PE Tool for creating patches

[tomasz86]

WildBill,

I have bad news. It's the same issue as before. With /SOS enabled it goes up to acpitabl.dat and then screen goes off. Without /SOS boot screen doesn't even show up.

[MacLover]

I just finished going through all of the files for VS2008 and found that the following APIs are needed to run it:

for .NET Framework 3.0:

RPCRT4.DLL -> I_RpcBindingInqLocalClientPID (InfoCard component)
RPCRT4.DLL -> RpcServerInqCallAttributesW (WPF)
RPCRT4.DLL -> RpcServerUnregisterIfEx (WPF)

[s]ADVAPI32.DLL -> SystemFunction036 (InfoCard component)[/s]

MSVCRT.DLL -> _vscwprintf (WIC)
MSVCRT.DLL -> _wtof (WIC, WPF)
MSVCRT.DLL -> _aligned_free (WIC)
MSVCRT.DLL -> _aligned_malloc (WIC)
MSVCRT.DLL -> ___lc_codepage_func (WPF, XPS)
MSVCRT.DLL -> ___lc_handle_func (WPF, XPS)
MSVCRT.DLL -> __uncaught_exception (WPF, XPS)
MSVCRT.DLL -> _resetstkoflw (WPF)
MSVCRT.DLL -> __crtGetStringTypeW (XPS)
MSVCRT.DLL -> __crtLCMapStringW (XPS)
MSVCRT.DLL -> ___mb_cur_max_func (XPS)
MSVCRT.DLL -> __pctype_func (XPS)
MSVCRT.DLL -> _strtoi64 (XPS)
MSVCRT.DLL -> _strtoui64 (XPS)

[s]KERNEL32.DLL -> RtlCaptureStackBackTrace (WIC, WPF, XPS)[/s]

[s]NTDLL.DLL -> DbgPrintEx (WIC, WPF)[/s]

USER32.DLL -> RegisterRawInputDevices (WPF)
USER32.DLL -> IsWinEventHookInstalled (WPF)

WINSPOOL.DRV -> IsValidDevmodeW (XPS)

for Web Designer Core (from WCU):

[s]KERNEL32.DLL -> CreateMemoryResourceNotification[/s]
[s]KERNEL32.DLL -> QueryMemoryResourceNotification[/s]

for Windows SDK tools:

DBGHELP.DLL -> SymLoadModuleEx
DBGHELP.DLL -> SymEnumTypes
DBGHELP.DLL -> SymGetTypeInfo

CRYPT32.DLL -> CryptStringToBinaryA
CRYPT32.DLL -> CryptStringToBinaryW

[s]KERNEL32.DLL -> SetThreadUILanguage[/s]

for VS2008 itself:

[s]KERNEL32.DLL -> AddVectoredExceptionHandler[/s]
KERNEL32.DLL -> DebugActiveProcessStop
KERNEL32.DLL -> DebugSetProcessKillOnExit

SHELL32.DLL -> SHCreateShellItem
SHELL32.DLL -> SHOpenFolderAndSelectItems
SHELL32.DLL -> SHParseDisplayName

OLEAUT32.DLL -> 442 (Ordinal number for RegisterTypeLibForUser)

URLMON.DLL -> CoInternetSetFeatureEnabled

[s]IPHLPAPI.DLL -> IcmpCloseHandle[/s]
[s]IPHLPAPI.DLL -> IcmpSendEcho[/s]
[s]IPHLPAPI.DLL -> IcmpCreateFile[/s]

EDIT: I forgot that a few files required UXTHEME.DLL but BlackWingCat's UXTHEME.DLL wrapper in system32 seems to take care of that issue. (At least as far as Dependency Walker is concerned )

EDIT: Strange, Ordinal 345 is missing from COMCTL32.DLL even on Windows XP... (I think this is yet another Vista/7 API or some undocumented function...)

EDIT: Crossed out functions added in MS11-011 v5

EDIT: Crossed out functions added in MS11-020 v5

Edited November 27, 2011 by MacLover

[WildBill]

WildBill,

I have bad news. It's the same issue as before. With /SOS enabled it goes up to acpitabl.dat and then screen goes off. Without /SOS boot screen doesn't even show up.

(sigh)

Here's another that switches one routine off. There's so much ruled out now that there can't be much left to cause it.

Windows2000-KB2393802-v1-early-c5f-x86-ENU.exe

[tomasz86]

Still the same issue.

[WildBill]

Hmm. Maybe it has to do with moving a couple of routines. I moved them back while keeping the mods to them...maybe this will do something.

Windows2000-KB2393802-v1-early-c5g-x86-ENU.exe

[tomasz86]

The problem remains

I also have one question about update.ver files.

What exactly does this value stand for?

msi.dll=D41E5FFFFFD2E47C638B63C5DDB41248,000400051772575A,4446720,850295E5

The rest is like this:

msi.dll=MD5,file version+?,file size,CRC32

Edited October 21, 2011 by tomasz86

[MacLover]

The problem remains

I also have one question about update.ver files.

What exactly does this value stand for?

msi.dll=D41E5FFFFFD2E47C638B63C5DDB41248,000400051772575A,4446720,850295E5

The rest is like this:

msi.dll=MD5,file version+?,file size,CRC32

There are 4 numbers in a version number in this file (The version number is also in hex.)

i.e. 5.1.2600.5512 = 000500010A281588

[WildBill]

I think I found something -- a variable that I wasn't initializing if custom bootskins were turned off. Maybe this will help:

Windows2000-KB2393802-v1-early-c5h-x86-ENU.exe

[tomasz86]

Thank you, MacLover

I think I found something -- a variable that I wasn't initializing if custom bootskins were turned off. Maybe this will help:

Windows2000-KB2393802-v1-early-c5h-x86-ENU.exe

It still doesn't work but the situation is different now. I can see a GUI part of /SOS boot and the progress bar goes up to around 80% and then monitor goes off.

Edited October 22, 2011 by tomasz86

[WildBill]

What do you get without /SOS? Does the monitor go off at about the same point? (80%)

[tomasz86]

First of all, without /SOS there's no normal boot screen. It's just a dark blue progress bar on a black background so I can't really say if it's 80% or 100% but still monitors goes off at the similar moment.

[WildBill]

Ah-ha. I think I found the reason why you weren't getting a boot screen with /SOS off. Also, I have a hunch as to why it' dying at 80%. Here's another test:

Windows2000-KB2393802-v1-early-c5i-x86-ENU.exe

[tomasz86]

The normal boot screen is back but the 80% problem persists. Interestingly, when /SOS is enabled the progress bar goes up to 100% but after that monitor goes off as usually.

Edited October 23, 2011 by tomasz86

[WildBill]

Almost there Here's another one that changes how it tries to load the bootskin image from disk to use a lot less stack space. Even if you have bootskins off it was still allocating a lot of stack space and maybe that was a problem.

Windows2000-KB2393802-v1-early-c5j-x86-ENU.exe

Edited October 23, 2011 by WildBill

[billtodd]

A cursory look at 2286198 as superseding 967715 leaves me wondering whether it really does (the latter dealing with autorun/autoplay functionality and the former not obviously having anything to do with that - nor apparently claiming to supersede any of the previous patches in that area).

Rather than spend more time trying to analyze this, I'm willing to risk implying what may be a stupid question here (because you presumably can answer it off the top of your head). Please forgive me if I should have posed it somewhere else

Thanks,

- bill