[DISCUSSION] Windows 10 termsrv.dll Patching

Discussion in 'Windows 10' started by Mr Jinje, Oct 2, 2014.

  1. Mr Jinje

    Mr Jinje MDL Expert

    Joined:
    Aug 19, 2009
    Messages:
    1,773
    Likes Received:
    1,098
    Trophy Points:
    60
    #1 Mr Jinje, Oct 2, 2014
    Last edited: Oct 3, 2014
  2. Mr Jinje

    Mr Jinje MDL Expert

    Joined:
    Aug 19, 2009
    Messages:
    1,773
    Likes Received:
    1,098
    Trophy Points:
    60
    Reserved for future use.
     
  3. Mr Jinje

    Mr Jinje MDL Expert

    Joined:
    Aug 19, 2009
    Messages:
    1,773
    Likes Received:
    1,098
    Trophy Points:
    60
    #3 Mr Jinje, Oct 2, 2014
    Last edited: Oct 2, 2014
    (OP)
    I'll probably add some further details here at some point.



     
  4. Tito

    Tito Super Mod / Adviser Staff Member

    Joined:
    Nov 30, 2009
    Messages:
    17,888
    Likes Received:
    16,542
    Trophy Points:
    340
  5. WardocsRevenge

    WardocsRevenge MDL Expert

    Joined:
    Jan 13, 2012
    Messages:
    1,827
    Likes Received:
    618
    Trophy Points:
    60
    what is this for ? i can't see the picture
     
  6. jasminsehic

    jasminsehic MDL Novice

    Joined:
    Oct 13, 2014
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    0
    Windows 10 64-bit build 6.4.9879
    termsrv.dll Patch

    Search

    BB01000000C7

    Replace

    BB00000000C7

    Search

    39813C0600000F846F970200

    Replace

    B80001000089813806000090
     
  7. jeansagi

    jeansagi MDL Novice

    Joined:
    Nov 27, 2013
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    0
    Can anyone confirm if this works?

    Can anyone confirm if this works?

    J.

     
  8. Tito

    Tito Super Mod / Adviser Staff Member

    Joined:
    Nov 30, 2009
    Messages:
    17,888
    Likes Received:
    16,542
    Trophy Points:
    340
  9. jeansagi

    jeansagi MDL Novice

    Joined:
    Nov 27, 2013
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    0
    Not talking about RDP Wrapper

    I'm talking about patching termsrv.dll even if it is done using an hexadecimal editor.


    J.
     
  10. pisthai

    pisthai Imperfect Human

    Joined:
    Jul 29, 2009
    Messages:
    7,060
    Likes Received:
    2,158
    Trophy Points:
    240
    A try would just show it works! If you could, create an Image of your drive upfront so, if anything goes wrong, you could just revert back!
     
  11. bjf2000

    bjf2000 MDL Expert

    Joined:
    Apr 11, 2008
    Messages:
    1,015
    Likes Received:
    156
    Trophy Points:
    60
    Didn't try x64 yet, but x86 works, so x64 certainly should. Slightly different Finds but the same Replaces as the last 8.1.

    10586 (x64):
    Find: 39813C0600000F843F420200
    Replace: B80001000089813806000090

    10586 (x86):
    Find: 3B81200300000F8479760200
    Replace: B80001000089812003000090

    As usual, if you care about multi-session with the *same* account, then also do (I don't do this part so haven't tested it lately):

    Find: BB01000000C7
    Replace: BB00000000C7

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
    fSingleSessionPerUser (dword) = 0
     
  12. bjf2000

    bjf2000 MDL Expert

    Joined:
    Apr 11, 2008
    Messages:
    1,015
    Likes Received:
    156
    Trophy Points:
    60
    #12 bjf2000, Jul 23, 2016
    Last edited: Jul 28, 2016
    Find string in 14393 (x64)*: 39813C0600000F84D3DE0200
    Replace: B80001000089813806000090

    Find string in 14393 (x86)*: 3B81200300000F84DE5A0200
    Replace: B80001000089812003000090

    *Subject to change if ZDP for 14393 on Aug 2 changes termsrv.dll.
     
  13. Prince_Charles

    Prince_Charles MDL Novice

    Joined:
    May 10, 2007
    Messages:
    38
    Likes Received:
    33
    Trophy Points:
    0
    10.0.14390(x64)

    Find: 39813C0600000F84D3DE0200
    Replace: B80001000089813806000090

    Find: BB01000000C7
    Replace: BB00000000C7

    Find:007418488D
    Replace:00EB18488D



    Use RDPConf.exe from RDPWrap to configure, and RDPCheck.exe to check configuration.
     
  14. bjf2000

    bjf2000 MDL Expert

    Joined:
    Apr 11, 2008
    Messages:
    1,015
    Likes Received:
    156
    Trophy Points:
    60
    As mentioned before, the second of your three is the optional multi-session with the same account (I don't bother with that one since I don't want that feature), but what is the optional third one? I don't recall seeing that one before.
     
  15. Prince_Charles

    Prince_Charles MDL Novice

    Joined:
    May 10, 2007
    Messages:
    38
    Likes Received:
    33
    Trophy Points:
    0
    Nested sessions: the ability to invoke rdp into an instance of a rdp session: recursive sessions. Totally pointless but feasible. Purely for anal retentives.
     
  16. MartinicoBreton

    MartinicoBreton MDL Novice

    Joined:
    Mar 19, 2014
    Messages:
    20
    Likes Received:
    4
    Trophy Points:
    0
    For Final build 1607 (10.0.14393)

    To patch termsrv.dll (x64)

    Find : 39 81 3C 06 00 00 0F 84 D3 DE 02 00
    Replace : B8 00 01 00 00 89 81 38 06 00 00 90

    It works fine on my computer
     
  17. zylor

    zylor MDL Junior Member

    Joined:
    Feb 25, 2012
    Messages:
    82
    Likes Received:
    30
    Trophy Points:
    0
    anyone care to explain what is termsrv and why should we patch it?

    EMI5 please? :)
     
  18. yomoma2

    yomoma2 MDL Senior Member

    Joined:
    Feb 27, 2010
    Messages:
    347
    Likes Received:
    114
    Trophy Points:
    10
  19. l33tissw00t

    l33tissw00t MDL Addicted

    Joined:
    Dec 6, 2012
    Messages:
    818
    Likes Received:
    516
    Trophy Points:
    30
    it's ELI5 ;)

    to allow simultaneous multiple connections. see rdpwrapper page for more info. or google termsrv patch
     
  20. Black_dog

    Black_dog MDL Novice

    Joined:
    Apr 26, 2009
    Messages:
    12
    Likes Received:
    3
    Trophy Points:
    0
    As a side note, the termsrv.dll patch allows for the use of "Remote Apps".

    With a few additional Registry tweaks, and a customised RDP file, you can launch remote applications on windows 10, and get a seamless application on your desktop, without affecting the currently logged in user.

    Exactly what you do with Windows Server 2012 R2 Terminal services Remote App.

    It allows me to run apps on my home machine while I'm at work, have have them appear on my desktop.

    I mention this cause the 'RDP Wrapper' tool, which works for many, does not work for this use case.

    Thanks again for the patch!