unattended XP SP2 : REPLACING NOTEPAD

[crazyboot]

Hello,

I tried to make an unattended replace of notepad by notepad++, but got a problem (didn't work at all)

This is what i ve tried :

1. i replaced the the file sfc_os.dll (which is responsible for the Windows File Protection) by the one in the bottom of the page (for XP SP2)Official.

2. i integrated a script that copy the modified notepad.exe in dllcash, system32 and windows directory,

3. i put also the reg file

;Disable WFP
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"SFCDisable"=dword:FFFFFF9D

4. in runonce method, i made execute the script after the Windows install,

after the reg file

Well it worked for few seconds and then Windows however cancelled it and restored the original notepad

To made thing worse, il is no more possible to replace it even manually ... (Windows restore immediately)...

Someone could help me please ?

PS : a little more precision, my Windows XP SP2 has got postSp2 hotfixes untill Sept 2005.

Edited September 29, 2005 by crazyboot

[InTheWayBoy]

All I had to do was compress the new notepad.exe into the source. I like Notepad2, which is only a single .exe, so this might not work for a multi-file replacement.

Since the original notepad.exe is located in your sources I386 dir as NOTEPAD.EX_, you could just replace that with a modified version. I use jcarle's awesome compression bin, which can be found here:

http://www.msfn.org/board/index.php?showto...arle+compressor

Just run that, drop your target file onto it...in this case we take the NOTEPAD2.EXE and rename it to NOTEPAD.EXE, and then drop it onto Compression Bin. That in turn spits out a new file, NOTEPAD.EX_. The nice thing is that this file is ready to go, so you just overwrite the original NOTEPAD.EX_ with the new one.

I haven't run into any SFC errors using that method. And it's pretty simple to...you can use it for other files as well I hear.

[-M-]

First thing, I would prefer Notepad2 to Notepad++.

Second thing, why don't you just use Microsoft's compress.exe? Just use "compress Notepad2.exe Notepad.ex_" and copy the result (Notepad.ex_) into the specific directory... that's how I'd do it.

[crazyboot]

Thanks a lot for your replies

I didn't try it yet do it directly. In fact, i thought that if a file is in dllcash, then it wasn't possible to replace it directly in I386...

What i found amazing is that you seem even not need to replace sfc_os.dll ?

Well i try and come back with result.

Thanks again !

[InTheWayBoy]

Just to clarify, we're talking about replacing the files in the I386 dir of your install source. Once you've replaced that file, any installation you do with that source will have Notepad replaced. If you want to replace it on an already installed copy of Windows, then it's a little trickier.

[crazyboot]

It worked by your method, thanks a lot !!!

Do you know how to do on an already installed copy of windows ?

I tried manually, but it doesn't work (maybe because of sfc_co.dll that i used, the one that i downloaded from the "howto" guide, for XP SP2, and combined with the reg above to disable WFP) ?

It is just in case you can save me another installation of windows (on an another compute) and for better understanding of problem ;o)

Thanks again !