Removal of Activation Overlay/Watermark in unactivated RTM. Need Help!

Discussion in 'Windows 8' started by dummekuehe, Aug 7, 2012.

  1. sephirothrx7

    sephirothrx7 MDL Novice

    Aug 9, 2012
    20
    17
    0
    Near that. I have listed process, modules and threads using .net functions. I have calculated the expected thread start address by looking at the dll, plus call stack offset and module base address. This may not be the best way but I think it will do for now. I have compiled using the Any Cpu flag, so it should load the proper files given the Os version.
    LOL:biggrin:
     
  2. Daz

    Daz MDL Developer / Admin

    Jul 31, 2009
    9,530
    67,283
    300
    #322 Daz, Aug 13, 2012
    Last edited: Aug 13, 2012
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. KTr1sk

    KTr1sk MDL Junior Member

    Feb 17, 2010
    88
    24
    0
    @ LiveFreeDead:
    can I use your patch even if I have activated windows?
    because if will be deactivate I will have no watermarks?
     
  4. LiveFreeDead

    LiveFreeDead MDL Member

    Aug 3, 2012
    122
    77
    10
    #324 LiveFreeDead, Aug 13, 2012
    Last edited: Aug 13, 2012
    So with the any CPU flag set, I guess both me and Daz were correct :p Quantum Answer.

    -EDIT-

    It's not my patch, I am not that smart!

    But yeah, his Thread Killer will cause NO problems at all, run it 100 times on an activated machine, still will just do it's thing and exit.
     
  5. dummekuehe

    dummekuehe MDL Addicted

    Jan 11, 2009
    506
    115
    30
    I told you guys that hacking twinui.dll wasn't the smartest way to do this. ;)
    I'd really like to know how exactly you kill the thread.
    What program did you use?
     
  6. LiveFreeDead

    LiveFreeDead MDL Member

    Aug 3, 2012
    122
    77
    10
    He specified that he'll share the source code with us, I put in my PM request for it anyway ;) very curious on how he's done it.

    But he doesn't use a program, he used WinAPI's etc written in .Net, tho he may have used other tools to get the details originally?
     
  7. sephirothrx7

    sephirothrx7 MDL Novice

    Aug 9, 2012
    20
    17
    0
    I didnt know a 32 bit version would give error on 64 bit process, good to know. I expect the way it's know will work for everyone.

    In a few hours I will make some changes and release a new version with source, so you guys may take a look.
     
  8. UnknownRE

    UnknownRE MDL Junior Member

    Aug 8, 2012
    52
    4
    0
    If I run the thread killer (your version) it does not work for me in my VM) ?? enterprise x64 anyone else got this problem or is it just me ?
     
  9. LiveFreeDead

    LiveFreeDead MDL Member

    Aug 3, 2012
    122
    77
    10
    #329 LiveFreeDead, Aug 13, 2012
    Last edited: Aug 13, 2012
    What do you mean, it's not been long enough for you to get results yet!

    If you mean it doesn't do anything when you run it, that's the beauty of it, to test it's working Download Process Explorer and watch as it kills off the thread. I have tested it as working for Win x64 Pro, maybe enterprise is different, how many more of these VM's do I need to install :D

    -EDIT-

    Remembered my Real PC was Enterprise, so I tested it on that, it worked fine for me in Windows x64 Enterprise too.
     
  10. UnknownRE

    UnknownRE MDL Junior Member

    Aug 8, 2012
    52
    4
    0
    I know but if I already have the activation watermark present (I got it right now) and then run the utility it doesn't work. doesn't this app kill the childThread ? (I got 6 vms running :p) x86 pro and enterprise and x64 pro and enterprise and 2 original untouched enterprise and professional vms :)
     
  11. LiveFreeDead

    LiveFreeDead MDL Member

    Aug 3, 2012
    122
    77
    10
    #331 LiveFreeDead, Aug 13, 2012
    Last edited: Aug 13, 2012
    The thread killer stops the watermark ever showing, it doesn't stop it once it's shown.
    Exit Explorer.exe (or reboot) then run the tool on startup or anytime before the watermark is shown.

