Watermarks & Timebombs (Windows) - A Think Tank

Discussion in 'Chit Chat' started by itsmemario1, Sep 11, 2021.

  1. itsmemario1

    itsmemario1 MDL Expert

    Sep 10, 2012
    1,047
    280
    60
    #1 itsmemario1, Sep 11, 2021
    Last edited: Sep 11, 2021
    Hi,

    I wanted to read more about watermarks and timebombs in windows...and I learned it that hard way, that it is quite more info than I can handle... ;D


    The Watermark removal had been done by setting a white wallpaper as a background :p, or by editing the file "shell32.dll.mui" for example...people always found a solution.

    And in todays world, the "Watermark Remover" still works like a charme in the latest Windows 11 Dev release.
    So no need to talk about watermarks here, it seems...or, is it ? ;)


    So I headed towards trying to understand timebombs. Timebombs based on changing the date, timebombs based on patching DLLs (slc.dll, nt.dll), checksums, file/date-comparsions...timebombs based on digital certificates in Windows 10 (again time based, more or less) and finally, timebombs based on...Windows 11.


    My current Windows 11 (Latest Dev 22454) will expire on 30th November 2021.

    So, where might that little bugger hide these days, hu ?




    Back then people used various tools like TIMCRK from KenOath (Windows 95 times), an intelligent tool searching for generic timebomb stuff in the background...

    They used file unsigners, regedit and even exchanged system files manually...

    For example, people had been exchanging specific files in Windows 8 :

    C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    "Microsoft-Windows-Security-SPP-Component-SKU-Professional-License-Package~31bf3856ad364e35"

    These files and folders, for example, are still there in the latest Windows 10 and latest Windows 11 DEV.

    I think these manual exchanges are the most interesting ones, as you often need deep knowledge about what files do, what they call and what they check. Or making sure, that a file doesnt get double checked by other files, so you simply just cant exchange it, as it would result into an error.

    With todays Windows 11 FIX tool and the story of exchanging the appraiserres.dll, I think it will be just a matter of time, until someone "stumbles" across the "right way" again, disabling the timebomb of Windows 11 Dev.

    I admire such people, that dissassemble, staring at the screen for days, looking for new ways, making big changes.
    Never giving up....well, often... ;)

    I will also spend some more time in the near future, trying to learn more about Windows timebombs and how to circumvent them. And I hope to gather some thoughts by other users in here as well.

    For me it all started by editing EXE files in DOS times, making..."interesting" changes to software and games. In todays world, minimal BIOS modding and beeing more into mobile devices, is all what is left. It always was and still will be more or less somekind of a hobby. I regret leaving behind coding and hexediting. But I still love to know more... :)