Here are the answers of the anonymous author of several unofficial 9x/ME patches to your comments/questions/requests:
Here are my answers now, at last.
On August 2, 2006 (03:38 PM) 'the_guy' wrote:
> On the note of the GDI fix for 918547 posted today, would you be able to get the author to make a patch for 98FE?
> Also, could you try to make the patched 98FE and the patched 98SE > (4.10.2225) ESDI_506.PDR in 1 file, and then
> rename the file with ESDI_506.PDR 4.10.2226 to SE48BLBA.EXE?
> Slightly O/T: Would you be able to contact the author of the unofficial 918547 patch to see if they could
> patch user.exe and user32.dll to prevent the 891711 flaw.
On August 2, 2006 (04:25 PM) 'erpdude8' wrote:
> hmm, looks like the author of 918547 will need to patch the 98fe GDI files.
It is highly unlikely I will have the time to create separate patches for Win98FE. The code in GDI.EXE 4.10.2002 is arranged differently, so the patches would have to be rewritten (no simple cut & paste operation in a hex editor here). However, there appear to be no differences in functionality between 4.10.2002 and 4.10.2225, so I suggest using 4.10.2227 under Win98FE. If someone finds a difference in functionality, please let me know.
For several reasons, it is very unlikely I will create patches for USER.EXE amd USER32.DLL in the near future (or possibly ever):
(1) U891711 is not an elegant solution, but indeed provides complete protection against the vulnerabilities whereas KB919547 and U919547 protect only one way of rendering a WMF record. GDI.EXE & GDI32.DLL had to be patched to ensure all ways of rendering a WMF record were protected.
(2) It is very time consuming to create the patches as 1-2 KBytes of extra code have to be added to USER.EXE.
(3) As Petr pointed out (as a matter of fact, only for Win98SE), there are the following versions of USER.EXE:
4.10.2000 original Windows 98 FE
4.10.2001 Q291362
4.10.2222 original Windows 98 SE
4.10.2223 Q242934
4.10.2225 Q258070
4.10.2226 Q242975-v2
4.10.2227 Q260067
4.10.2228 Q262830
4.10.2229 Q265115
4.10.2230 Q277822
4.10.2231 Q291362
4.90.3000 original Windows ME
4.90.3001 Q280800
and each version would have to be patched individually. Which version should have the highest priority to be patched??? All versions of USER.EXE have bugs and it would be more important, but probably extremely challenging to fix those than adding code for KB891711 or fixing the purely "cosmetic" bug of a ghost screensaver taskbar entry. One of these bugs causes a permanent memory leak in the 16-bit USER resources when a user logs off.
I very rarely use Win98SE these days, but if I do, I run a modified version of 4.90.3001 under Win98SE (apparently w/o the issues I described in an earlier message re the original 4.90.3001 under 982ME).
On Aug 2 2006, 01:10 AM, LLXX wrote:
> Maybe my new code is just more efficient...
It all depends on the definition of efficiency!

--
I took another quick look at LLXX's patched ESDI_506.PDR. As before, I looked only at 4.90.3000 since it is closer than 4.10.2225 to what I have been using under Win98SE.
When I examined the patch, I first looked at extra code added between 00001E54 and 00001FFF. I was unable to find the instructions that are needed to set the 16-bit sector count correctly. Closer examination revealed that they are there indeed, but they "replace" the 8 NOP instructions that, in the original driver, were placed between commands sending data to two different HDC registers. I assume those 8 NOPs had been put there for a good reason. It is common code and may be executed immaterial whether the drive uses CHS translation, 28-bit LBA or 48-bit LBA. So LLXX's statement that there are no differences for < 128 GiBytes is not correct!! There are some NOP instructions between sending the higher and lower bytes of the sector count, but I am not sure they are necessary.
LLXX's added code presumes that the commands are always Read/Write Sectors Extended, but I now think this should be okay. There are two more items, probably minor or irrelevant, and I will comment on them when I have had a chance to test out a few things with my driver (unfortunately not anytime soon).
I wrote this before: LLXX's patched driver is a very nice piece of work! Keep up the good work!!!
Best wishes.