[DISCUSSION] Windows 10 termsrv.dll Patching

Discussion in 'Windows 10' started by Mr Jinje, Oct 2, 2014.

  1. wyxchari

    wyxchari MDL Novice

    Aug 19, 2018
    31
    33
    0
    termsrv.dll x64 19041.1741
    Multi-user: File offset: 1E1C5h. Write: B80001000089813806000090
    Multi-session: File offset: 10D32h. Write: 00.
     
  2. Mardok123

    Mardok123 MDL Novice

    Nov 11, 2021
    5
    0
    0
    thank you :)
     
  3. JoNaTaZ

    JoNaTaZ MDL Novice

    Oct 1, 2009
    21
    28
    0
    Windows 10 Pro
    Version: 21H2
    OS Build: 19044.1741
    termsrv.dll (x64): 10.0.19041.1741
    ===============================
    Replace:
    39 81 3C 06 00 00 0F 84 73 55 01 00
    With:
    B8 00 01 00 00 89 81 38 06 00 00 90
     
  4. KleineZiege

    KleineZiege MDL Expert

    Dec 11, 2018
    1,694
    1,933
    60
  5. zielonyjelen

    zielonyjelen MDL Novice

    Jan 10, 2012
    2
    0
    0
    Windows 11 Pro
    Version: 21H2
    OS Build: 22000.795
    termsrv.dll: 10.0.22000.708
    =========================
    Find: 39 81 3C 06 00 00 0F 84 79 6A 01 00
    Repl: B8 00 01 00 00 89 81 38 06 00 00 90
     
  6. PERSoft

    PERSoft MDL Novice

    Jun 20, 2010
    20
    15
    0
    Did not worh for me.
    Can`t find the search string 39 81 3C 06 00 00 0F 84 79 6A 01 00 with hexedit.
    Anyone an idea to patch 708
     
  7. PERSoft

    PERSoft MDL Novice

    Jun 20, 2010
    20
    15
    0
    Did not work for me.
    Cannot find the search string 39 81 3C 06 00 00 0F 84 79 6A 01 00 with hexedit.
    Anyone an idea to patch 708?
     
  8. PERSoft

    PERSoft MDL Novice

    Jun 20, 2010
    20
    15
    0
    Sorry a mistake by me. Everything is ok.
     
  9. PERSoft

    PERSoft MDL Novice

    Jun 20, 2010
    20
    15
    0
    Sorry. A mistake by me. Everything is ok.
     
  10. wyxchari

    wyxchari MDL Novice

    Aug 19, 2018
    31
    33
    0
    termsrv.dll x64 19041.1949
    Multi-user: File offset: 1E1C5h. Write: B80001000089813806000090
    Multi-session: File offset: 10D32h. Write: 00.
     
  11. Noah Sutherland

    Noah Sutherland MDL Novice

    Sep 12, 2022
    2
    0
    0
    How do I use this? I'm using Tiny Hexer. I'm used to doing the search and replace from other versions of termsrv.dll. Do I just insert these strings into the locations listed?
     
  12. Carlos Detweiller

    Carlos Detweiller Emperor of Ice-Cream

    Dec 21, 2012
    6,359
    7,078
    210
    Navigate to the given offsets and overwrite (NOT insert) the Bytes beginning with the offset location. The file size must not change.
     
  13. Noah Sutherland

    Noah Sutherland MDL Novice

    Sep 12, 2022
    2
    0
    0
    Thank you very much. That worked for me.
     
  14. CptSanifair

    CptSanifair MDL Novice

    Jun 19, 2022
    7
    5
    0
    Win10 Pro (termsrv.dll x64), 10.0.19041.2075

    Offset 1E6A5:
    39 81 3C 06 00 00 0F 84 85 45 01 00

    replace by
    B8 00 01 00 00 89 81 38 06 00 00 90
     
  15. xapko

    xapko MDL Novice

    Nov 22, 2016
    1
    1
    0
    Thank you!
     
  16. xflbret

    xflbret MDL Novice

    Jul 27, 2011
    28
    0
    0
    Anything for 19044.2311???
     
  17. boy_de_ghet

    boy_de_ghet MDL Novice

    Jun 25, 2007
    1
    1
    0
    Offset 1E6A5:
    39 81 3C 06 00 00 0F 84 85 45 01 00

    Replace by
    B8 00 01 00 00 89 81 38 06 00 00 90

    Working on 190044.2311
     
  18. xflbret

    xflbret MDL Novice

    Jul 27, 2011
    28
    0
    0
    I'm sorry...is this for 190044.2311, or is this for something else and 190044.2311 is coming in the future?
     
  19. CptSanifair

    CptSanifair MDL Novice

    Jun 19, 2022
    7
    5
    0
    what OS / Version / Stage?
    Insider Build?

    tell us more about
     
  20. 1NDecent

    1NDecent MDL Novice

    May 5, 2015
    3
    0
    0
    Does anyone know one for x86 of the same version?