Artoo's Inter-Galactic termsrv.dll Patcher Tool™

Slartibartfast42 · Dec 18, 2013

DrDickButt said: ↑

The heldigard patch works for me but doesnt enable multiple logins for the same user.

I could never get the intergalactic tool to edit the dll file. It added the patch files in the system32 folder but it never did anything to termsrv.dll file.
Click to expand...

Yea, like I just said, it doesn't autocopy correctly. You have to take the W81x64termsrv.dll.patch file, rename is termsvr.dll, and copy it to System32. You may have to take ownership of termsvr.dll first. Of course, have the remote desktop service stopped during the copy too.

I got a same user and a different user working simultaneously.

Mr Jinje · Dec 18, 2013

You need to login to view this posts content.

Mr Jinje · Dec 20, 2013

Testing out a new method, what a headache, think it's finally working. Many thanks to sunstar for the patches. Need a few testers, no n00bs. Copy any spare W81x64 termsrv.dll you have, doesn't matter what version patch was applied and point the $termpath to it. Run this code and it will patch the file in place and overwrite all the previous patches. Much easier for me to do it this way to try and identify every possible version that a user could have installed previously. Report back,

Make a backup before running this, as I mentioned it modifies the file in place.

Code:

# PATCH

$termpath = "B:\termsrv.dll"

GPS|%{$LOCK = $_;$_.Modules|%{If($_.FileName -eq "$termpath"){Kill -id $LOCK.id -force}}}

function Convert-HexStringToByteArray {[CmdletBinding()]Param ( [Parameter(Mandatory = $True, ValueFromPipeline = $True)] [String] $String );$String = $String.ToLower() -replace '[^a-f0-9\\\,x\-\:]','';$String = $String -replace '0x|\\x|\-|,',':';$String = $String -replace '^:+|:+$|x|\\','';if ($String.Length -eq 0) { ,@() ; return };if ($String.Length -eq 1){ ,@([System.Convert]::ToByte($String,16)) }elseif (($String.Length % 2 -eq 0) -and ($String.IndexOf(":") -eq -1)){ ,@($String -split '([a-f0-9]{2})' | foreach-object { if ($_) {[System.Convert]::ToByte($_,16)}}) }elseif ($String.IndexOf(":") -ne -1){ ,@($String -split ':+' | foreach-object {[System.Convert]::ToByte($_,16)}) }else{ ,@() }}

$patch = new-object System.IO.FileStream "$termpath",Open,ReadWrite,None

$W81x64_offset1 = "{0:d}" -f 0x1F641
$W81x64_patch1 = "00"
$W81x64_offset2 = "{0:d}" -f 0x56C23
$W81x64_patch2 = "8B8138060000B80001000089813806000090418BC04883C4"
$W81x64_offset3 = "{0:d}" -f 0x80C24
$W81x64_patch3 = "90E9"

$hex = Convert-HexStringToByteArray $W81x64_patch1
$patch.Position = $W81x64_offset1
$hex | foreach {$patch.WriteByte($_)}

$hex = Convert-HexStringToByteArray $W81x64_patch2
$patch.Position = $W81x64_offset2
$hex | foreach {$patch.WriteByte($_)}

$hex = Convert-HexStringToByteArray $W81x64_patch3
$patch.Position = $W81x64_offset3
$hex | foreach {$patch.WriteByte($_)}

$patch.Flush()
$patch.Close()
$patch.Dispose()

Write-Host "$termpath has been patched"
#

Code:

# REVERSE

$termpath = "B:\termsrv.dll"

