A new patch to edit syssetup.inf without any error messages

[harkaz]

1. Grab the original XP SP3 syssetup.dll file.
2. Using a hex editor, like XVI32, open the dll file.
3. Go to address (offset) 33B7B.
4. Replace 74 with EB.
5. Save changes to syssetup.dll
6. Using modifype -c command or a similar tool fix the PE checksum.
7. To get rid of the "Battery unsigned" issue, you have to perform this additional step: Open the syssetup.inf with notepad. Go to the [DeviceInfsToInstall] section of the INF file. Delete or comment the line with the battery.inf file. Save changes.
8. Use the new syssetup.dll and syssetup.inf files instead of the original ones.

Known side-effects: Setuperr.log file reports that syssetup.dll is not properly signed. In addition, SFC does not protect syssetup.dll after installing Windows. However, SFC does not report any problems after Windows installation.

[Acheron]

I have seen over the years different patches for syssetup.dll for Windows XP SP3 here and on ryanvm.net and most of them have some problems about driver warnings or breaking some functionality.

 

Recently I replaced all of them with the patches published by Mr. Dusha on OSZone.net and have not had any problems since.

 

http://forum.oszone.net/thread-119984.html.

 

I had to register to download the files. The text file is very useful but despite its name does not contain all modifications made. Using the Fake Setup Advanced command line I was able to apply all the patches to syssetup.dll and setupapi.dll.

 

Here's the complete list of patches and descriptions for Windows XP SP3.

//=============// SETUPAPI.dll//=============//5.1.2600.5603 (KB948720)0001CD29: 74 EB // Disable DSP increase from 0 to 1,0001D509: 74 EB // if replaced SFC-protected signed driver00021B5F: 74 90 //00021B60: 0A 90 // Disable unsigned drivers decreasing rank00021B6E: 75 EB //000456A7: 74 EB // Disable error messages in Setupapi.log and pop-up driver install dialogs with patched syssetup.dll.....//5.1.2600.55120001CD29: 74 EB // Disable DSP increase from 0 to 1,0001D509: 74 EB // if replaced SFC-protected signed driver00021B7F: 74 90 //00021B80: 0A 90 // Disable unsigned drivers decreasing rank00021B8E: 75 EB //000456C7: 74 EB // Disable error messages in Setupapi.log and pop-up driver install dialogs with patched syssetup.dll.....//========================// SYSSETUP.dll PatchBlock//========================//5.1.2600.551200033B29: 73 EB // Disable Syssetup.inf protect 00033E00: 39 85 //00033E01: 5D DB // DefaultDrvSignPol = 0 (params in winnt.sif will be ignored)00033E02: 08 90 //000574FF: 74 90 // Disable OOBE00057500: 07 90 0005AB31: 6A EB // Disable SFC files scan in T-80005AB32: 46 0D ////===========// SFC_OS.dll//===========//5.1.2600.55120000EC87: 75: EB // SfcDisable=0xFFFFFF9D enable//=======================// UXTHEME.dll PatchBlock//=======================//6.0.2900.551200018727: 8B 33 //00018728: FF C0 //00018729: 55 C2 // Unsigned themes usage enable0001872A: 8B 04 //0001872B: EC 00 //

Edited May 5, 2014 by Acheron

[harkaz]

@Acheron Thanks for publishing the patches in one place. It's not easy to develop these patches without help...

[Zorba the Geek]

Redacted

Edited January 26 by Zorba the Geek

[Zorba the Geek]

Here is my interpretation of Mr dUSHA's patch for syssetup.dll as it would be implemented for the RVM integrator: 

[HexEdit]
I386\syssetup.dll|5.1.2600.5512|211753|73|EB   :????????? (33B29)
I386\syssetup.dll|5.1.2600.5512|212480|39|85   ;Disable Syssetup.inf protect (33E00)
I386\syssetup.dll|5.1.2600.5512|212481|5D|DB   ;Disable Syssetup.inf protect (33E01)
I386\syssetup.dll|5.1.2600.5512|212482|08|90   ;DefaultDrvSignPol = 0 (33E02)
I386\syssetup.dll|5.1.2600.5512|357631|74|90   ;DefaultDrvSignPol = 0 (574FF)
I386\syssetup.dll|5.1.2600.5512|357632|07|90   ;DefaultDrvSignPol = Disable (57500)
I386\syssetup.dll|5.1.2600.5512|371506|46|0D   :Disable SFC files scan in T-8 (5AB32)

As the two entries for Disable Syssetup.inf Protect are adjacent to each other in offsets 212480, and 212481 they can be combined like so:

I386\syssetup.dll|5.1.2600.5512|212480|395D|85DB   ;Disable Syssetup.inf protect (33E00)

More from Mr dUSHA can be found using a translation in 360 Chrome here.

Edited January 26 by Zorba the Geek

[Zorba the Geek]

Back again.  I have tested Harkaz's syssetup.dll patch and I must say that it seems to be perfectly suitable for my XP addons that remove Windows applications like Outlook Express.  I did reproduce the syssetup.dll patch created by nLite, and although it makes more extensive changes it does cause problems.like syssetup.dll and sfcfiles.dll sometimes being flagged as modified in setuperr.log and the installation being halted because the battery driver had not been copied to System32.  Here is the nLite patch adapted for addons

[HexEdit]
I386\syssetup.dll|5.1.2600.5512|328|DC27|10A9
I386\syssetup.dll|5.1.2600.5512|211780|56565656|33C0EB29
I386\syssetup.dll|5.1.2600.5512|212461|8BFF558BEC|33C0C20400
I386\syssetup.dll|5.1.2600.5512|360769|7507|9090

If entries are removed from syssetup.inf and syssetup.dll is not patched the installation is halted due to a fatal error with these messages:

Quote

An error has been encountered that prevents Setup from continuing.  Setup failed to install the product catalogs.  This is a fatal error.  the setup log files should contain more information.

Error:  The signature for Windows XP Home Edition Setup is invalid.  The error code is 800b0100.  No signature was present in the subject.

The Harkaz patch without the checksum in the header being updated will result in the halting of the file copy stage with this message:

The file syssetup.dll was not copied correctly.  The file Setup placed on your hard drive is not a valid Windows XP system image.

The patch has to be combined with the updated checksum at 0x0148 like so:

[HexEdit]
I386\syssetup.dll|5.1.2600.5512|329|27|9E
I386\syssetup.dll|5.1.2600.5512|211835|74|EB

The Harkaz patch did not produce errors in setuperr.log, but there were errors in setupapi.log about unsigned or incorrectly signed files.  Perhaps the Mr Dusha patches were meant to remedy this.  Also this patch did not cause the installation of the battery driver to fail.