[DISCUSSION] Windows 10 termsrv.dll Patching

Discussion in 'Windows 10' started by Mr Jinje, Oct 2, 2014.

  1. wyxchari

    wyxchari MDL Novice

    Aug 19, 2018
    31
    33
    0
    #341 wyxchari, Jan 13, 2021
    Last edited: Feb 28, 2021
    - termsrv.dll x64 19041.746 12.01.2020 (Windows x64 v20H2 10.0.19042.746)
    - Multi-user: File offset: 17E15h. Write: B80001000089813806000090
    - Multi-session: File offset: BF52h. Write: 00
     
  2. andy2112

    andy2112 MDL Novice

    Nov 1, 2008
    25
    3
    0
    This change doesn't work for me. What could be the reason? fSingleSessionPerUser = 0 - need any additional settings?
     
  3. wyxchari

    wyxchari MDL Novice

    Aug 19, 2018
    31
    33
    0
    #343 wyxchari, Jan 13, 2021
    Last edited: Jan 13, 2021
    For multi-user the first change is made. For multi-session you need the 2 changes. If you only do the second one, it won't work.
    Check that the 00 is written where the 01 is and not at the beginning of the search string, or better go to the displacement and write a 00 without searching for anything.
    termsrv.dll x64 19041.746 12.01.2020 (Windows x64 v20H2 10.0.19042.746) easyupload.io/yf9cdj
     
  4. andy2112

    andy2112 MDL Novice

    Nov 1, 2008
    25
    3
    0
    #344 andy2112, Jan 14, 2021
    Last edited: Jan 14, 2021
    these are my changes (match yours):
    fc /b termsrv.dll.bak termsrv.dll
    0000BF52: 01 00
    00017E15: 39 B8
    00017E16: 81 00
    00017E17: 3C 01
    00017E18: 06 00
    00017E1A: 00 89
    00017E1B: 0F 81
    00017E1C: 84 38
    00017E1D: 01 06
    00017E1E: 5E 00
    00017E1F: 01 00
    00017E20: 00 90
     
  5. wyxchari

    wyxchari MDL Novice

    Aug 19, 2018
    31
    33
    0
    #345 wyxchari, Jan 14, 2021
    Last edited: Jan 14, 2021
    The file comparison you have done is correct.
    I confirm that it works. I've checked again. I put the remote desktop and log in with the same user who is already logged in locally.
    I'm sorry it doesn't work for you but it has to be something else. These search strings work from version termsrv.dll:
    19041.84 11.05.2020 27.09.2020 (Windows 10 x64 v2004)
    19041.662 01.12.2020 (Windows x64 v20H2 10.0.19042.662 .685)
    19041.746 12.01.2020 (Windows x64 v20H2 10.0.19042.746)
     
  6. JoNaTaZ

    JoNaTaZ MDL Novice

    Oct 1, 2009
    19
    26
    0
    ===============================
    termsrv.dll (x64) 10.0.19041.746
    ===============================

    39813C0600000F84015E0100
    B80001000089813806000090
     
  7. PYOUMANS

    PYOUMANS MDL Novice

    Jan 22, 2016
    3
    3
    0
    This works Thank you.

    JoNaTaZ said
    39813C0600000F84015E0100
    B80001000089813806000090
     
  8. andy2112

    andy2112 MDL Novice

    Nov 1, 2008
    25
    3
    0
    Can you test 2 or 3 sessions with the same user from remote computer?
     
  9. kompmaster.avito

    kompmaster.avito MDL Novice

    Jan 19, 2021
    1
    0
    0
    RDP Wrapper works on this version(Win Serv 2019).
    10.0.17763.1697 version, on the site github.
     
  10. wyxchari

    wyxchari MDL Novice

    Aug 19, 2018
    31
    33
    0
    #350 wyxchari, Feb 3, 2021
    Last edited: Feb 28, 2021
    - termsrv.dll x64 19041.789 03.02.2021 (Windows x64 v20H2 10.0.19042.789)
    - Multi-user: File offset: 17E15h. Write: B80001000089813806000090
    - Multi-session: File offset: BF52h. Write: 00
     
  11. brokenwindoze

    brokenwindoze MDL Novice

    Jan 30, 2017
    1
    0
    0
    #351 brokenwindoze, Feb 15, 2021
    Last edited: Feb 15, 2021
    when you write 12 bytes over the 8 and restart the service, it says it is "The Remote Desktop Services service could not be started. A system error has occured. *** is not a valid Win32 application."

    edit: searched and replaced 39813C0600000F84015E0100 with B80001000089813806000090, worked on .789
     
  12. wyxchari

    wyxchari MDL Novice

    Aug 19, 2018
    31
    33
    0
    Search 8 bytes: 39813C0600000F84 --> offset 17E15h --> Write 12 bytes: B80001000089813806000090.
    Search 12 bytes: 39813C0600000F84015E0100 --> offset 17E15h --> Write 12 bytes: B80001000089813806000090.
    Search 4 bytes: 39813C06 --> offset 17E15h --> Write 12 bytes: B80001000089813806000090.

    They are exactly the same. You would do something wrong in the search for the 8 bytes so that it does not work. Maybe you didn't restart the computer? Maybe you compressed the 12 bytes to be written into 8 bytes? XDD:eek::p
     
  13. Heidegger

    Heidegger MDL Member

    Mar 17, 2008
    137
    51
    10
    If you're not in overwrite mode, it will insert the 12 bytes in an 8 byte space, shifting the data and the file won't work.
     
  14. wyxchari

    wyxchari MDL Novice

    Aug 19, 2018
    31
    33
    0
    #354 wyxchari, Feb 21, 2021
    Last edited: Feb 25, 2021
    From now on I will not put more search strings. I'll put an offset and the bytes to write so that you don't have to look for anything that confuses people.

    - termsrv.dll x64 19041.789 03.02.2021 (Windows x64 v20H2 10.0.19042.789:roll1:.844)
    - Multi-user: File offset: 17E15h. Write: B80001000089813806000090
    - Multi-session: File offset: BF52h. Write: 00
     
  15. andy2112

    andy2112 MDL Novice

    Nov 1, 2008
    25
    3
    0
    I ask again. Can you test 2 or 3 sessions with the same user from remote computer?
     
  16. KleineZiege

    KleineZiege MDL Expert

    Dec 11, 2018
    1,680
    1,924
    60
    #356 KleineZiege, Feb 23, 2021
    Last edited: Feb 23, 2021

    Attached Files:

  17. wyxchari

    wyxchari MDL Novice

    Aug 19, 2018
    31
    33
    0
  18. sebus

    sebus MDL Guru

    Jul 23, 2008
    6,354
    2,026
    210
    Try, who knows what you can stir up...
     
  19. SDMTEAM

    SDMTEAM MDL Novice

    Apr 26, 2010
    2
    0
    0
    Edition Windows 10 Pro
    Version 20H2
    OS Build 19042.867
    Experience Windows Feature Experience Pack 120.2212.551.0

    & Windows Server 2019

    RDP Patch
     
  20. JoNaTaZ

    JoNaTaZ MDL Novice

    Oct 1, 2009
    19
    26
    0
    #360 JoNaTaZ, May 3, 2021
    Last edited: May 3, 2021
    =========================
    Windows 10 Pro
    Version: 20H2
    OS Build: 19042.964
    termsrv.dll: 10.0.19041.964
    =========================
    Replace:
    39813C0600000F84E16A0100

    B80001000089813806000090