[DISCUSSION] Windows 10 termsrv.dll Patching

Discussion in 'Windows 10' started by Mr Jinje, Oct 2, 2014.

Page 23 of 23
  1. kixeon

    kixeon MDL Novice

    May 5, 2015
    7
    1
    0
    #441 kixeon, Aug 16, 2023
    Last edited: Aug 16, 2023
    Hello to everyone!
    On a github page of rdp wrapper I found information that I can have up to 15 concurrent connections (the actual limitation depends on your hardware and OS version).
    What does this actually mean? I need 20+ connection. Everything is working fine on Win7 with wrapper. I was thinking to upgrade OS to Win10 but I'm not sure what to do now.
    Any advice?
    Thank you.
     
  2. lancillotto

    lancillotto MDL Novice

    Aug 3, 2010
    1
    0
    0
    #442 lancillotto, Sep 10, 2023
    Hi everyone,
    I downloaded the latest rdpwrap.ini (Updated=2023-09-09, Edited by sebaxakerhtc) just to double check my IdaPro skills.
    I think there is an error in SingleUserOffset.x64. Termsrv.dll version is 10.0.22621.2070.

    [10.0.22621.2070]
    ; no x86 section

    LocalOnlyPatch.x64 =1
    LocalOnlyOffset.x64 =9BBA1
    LocalOnlyCode.x64 =jmpshort
    SingleUserPatch.x64 =1
    SingleUserOffset.x64 =1CC29 <--- according to IdaPro should be 18602
    SingleUserCode.x64 =Zero
    DefPolicyPatch.x64 =1
    DefPolicyOffset.x64 =1C045
    DefPolicyCode.x64 =CDefPolicy_Query_eax_rcx
    SLInitHook.x64 =1
    SLInitOffset.x64 =28BA0
    SLInitFunc.x64 =New_CSLQuery_Initialize

    Strangely enough the correct offset is just a few lines above (in 10.0.22621.2066 section):

    [10.0.22621.2066]
    ; no x86 section

    LocalOnlyPatch.x64 =1
    LocalOnlyOffset.x64 =9BBA1
    LocalOnlyCode.x64 =jmpshort
    SingleUserPatch.x64 =1
    SingleUserOffset.x64 =18602 <--- right one for ver 10.0.22621.2070
    SingleUserCode.x64 =Zero
    DefPolicyPatch.x64 =1
    DefPolicyOffset.x64 =1C045
    DefPolicyCode.x64 =CDefPolicy_Query_eax_rcx
    SLInitHook.x64 =1
    SLInitOffset.x64 =28BA0
    SLInitFunc.x64 =New_CSLQuery_Initialize

    Furthermore, the remaining offsets in 10.0.22621.2066...they are exactly the same as those of ver 10.0.22621.2070.
    Is it possible? I don't have termsrv.dll ver 10.0.22621.2066 to check it out...
    Someone (human error?) or something (automated tools? autohotkey?...) must have messed things up.
     
  3. JoNaTaZ

    JoNaTaZ MDL Novice

    Oct 1, 2009
    18
    22
    0
    #443 JoNaTaZ, Sep 27, 2023 at 02:02
    Windows 10 Pro
    Version: 22H2
    OS Build: 19045.3516
    ===================================
    termsrv.dll (x64): 10.0.19041.3516
    ===================================

    Offset: 1E715

    Search: 39 81 3C 06 00 00 0F 84 F7 40 01 00

    Replace: B8 00 01 00 00 89 81 38 06 00 00 90
     
Page 23 of 23