[DISCUSSION] Windows 10 termsrv.dll Patching

Discussion in 'Windows 10' started by Mr Jinje, Oct 2, 2014.

  1. PYOUMANS

    PYOUMANS MDL Novice

    Jan 22, 2016
    1
    1
    0
    This works Thank you.

    JoNaTaZ said
    39813C0600000F84015E0100
    B80001000089813806000090
     
  2. andy2112

    andy2112 MDL Novice

    Nov 1, 2008
    25
    3
    0
    Can you test 2 or 3 sessions with the same user from remote computer?
     
  3. kompmaster.avito

    kompmaster.avito MDL Novice

    Jan 19, 2021
    1
    0
    0
    RDP Wrapper works on this version(Win Serv 2019).
    10.0.17763.1697 version, on the site github.
     
  4. wyxchari

    wyxchari MDL Novice

    Aug 19, 2018
    24
    22
    0
    - termsrv.dll x64 19041.789 03.02.2021 (Windows x64 v20H2 10.0.19042.789)
    - Multi-user:
    Search 8 bytes: 39813C0600000F84. Write 12 bytes: B80001000089813806000090.
    File offset: 17E15h. Write 12 bytes: B80001000089813806000090
    - Multi-session:
    Search 8 bytes: C706010000008BDF. Write 1 byte (01->00): ====00==========
    File offset: BF52h. Write: 00
     
  5. brokenwindoze

    brokenwindoze MDL Novice

    Jan 30, 2017
    1
    0
    0
    #345 brokenwindoze, Feb 15, 2021
    Last edited: Feb 15, 2021
    when you write 12 bytes over the 8 and restart the service, it says it is "The Remote Desktop Services service could not be started. A system error has occured. *** is not a valid Win32 application."

    edit: searched and replaced 39813C0600000F84015E0100 with B80001000089813806000090, worked on .789
     
  6. wyxchari

    wyxchari MDL Novice

    Aug 19, 2018
    24
    22
    0
    Search 8 bytes: 39813C0600000F84 --> offset 17E15h --> Write 12 bytes: B80001000089813806000090.
    Search 12 bytes: 39813C0600000F84015E0100 --> offset 17E15h --> Write 12 bytes: B80001000089813806000090.
    Search 4 bytes: 39813C06 --> offset 17E15h --> Write 12 bytes: B80001000089813806000090.

    They are exactly the same. You would do something wrong in the search for the 8 bytes so that it does not work. Maybe you didn't restart the computer? Maybe you compressed the 12 bytes to be written into 8 bytes? XDD:eek::p
     
  7. Heidegger

    Heidegger MDL Member

    Mar 17, 2008
    137
    51
    10
    If you're not in overwrite mode, it will insert the 12 bytes in an 8 byte space, shifting the data and the file won't work.
     
  8. wyxchari

    wyxchari MDL Novice

    Aug 19, 2018
    24
    22
    0
    #348 wyxchari, Feb 21, 2021 at 09:12
    Last edited: Feb 25, 2021 at 07:53
    From now on I will not put more search strings. I'll put an offset and the bytes to write so that you don't have to look for anything that confuses people.

    - termsrv.dll x64 19041.789 03.02.2021 (Windows x64 v20H2 10.0.19042.789:roll1:.844)
    - Multi-user: File offset: 17E15h. Write: B80001000089813806000090
    - Multi-session: File offset: BF52h. Write: 00
     
  9. andy2112

    andy2112 MDL Novice

    Nov 1, 2008
    25
    3
    0
    I ask again. Can you test 2 or 3 sessions with the same user from remote computer?
     
  10. KleineZiege

    KleineZiege MDL Senior Member

    Dec 11, 2018
    399
    176
    10
    #350 KleineZiege, Feb 23, 2021 at 13:38
    Last edited: Feb 23, 2021 at 14:18

    Attached Files:

  11. wyxchari

    wyxchari MDL Novice

    Aug 19, 2018
    24
    22
    0