SFC_OS.DLL for SP2 RC2 hacked!

[Denney]

Updated & Fixed:

Credit goes to vorte[x] for the original hex edit to disable WFP. I added mine to change the registry setting.

Ok. Well, after a couple of more tries, I have finally fixed it.

This modified file works EXACTALLY the same as my other one except it uses the SP2 RC2 sfc_os.dll rather than the SP1 sfc_os.dll so no campatibility problems should arise.

To use it, simple replace the sfc_os.dl_ file on your Windows XP SP2 RC2 CD with the one attached here, then, edit HIVESFT.INF and add the following line after "SfcQuota" (search for it).

HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon","SFCSetting",0x00010003,0xffffff9d

That's it!! You have now disabled WFP for good. If you want to re-enable it, change the above registry setting to 0x00000000 rather than 0xffffff9d. Simple.

Hope you all enjoy my work.

BTW... this file has been modpe'd and compressed, ready to go onto a CD.

SFC_OS.DL_

[DarkBringer]

Thanks, RaveRod. I'll wait for the official release of Service Pack 2 to try it out.

[Denney]

Yeah. Hopefully they won't change the SFC_OS.dll file between RC2 and RTM like they did with RC1 to RC2.

[XtremeMaC]

using the actual SP2 RC2 SFC_OS.DLL file.

how is this actual if u have modified it? or vorte[x] modified it?

though thanks for the file I believe 2055's dll was posted while back I was wondering if any new one's came up

also u can put that registry entry into the hive files so it gets executed even b4..

[Denney]

@XtremeMaC: I mean it's the actual file from RC2 rather than the one from SP1 which also works.

I tried putting that registry entry into the hive files but setup overwrites that entry later on in the setup. You could be thinking of my modified SP1 file where you add "SFCSetting" to the hive file... not "SFCDisable".

[Denney]

Just a bump so people will re-read my post... explaining why this hack won't work and that I jumped the gun.

[XtremeMaC]

ow I see thanks for the explanation

(I'm critisizing too much these days, stress sorry )

[my2001]

I'll wait for the official release of Service Pack 2 to try it out.

Yeah, me, too. But hopefully they're gonna release it soon.

[creopard]

So this RC2 modded sfc_os.dll won't help me, if i already set any unsigned drivers in the "OEMPnPDriversPath" section of winnt.sif?

I also read somewhere you should take these settings in your winnt.sif

[SystemFileProtection]
SFCQuota=0
SFCScan=0
SFCDisable=ffffff9d

On a test installation XP used it's own Microsoft drivers (instead of the vendors drivers!) where it could

[Louie666]

Hi just a quick note I have succesfully used the modified sfc.dll from nlite, as well as the one from SP1 mod...inserted the code you mention above into winnt.sif & it works a treat used vortex hacked uxtheme.dll & works fine

[systemFileProtection]SFCQuota=0

SFCScan=0

SFCDisable=ffffff9d

[Denney]

@swgreed: This modded sfc_os.dll has nothing to do with vendor drivers or Windows ones. The drivers are totally separate from this file.

@Louie666: The sfc_os.dll from nLite is the one I modded from SP1. This sfc_os.dll file is the actual one from SP2. That's about the only difference. I cannot gurantee that the sfc_os.dll from SP1 will work with RTM of SP2 when it comes out. That's why I'm doing this.

Also, using SP2's sfc_os.dll, adding SFCDisable to your winnt.sif file does NOTHING. That variable is no longer used so there's no point putting it in there.

This file is currently only for people who want to use the actual sfc_os.dll from SP2, not the one from SP1 (which just happens to work, for now).

[creopard]

But i thought if I don't turn of WFP XP overrides any drivers without WHQL signature and uses its own Microsoft drivers again.

Am I muddling up here anything?

[Denney]

Just a quick post to inform everyone that I have now fixed the SFC_OS.DLL file to disable WFP during setup (same as with the SP1 file).

@swgreed: I think your muddled up because it doesn't matter if WFP is enabled or disabled... you can use any drivers you want so long as you have the correct entries in your winnt.sif file to disable driver signing.