SFC_OS.DLL hack for XP SP2 Final

[xb00t]

@xb00t: You can use the one attached on the CD. No need to edit it. I only put the edits up so that people know what is edited in that file.

[netquik]

Okay thanks!!!

RaveRod

can you tell me which code is the header CRC?

I have to be ready to manually apply patch to italian version

(this is why i m so curious)

is At offset (0000ECE9)?

[RyanVM]

I think you mean ...

http://www.ryanvm.net/msfn/SFCFILES.DL_

But I know you are just showing off that ryanvm.net !

(GreenMachine.net is long gone, alas)

EDIT:: Silly me: forgot to add Thanks, RyanVM!

hehe, didn't realize it was case sensitive

And for what it's worth, I would have attached it but it was too big 8)

[Denney]

can you tell me which code is the header CRC?

Use the ModifyPE program available at unattended.msfn.org. It will modify the PE (CRC) header of SFC_OS.DLL to allow setup to accept it.

[todd]

What exactly does the hacked sfcfiles.dll do/used for? I searched Google and found that if you remove the file, you can delete those folders that appearantly have no use in Program Files.. but what about the hacked version?

Edit: And if you use the hacked sfc_os.dl_ do you need to edit i386\hivesft.inf ? The guide says use one or the other but the auther of this thread makes it sound like you need both.

[RyanVM]

What exactly does the hacked sfcfiles.dll do/used for? I searched Google and found that if you remove the file, you can delete those folders that appearantly have no use in Program Files.. but what about the hacked version?

It maintains the list of files that WFP protects. The hacked version removes Program Files folders from the list without removing earlier ones.

Edit: And if you use the hacked sfc_os.dl_ do you need to edit i386\hivesft.inf ? The guide says use one or the other but the auther of this thread makes it sound like you need both.

@RyanVM: Yes the hive does need to be edited (or you can import the registry entry during "cmdlines". If you import the registry entry during "RunOnceEx", WFP won't be disabled until the second boot.

[Adiel]

Use the information on the unattended page here (just replace the file there with this file here):

http://unattended.msfn.org/xp/wfp.htm

@ Adiel, OMERZEN & DaLurker:

If you would just follow the link provided you would find the answer t oyour question.

ok thank u

[netquik]

can you tell me which code is the header CRC?

Use the ModifyPE program available at unattended.msfn.org. It will modify the PE (CRC) header of SFC_OS.DLL to allow setup to accept it.

thanks RaveRod...

I would go with modifyPE in anyway cause i'm going to patch italian version...

so is this the change without CRC question?

At offset (00000F82) change:

CODE

44 00 69 00 73 00 61 00 62 00 6C 00 65

to:

CODE

53 00 65 00 74 00 74 00 69 00 6E 00 67

thanks

[netquik]

hi raverod...

i have another little question

At offset (00000F82) change:

CODE

44 00 69 00 73 00 61 00 62 00 6C 00 65

to:

CODE

53 00 65 00 74 00 74 00 69 00 6E 00 67

At offset (0000ECE9) change:

CODE

33 C9

to:

CODE

EB 01

okay..

At offset (0000ECE9) I found (SP2 EN)

33 C0 not 33 C9

Am I wrong?

[netquik]

sorry.. bump

[Denney]

@netquik: If you look at my first post, you'll see I changed that some time ago.

You are right about the C9 being C0, it was my mistake. I didn't read what I was typing close enough.

Oh, and you need to make BOTH hex edits to your file.

The first edit changes the SFCDisable registry key to SFCSetting and the second one disables that annoying dialog and stops the file being overwritten.

[netquik]

thanks

[DingoDaddy]

Question for people using this hacked sfc_os.dll. It does not appear to be working for me. I made the registry change to change SfcDisable to SfcSetting and set it to 0xfffffffd. Whenever I reboot SfcSetting is set back to 0x00000000 and directories in ProgramFiles remain locked. Any clues?

I installed SP2 off of the full administrator version and this is my reported Windows version:

Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2

[Denney]

@DingoDaddy: What hacked file did you use? The one attached to my post? Try adding SFCDisable=0x00000000 to the registry and then change SFCSetting=0xffffff9d.

[Astalavista]

ok... stupid question here... downloaded the file now

i put into my i386 folder.

is there a registry entry that i must do to my regtweaks???