Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account



Photo

SFC_OS.DLL hack for XP SP2 Final

- - - - -

  • Please log in to reply
128 replies to this topic

#1
Denney

Denney

    *shrug*

  • Member
  • PipPipPipPip
  • 685 posts
  • Joined 11-September 03
Update (05.10.07): If you wish to disable SFC, I'd recommend a program like nLite to do it as it is more advanced than this. This no longer exists and my website either.

Update (27.05.05): I've noticed a lot of people are still coming to my website for these instructions. At the moment, our website is undergoing a redesign and this information is currently not available. I suggest using a program like nLite for this purpose. Thankyou.

EDIT: FIXED HEX EDIT. PLEASE REDOWNLOAD!!

Here is my SFCSetting hack for WFP...

At offset (00000F82) change:
44 00 69 00 73 00 61 00 62 00 6C 00 65
to:
53 00 65 00 74 00 74 00 69 00 6E 00 67

At offset (0000ECE9) change:
33 C0
to:
EB 01

Simple as that. I've also attached the hacked SFC_OS.DLL for use on the Windows XP CD.

Follow the instructions at http://unattended.msfn.org for the hacked SFC_OS.DLL file but replace it with this file instead...

Edit: Re-attached the SFC_OS.DL_ file with better compression (thanks RyanVM).

Edit2: The attached file can be placed straight in the I386 folder WITHOUT modification. :)

Edit3: For people getting confused about how to apply this properly and what version it's for, follow the instructions at doesn't exist anymore. The files there and the file attached here are for Windows XP Service Pack 2 RTM (Build 2180).

Edit4: You DO NOT need the sfcfiles.dll file, found in this thread, to disable WFP. The sfcfiles.dll file only allows you to delete files and folders in the Program Files directory. It doesn't disable WFP.

Edited by Denney, 22 March 2009 - 01:16 AM.



How to remove advertisement from MSFN

#2
Bachus

Bachus

    Advanced Member

  • Member
  • PipPipPip
  • 408 posts
  • Joined 25-July 03
How would I go about removing a certain directory (in this case Program Files and everything under it) from being watched by WFP? There was post with a hacked dll for SP1 a while back, but I didn't find it in a search. Besides, I don't remember there being much in the way of instructions for making a new version of the dll. :)

#3
Denney

Denney

    *shrug*

  • Member
  • PipPipPipPip
  • 685 posts
  • Joined 11-September 03
Use the information on the unattended page here (just replace the file there with this file here):

http://unattended.msfn.org/xp/wfp.htm

#4
GreenMachine

GreenMachine

    ineXPlicable

  • Developer
  • 3,062 posts
  • Joined 22-August 03
RaveRod again, eh. Why am I not surprised?

Thanks, Mate! You always are watching out for us lazy ones! Perhaps I need not ask ... but have these been PEModified?

#5
Denney

Denney

    *shrug*

  • Member
  • PipPipPipPip
  • 685 posts
  • Joined 11-September 03
Sure have. Just put the file on the CD and away we go!!

Edit: Make sure you have the registry edit as well. :)

#6
captdilly

captdilly

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 03
Has this version be properly modified so that setup won't complain? (Like what running ModifyPE does)

#7
Adiel

Adiel

    Advanced Member

  • Member
  • PipPipPip
  • 401 posts
  • Joined 04-August 04
sry 4 being noob, but what file is doing exactly?

#8
OMERZEN

OMERZEN

    Newbie

  • Member
  • 19 posts
  • Joined 15-June 04

sry 4 being noob, but what file is doing exactly?

+1

what does it for? :)

#9
mark

mark

    Friend of MSFN

  • Member
  • PipPipPipPipPip
  • 851 posts
  • Joined 23-July 04

sry 4 being noob, but what file is doing exactly?

+1

what does it for? :)

+2 :rolleyes:

Posted Image


#10
gabriel_buc

gabriel_buc

    G@bR!e|_

  • Member
  • PipPip
  • 200 posts
  • Joined 05-August 04

Use the information on the unattended page here (just replace the file there with this file here):

http://unattended.msfn.org/xp/wfp.htm

@ Adiel, OMERZEN & DaLurker:
If you would just follow the link provided you would find the answer t oyour question. :)
G@bR!e|_

#11
Denney

Denney

    *shrug*

  • Member
  • PipPipPipPip
  • 685 posts
  • Joined 11-September 03
If you look on the unattended website (like I said), you would know that it allows you disable Windows File Protection so you can overwrite/delete protected files during and after Windows setup.

@captdilly: Yes is has. I stated that in my last post when GreenMachine asked me.

NOTE: The file you download from here can be put onto your Windows XP CD WITHOUT modification.

#12
Denney

Denney

    *shrug*

  • Member
  • PipPipPipPip
  • 685 posts
  • Joined 11-September 03
TO THE ~100 DOWNLOADS, PLEASE REDOWNLOAD!!! I DIDN'T TEST MY HEX EDIT!!!

The new version attached should work. Note: The old one WON'T work.

#13
Bachus

Bachus

    Advanced Member

  • Member
  • PipPipPip
  • 408 posts
  • Joined 25-July 03
I should rephrase myself. I want WFP active, but I'd like to keep it from protecting everything in and including the Program Files directory (So I can, for example, remove an empty WMP directory :)). There was a hacked sfc_os.dll for SP1 that did this, but there isn't a version for SP2 yet (that I know of). I was hoping someone could help me in editing sfc_os.dll to suit my needs. Oh well, I'm sure I'll figure something out. :rolleyes:

#14
RyanVM

RyanVM

    Like a big surly teddy bear.

