[jdoe]

verbal, on Nov 25 2004, 02:12 AM, said:

I still cannot get this to work.  I've replaced every sfc_os.dll file on my machine with this one AND changed both SFCSetting and SFCDisable in the registry.  This doesn't work for me.

Disabling Windows File Protection Permanently.

I made an hacked SFC_OS.DLL for disabling WFP without any registry settings.

You can replace the file from your Windows XP SP2 source files or follow this guide if you have already installed XP.


1) Rename the hacked SFC_OS.DLL to SFC_OS.DLL.HACK

2) Unchecked "Hide protected operating system files" from "Folder Options"

3) Copy SFC_OS.DLL.HACK to "%WINDIR%\system32\dllcache"

4) Copy SFC_OS.DLL.HACK to "%WINDIR%\system32"

5) Start Task Manager, select Processes tab, right-click on explorer.exe and select End Process

6) On Task Manager menu, select File / New Task(Run...) and browse to "%WINDIR%\system32\dllcache"

7) Rename SFC_OS.DLL to SFC_OS.DLL.BAK and rename SFC_OS.DLL.HACK to SFC_OS.DLL

8) Browse to "%WINDIR%\system32"

9) Rename SFC_OS.DLL to SFC_OS.DLL.BAK and rename SFC_OS.DLL.HACK to SFC_OS.DLL

If windows appears select "Cancel" and on Task Manager menu, select Shutdown / Restart


That's it. For re-enabling I think it's obvious.



English SP2 SFC_OS.DL_

French SP2 SFC_OS.DL_

This post has been edited by jdoe: 25 September 2005 - 11:21 PM

[bucketbuster]

@jdoe

Will there be complications when using the registry tweak with your hacked dll?

[jdoe]

bucketbuster, on Nov 25 2004, 08:08 AM, said:

@jdoe

Will there be complications when using the registry tweak with your hacked dll?

What my hacked file does is simple. Instead of reading the registry for a key and value, the code execution is redirected where it should goes if the SFCDisable was FFFFFF9D (WFP disabled).

If this hacked file is used with unattended installation of Windows then SFCDisable is not created in the registry.

If this hacked file is installed using the guide then SFCDisable is there but useless.


Hoping it answer your question.

This post has been edited by jdoe: 22 September 2005 - 08:39 PM

[bucketbuster]

Thanks for clarifying

[RyanVM]

Very cool, jdoe

[jdoe]

RyanVM, on Nov 25 2004, 12:42 PM, said:

Very cool, jdoe

Thanks,

I made it while ago but I didn't thought one more was needed after RaveRod and nLite. But for those who really don't like WFP and don't want to deal with registry, now they have an other option.


BTW, the guide is also good for UXTHEME.DLL and maybe others files replacement with WFP enable.


P.S.: the guide is inspired from something I red but I just can't remember where. So if some of you know where it come from, a credit goes to that source for the idea.

[verbal]

jdoe, on Nov 25 2004, 02:31 AM, said:

verbal, on Nov 25 2004, 02:12 AM, said:

I still cannot get this to work.  I've replaced every sfc_os.dll file on my machine with this one AND changed both SFCSetting and SFCDisable in the registry.  This doesn't work for me.

Disabling Windows File Protection Permanently.

I made an hacked SFC_OS.DLL for disabling WFP without any registry settings.

3) Copy SFC_OS.DLL.HACK to "%WINDIR%\system32\dllcache"

4) Copy SFC_OS.DLL.HACK to "%WINDIR%\system32"

I don't have an sfc_os.dll file in my \windows\system32\dllcache folder. I have an sfc.exe, but no sfc_os.dll. There is one in system32, but not in dllcache.

This is the same problem I had before. Thanks for any help!

[jdoe]

verbal, on Dec 2 2004, 01:55 AM, said:

jdoe, on Nov 25 2004, 02:31 AM, said:

verbal, on Nov 25 2004, 02:12 AM, said:

I still cannot get this to work.  I've replaced every sfc_os.dll file on my machine with this one AND changed both SFCSetting and SFCDisable in the registry.  This doesn't work for me.

Disabling Windows File Protection Permanently.

I made an hacked SFC_OS.DLL for disabling WFP without any registry settings.

