• Announcements

    • xper

      MSFN Sponsorship and AdBlockers!   07/10/2016

      Dear members, MSFN is made available via subscriptions, donations and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. Alternatively, become a site sponsor and ads will be disabled automatically and by subscribing you get other sponsor benefits.
WildBill

PE Tool for creating patches

695 posts in this topic

hello...

Actually I have take a look on it.. but unfortunately I have no win2k system ATM (its still being repaired..),, and I have only vc2010 express MASM32 package..

so I just tried to recompile them..

the first is csrsrv... I got it succeed..

but when I tried to recompile basesrv...

it complain that I'm missing for some import from csrsrv, I have copied the produced LIB from csrsrv... but still did not succeed....

because the basesrv need functions from csrsrv as Stdcall...

because of curiosity I open up the csrsrv .lib with Hex editor then tried to search the missing export..

And I don't know is it right or not but adding extern "C" before exported function solve my problem... --> the produced lib contain correct export lists...

since I have not programming in C/C++ for a long time, I almost forgot the languages.. :blushing: (I'm still trying to starting over)

well I don't know its help or not... anyway you have done such a great job... :thumbup

0

Share this post


Link to post
Share on other sites

It's the same file either way. I don't think I've ever had a separate one for uniproc in that patch.

The file is same but M$ always puts it in uniproc too. And it's required for slipstreaming...

0

Share this post


Link to post
Share on other sites

@WildBill

There seem to be some problems with the newest version of ntdll.dll. Please have a look at this topic. I used ntdll.dll 5.0.2195.7084 in UURollup-v10 which caused all the issues which are now gone in UURollup-v11 where the older version of ntdll.dll (5.0.2195.7083) is used.

0

Share this post


Link to post
Share on other sites

@WildBill

There seem to be some problems with the newest version of ntdll.dll. Please have a look at this topic. I used ntdll.dll 5.0.2195.7084 in UURollup-v10 which caused all the issues which are now gone in UURollup-v11 where the older version of ntdll.dll (5.0.2195.7083) is used.

The issues regarding the ntdll.dll are gone in UURollup-v10a. I'm wondering if version 5.0.2195.7085 of ntdll.dll will fix the issues that I experienced for a while. :)

0

Share this post


Link to post
Share on other sites

Hi, WildBill.

Is there your extended kernel function table such as http://j00ru.vexillium.org/ntapi/

I want to extend Kernel Core wirth Your Kernel.

It's the same file either way. I don't think I've ever had a separate one for uniproc in that patch.

I guess no one has taken a look at the v9e sources :(

0

Share this post


Link to post
Share on other sites

Hi, WildBill.

Is there your extended kernel function table such as http://j00ru.vexillium.org/ntapi/

I want to extend Kernel Core wirth Your Kernel.

It's the same file either way. I don't think I've ever had a separate one for uniproc in that patch.

I guess no one has taken a look at the v9e sources :(

This is what's in my kernel32.def file at present, which lists all of the exported functions currently implemented in C. I still have about 180 more to do before it contains everything in the latest V10 kernel. Also, until I have the first 830 or so all implemented I can't test or debug them, so crashes are likely until that point. Once I get everything working I can then put it through the hardening passes that I did for csrsrv and basesrv.

http://www.mediafire.com/download.php?1966gy8kokutq6p

I could post the full sources to my kernel32 project, but while it compiles it won't do anyone any good until it's complete enough to run in a 2k environment.

0

Share this post


Link to post
Share on other sites

Hi.

I don't think that it is important kernel32.dll function's order very much.

I want not to look Kernel32 function table but win32k.sys and ntoskrnl.exe System Call Table . :whistle:

This is what's in my kernel32.def file at present, which lists all of the exported functions currently implemented in C. I still have about 180 more to do before it contains everything in the latest V10 kernel. Also, until I have the first 830 or so all implemented I can't test or debug them, so crashes are likely until that point. Once I get everything working I can then put it through the hardening passes that I did for csrsrv and basesrv.

http://www.mediafire.com/download.php?1966gy8kokutq6p

I could post the full sources to my kernel32 project, but while it compiles it won't do anyone any good until it's complete enough to run in a 2k environment.

0

Share this post


Link to post
Share on other sites

I don't have a handy list of the functions in those files, though a tool like Ida could probably generate one. I'd love to eventually rewrite those in C as well, but first things first--rewriting kernel32 has already proven to be a much larger endeavor than I had envisioned...

Edited by WildBill
0

Share this post


Link to post
Share on other sites

Hi.

I found your code miss. ntdll.dll (5.0.2195.7084)

 77FD4A02  68F10000C0                		push	C00000F1h <- 
77FD4A07 E84C7BFDFF call RtlRaiseStatus
77FD4A0C L77FD4A0C:
77FD4A0C BEF00000C0 mov esi,C00000F0h
77FD4A11 EBCF jmp L77FD49E2

Edited by blackwingcat
0

Share this post


Link to post
Share on other sites

@WildBill

There seems to be a bug in atmfd.dll from KB2507618:

0

Share this post


Link to post
Share on other sites

Hi.

I found your code miss. ntdll.dll (5.0.2195.7084)

 77FD4A02  68F10000C0                		push	C00000F1h <- 
77FD4A07 E84C7BFDFF call RtlRaiseStatus
77FD4A0C L77FD4A0C:
77FD4A0C BEF00000C0 mov esi,C00000F0h
77FD4A11 EBCF jmp L77FD49E2

Thanks! I found a separate issue in ntdll so I was going to release a new one anyway, so I'll put this fix in also.

