MSFN Forums > shiny freshly hacked appwiz.dll

Full Version: shiny freshly hacked appwiz.dll

MSFN Forums > Member Contributed Projects > HFSLIP

whitehorses

Feb 8 2007, 01:11 PM

@FDV

Look I made this thing: an appwiz.dll, hacked its registering and version info, and with some modification in HIVECLS.INF (.lnk appwiz.cpl -> appwiz.dll) , TXTSETUP, LAYOUT, SYSSETUP, it can be placed into system32, with no control panel applet, and a working shortcut creation.

fdv

Feb 9 2007, 04:29 PM

? I don't understand what this is?
Isn't this file normally not in Windows? Isn't it Bankem?
http://www.sarc.com/avcenter/venc/data/trojan.bankem.html

whitehorses

Feb 10 2007, 02:48 AM

Nope.

CODE

; AppWiz does not work as a cpanel applet without IE
; but it's needed to create shortcuts (.lnk).
; So put it in 'system' instead
;appwiz.cpl   = 2,,,,,,,2,0,0
appwiz.cpl   = 2,,,,,,,5,0,0

The above is in your txtsetup.sif. I made an alternate solution to this problem, by renaming appwiz.cpl to appwiz.dll, removed the reginst information inside the dll, and renamed some references to appwiz.cpl in INF files.

After a few testing it turned out that some other dlls register lnk\shellnew to appwiz.cpl, so it might be ok if ie.in_ has some entries to remove these from registry ([FDVPATCH]) then recreate one with appwiz.dll. That's all.

This way you will have no appwiz.cpl, ergo no "dead" control panel applet problem, but you can have appwiz.dll in system32, thus able to create those shortcuts if you want to.

EDIT: Another idea, I can inject some registry info into my appwiz.dll to overwrite appwiz.cpl entry of .lnk\shellnew created by browseui.dll, but then it has to be registered AFTER browseui (if I remeber correctly it is the one)...Maybe from FDVPATCH

Also I'm working on a slimmed down shell32.dll, with some registry junk removed too. When it's stable enough and there is interest i might upload it somewhere. Can be used through FIX folder.

EDIT 2: I added these lines to ie.inf finaly, instead of hacking dll reginst:

CODE

; Task Scheduler Control Panel "applet"
;
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RemoteComputer\NameSpace\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"

... in progress

@FDV
I'm curious why haven't you added a remover for htmlfile and clsid 25336920-03F9-11CF-8FD0-00AA00686F13 (mshtml)? Till you answer I will try it of course

maybe bluesrceen?

EDIT 3: Is it possible to run the delreg section before addreg in IE.INF? (I would like to remove HKCR\htmlfile, and readd it with according how i want to - same applies to appwiz.dll)

fdv

Feb 11 2007, 06:05 PM

CODE

; AppWiz does not work as a cpanel applet without IE

Ohhh!! See I needed context.

QUOTE

by renaming appwiz.cpl to appwiz.dll, removed the reginst information inside the dll, and renamed some references to appwiz.cpl in INF files.

That's pretty clever. I will email for more detailed info and probably include it in my fileset.

You say "... in progress" so let me know how it goes.

QUOTE

I'm curious why haven't you added a remover for htmlfile and clsid 25336920-03F9-11CF-8FD0-00AA00686F13 (mshtml)? Till you answer I will try it of course

maybe bluesrceen?

I really dont' recall. I have no notes about this. Try it and see. I doubt it could hurt anything. I probably left it thinking (I am not sure, this is a maybe) that the Windows CLSID would point to the default browser -- in this case Firefox or Opera -- and any apps that want to display HTML using the native CLSID would therefore be associated with FF or Opera. Probably that is what I was going for.

QUOTE

Is it possible to run the delreg section before addreg in IE.INF?

No. You have to delete it in one INF and add it in an entirely different one. Which is easy because IE.INF is first to exectue. AXANT5.INF would probably be a good one to add to I think. It already has some stuff necessary for an install.