3) Copy SFC_OS.DLL.HACK to "%WINDIR%\system32\dllcache"

4) Copy SFC_OS.DLL.HACK to "%WINDIR%\system32"

I don't have an sfc_os.dll file in my \windows\system32\dllcache folder. I have an sfc.exe, but no sfc_os.dll. There is one in system32, but not in dllcache.

This is the same problem I had before. Thanks for any help!

Well it's not the end of the world.

You can type this at command prompt to know where the file is and follow the guide to replace the file where it is. From what I understand you must have only one sfc_os.dll on your system and it must be in \windows\system32

At Command Prompt

DIR /S /B %SYSTEMDRIVE%\SFC_OS.DLL

After restart, WFP should be disabled.

[itsme_4ucz]

Hi
all
can u all guys make SFC_OS.DLL to somthing like this SFC_OS.DL_ so even newbe can diretly add to the i386 folder to the cd itself.Bcos i myself dono how to make it.

And
RyanVM
you can add it to ur upcomming Update Pack 1.4.

THX

[RyanVM]

As I've already explained, I don't include hacked DLLs which don't give the user the ability to use the original functionality as well. Hence why I don't include a hacked tcpip.sys either.

[Kelsenellenelvian]

itsme_4ucz, on Dec 2 2004, 10:19 PM, said:

Hi
all
can u all guys make SFC_OS.DLL to somthing like this SFC_OS.DL_ so even newbe can diretly add to the i386 folder to the cd itself.Bcos i myself dono how to make it.

And
RyanVM
you can add it to ur upcomming  Update Pack 1.4.

THX

Here ya go...

[itsme_4ucz]

Thx u.

[Kwinto]

I find error in Mantra Software Australia site:

http://beckrod.beige...dex.php?a=xpsp2

"SFC_OS.DLL Hack (07.08.04)
You will need a hex editor to perform these hex edits.

At offset (0x00000F82) change:

44 00 69 00 73 00 61 00 62 00 6C 00 65

to:

53 00 65 00 74 00 74 00 69 00 6E 00 67

At offset (0x0000ECE9) change:

33 C9

to:

EB 01"

offset (0x0000ECE9) is: 33 C0 .
33 C9 is offset (0x0000ECF5)
In "Download the hacked SFC_OS.DLL here:" is too error.

[Jazkal]

Does anyone know the offset for Windows XP x64 version of SFC_OS.DLL ?

[jdoe]

Jazkal, on Apr 22 2005, 04:10 PM, said:

Does anyone know the offset for Windows XP x64 version of SFC_OS.DLL ?
<{POST_SNAPBACK}>

Zip and post the Windows XP x64 version of SFC_OS.DLL and I will post back the offset and hex values.

[redanimalwar]

is it normal that the windows file protection comes up while updating drivers ?

[Nanaki]

Crap, I need help with this, please.

This is the final bug remaining in my uA CD. :/

I applied the WinSP2 from unattended.msfn.org. Then I applied the "SFCdisable"-value:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"SFCDisable"=dword:FFFFFF9D

during T-12.

After the first boot, a window immediatly pops up (the WFP-warning). Please help. :/ I don't minding disabling it permanently.

[evilvoice]

@jdoe, here is the xp x64 version of sfc_os.dll...please reply with what to edit so that we can disable wfp...thank you. Rename sfc_os.txt to sfc_os.dl_

Attached File(s)

•  SFC_OS.txt (64.81K)
  Number of downloads: 114

[jdoe]

evilvoice, on May 2 2005, 03:54 PM, said:

@jdoe, here is the xp x64 version of sfc_os.dll...please reply with what to edit so that we can disable wfp...thank you.  Rename sfc_os.txt to sfc_os.dl_
<{POST_SNAPBACK}>

Sorry evilvoice but I can't find a 64bits executable disassembler. I didn't thought it was hard to find.

If someone knows one, post a link to it.

[jamesagmoore]

jdoe, on Nov 25 2004, 02:31 AM, said:

Disabling Windows File Protection Permanently.

I made an hacked SFC_OS.DLL for disabling WFP without any registry settings.

You can replace the file from your Windows XP SP2 source files (don't forget to compress with MAKECAB.EXE) or follow this guide if you have already installed XP.

Does anyone know where the sfc_os.dll file with no registry check went? It is not possible to download it any more
Thanks