PE Tool for creating patches

[acus]

Hi,

I think that the BWC hotfix instals files from rtmgdr folder, because mshtml.dll ver. 1664 is located in RTMQFE folder.

Regards

Edited February 25, 2012 by acus

[WildBill]

I included XP's comctl32.dll in MS10-081 for Windows 2000.

But there is a little difference from xp version (ver 5.82.2900.6029)

Some applications are checked control version by comctl32, so I changed it as same as ver 5.81.

Do you remember which applications had problems when XP's comctl32 was used? What exactly happened?

XP's comctl32.dll is not compatible with the changes in 2479628. The layout of the cursor/icon structures are different. XP added 32-bit support fields in the middle of the structure, whereas to maintain backward compatibility in Win2k I had to add the extra fields to the end.

In other news, I think I'm almost there with 2393802-v9, but I'm having issues getting the larger csrss messages going across from kernel32 to basesrv. They're getting dropped somewhere once they get into csrsrv. I decided that since csrsrv.dll is rather small, the easiest thing to do would be to rewrite it from scratch based on the disassembly and load it up with debugging output when it sees problems. The rewrite is about 90% finished, and in the process I'm finding that MS did a shockingly poor job in writing it. They left it wide open to crashes if it gets invalid inputs, and looking at the XP version shows that it isn't any better. I'm probably going to add a compiler directive so it can be compiled as an "original" version and a "paranoid" one. One major difference is that I'm writing it in Delphi 6.0 instead of C (since I'm just not a C person), but this affords me the opportunity to make *sure* that the code is valid. Just be glad I'm not writing it in Ada

Edited February 27, 2012 by WildBill

[blackwingcat]

PeTool v0.0.5 always crushes when I reload DLL.

Access violation at address 00403E6C in module 'PETool.exe'.

I think it doesn't initialize data area, when reload another dll.

[WildBill]

Yeah, that's a long-standing bug that I never fixed. Someday when I have some time I need to fix that. Maybe once 2393802-v9 is out. At present I'm still working on the csrsrv.dll rewrite, though there are only a handful of routines left to do. Then I have to test it, debug it, and harden it (and then I have to finish the patch...)

No wonder there have been so many LPC exploits in Windows over the years. This DLL would *never* pass code reviews where I work. It's utter garbage.

[tomasz86]

I've prepared a beta version of Unofficial Updates Rollup. It's created 100% automatically by a script without any manual work involved. This is a multilanguage version. I'm working on the English one (many more English only updates included) but it's quite tricky and much more complicated.

I tested the global version in HFSLIP (no difference between integrating the rollup and integrating the single updates) and also in a VM. No problems occured.

Windows2000-UURollup-BETA-x86-Global.exe (6.01 MB)

Edited March 6, 2012 by tomasz86

[tomasz86]

I prepared a BETA2 of UU Rollup. I haven't added any more updates yet but there were a few bugs which I've fixed, ex. not all files were installed the rollup was installed in a running system (slipstreaming worked fine). I'm sure there're still other issues to be fixed though.

Windows2000-UURollup-BETA2-x86-Global.exe (6.02 MB)

Edited March 10, 2012 by tomasz86

[the xt guy]

I see a need for a complete pack of all the hotfixes for 2K: official, unofficial, HBR and paid ($) support fixes. As you said Tomasz86 (over on the RyanVM board) there are about 300 patches in total for 2K, too many for most to download and manage.

The problem with all in one packs is, what one person deems essential, someone else considers optional or even undesireable to install on a system (I consider WMP spyware and use a 3rd party media player. There are many other 3rd party apps I use instead of the ones that come with 2K. I even uninstall IE6, since it is hopelessly outdated-even unsafe on the net and use Firefox or K-Meleon.)

I consider 2K Microsoft's best operating system.

Edited March 10, 2012 by the xt guy

[tomasz86]

I've been working on Unofficial SP6 which will include everything but it's still a long way to go.

For now, I've prepared a BETA3 of UU Rollup (Global). I've added KB927489 and fixed some issues with manual uninstall and reinstall. I think I haven't said it before but this rollup does not require unofficial kernel to work.

Windows2000-UURollup-BETA3-x86-Global.exe (14 MB)

Edited March 12, 2012 by tomasz86

[tomasz86]

Unofficial Updates Rollup (BETA4) ready. I've added Services, True Type Fonts (TTF) Pack and Script 5.8. There was also a mistake in all previous versions - the official 972270 is not replaced by the rollup.

And I think I haven't mentioned it before but of course UU Rollup is fully compatible with HFSLIP.

Windows2000-UURollup-BETA4-x86-Global.exe (20.3 MB)

Edited March 13, 2012 by tomasz86

[tomasz86]

EDIT: From this moment all information about everything I do will be available here & here.

EDIT: There was a small bug in BETA5. Please use BETA5a instead.

I've prepared a BETA5 of Unofficial Updates Rollup. I've only fixed some bugs. This one is very likely to be the final version.

