[DISCUSSION] Windows 10 termsrv.dll Patching

Discussion in 'Windows 10' started by Mr Jinje, Oct 2, 2014.

  1. sebaxakerhtc

    sebaxakerhtc MDL Novice

    Nov 27, 2018
    38
    18
    0
    #221 sebaxakerhtc, May 14, 2020
    Last edited: May 17, 2020
    Hi to all !
    I try to make it working on a Windows 10 2004 build 19041.264 (latest release. Not preview)
    RDPCheck show me build 19041.84
    I make changes to rdpwrap.ini "LocalOnlyOffset.x64=87611" (see it in the termsrv.dll to make "jz" to "jmp")
    Now i have all lines green and [Fully supported]
    But when i try remote connection i see error 0x4
    I can't show you because forum do not give me access to put links

    After restart can't login at all
    "remote procedure call failed"

    Upd. I found SingleUserOffset.x64. It's changed too. Will try to find others

    Upd2. Changes at all...
    I think it should work on 19041.264.
    Test if you want and give me feedback
    https: github.com sebaxakerhtc/rdpwrap

    Upd3. N̶o̶t̶ ̶w̶o̶r̶k̶
    ̶S̶e̶r̶v̶i̶c̶e̶ ̶s̶t̶o̶p̶p̶e̶d̶
    ̶N̶o̶t̶ ̶l̶i̶s̶t̶e̶n̶i̶n̶g̶

    UPD4. Working now!
    My mistake in the address of the slinit! It's now bigger value!
    My old value = 5 simbols like older builds BUT! newer have a one symbol before! Because there is bigger value.
    Now i fully understand, why in the youtube lesson it was important to look the address range!
    Before two days i never mind i can make it working without help of specialist. But two days, beer and my love to knowlege make it :) Good luck to you all!

    OLD (5 symbols):
    =03FF8
    NEW (6 symbols):
    =103FF8

    -16.05.2020: Now it's work with 19041.264
    -17.05.2020: Now it's work with 19628.1 Insider Preview
     
  2. sebaxakerhtc

    sebaxakerhtc MDL Novice

    Nov 27, 2018
    38
    18
    0
    Hi. Just copy all files from RDPWrapper to your install directory.
    After it copy my file autoupdate.bat from github to your install directory and run it with administrator privilegies.
    Enjoy!
     
  3. sebaxakerhtc

    sebaxakerhtc MDL Novice

    Nov 27, 2018
    38
    18
    0
  4. sebaxakerhtc

    sebaxakerhtc MDL Novice

    Nov 27, 2018
    38
    18
    0
    Yes. Glad to make it working.
    Also as 19628.1 and 19631.1
     
  5. Smile2020

    Smile2020 MDL Novice

    Mar 11, 2020
    9
    4
    0
    Thank you, it's working on 19041.264 :) is there any possibility for hex code of termsvr dll-patch 19041

    Thank you.
     
  6. sebaxakerhtc

    sebaxakerhtc MDL Novice

    Nov 27, 2018
    38
    18
    0
    Now you know addresses and you can make a patched file by yourself
     
  7. Lucas Rey

    Lucas Rey MDL Member

    Feb 16, 2010
    124
    32
    10
    Could you please be more specific? I can see the following section on rdwrap.ini:

    [10.0.19041.264]
    LocalOnlyPatch.x64=1
    LocalOnlyOffset.x64=87611
    LocalOnlyCode.x64=jmpshort
    SingleUserPatch.x64=1
    SingleUserOffset.x64=0DBFC
    SingleUserCode.x64=Zero
    DefPolicyPatch.x64=1
    DefPolicyOffset.x64=1FE15
    DefPolicyCode.x64=CDefPolicy_Query_eax_rcx
    SLInitHook.x64=1
    SLInitOffset.x64=22DDC
    SLInitFunc.x64=New_CSLQuery_Initialize

    So please, where and what I have to change on termsrv.dll ?
     
  8. sebaxakerhtc

    sebaxakerhtc MDL Novice

    Nov 27, 2018
    38
    18
    0
    For example:
    LocalOnlyOffset.x64=87611
    LocalOnlyCode.x64=jmpshort
    It means at adress ******87611 you need to apply parch "jmpshort" find this patch in the rdwrap.ini
    In the patchcodes section
    jmpshort=EB
     
  9. Leon12

    Leon12 MDL Novice

    May 26, 2020
    11
    0
    0
    Hey!
    In the past I only changed the two offsets in the DLL file, but for the verison 19041, I can not find the values to change. Can anyone provide them please?
    thank you!
     
  10. Leon12

    Leon12 MDL Novice

    May 26, 2020
    11
    0
    0

    Thank you, but this is not what I am looking for. I need the offsets and values to change the dll with a hex editor, as I did all the years before. I don't want to use a third party software for this purpose.

    So do anyone know the offsets to change or the values to be replaced?
     
  11. sebaxakerhtc

    sebaxakerhtc MDL Novice

    Nov 27, 2018
    38
    18
    0
    As i said before to another member, this file contains
     
  12. Leon12

    Leon12 MDL Novice

    May 26, 2020
    11
    0
    0
    I don't understand how to extrapolate the requested information from this. I have never used rdpwrap and I don't know how its ini files are constructed.
    Does anyone go through this already and can provide the requested information?

    I am looking for something like:

     
  13. sebaxakerhtc

    sebaxakerhtc MDL Novice

    Nov 27, 2018
    38
    18
    0
    Like this? :)
    007444833D46BA<=>00EB44833D46BA

    But why you need more symbols if you need to replace just two?
    74 to EB at address 180087611
     
  14. Leon12

    Leon12 MDL Novice

    May 26, 2020
    11
    0
    0
    Yes, like this! :) Now I can try to reverse engineer what this is in the ini file... But at first I will check if this is all I need, as there where two replacements in the past... Thank you! I will report.
     
  15. sebaxakerhtc

    sebaxakerhtc MDL Novice

    Nov 27, 2018
    38
    18
    0
    Oh, no!
    There are changes at all the things