Artoo's Inter-Galactic termsrv.dll Patcher Tool™

Discussion in 'Windows 8' started by Mr Jinje, Nov 1, 2013.

Page 5 of 10

Mr Jinje MDL Expert

Aug 19, 2009

1,769

1,106

60
#81 Mr Jinje, Dec 29, 2013
Last edited by a moderator: Apr 20, 2017
(OP)
Here is a fun one. Imported Artoo into the registry as binary data, wrote it to memory as memorystream and run R2 without need for an.exe via right click shell extension. The memorystream seems to make it a bit more responsive.

Instructions for 8.1 / R2 only - merge with registry, right click anywhere on desktop and choose "Artoo's Termsrv Patcher" to open.

Here is an excerpt.

Code:

Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\Directory\background\shell\runas] "MUIverb"="Artoo's Termsrv Patcher" "icon"="cmd.exe" "Position"="Top" "HasLUAShield"="" [HKEY_CLASSES_ROOT\Directory\background\shell\runas\command] "R2"="H4sIAAAAAAAEAO29B2AcSZYlJi9tynt/SvVK1+B0oQiAYBMk2JBAEOzBiM3mkuwdaUcjKasqgcpl

Uninstaller

Code:

Windows Registry Editor Version 5.00 [-HKEY_CLASSES_ROOT\Directory\background\shell\runas]

Click to expand...

FYI, this experimental method could be deleted by me at any time, so get it while the getting is good.
Attached Files:

R2_BETA_3_EXPERIMENTAL_REGISTRY_VERSION.7z

File size:

128.4 KB

Views:

625
ffddhhh MDL Novice

Dec 29, 2013

2

0

0

#82 ffddhhh, Dec 30, 2013

Stupidity on my part. Permissions issue, basically once you take ownership as admin, you need to change permissions to full control. I mistakingly had it changed to full control for users not admins. works perfectly now
Thanks for the great tool Jinje

ffddhhh said: ↑

Just tried 8.1x64
No changes made to termserv as far as date
When you hit apply patch I see the comand line flash, but can`t actually see what it does
Is therea way to run from command line?
Click to expand...
larza83 MDL Novice

Dec 7, 2013

3

0

0

#83 larza83, Jan 4, 2014
Last edited: Jan 4, 2014

Mr Jinje said: ↑

are you on x86 by chance ?

Confirm, are you on W8 Home version, IIRC only the core or home versions needed that.
Click to expand...

Sorry for late reply, I am on Enterprise version, 8.1 x64

Mr Jinje MDL Expert

: Aug 19, 2009

: 1,769

: 1,106

: 60

#84 Mr Jinje, Jan 6, 2014

Last edited by a moderator: Apr 20, 2017

(OP)

W81x64 gotcha, try this. Added a SnoopLoggy.Log for error collection, instructions are copy your unpatched termsrv.dll somewhere + edit the path where instructed. Report any errors.

Code:



Function Artoo($patchfile,$offsets,$patches)

{<#
.SYNOPSIS
Artoo's Inter-Galactic Hex Patching Tool™ command line interface
.EXAMPLE
Artoo -patchfile "C:\termsrv.dll" -offsets 0x1F641,0x80C24,0x56C23 -patches 00,90E9,8B8138060000B80001000089813806000090418BC04883C4
#>

Function Convert-HexStringToByteArray {[CmdletBinding()]Param ( [Parameter(Mandatory = $True, ValueFromPipeline = $True)] [String] $String );$String = $String.ToLower() -replace '[^a-f0-9\\\,x\-\:]','';$String = $String -replace '0x|\\x|\-|,',':';$String = $String -replace '^:+|:+$|x|\\','';if ($String.Length -eq 0) { ,@() ; return };if ($String.Length -eq 1){ ,@([System.Convert]::ToByte($String,16)) }elseif (($String.Length % 2 -eq 0) -and ($String.IndexOf(":") -eq -1)){ ,@($String -split '([a-f0-9]{2})' | foreach-object { if ($_) {[System.Convert]::ToByte($_,16)}}) }elseif ($String.IndexOf(":") -ne -1){ ,@($String -split ':+' | foreach-object {[System.Convert]::ToByte($_,16)}) }else{ ,@() }}

$log = (split-path $patchfile -parent)+ "SnoopLoggy.log"
start-transcript -path $log 
$patch = new-object System.IO.FileStream "$patchfile",Open,ReadWrite,None

$i=0
foreach ($position in $offsets){
$offset = "{0:d}" -f $position
$hex = Convert-HexStringToByteArray $patches[$i]
$patch.Position = $offset
$hex | foreach {$patch.WriteByte($_)}
$i=$i+1
}

$patch.Flush()
$patch.Close()
$patch.Dispose()
stop-transcript
Get-Help Artoo -Detailed | Out-file -FilePath $log -Append
notepad $log
}

#
# EDIT PATH BELOW
#

Artoo -patchfile "A:\Working\Path\termsrv.dll" -offsets 0x1F641,0x80C24,0x56C23 -patches 00,90E9,8B8138060000B80001000089813806000090418BC04883C4
#

Click to expand...

