NemoNada Posted November 22, 2004 Share Posted November 22, 2004 In reviewing and trying to understand what's going w/WFP and RaveRod's hacked "SFC_OS.DLL" I noticed some discrepancies between what nLite does, RyanVM's RVMUpdatePack1.03Full.cab, and RaveRod's instructions and actual file. Can you all review this and tell me if my analysis & conclusions are correct? Analysis-1 The SFC_OS.DL_ file in this thread provided by RaveRod is different from the SFC_OS.DL_ file in the final product nLite (v.99.4) creates BUT it is identical to the SFC_OS.DL_ file in RyanVM's RVMUpdatePack1.03Full.cab (I can list the differences if you need them - 13 total changed). The version in all 3 is the same: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)Conclusion-1 Not sure why the nLite file would be different but the obvious safe course of action is to "swap it out" for RaveRod's. Right? Analysis-2-1 The entry for HIVESFT.INF suggested by RaveRod is:HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon","SFCSetting",0x00010003,0xffffff9dAnalysis-2-2 The entry actually in the nLite build HIVESFT.INF is:HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon","SfcDisable",0x00010000,0xFFFFFF9DAnalysis-2-3 The entry in the official Bypassing Windows File ProtectionMSFN Unattended Site section on "Bypassing Windows File Protection" is:HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon","SFCSetting",0x00010001,0xffffff9dConclusion-2 Okay, this one's tougher... RaveRod and nLite are saying almost the same thing except RaveRod's entry adds the NOCLOBBER qualifier to the REG_MULTI_SZ that both he and nLite use. If memory serves, NOCLOBBER means that a new value cannot replace an old (existing) value.On the other hand, the Unattended Guide is actually creating a REG_DWORD entry which is a different kind of animal altogether (text vs. hex)!?! And on checking my computer--which only has SP1 right now--it is a REG_DWORD entry. Since the value is in hex format I believe the entry should be REG_DWORD or 0x00010000.Comments, corrections, suggestions anyone? Link to comment Share on other sites More sharing options...
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!Register a new account
Already have an account? Sign in here.Sign In Now