Windows2000-UURollup-BETA5a-x86-Global.exe (20 MB)

Edited March 23, 2012 by tomasz86

[blackwingcat]

msvcrt.dll (VC6 Runtime) compatible to Windows XP/2003.

I use in KDW msvcrt changed a little change from 2003's one.

Lastest DBGHELP.DLL is included in last SDK, and it is Advanced compatible to XP7s one.

Almost game installers include it.

CryptStringToBinaryA/W

WIndows 2000 has native both functions.

Plz see offcet 00072180 and 0007232A (5.131.2195.7147)

I just finished going through all of the files for VS2008 and found that the following APIs are needed to run it:

MSVCRT.DLL -> _vscwprintf (WIC)

MSVCRT.DLL -> _wtof (WIC, WPF)

MSVCRT.DLL -> _aligned_free (WIC)

MSVCRT.DLL -> _aligned_malloc (WIC)

MSVCRT.DLL -> ___lc_codepage_func (WPF, XPS)

MSVCRT.DLL -> ___lc_handle_func (WPF, XPS)

MSVCRT.DLL -> __uncaught_exception (WPF, XPS)

MSVCRT.DLL -> _resetstkoflw (WPF)

MSVCRT.DLL -> __crtGetStringTypeW (XPS)

MSVCRT.DLL -> __crtLCMapStringW (XPS)

MSVCRT.DLL -> ___mb_cur_max_func (XPS)

MSVCRT.DLL -> __pctype_func (XPS)

MSVCRT.DLL -> _strtoi64 (XPS)

MSVCRT.DLL -> _strtoui64 (XPS)

DBGHELP.DLL -> SymLoadModuleEx

DBGHELP.DLL -> SymEnumTypes

DBGHELP.DLL -> SymGetTypeInfo

CRYPT32.DLL -> CryptStringToBinaryA

CRYPT32.DLL -> CryptStringToBinaryW

[WildBill]

Hey all, just a little news update...

I've finished rewriting csrsrv in VS2005 for KB2393802 v9 and it's working well. I've significantly hardened it against attack and fixed what I think are several bugs in the original. I could take the hardening approach one step farther, but I haven't decided to do it yet as it would be pretty paranoid. I also think I've fixed the crash issue in the UP PAE kernel (ntkrnlpa.exe). Unfortunately (or fortunately, depending on how you look at it) I;m seeing that the SxS messages that my upgraded kernel32 is generating are getting lost in basesrv.dll (which csrsrv loads). The easiest thing to do is going to be to rewrite basesrv as well, which I think will be a lot easier since it's a lot smaller than csrsrv and now I have a starting codebase to work with. I'm still working nearly every day on KB2393802 v9 and I'm bound and determined to finish it.

I've put in doxygen comments for all of the routines in my csrsrv, but not yet for variables, types, etc. I'm not sure that it's really necessary as they're pretty self-explanatory. If people wish I can post the sources for it in the meantime in case anyone wants to improve on it.

[tomasz86]

@WildBill

The ole32.dll 5.0.2195.7060 from your 979687 seems to be buggy. Please check this and the following post.

Edited April 3, 2012 by tomasz86

[WildBill]

(sigh)

Sometimes I wonder why I put myself through this...

I've completely rewritten csrsrv.dll and basesrv.dll in C and I've significantly hardened them against attack. Then I figured it would be straightforward to update kernel32.dll to finish KB2393802-v9. But nooo..... for some reason I just can't make it work at the assembler level, partially because I can't trace its progress. So I decided to bite the mother-of-all-bullets...rewrite kernel32.dll in C as well.

In 5 days I've implemented 329 exported functions out of about 850, though the pace will slow down as the remaining ones become more and more complex. Nevertheless, it's proving to be a much simpler process than rewriting csrsrv and basesrv -- mainly because kernel32 apparently doesn't really do all that much: it farms out the heavy lifting to csrsrv, basesrv, winsrv, and ntdll and is mostly just a wrapper for those DLL's. So this mainly an exercise of cranking the handle by examining each function in IDA's decompiler and implementing a version that VS2005 can digest. In some cases IDA produces code that is pretty convoluted and I have to do some rewriting, but so far it's not nearly as bad as it was for csrsrv and basesrv -- the code in kernel32 just isn't that complex.

I'm hoping that this will be the last DLL I have to rewrite to get the patch working, since there isn't that much involved in getting SxS support going, and I've already done all the kernel-side stuff. The big unknown will be making sxs.dll happy, though I don't expect to have to rewrite it, just include it.

[WildBill]

I've posted KB2393802-v9

It doesn't include the new rewritten stuff and is mostly a bugfix version. It adds several SxS API's to ntdll, but until the rest of the pieces are added to kernel32 they won't do anything (they should be safe to call, they'll just return error codes since they won't succeed). I still recommend it though as it fixes several bugs in -v8.

Now I can work on finishing SxS support for v10 without having those bugs hanging over my head...

Edited May 14, 2012 by WildBill