[DISCUSSION] Windows 8.1 termsrv.dll Patching

I think, this change should stay, because it might be helpful for next Windows editions and for the reverse engineering guys, like me.

Also, I will use this change in the RDP Wrapper.

 

Is that correct or just rumor? I know termsrv.dll has en-US locale between systems (from Vista and higher), and MUI files are used for localization.
The next release of RDP Wrapper will use constant offsets, based on version and architecture of termsrv.dll. I'm highly interested in how to make it work on system with any localization.

 

Hi again...

I tried what Cowboy said, to choose the Do Not play option, and the audio at the console keeps working. But sometimes, i play from itunes or spotify from the RDP user, so it would really be great if "play on remote Computer" can be fixed. It's not an issue on Windows Server 2012 R2 and in Windows 7.

//TjaLfE

 

I finally figured out that's not a typo. If I use "this+63C" on x64 the LSM service fails to logon the RDP user. But "this+638" works well.

Next day I will test RDP Wrapper on different Windows x64 builds.

 

You need to login to view this posts content.

 

@Mr Jinje

Is it theoretically can be done? I know notepad.exe dynamically allocates memory for text, and the text has Unicode format in the memory.

But, I think ReadFile API hook can be used for it...

UPD:
Nope, it checks file size with GetFileInformationByHandle, and will not load empty file.

 

Ok, here is pseudocode:

Spoiler

Code:

  SetCursor(hWaitCursor);
  if (FileSize)
  {
    pMappedView = NULL;
    TextData = NULL;
    hFileMappingObject = CreateFileMapping(...);
    if (hFileMappingObject)
    {
      pMappedView = MapViewOfFile(hFileMappingObject, ...)
      TextData = (__int16 *)pMappedView;
      CloseHandle(hFileMappingObject);
    }
  }
  else
  {
    // File is empty
    pMappedView = &v34;
    TextData = &v34;
    v34 = 0;
  }

And here is assembly:

Spoiler

Code:

.text:010058BD                 lea     ebx, [ebp+var_24C]
.text:010058C3                 mov     [ebp+TextData], ebx
.text:010058C9                 xor     eax, eax
.text:010058CB                 mov     [ebp+var_24C], ax
.text:010058D2                 jmp     loc_10028F8

So, to replace empty text with our, it's needed to manipulate EAX, or EBP+TextData.
I tried to do this in debugger, but however not succeeded.

BTW, I found the CDB.exe on my PC in C:\Program Files\Debugging Tools for Windows (x86)\
Obviously, I've already installed WinSDK before, but not tested all of the available tools. So I will try it.

 

You need to login to view this posts content.

 

Try Resource Turner ! It is a unique application that would allow you to replace those empty texts with yours.

 

enabling multi session for one user account (windows 8.1 and 2012 x64 updated [6.3.9600.17095] )

try these :

change
38 5D 7A 0F 85 69 D8
to
38 5D 7A 90 E9 69 D8

and

change
83 7C 24 68 00 74 18
to
83 7C 24 68 00 EB 18

 

Sunstar et al., I tried these changes and both variants of the .dll have the same effect on my Win8.1 Pro x64 systems: the default behavior is to allow the same user to create many concurrent sessions. This is also the default behavior for the "Wrapper Library by Stas'M" on an unpatched .dll. I would like a single session per user to move around as the user logs in from different places (similar to the default for a Windows Terminal Server).
Any other tips?
Thanks!

 

You need to login to view this posts content.

 

Hello all!
I found really cool programm for muliti-rdp RDP Wrapper Library by Stas'M
Link: stascorp.com/load/1-1-0-63
Very good thing is the original termsrv.dll file remains untouched. Also this method is very strong against Windows Update.
Just tested on my Windows 8.1 with termsrv.dll 6.3.9600.17095 - it work! Many thanks to author!!!

 

You need to login to view this posts content.

 

Спасибо дружище еще раз!!!!! Просто выручил!

 

whether i need to apply these codes on fresh termserv.dll?

 

Hi all,

Many Thanks to Stas'M and for this very interesting thread in My Digital Life forums where I just subscribed .

FYI the RDP Wrapper Library works very well on my french localized unmodified Windows 8.1 (basic or home as you want).

SYL
Léo

 

Hello,


Yesterday's windows update broke my patched termsrv.dll from almost two years ago, sadly I can't remember how exactly I patched it that time. I've tried restore that file from windows backup, but now RDP doesn't work at all (crashes on login).


I've tried methods posted above, but none of them worked on my system (RDP Wrapper Library does nothing, black cmd just flashes and disappeares, Arrtoo's patcher returns non matching hash).


Could anyone please advise me how to patch it or patch my termsrv.dll for me or provide me with correct patched termsrv.dll? I've tried few of them from this forum, but none of them worked (they all are for win7, 8, 8.1 etc, none for 2012 server).


I run Windows Server 2012 64bit, termsrv.dll version 6.2.9200.17048 (downloadable from my dropbox)
https: // dl.dropboxusercontent.com/u/7125147/termsrv.dll


Thanks in advance

 

It would be good to have a patched DLL as an alternative to the wrapper. With the patched DLL, I know there are only 20 bytes changed and nothing else hiding in there. With the wrapper, I have to trust someone that their code is clean. (No offense to the developer - I think it is very clever).

For Windows 7/64 there is a patched version of the October 14 2014 DLL available on page 2 of this thread:

(please remove spaces, I don't have enough posts to post links yet)
forums. mydigitallife. info/threads/57448-KB2984972-breaks-concurrent-RDP-patch/page2

It would be good if someone can make a patched version for Win 8.1 with the 14 October updates. Then again, possibly this patched Win 7 DLL will work instead?

Lalo

 

You need to login to view this posts content.