I am making vegetable soup.
Not that that's important. I just wanted everyone to know that.

whitehorses

Feb 11 2007, 06:38 PM

Here is what have been doing:
- Found a better solution than renaming appwiz.cpl (no hacking was needed anyway, just removing the registering entry from syssetup.inf was enough even then) so that I drop this too IE.INF addreg to prevent appwiz.CPL from loading:

;
; Added entry to prevent loading the obsolete appwiz.cpl
;
HKCU,"Control Panel\don't load","appwiz.cpl",,"No"
HKU,".DEFAULT\Control Panel\don't load","appwiz.cpl",,"No"

Both shell32 and shdocvw register appwiz.cpl as .lnk handler, I didn't want to fight with "them" over that key

- Testing of the following keys is the next (added these to IE.INF delreg):

CODE

;
; ShellFolder keys from SHDOCVW.DLL (TESTING)
;
HKCR,"CLSID\{00020D75-0000-0000-C000-000000000046}" ; uhh dunno, just suspicious
HKLM,"SOFTWARE\Classes\CLSID\{00020D75-0000-0000-C000-000000000046}"
HKCR,"CLSID\{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}" ; CLSID_CBaseBrowser
HKLM,"SOFTWARE\Classes\CLSID\{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}" ; CLSID_CBaseBrowser
HKCR,"CLSID\{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}" ; CLSID_CDocObjectFolder
HKLM,"SOFTWARE\Classes\CLSID\{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}" ; CLSID_CDocObjectFolder
HKLM,"Microsoft\Windows\CurrentVersion\Shell Extensions\Approved","{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}" ; CLSID_CDocObjectFolder
;
; Class keys in BROWSEUI.DLL (TESTING)
;
HKCR,"CLSID\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}"
HKLM,"SOFTWARE\Classes\CLSID\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}" ; Microsoft Internet Toolbar
HKCR,"CLSID\{7376D660-C583-11d0-A3A5-00C04FD706EC}"
HKLM,"SOFTWARE\Classes\CLSID\{7376D660-C583-11d0-A3A5-00C04FD706EC}" ; Trident Image Extractor
HKCR,"CLSID\{603D3800-BD81-11d0-A3A5-00C04FD706EC}"
HKLM,"SOFTWARE\Classes\CLSID\{603D3800-BD81-11d0-A3A5-00C04FD706EC}" ; Background Task Scheduler (TESTING)
HKCR,"CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}"
HKLM,"SOFTWARE\Classes\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}" ; Shared Task Scheduler (TESTING)
HKCR,"CLSID\{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"
HKLM,"SOFTWARE\Classes\CLSID\{DD313E04-FEFF-11d1-8ECD-0000F87A470C}" ; User Assist
HKCR,"CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}"
HKLM,"SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}" ; Component Categories cache daemon
HKCR,"CLSID\{E56829C9-2D59-11d2-BE38-3078302C2030}"
HKLM,"SOFTWARE\Classes\CLSID\{E56829C9-2D59-11d2-BE38-3078302C2030}" ; Component Categories conditional cache daemon
HKLM,"Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler" ; (TESTING: this removes an entry of BROWSEUIPRELOADER too)
HKLM,"Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler","{8C7461EF-2B13-11d2-BE35-3078302C2030}"
;
; MSHTML class key (TESTING)
;
HKCR,"CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}"
HKLM,"SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}"
;
; and this in addition to the two other taskscheduler keys
;
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"

- finally, found some duplicate occurances in ie.inf:
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved","{FF393560-C2A7-11CF-BFF4-444553540000}"

HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RemoteComputer\NameSpace\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"

Oleg_II

Feb 12 2007, 11:33 PM

Don't understand what are you talking about gentelmen

I don't have any problems in Control Panel and I can create shortcuts (created tons of them until now

But I mostly create shortcuts by right clicking on an item and choosing Send To > Create shortcut. Create shortcut through File > New is also working fine in my reduced W2k (just tried and it works

whitehorses

Feb 13 2007, 01:18 AM

Oleg

This is not about an issue at all. Of course it works for you. By default fdv's txtsetup.sif puts appwiz.cpl into systemroot (i.e. WINDOWS folder) not in system32, to prevent its icon appear in control panel. This way you can use it since systemroot is in the path variable

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.