    -EDIT-

    I too have a x64 VM snapshot saved in active state with the watermark shown :p - handy for testing out other solutions.

    -EDIT-

    He is killing the thread that waits 4 hours and calls another section of memory to show the Watermark, so if it's never called it will never show, but if the watermark is already shown and you kill the calling thread, it'll do absolutely nothing, the watermark will remain.
     
  12. UnknownRE

    UnknownRE MDL Junior Member

    Aug 8, 2012
    52
    4
    0
    aah that's the problem :) ok :) I will try it (we need to find a way to call the watermark :p) it takes too long xd
     
  13. LiveFreeDead

    LiveFreeDead MDL Member

    Aug 3, 2012
    122
    77
    10
    I am using his first x64 release on a VM, it's been up 3 1/2 hours, so I'll start the secondary tests (CPU usage, Metro apps etc) soon.
     
  14. Daz

    Daz MDL Developer / Admin

    Jul 31, 2009
    9,530
    67,283
    300
    #334 Daz, Aug 13, 2012
    Last edited: Aug 13, 2012
    @ sephirothrx7
    I didn't know until I tested it on a 64-bit system either. I'd built everything on a 32-bit virtual machine and it worked perfectly, but then I tested it on a 64-bit system and it listed the threads belonging to the process, but I had no idea what them threads belonged to e.g. ole32.dll, ntdll.dll etc. So I done a little reading and that's when I found that by passing the process ID to CreateToolhelp32Snapshot that it'd fail.

    So to break things down as to how it can be achieved via WinAPI:

    1. Get the process ID of explorer via CreateToolhelp32Snapshot (no PID required)
    2. Get all of the threads running for the process via CreateToolhelp32Snapshot (no PID requied)
    3. Use NtQueryInformationThread with ThreadQuerySetWin32StartAddress (9) to retrieve the address of each thread
    4. Use CreateToolHelp32Snapshot with the explorer PID to get a list of modules (goes into MODULEENTRY32 structure)
    5. Loop through each and use modBaseAddr, modBaseSize and our known address (step 3) to calculate the name and/or path of each thread
    6. Look for twinui.dll and terminate the thread via TerminateThread
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  15. UnknownRE

    UnknownRE MDL Junior Member

    Aug 8, 2012
    52
    4
    0
    ok created a method to call the watermark and it shows :D now kill and then its ok :)
     
  16. LiveFreeDead

    LiveFreeDead MDL Member

    Aug 3, 2012
    122
    77
    10
    How are you calling the watermark? I tried to do it with rundll32 twinui.dll,GetActivationFactory and a few other types but could never get it to work. Tried moving the date forward on the VM too.
     
  17. UnknownRE

    UnknownRE MDL Junior Member

    Aug 8, 2012
    52
    4
    0
    just get the thread pointer that is calling the watermark and then call the thread :)
     
  18. LiveFreeDead

    LiveFreeDead MDL Member

    Aug 3, 2012
    122
    77
    10
  19. KTr1sk

    KTr1sk MDL Junior Member

    Feb 17, 2010
    88
    24
    0
    #339 KTr1sk, Aug 13, 2012
    Last edited: Aug 13, 2012
    @ LiveFreeDead:
    can I use this patch even if I have activated windows?
    because if will be deactivate I will have no watermarks?

    im sorry; I didnt see above
    "You can use these tools on an Activated Windows 8 RTM without causing problems. "

    Thank you :))

    I will now install windows with your tool and then activate windows, and no more any watermarks,:)
     
  20. LiveFreeDead

    LiveFreeDead MDL Member

    Aug 3, 2012
    122
    77
    10
    #340 LiveFreeDead, Aug 13, 2012
    Last edited: Aug 13, 2012
    Updated above post with the answer to that question, but i had answered your question 3 pages back when you asked me the same thing :p

    Keep in mind that this is not a patch, it is a tool. A patch will make changes to your system, this one makes no changes, that is why you have to keep running it on every boot.