[DISCUSSION] Windows 8.1 termsrv.dll Patching

THANK YOU!!! It works (X64) for me.

I can't fully operate my home theater pc, without concurrent login.

 

Greetings to all!

This is my first post on the MDL forum, but I often visited it before for many reasons.

I want to inform that I've found a working solution to enable RDP host on home/basic editions, such as Windows Vista / 7 Starter, Home Basic, and Windows 8 Core / Basic / Single Language and made a project which called RDP Wrapper Library (you can google it, I'm not able to post links now).

Also, I've shared RDP Wrapper source code, so you can compile/rebuild it on your own, maybe with some modifications.

rdpwrap.dll works as a layer between Service Control Manager (SCM) and TermService library - termsrv.dll. It wraps two exported functions from termsrv - ServiceMain and SvchostPushServiceGlobals, and it hooks SLGetWindowsInformationDWORD function, which is used to get current policy configuration values. If termsrv calls this function, the code execution of it will be redirected to the internal function, which checks for value name, and rewrites the resulting value. In this case we can get the listener working, and so the RDP.

When the Windows 8 released, termsrv.dll (build 9200) changed the way of policy requests. Now it uses internal unexported function called SLGetWindowsInformationDWORDWrapper (got name from debugging symbols). So, the intercepting method became a little more complicated. I've implemented a signature search for it.

So, here am I... In the termsrv build 9600 the policy requests was changed again and more complex!

I've tried to analyse it in IDA, but it really looks too hard, and many of the processor cycles was wasted for the decompilation process

First version of RDP Wrapper was released in the october 2013, but I still have no ideas... So here is the reason I'm posting this message here. I hope I've clearly explained the main idea, and shared the source code, so maybe someone finds the solution to trick the terminal service on Win 8.1.

But I'm not going to abandon this project. I just want to take some ideas about it, then I can made a new release.

 

You need to login to view this posts content.

 

In addition to uncertainty about my patch of new x64 dll - I want to report that today a have a first bluescreen when connecting at RDP to my computer (with active my console session).
This error occurred only once and does not repeat.
But very big request to experienced programmers to check this work.

 

termsrv.dll

Спасибо ! Работает для 8.1 x64 (июль 2014)

 

Translate into = Thank you! Works for 8.1 x64 (July 2014)

 

Well, I can share the decompilled .C file (termsrv 9600), but I don't know is that a good idea

Spoiler

Here is the link: httр://stascorp.com/load/1-1-0-63
And yes, the main discussion is started on Andrew Block's web blog.

In the termservice build 9600 I found policy queries in the function CSLQuery::Initialize, but there is no such familiar calls as in build 9200. The query function has been integrated directly without internal/external calls, and this is the main problem.

 

You need to login to view this posts content.

 

You need to login to view this posts content.

 

You need to login to view this posts content.

 

I've researched a bit more... and think I can do it

Here is code in 6.2:

Spoiler

Code:

  v1 = SLGetWindowsInformationDWORDWrapper(
         (int)L"TerminalServices-RemoteConnectionManager-AllowRemoteConnections",
         (int)&v9);
  if ( v1 == -1073418222 )
  {
    _DbgPrintMessage((int)"The SL policy for 'Allow Remote Connections' is not defined - assuming Reduced Functionality Mode");
    v1 = 0;
    v2 = CSLQuery__bServerSku != 0;
    v9 = CSLQuery__bServerSku != 0;
  }
  else
  {
    v2 = v9;
  }

v1 - resulting value
v9 - policy data value

Here is code in 6.3:

Spoiler

Code:

  SP_unsigned_char_SP_HLOCAL_unsigned_char____Reset((HLOCAL *)&v6741);
  if ( v119 == -1073418222 )
  {
    _DbgPrintMessage(4, "The SL policy for 'Allow Remote Connections' is not defined - assuming Reduced Functionality Mode");
    v544 = CSLQuery__bServerSku != 0;
    v119 = 0;
  }
  else
  {
    v544 = v6998;
  }
  if ( v119 < 0 )
  {
    _DbgPrintMessage(
      8,
      "CSLQuery::Initialize - SLGetWindowsInformationDWORD failed: 0x%x in %s",
      v119,
      "CSLQuery::Initialize");
    return (LPVOID)v119;
  }
  CSLQuery__bRemoteConnAllowed = v544 != 0;

v119 - resulting value
v544 - policy data value

All is to do:
a) v544 = v6998; replace with v544 = 1;
or
b) CSLQuery__bRemoteConnAllowed = v544 != 0; replace with CSLQuery__bRemoteConnAllowed = true;

And so on...

 

I did uncheck the box to use the download manager. It still wants to download the .exe file.

 

Try a different browser/machine. It's a RAR.

 

A different browser of computer is not going to make any difference!!!

 

Reuploaded:
httр://rghost.net/56865147

 

rghost is not working for me. I've downloaded it from datafilehost, can't reupload it because I don't have 20 posts.

Working like a charm with 3 clients on 8.1 (embedded industry pro) x64. (1 hour so far).

Thanks a lot!

ps: a new thread should be made that states the current status of the termsrv.dll patch.

 

You need to login to view this posts content.

 

Me neither, but I finally got datafilehost to work!

 

You need to login to view this posts content.