (roughly) 3.5 Gb of memory (which happened with SP2) was "fair play" . ... and of course the AARD issue back in the good ol'times was legit ... https://en.wikipedia.org/wiki/AARD_code jaclaz
  19. @submix8c Anyway the getTimeInAdvanceFromCrystalBall function is not available in the API unless user is "Magician" . Just in case the needed XKCD: https://xkcd.com/612/ @Kali Hmmm, the batch you posted seemingly mixes liberally HH , MM, SS and hs, you will have a number of incorrect results in many cases. And - if I get this right now - what you want is that the thingy shows time elapsed since start of the program updating it in "real time", i.e. something more like a "progress bar". This could be done in batch of course, BUT it will hog the CPU. AND you will have the whole display flashing, as the only simple way to update a command window from batch is to clear screen and re-output the new info. BUT there is a neat trick using SET /P and the backspace character (0x08) see: http://stackoverflow.com/questions/368041/how-to-code-a-spinner-for-waiting-processes-in-a-batch-file so that we can have *something* like: For the example above I used the Wait.exe available here: http://www.softtreetech.com/24x7/archive/58.htm jaclaz
  20. I wonder why he used "months" instead of the more accurate "decades" . jaclaz
  21. ... and on the BBC too: http://www.bbc.co.uk/news/technology-36367221 jaclaz
  22. Well, here, once saved the posted batch as mytymer.cmd, when run in a command prompt it shows: batch Program by jaclaz for Start Time and End Time of a Program execution Parameter is Missing Usage: mytimer.cmd <executable> PING -n 6 127.0.0.1 Program Start 18.32.43,74 Program End 18.32.49,05 Program Time 00.00.05,31 How different is what happens there? jaclaz
  23. Maybe you want to change the text "jnz" to "jz" or "jmp" instead .. Seriously , what you posted is the disassembly view, you need to change the OPCODE(s) in the binary, that is the idea of the given commands: First one search and replaces a number of hex bytes: gsar -o -s:xE8:x02:xBA:x02:x00:x85:xC0:x75:x41 -r:xE8:x02:xBA:x02:x00:x31:xC0:xEB:x41 update.exe Second one re-validates the PE checksum: pechecksum -c update.exe In the -s hex the 85C0 is "test eax,eax", and 75 is "jnz", in the -r hex this becomes 31C0 for "xor eax. eax" and (you never know) the EB is "jmp" (short, unconditional), see (example): http://www.mathemainzel.info/files/x86asmref.html You will need to change the other bytes before and after in the gsar command line to match the different binary you have (or use an hex editor, maybe easier). In any case make sure and double sure that gsar finds the right occurrence/area before adding the -r vaues. jaclaz
  24. So, you don't actually want a "stopwatch", you want a "timer" instead. This latter can easily be made in batch. The following is slightly obfuscated (so that readers may have an occasion to exercise their little gray cells): @ECHO OFF SETLOCAL ENABLEEXTENSIONS ENABLEDELAYEDEXPANSION REM Time format expected HH.MM.SS.hs 24h format SET N=batch Program by jaclaz for Start Time and End Time of a Program execution CALL :SET ECHO 1,6,11,3 CALL SET Var=42 %§%%P%=%* CLS IF NOT DEFINED PROGRAM ( ECHO %N% ECHO Parameter is Missing ECHO Usage: %~nx0 ^<executable^> SET PROGRAM=PING -n 6 127.0.0.1 ECHO !PROGRAM! ECHO. ) %§%%S%=!%T%! %?% %P% %S% !%S%! %_9% :M %S% %S% /W "" !%P%! %§%N=!%T%! %?% %P% %E% %N% %_9% :M N %§%/A D=%N%-!%S%! %?%. %§%/A F=%D%/%.%&%§%F=0!F! %§%/A A=(%D%-%F%*%.%)/%...%&%§%A=0!A! %§%/A J=(%D%-%F%*%.%-%A%*%...%)/%..%&%§%J=0!J! %§%/A H=(%D%-%F%*%.%-%A%*%...%-%J%*%..%)&%§%H=0!H! %?%. ECHO %P% %Y% %F:~-2%.%A:~-2%.%J:~-2%,%H:~-2% GOTO :EOF :M N O P Q SET /A %1=(1!%1:~0,2!-%..%)*%.%+(1!%1:~3,2!-%..%)*%...%+(1!%1:~6,2!-%..%)*%..%+1!%1:~9,2!-%..% GOTO :EOF :SET Answer=42 SET §=%0 &&SET §=!§:~1!&!§!#=%2-%4&!§!?=%1&!§!_9=%6 FOR /F "tokens=%#% delims= " %%N IN ('%?% %N%') DO ( %§%P=%%O&%§%!§:~0,1!=%%S&%§%!§:~1,1!=%%V&%§%!§:~2,1!=%%T&%§%Y=%%W %§%..=%200&%§%...=%3000&%§%.=%5%30000 ) jaclaz
  25. And now for the usual OFF TOPIC ... ... meanwhile in Maine ... http://www.macrumors.com/2016/05/23/apple-replace-ipads-macbooks-classrooms/ I personally read in the above "tablets" (in the meaning of underpowered touch enabled devices) instead of iPads, of course. jaclaz
×
×
  • Create New...