May 16, 20233 yr If you want change 2000, XP x86's version and build number, use imagecfg! for Longhorn, modify ntoskrnl or ntkr**** via hex editor. (follow this guide!) But in case of XP x64, imagecfg doesn't work and I can't find where major and minor are in ntoskrnl.. Does anyone know where they are? I was able to find build number in ntoskrnl, so version is 5.2.2600 now
May 16, 20233 yr Author Quote Whats exactly your goal? Changing minor version. + Purpose is testing compatiblity Edited May 17, 20233 yr by doldolekim
May 17, 20233 yr Look in ntos' RtlGetVersion. It's either hardcoded in there (Vista+) or it references the global variables that store the major and minor versions (XP x64, I'm almost certain).
May 17, 20233 yr Changing build for what test exactly? Compatibility of what exactly? If you want to lie for certain app, use Application Verifier. Otherwise build could be changed using hacking kernel32.dll If I remember correctly. Also If you just want to display different build in WinVer dialog, it can be done by registry
May 17, 20233 yr Author 1 hour ago, win32 said: Look in ntos' RtlGetVersion. It's either hardcoded in there (Vista+) or it references the global variables that store the major and minor versions (XP x64, I'm almost certain). I modified RtlGetVersion and PsGetVersion both, but version is still 5.2 Edited May 17, 20233 yr by doldolekim
May 17, 20233 yr So XP x64 doesn't have the global variables that store the major/minor versions after all (WRK does). In that event, you should look for MmCreatePeb or a similarly named function; this will provide the values that are fed to user mode version functions. You can also modify ntdll's RtlGetVersion or "intercept" kernel32's GetVersionExW.
May 17, 20233 yr Author 1 hour ago, win32 said: So XP x64 doesn't have the global variables that store the major/minor versions after all (WRK does). In that event, you should look for MmCreatePeb or a similarly named function; this will provide the values that are fed to user mode version functions. You can also modify ntdll's RtlGetVersion or "intercept" kernel32's GetVersionExW. Thank you so much!! I found major and minor near MmCreatePeb function Edited May 17, 20233 yr by doldolekim
Create an account or sign in to comment