GPS|%{$LOCK = $_;$_.Modules|%{If($_.FileName -eq "$termpath"){Kill -id $LOCK.id -force}}}

function Convert-HexStringToByteArray {[CmdletBinding()]Param ( [Parameter(Mandatory = $True, ValueFromPipeline = $True)] [String] $String );$String = $String.ToLower() -replace '[^a-f0-9\\\,x\-\:]','';$String = $String -replace '0x|\\x|\-|,',':';$String = $String -replace '^:+|:+$|x|\\','';if ($String.Length -eq 0) { ,@() ; return };if ($String.Length -eq 1){ ,@([System.Convert]::ToByte($String,16)) }elseif (($String.Length % 2 -eq 0) -and ($String.IndexOf(":") -eq -1)){ ,@($String -split '([a-f0-9]{2})' | foreach-object { if ($_) {[System.Convert]::ToByte($_,16)}}) }elseif ($String.IndexOf(":") -ne -1){ ,@($String -split ':+' | foreach-object {[System.Convert]::ToByte($_,16)}) }else{ ,@() }}

$patch = new-object System.IO.FileStream "$termpath",Open,ReadWrite,None

$W81x64_offset1 = "{0:d}" -f 0x1F641
$W81x64_patch1 = "01"
$W81x64_offset2 = "{0:d}" -f 0x56C23
$W81x64_patch2 = "8B813806000039813C0600000F841B700000418BC04883C4"
$W81x64_offset3 = "{0:d}" -f 0x80C24
$W81x64_patch3 = "0F84"

$hex = Convert-HexStringToByteArray $W81x64_patch1
$patch.Position = $W81x64_offset1
$hex | foreach {$patch.WriteByte($_)}

$hex = Convert-HexStringToByteArray $W81x64_patch2
$patch.Position = $W81x64_offset2
$hex | foreach {$patch.WriteByte($_)}

$hex = Convert-HexStringToByteArray $W81x64_patch3
$patch.Position = $W81x64_offset3
$hex | foreach {$patch.WriteByte($_)}

$patch.Flush()
$patch.Close()
$patch.Dispose()

Write-Host "$termpath has been reversed"
#

Click to expand...

pzjuls · Dec 20, 2013

Thanks Mr Jinje i will wait till you have this tested but very excited we might have a solution soon.
Cheers Juls

spacebebop · Dec 21, 2013

Just wanted to pop in say thanks for the cool tool!!

One thing to note on at least one box - firewall rule. Had to add one manually (standard Windows Firewall) for TCP 3389. Added, and can RDP just fine now. Perfect! Would offer to test for 8.1, but I haven't upgraded my one win8 machine (yet). If I can find time to, I'd be glad to volunteer

larza83 · Dec 21, 2013

Don´t know what I am doing wrong...

I must say I am so glad to see that this seems to work for most people, hoping to get it working my self as well. Great job Mr Jinje!

Im on windows 8.1 pro. I downloaded the latest beta release Artoo patcher. Opened it op, stopped the service and tried to apply the patch. Doesn´t change anything.. Still unpatched.

What can I provide you with to enable you to assist me?

Thank you in advance! Greatful for any help given.

Mr Jinje · Dec 22, 2013

larza83 said: ↑

I must say I am so glad to see that this seems to work for most people, hoping to get it working my self as well. Great job Mr Jinje!

Im on windows 8.1 pro. I downloaded the latest beta release Artoo patcher. Opened it op, stopped the service and tried to apply the patch. Doesn´t change anything.. Still unpatched.

What can I provide you with to enable you to assist me?

Thank you in advance! Greatful for any help given.
Click to expand...

Try the manual button, it should open up system32, after that close down artoo, rename the termsrv.dll, and copy the "W81x64termsrv.dll.patch" from the artoo directory and rename it termsrv.dll. Do that or rename termsrv.dll.patch to termsrv.dll if the patch has already been copied into system32. Unsure why artoo will not release the lock file preventing itself from renaming.