Edited by WildBill
0

Share this post


Link to post
Share on other sites

@WildBill

There seems to be a bug in atmfd.dll from KB2507618:

I can't begin to describe how much I hate that DLL. There is no symbol info available for it, and it's hopelessly complicated. Do you know if the problem goes away with an earlier version of my patched DLL? That would help me narrow the problem down.

0

Share this post


Link to post
Share on other sites

The problem happens both in the older and the newer version. Can't just the XP file be used as it is? OTF fonts open properly with the XP atmfd.dll from KB2507618 installed.

0

Share this post


Link to post
Share on other sites

The problem happens both in the older and the newer version. Can't just the XP file be used as it is? OTF fonts open properly with the XP atmfd.dll from KB2507618 installed.

I tried it once and it refused to let any fonts show up in the Control Panel. I haven't tried it since...

0

Share this post


Link to post
Share on other sites

I tried it once and it refused to let any fonts show up in the Control Panel. I haven't tried it since...

I'm using it right now and all fonts are shown correctly.

The file is atmfd.dll 5.1.2.232.

0

Share this post


Link to post
Share on other sites

I've got a couple of updates posted:

Windows2000-KB2393802-v11-x86-ENU.exe

- A couple of ntdll bugfixes, and it should now be friendlier for slipstreaming.

Windows2000-KB2508429-v7-x86-ENU.exe

- Some new API functions added:

dnsapi.dll

NetInfo_Free

DnsFree

DnsFreeConfigStructure

iphlpapi.dll

GetTcpStatsFromStackEx

GetIpStatsFromStackEx

GetUdpStatsFromStackEx

GetIcmpStatsFromStackEx

GetTcpExTable2FromStack

GetUdpExTable2FromStack

GetExtendedTcpTable

GetExtendedUdpTable

GetBestInterfaceEx

The 2k iphlpapi only supports ipv4, so while the calls above will work for ipv4, they'll properly report an error code if called for ipv6.

My kernel32.dll rewrite is still proceeding apace...765 exported routines and counting.

Edited by WildBill
0

Share this post


Link to post
Share on other sites

Thanks WildBill :)

Is the ntdll.dll version same as in v10?

Edit: Something seems to be wrong in the new ntdll.dll :( Explorer.exe restarts itself each time when trying to open a folder.

Edited by tomasz86
0

Share this post


Link to post
Share on other sites

Does Nirsoft Currport work ?

Our iphlpapi.dll seems problem on GetUdpExTable2FromStack/GetTcpExTable2FromStack

I found iphlpapi v5.0.2195.7097 requires KB957579(Minimum require is KB951798)

I've got a couple of updates posted:

iphlpapi.dll

GetTcpStatsFromStackEx

GetIpStatsFromStackEx

GetUdpStatsFromStackEx

GetIcmpStatsFromStackEx

GetTcpExTable2FromStack

GetUdpExTable2FromStack

GetExtendedTcpTable

GetExtendedUdpTable

GetBestInterfaceEx

Edited by blackwingcat
0

Share this post


Link to post
Share on other sites

Thanks WildBill :)

Is the ntdll.dll version same as in v10?

Edit: Something seems to be wrong in the new ntdll.dll :( Explorer.exe restarts itself each time when trying to open a folder.

Really? There were only two extremely minor changes. One was to correct the error code that blackwingcat pointed out and the other was to fix a bug when initializing a process -- the location of a particular field is different in 2k vs. XP. The thing is, though, the code that's affected should never actually run since it only gets invoked if a process was using an activation context, and that functionality isn't active in my kernel yet. I'm not having any problems here...can you provide any more info?

0

Share this post


Link to post
Share on other sites

I've just done more tests and actually the same problem happens with both v10 and v11. The test machine is a VM (uses uniproc non-PAE kernel) with all official updates installed. I just added KB2479628 and KB2393802.

0

Share this post


Link to post
Share on other sites

I've just done more tests and actually the same problem happens with both v10 and v11. The test machine is a VM (uses uniproc non-PAE kernel) with all official updates installed. I just added KB2479628 and KB2393802.

Now that's interesting. I'm seeing the same thing in my VM, but not on real hardware. It must date back to v9, since the ntdll in v9 and v10 are the same. v9 was where I added a bunch of SxS API's to ntdll. I guess I'll have to look at it closely to see if I broke anything.

0

Share this post


Link to post
Share on other sites

Well, I had problems with the ntdll.dll starting from v9, on real hardware too (check #533).

0

Share this post


Link to post
Share on other sites

I've been crawling through the code, double-checking and triple-checking everything, and I can't find anything wrong with the code. I tried backing some changes out and eventually replaced v9 ntdll with v8 ntdll and I still see occasional problems in a VM (though never on real hardware). From looking at the exceptions it looks like something is corrupting the heap, and subsequent heap operations are throwing exceptions. Mixing v8 ntdll with v9 kernel definitely isn't preventing the problem. What happens if you try a pure v8 install on a VM?

0

Share this post


Link to post
Share on other sites

More test results:

1. After installing v11 folders don't open / Explorer is restarted... but they open in Safe Mode. On the other hand, IE doesn't open neither in "normal" mode nor in Safe Mode (Add/Remove programs don't open either as they depend on IE).

2. No problems occur when v8 is installed.

3. I found a bug in update.inf. There should be no ntdll.dll and win32k.sys in [system32.Files].

4. Replacing ntdll.dll v7084 from v11 with ntdll.dll v.7083 from v8 fixes all issues.

Edited by tomasz86
0

Share this post


Link to post
Share on other sites

There's something screwy going on...I backed up all the way to v3 and I still get the same occasional errors when accessing a network share from within a VM. I then tried a clean install of 2kSP4 and it still happens. I wonder if it's a VM thing. I'm using Virtual PC 2007.

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.