Mr Jinje MDL Expert

Aug 19, 2009

1,769

1,106

60

#85 Mr Jinje, Jan 6, 2014
Last edited by a moderator: Apr 20, 2017
(OP)

You need to login to view this posts content.
joakim MDL Novice

Dec 30, 2009

21

6

0

#86 joakim, Jan 15, 2014

Have anyone tried patching it in memory? Would it be possible? I tried on Windows 7 x86, but it seems to just hang at connecting...
Mr Jinje MDL Expert

Aug 19, 2009

1,769

1,106

60

#87 Mr Jinje, Jan 16, 2014
Last edited by a moderator: Apr 20, 2017
(OP)

You need to login to view this posts content.
malltaf MDL Novice

Jan 16, 2014

2

0

0

#88 malltaf, Jan 16, 2014
Last edited: Jan 16, 2014

I try R2_Beta3 Patch on Windows 8.1 Enterprise x64 now. Well, seems it works, I can connect to two users at the same time. I can't check whether the local user can enter, because I only could connect remotely now (until evening comes). Computer should automatically load user when comp started, but if i'm connecting remotely, it will ship it at this point, ie either it can not boot at startup now, or the connection is different from the connection of a local user. Teamviewer also going crazy, connects, but draws the devils and not responding ...
Do I understand correctly, that it is possible to connect several times to the same user by using this patch? I don't need this feature, but need to connect to different users at the same time without troubles the local user.
Thanks for your work)
Mr Jinje MDL Expert

Aug 19, 2009

1,769

1,106

60

#89 Mr Jinje, Jan 16, 2014
Last edited by a moderator: Apr 20, 2017
(OP)

You need to login to view this posts content.
malltaf MDL Novice

Jan 16, 2014

2

0

0

#90 malltaf, Jan 16, 2014
Last edited: Jan 16, 2014

I was testing all that right now. My wife is from local user, i'm - remotely. So that's ok with patch, i think. And TeamViewer connected correctly now. Magic? I'll watch what will happen next and tell about it here.
joakim MDL Novice

Dec 30, 2009

21

6

0

#91 joakim, Jan 16, 2014

Mr Jinje said: ↑

If you can teach me the correct syntax for cdb.exe I can give it a shot.

See here, WinRT finds the $pid of csrss.exe and attaches to it. Then it modifies winsrv.dll at multiple offsets. How do we do the same thing for svchost.exe and termsrv.dll ?
Click to expand...

So I tried the same thing in ollydbg and attached it to the correct svchost, and did the same patch as I already tried with inline memory attempt. And it worked. So I guess the answer lies in how I have left the module, or its state. I tweaked the page protection and set it to PAGE_READWRITE, which may have produced undesired behaviour.. Btw, finding the correct svchost can be done by looping through all svchosts and using EnumProcessModulesEx (to search for termsrv.dll).

Good to know that memory patching will work then!
joakim MDL Novice

Dec 30, 2009

21

6

0

#92 joakim, Jan 16, 2014

Bingo! It was the page protection that had to be reset. Needed to be changed back to PAGE_EXECUTE_READ after temporarily being PAGE_READWRITE in order to write to the page. How x64 behaves with this is not yet tested.
phil123 MDL Novice

Jan 17, 2014

1

0

0

#93 phil123, Jan 17, 2014

Help- I've install the patch all ok. BUT I can't seem to get the RDC to auto login to the desktop. When I login remotely, I get the Windows 8 login screen, and therefore have to select the user name and type the password again.
Tried all sorts to resolve. I appears to be a be an issue on the Windows 8 side not Client side. I'm testing between a windows 7 PC and windows 8 PC. RDC to windows 7 works fine (straight to desktop), RDC to windows 8 always get me to the login screen.
How do I enable auto login on the RDC session?
joakim MDL Novice

Dec 30, 2009

21

6

0

#94 joakim, Jan 17, 2014

@Mr Jinje
The memory patch also works on x64 (at least Windows 7). After a couple of failed attempts I realized after trying your tool, that 2 other places had to be patched. Nice work though! Will you consider a memory patcher too?
Mr Jinje MDL Expert

Aug 19, 2009

1,769

1,106

60

#95 Mr Jinje, Jan 18, 2014 (OP)

joakim said: ↑

@Mr Jinje
The memory patch also works on x64 (at least Windows 7). After a couple of failed attempts I realized after trying your tool, that 2 other places had to be patched. Nice work though! Will you consider a memory patcher too?
Click to expand...

like i said, if you can provide me a working example of the cmd line syntax, I'll take a look at it again, but for now I just don't have the free time to learn and do everything I want.
esword MDL Novice

Jan 18, 2014

1

0

0

#96 esword, Jan 18, 2014

These steps worked great for me on a 8.1 pro box that I just upgraded from 8.0 pro using the beta3 r2d2. Only hiccup was remembering how to take ownership of the termsrv.dll file, which a post on winmatrix helped with. Thanks for everyone's hard work! e

Hackministrator said: ↑

Hello,
I've tried it on Win8.1x64.

On a clean system:
1) Manual backup of termserv
2) Take ownership of termserv.dll (administrators/system/users)
3) Launch R2D2.exe
a) clic on Service (Stop service)
b) clic on patch
c) clic on restart
Click to expand...
joakim MDL Novice

Dec 30, 2009

21

6

0

#97 joakim, Jan 19, 2014

You need to login to view this posts content.
Mr Jinje MDL Expert

Aug 19, 2009

1,769

1,106

60

#98 Mr Jinje, Jan 21, 2014 (OP)

You need to login to view this posts content.
joakim MDL Novice

Dec 30, 2009

21

6

0

#99 joakim, Jan 22, 2014

Maybe in next version when it is cleaned up a bit.
tvcat MDL Novice

Feb 23, 2011

34

11

0
#100 tvcat, Jan 23, 2014
joakim said: ↑

Here's a memory patcher for the same stuff;

Uses the same patches as the tool of this thread, but will patch memory instead of on-disk. Just execute it. If run from console then feedback will be printed. In order to undo a patch, just restart the service "Remote Desktop Services".

Supported versions are currently only: 6.1.7601.17514 and 6.3 9600.16384.
Click to expand...

i tried this on windows 8.1 64bit
working good but it cant be undo even after restart service, restart windows, and full shutdown.

(You must log in or sign up to post here.)

Page 5 of 10