If you still can't rename because of locked process, run this snip and then try to rename.
Code:
$termpath = "C:\windows\system32\termsrv.dll"

GPS|%{$LOCK = $_;$_.Modules|%{If($_.FileName -eq "$termpath"){Kill -id $LOCK.id -force}}}

larza83 · Dec 22, 2013

Mr Jinje said: ↑
Try the manual button, it should open up system32, after that close down artoo, rename the termsrv.dll, and copy the "W81x64termsrv.dll.patch" from the artoo directory and rename it termsrv.dll. Do that or rename termsrv.dll.patch to termsrv.dll if the patch has already been copied into system32. Unsure why artoo will not release the lock file preventing itself from renaming.

If you still can't rename because of locked process, run this snip and then try to rename.
Code:
$termpath = "C:\windows\system32\termsrv.dll"

GPS|%{$LOCK = $_;$_.Modules|%{If($_.FileName -eq "$termpath"){Kill -id $LOCK.id -force}}}
Click to expand...
Thank you mate! It works great!

For any other newbie (like me) if you fail renaming/deleting the old termsrv.dll file, just right click on it and set permissions under advanced. Give admin full ownership, as standard it only has read and execute.

Mr Jinje · Dec 22, 2013

larza83 said: ↑

Thank you mate! It works great!

For any other newbie (like me) if you fail renaming/deleting the old termsrv.dll file, just right click on it and set permissions under advanced. Give admin full ownership, as standard it only has read and execute.
Click to expand...

are you on x86 by chance ?

spacebebop said: ↑

Just wanted to pop in say thanks for the cool tool!!

One thing to note on at least one box - firewall rule. Had to add one manually (standard Windows Firewall) for TCP 3389. Added, and can RDP just fine now. Perfect! Would offer to test for 8.1, but I haven't upgraded my one win8 machine (yet). If I can find time to, I'd be glad to volunteer
Click to expand...

Confirm, are you on W8 Home version, IIRC only the core or home versions needed that.

Mr Jinje · Dec 22, 2013

You need to login to view this posts content.

Mr Jinje · Dec 27, 2013

Here is the 3rd beta - full re-write. No SoundFX. Mostly to address issues faced by a few readers.

NOTE: Windows 8.1 only - does not include patches for other OS's. Need some testers + feedback to ensure method is working correctly on all machines.
RELEASE NOTES: Decided to drop all the sha1 nonsense for byte size switch.
Code:
if ($patch.length = 862720) {
Write-Host "W81x86"
}

if ($patch.length = 1032704) {
Write-Host "W81x64"
}
EDIT: Forgot to add the Firewall rule, maybe next version.
Click to expand...

dementor5 · Dec 28, 2013

Mr Jinje said: ↑

Here is the 3rd beta - full re-write. No SoundFX. Mostly to address issues faced by a few readers.

NOTE: Windows 8.1 only - does not include patches for other OS's. Need some testers + feedback to ensure method is working correctly on all machines.
Click to expand...

Hi! I tried your program (2rd beta and 3rd beta), but it doesn't work for me. When I try to connect to myself (localhost - 127.0.0.1), I receive a mistake "Your computer could not connect to another console session on the remote computer because you already have a console session in progress." My OS is Windows 8.1 Enterprise x64.
Can you help me?

Mr Jinje · Dec 28, 2013

dementor5 said: ↑

Hi! I tried your program (2rd beta and 3rd beta), but it doesn't work for me. When I try to connect to myself (localhost - 127.0.0.1), I receive a mistake "Your computer could not connect to another console session on the remote computer because you already have a console session in progress." My OS is Windows 8.1 Enterprise x64.
Can you help me?
Click to expand...

Try from a remote host, I've only gotten that to work on 2012-R2.

Hackministrator · Dec 28, 2013

Mr Jinje said: ↑

Here is the 3rd beta - full re-write. No SoundFX. Mostly to address issues faced by a few readers.

NOTE: Windows 8.1 only - does not include patches for other OS's. Need some testers + feedback to ensure method is working correctly on all machines.
Click to expand...

Hello,
I've tried it on Win8.1x64.
I don't know if I have done all the needed operations., did I forget something?

