Sign in to follow this  
Followers 0
Denney

SFC_OS.DLL hack for XP SP2 Final

129 posts in this topic

Update (05.10.07): If you wish to disable SFC, I'd recommend a program like nLite to do it as it is more advanced than this. This no longer exists and my website either.

Update (27.05.05): I've noticed a lot of people are still coming to my website for these instructions. At the moment, our website is undergoing a redesign and this information is currently not available. I suggest using a program like nLite for this purpose. Thankyou.

EDIT: FIXED HEX EDIT. PLEASE REDOWNLOAD!!

Here is my SFCSetting hack for WFP...

At offset (00000F82) change:

44 00 69 00 73 00 61 00 62 00 6C 00 65

to:

53 00 65 00 74 00 74 00 69 00 6E 00 67

At offset (0000ECE9) change:

33 C0

to:

EB 01

Simple as that. I've also attached the hacked SFC_OS.DLL for use on the Windows XP CD.

Follow the instructions at http://unattended.msfn.org for the hacked SFC_OS.DLL file but replace it with this file instead...

Edit: Re-attached the SFC_OS.DL_ file with better compression (thanks RyanVM).

Edit2: The attached file can be placed straight in the I386 folder WITHOUT modification. :)

Edit3: For people getting confused about how to apply this properly and what version it's for, follow the instructions at doesn't exist anymore. The files there and the file attached here are for Windows XP Service Pack 2 RTM (Build 2180).

Edit4: You DO NOT need the sfcfiles.dll file, found in this thread, to disable WFP. The sfcfiles.dll file only allows you to delete files and folders in the Program Files directory. It doesn't disable WFP.

Edited by Denney
0

Share this post


Link to post
Share on other sites

How would I go about removing a certain directory (in this case Program Files and everything under it) from being watched by WFP? There was post with a hacked dll for SP1 a while back, but I didn't find it in a search. Besides, I don't remember there being much in the way of instructions for making a new version of the dll. :)

0

Share this post


Link to post
Share on other sites

RaveRod again, eh. Why am I not surprised?

Thanks, Mate! You always are watching out for us lazy ones! Perhaps I need not ask ... but have these been PEModified?

0

Share this post


Link to post
Share on other sites

Sure have. Just put the file on the CD and away we go!!

Edit: Make sure you have the registry edit as well. :)

0

Share this post


Link to post
Share on other sites

Has this version be properly modified so that setup won't complain? (Like what running ModifyPE does)

0

Share this post


Link to post
Share on other sites

sry 4 being noob, but what file is doing exactly?

0

Share this post


Link to post
Share on other sites
sry 4 being noob, but what file is doing exactly?

+1

what does it for? :)

0

Share this post


Link to post
Share on other sites
sry 4 being noob, but what file is doing exactly?

+1

what does it for? :)

+2 :rolleyes:

0

Share this post


Link to post
Share on other sites
Use the information on the unattended page here (just replace the file there with this file here):

http://unattended.msfn.org/xp/wfp.htm

@ Adiel, OMERZEN & DaLurker:

If you would just follow the link provided you would find the answer t oyour question. :)

0

Share this post


Link to post
Share on other sites

If you look on the unattended website (like I said), you would know that it allows you disable Windows File Protection so you can overwrite/delete protected files during and after Windows setup.

@captdilly: Yes is has. I stated that in my last post when GreenMachine asked me.

NOTE: The file you download from here can be put onto your Windows XP CD WITHOUT modification.

0

Share this post


Link to post
Share on other sites

TO THE ~100 DOWNLOADS, PLEASE REDOWNLOAD!!! I DIDN'T TEST MY HEX EDIT!!!

The new version attached should work. Note: The old one WON'T work.

0

Share this post


Link to post
Share on other sites

I should rephrase myself. I want WFP active, but I'd like to keep it from protecting everything in and including the Program Files directory (So I can, for example, remove an empty WMP directory :)). There was a hacked sfc_os.dll for SP1 that did this, but there isn't a version for SP2 yet (that I know of). I was hoping someone could help me in editing sfc_os.dll to suit my needs. Oh well, I'm sure I'll figure something out. :rolleyes:

0

Share this post


Link to post
Share on other sites

Does the hive file have to be edited, or will adding the registry entry be enough? The hive file entry is only if you want it disabled during setup, right?

0

Share this post


Link to post
Share on other sites

@Bachus: There is a post here that edits the "sfcfiles" file to remove protected directories. You cannot do what you want to do with the "sfc_os.dll" file.

@RyanVM: Yes the hive does need to be edited (or you can import the registry entry during "cmdlines". If you import the registry entry during "RunOnceEx", WFP won't be disabled until the second boot.

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.