  • Member
  • PipPipPipPipPipPipPipPip
  • 2,661 posts
  • Joined 31-August 03
Does the hive file have to be edited, or will adding the registry entry be enough? The hive file entry is only if you want it disabled during setup, right?
RyanVM MSFN Files | RyanVM Forums
Please do not link directly to files on my site or modify/redistribute them without getting my permission first. Link to the above URL instead.
Current Update Pack Release: 2.2.2
(Released April 28, 2008)

BTW, 90% of what I say is kidding around. Don't take things so personally ;)

#15
Denney

Denney

    *shrug*

  • Member
  • PipPipPipPip
  • 685 posts
  • Joined 11-September 03
@Bachus: There is a post here that edits the "sfcfiles" file to remove protected directories. You cannot do what you want to do with the "sfc_os.dll" file.

@RyanVM: Yes the hive does need to be edited (or you can import the registry entry during "cmdlines". If you import the registry entry during "RunOnceEx", WFP won't be disabled until the second boot.

#16
visitor

visitor

    Newbie

  • Member
  • 24 posts
  • Joined 01-August 04

SFCSetting hack for WFP...

At offset (0000ECE9) change:

33 C9
to:
EB 01
...

RaveRod
Hey :rolleyes:
thaNX for the info. We're running SP2 build2179 & prefer to stick with this RTM release, which is working well for us. The value @ offset ECEA = C0 (not C9). All other values are as you posted for 2180...

...sorry - found the answer here

Is the manually applied registry value name "SFCDisable" or "SFCSetting"?

thaNX :)

#17
Denney

Denney

    *shrug*

  • Member
  • PipPipPipPip
  • 685 posts
  • Joined 11-September 03
@visitor: The "SFCSetting" registry value should be set to "ffffff9d" if you want to disable WFP. The "SFCDisable" registry value is now useless (just there to trick Windows).

Build 2179 isn't RTM by the way. It was going to be but they had to fix a few more little bugs and application compatibility. Build 2179, I think, will expire is 180 days.

#18
Denney

Denney

    *shrug*

  • Member
  • PipPipPipPip
  • 685 posts
  • Joined 11-September 03
Re-attached SFC_OS.DL_ file with better compression (thanks RyanVM).

#19
netquik

netquik

    Tweaker

  • Member
  • 46 posts
  • Joined 28-July 04
more info about the hacK?

has it modified header crc?


Could explain SFCsetting and SFCdisable fact?


could comment code?


thanks

#20
kolath

kolath

    Newbie

  • Member
  • 10 posts
  • Joined 10-August 04

How would I go about removing a certain directory (in this case Program Files and everything under it) from being watched by WFP?  There was post with a hacked dll for SP1 a while back, but I didn't find it in a search.  Besides, I don't remember there being much in the way of instructions for making a new version of the dll. :)


+1

I have used the hacked SFC_OS.dll + registry method to disable WFP before, but all I really want to do is delete those annoying folders that XP puts in the Program Files directory (e.g. "xerox", "MSN Gaming Zone", "Movie Maker", etc). Is there any way to remove these from the list of protected files rather than disabling WFP altogether. And also, does anyone know why the heck those stupid folders are considered protected system folders in the first place?

#21
kolath

kolath

    Newbie

  • Member
  • 10 posts
  • Joined 10-August 04
bump?

#22
RyanVM

RyanVM

    Like a big surly teddy bear.

  • Member
  • PipPipPipPipPipPipPipPip
  • 2,661 posts
  • Joined 31-August 03

How would I go about removing a certain directory (in this case Program Files and everything under it) from being watched by WFP?  There was post with a hacked dll for SP1 a while back, but I didn't find it in a search.  Besides, I don't remember there being much in the way of instructions for making a new version of the dll. :)


+1

I have used the hacked SFC_OS.dll + registry method to disable WFP before, but all I really want to do is delete those annoying folders that XP puts in the Program Files directory (e.g. "xerox", "MSN Gaming Zone", "Movie Maker", etc). Is there any way to remove these from the list of protected files rather than disabling WFP altogether. And also, does anyone know why the heck those stupid folders are considered protected system folders in the first place?

Disable WFP, delete the folders, then re-enable it. Does that work?
RyanVM MSFN Files | RyanVM Forums
Please do not link directly to files on my site or modify/redistribute them without getting my permission first. Link to the above URL instead.
Current Update Pack Release: 2.2.2
(Released April 28, 2008)

BTW, 90% of what I say is kidding around. Don't take things so personally ;)

#23
kolath

kolath

    Newbie

  • Member
  • 10 posts
  • Joined 10-August 04
nope. At least it didn't work on SP1. I disabled WFP, deleted the folders, rebooted, no problem. But if I ever re-enabled WFP, the folders would come back on the next reboot.

#24
visitor

visitor

    Newbie

  • Member
  • 24 posts
  • Joined 01-August 04
*DELETE* <- we're off on a tangent here, sorry :)

...Build 2179, I think, will expire is 180 days...

How can we test this?

Turning the system clock ahead did not cause it to expire...

thaNX

#25
RyanVM

RyanVM

    Like a big surly teddy bear.

  • Member
  • PipPipPipPipPipPipPipPip
  • 2,661 posts
  • Joined 31-August 03

nope.  At least it didn't work on SP1.  I disabled WFP, deleted the folders, rebooted, no problem.  But if I ever re-enabled WFP, the folders would come back on the next reboot.

In that case, it would be nice to be able to remove those entries from the sfcfiles list
RyanVM MSFN Files | RyanVM Forums
Please do not link directly to files on my site or modify/redistribute them without getting my permission first. Link to the above URL instead.
Current Update Pack Release: 2.2.2
(Released April 28, 2008)

BTW, 90% of what I say is kidding around. Don't take things so personally ;)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users