[DISCUSSION] Windows 7 termsrv.dll Patching

Discussion in 'Windows 7' started by l33tissw00t, Feb 26, 2019.

  1. l33tissw00t

    l33tissw00t MDL Addicted

    Dec 6, 2012
    819
    520
    30
  2. bjf2000

    bjf2000 MDL Expert

    Apr 11, 2008
    1,087
    198
    60
    I could have sworn there was a thread for Win7, but this is the only one I can find now. In any case, here's what works for 6.1.7601.25757 (x86), which is assumed to be the final release:

    FIND
    REPLACE

    00 3B 86 20 03 00 00 0F 84 35 19 01
    00 B8 00 01 00 00 90 89 86 20 03 00

    85 E0 FE FF FF 43
    85 E0 FE FF FF 90

    74 2F 68 E8 7A
    E9 2C 00 00 00
     
  3. kebabstorm

    kebabstorm MDL Junior Member

    Aug 3, 2016
    94
    121
    0
    I prefer memory patching instead of modifying system files, so I made this tiny Avrf-based hook which will patch the termsrv.dll in memory so no files are changed.
    Supported version is the currently latest (6.1.7601.25757) 2021-11 , both x86/x64 versions.
    There are also some .reg files included to easily change the relevant RDP config options without having to waddle through the group policy editor.

    Readme:
    Code:
      _________________
     |                 |
     | RDPConfig7 v1.0 |
     |_________________|
    
     CONFIGURATION OPTIONS
     =====================
    
     Concurrent-Connections
     ----------------------
       Default: Allow
       Requirements: WinServer2008R2 / TermSrvAvrf
    
       Controls whether multiple connections are allowed.
    
       - If not allowed, any logged in user will be logged off when another one logs in.
    
     Multiple-Sessions-Per-User
     --------------------------
       Default: Deny
       Requirements: WinServer2008R2 / TermSrvAvrf
    
       Controls whether multiple sessions are allowed for a single local user account
    
       - If allowed, multiple users can start sessions under the same user account/profile
       - If not allowed, logins to the same account will be directed to the same session
       - Allowing this option has no effect unless "Concurrent Connections" is also allowed
       - Denying this option will not deny multiple connections under different users
    
     Enable/Disable-Server
     ---------------------
       Default: Disabled (Win7) / Enabled (WinServer2008R2)
       Requirements: WinServer2008R2 / Win7Professional / Win7Ultimate / Win7Enterprise / TermSrvAvrf
    
       - Self-explanatory, enables or disables the RDP server
       - Enable-Server also sets some sensible defaults
         + Enables RDP 8.0 protocol
         + Sets password authentication
         + Sets secure RPC communication to required
         + Sets connection mode to TCP only for stability
    
    
     TERMSRVAVRF
     ===========
    
     TermSrvAvrf removes arbitrary RDP restrictions from all Windows 7 and Windows Server 2008 R2 editions.
    
     Install/Uninstall by clicking the .cmd file in TermSrvAvrf folder.
     The install script will check whether you are on a supported version before proceeding.
    
     TermSrvAvrf installs as a Application Verifier for termsrv.dll and patches the functions in-memory.
     No files are altered, so if you choose to uninstall it, nothing will be left behind.
     It uses 8KB of RAM and applies the patch once on load so there is no performance impact.
     TermSrvAvrf automatically disables itself on unsupported versions so it is always safe to use, as
     it will never break anything if future updates happen.
    
     Features
     --------
       - Allows any edition to host a RDP server
       - Allows any edition to connect to the RDP server
       - Allows multiple connections in non-Server editions
    
     Supported OS
     ------------
       Windows 7 SP1 / Windows Server 2008 R2
    
     Supported version
     -----------------
       termsrv.dll : 6.1.7601.25757 x86
                   : 6.1.7601.25757 x64
    
     Related Windows Update
     ----------------------
       termsrv.dll version 6.1.7601.25757 is included in KB5008605
       "KB5008605: Authentication fails on domain controllers in certain Kerberos scenarios on Windows Server 2008 R2 SP1 (2021-11)"
    
    


    If you prefer the manual method instead, here are the offsets for x64:

    Code:
    // CDefPolicy::Query
    // 0x1718A
    39 87 3C 06 00 00 0F 84 53 C5 (00 00)
    B8 00 01 00 00 90 89 87 38 06 (00 00)
    
    // CSessionArbitrationHelper::IsSingleSessionPerUserEnabled (OSVERSIONINFOEXW.wProductType != VER_NT_WORKSTATION)
    // 0x17385
    BB 01
    BB 00
    
    // CEnforcementCore::GetInstanceOfTSLicense
    // 0x5B9B5
    85 C0 78 1F 83 7C 24 50 00
    E9 1E 00 00 00 90 90 90 90
    
     

    Attached Files:

  4. BreakBalls

    BreakBalls MDL Novice

    Mar 14, 2016
    4
    0
    0
    It seems like You searching for https://forums.mydigitallife.net/threads/kb2984972-breaks-concurrent-rdp-patch.57448/