The Russion version of win32k.sys has the same offset for patching like an English one, and it works perfectly, thanks harkaz By the way, i have to add my one cent to "update.ver" file patching. It has the structure, as it described below: [sourceFileInfo] sp3qfe\win32k.sys=D34BA6467C2109D604646747AB33D3AC,000500010A281A4D,1890432,SP3QFE,7B2FBF88 |----------- MD5 -------------| |-- Version --| |--bytes--| |--Branch--| |--Unknown--| ======== In our case Version is 5.1.2600.6733, so it can be decoded in this way: 0x0005 - 5 0x0001 - 1 0x0A28 - 2600 0x1A4D - 6733 PS: What means the last group of digits i dont know. If anyone knows, so describe it here, please.