On a clean system:
1) Manual backup of termserv
2) Take ownership of termserv.dll (administrators/system/users)
3) Launch R2D2.exe
a) clic on Service (Stop service)
b) clic on patch
c) clic on restart

I don't see any termserv.patch or newly created files in system32 (is it the correct behaviour?)

Connect from a remote W8.1x64 disconnect the local session, can't have multiple sessions from remote.

Thanks for your work.

Mr Jinje · Dec 29, 2013

You need to login to view this posts content.

ffddhhh · Dec 29, 2013

Just tried 8.1x64
No changes made to termserv as far as date
When you hit apply patch I see the comand line flash, but can`t actually see what it does
Is therea way to run from command line?

Mr Jinje said: ↑

The patch is happening you can confirm by checking the hash or "Date Modified".

The beta 3 is programmed to over-write all known previous patch bits, thus converting any termsrv.dll it finds (modded or untouched) into the most current 8.1 patch. The disable button works the same way and should convert any 8.1 termsrv.dll back to the original SHA1.

This avoids name collisions with any pre-existing files in the .patch or .bak namespaces from earlier versions. A backup file is located in the winsxs directory. I rename it termsrv.dll.bak to avoid an issue where 'termservice' creates a handle to the winsxs copy instead of the modded copy in System32.

Easier for me to upkeep going forward. Still waiting on feedback from users who had issues with the termsrv.dll not getting changed at all by beta-2
Click to expand...

Mr Jinje · Dec 29, 2013

You need to login to view this posts content.

ndfan77 · Dec 29, 2013

Mr Jinje said: ↑
are you getting a UAC popup confirming that it is running as Administrator ?

You can run this snip on 8.1 to find the SHA1 hash.
Code:
$termpath = "C:\Windows\System32\termsrv.dll"
(Get-FileHash -Algorithm SHA1 $termpath | Select-Object -Property Hash).Hash
#
If patched, it should return "04CE7DBFE9EF2C133A9FCCC27F1C15268CA9EBBC", original / unpatched is "D9560284FF79D139E5D7DD73C94AF2F4FBFF1551".
Click to expand...
Get-FileHash seems to be a new command in PowerShell 4. My version of Windows 8.1 still has PowerShell 3. I can't figure out how to upgrade it to PS 4. The Windows Management Interface 4.0 updates published for download seem to only be applicable to Windows 8.0 (apparently Windows 8.1 installs WMI 4.0 -- but if so, I don't understand why I still have PS 3...).

Mr Jinje · Dec 29, 2013

ndfan77 said: ↑

Get-FileHash seems to be a new command in PowerShell 4. My version of Windows 8.1 still has PowerShell 3. I can't figure out how to upgrade it to PS 4. The Windows Management Interface 4.0 updates published for download seem to only be applicable to Windows 8.0 (apparently Windows 8.1 installs WMI 4.0 -- but if so, I don't understand why I still have PS 3...).
Click to expand...

are you upgraded from 8.0 or clean install from ISO ?

ndfan77 · Dec 29, 2013

Mr Jinje said: ↑

are you upgraded from 8.0 or clean install from ISO ?
Click to expand...

8.1 Upgraded from 8.0

Artoo's Inter-Galactic termsrv.dll Patcher Tool™

Slartibartfast42 MDL Novice

Mr Jinje MDL Expert

Mr Jinje MDL Expert

pzjuls MDL Novice

spacebebop MDL Novice

larza83 MDL Novice

Mr Jinje MDL Expert

larza83 MDL Novice

Mr Jinje MDL Expert

Mr Jinje MDL Expert

Mr Jinje MDL Expert

Attached Files:

R2-D2.7z

dementor5 MDL Novice

Mr Jinje MDL Expert

Hackministrator MDL Novice

Mr Jinje MDL Expert

ffddhhh MDL Novice

Mr Jinje MDL Expert

ndfan77 MDL Novice

Mr Jinje MDL Expert

ndfan77 MDL Novice