Windows Vista 5308 anti product activation patch v1.0
================================================== ====
How to use:
Exchange c:\windows\system32\winlogon.exe with that one
0. Make sure the Versions match
1. Start\rightclick on explorer\'run elevated'
2. Change Permissions:
Rightclick on c:\windows\system32\winlogon.exe
Security/owner and overtake ownership of winlogon.exe as administrator
Close securitydialog and reopen it
Change permission to fullaccess for administrators
3. rename winlogon.exe to winlogon.org
4. copy this winlogon.exe into c:\windows\system32\
(If you still don't have enough rights to set permission - try login as 'real' Administrator:
click on 'other user' and type in "Administrator"[ + password] )
Instead of winlogon.exe you can exchange SLC.dll instead.
But this is a dll and also used by other programs that Query license value
and will also effect these in positive or negative way. The 'patched' slc.dll
will always return 1 to any licensevalue request. So for ex for
isActivated 1 or IsAeroThemeAllow 1 is good but for
MaxAllowedTerminalServerConnection 1 is no so good.
However exchange both winlogon.exe and SLC.dll is possible but doesn't makes much sense.
Noninversive workarounds
* Break out from Vista Activationscreen
-------------------------------------
When your time to activate is down you will get a dialogbox to activate windows and are not allowed to login.
That trick will help out:
-> click on contact M$
-> rightclick inside browser windows and choose print
-> Button find printer
-> rightclick on network - explore
now explorer is started.
Minimize activate windows but do not close it.
Limitations:
* Shortcuts like Alt+Ctrl+Del , Winkey+L have no effect because Winlogon_SAS_Handler (=Secure Attention Sequence) is not setup at this point
* When screensaver popup you maybe get logged off
That's is not the best solutions but it's simple and easy to apply and need to chance absolutly nothing.
* Boot in Safemode (F8 during boot) will skip Activationcheck
* Disable Software Licensing Service
Press Winkey+R enter "services.msc"
Doubleclick on 'SL UI' and 'Software Licensing Service'
and choose Start: 'Disable'
* SL UI notification service
----------------------------------------------------------
Winlogon pseudocode
If IsSafemode [GetSystemMetrics(43)] <-Patched to goto Continue Login
if WPA-Check()==failed
No Login
Continue Login:
WPA-Check:
if SLC.dll!SLGetWindowsInformationDWORD("Winlogon-Licensing-InteractiveLogon")!=1
Launch SLUI.exe [=activationScreen]
if SLC.dll!SLGetWindowsInformationDWORD("Winlogon-Licensing-InteractiveLogon")!=1
return(WPA-Check := failed)
return(WPA-Check := ok)
The Patch
0100EE83 . 6A 43 PUSH 43 ; /Index = SM_CLEANBOOT
0100EE85 . FF15 E4130001 CALL [<&USER32.GetSystemMetrics>] ; \GetSystemMetrics
0100EE8B . 83F8 01 CMP EAX, 1
0100EE8E 90 NOP
0100EE8F E9 63010000 JMP <nowpa>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0100EE8E /0F84 63010000 JE <nowpa>
... now WPA is skipped as in save mode
SLC.dll!SLGetWindowsInformationDWORD redirects query to SLS
SLC=SystemLicenseClient,SLS=SystemLicenseService
SystemLicenseService gets Value from
HKEY_LOCAL_MACHINE\TempHive\ControlSet002\Control\ ProductOptions
If that helps that is the struct-definationfiles I use for winhex script for better edit&display. (Note: I used
[ برای مشاهده لینک ، با نام کاربری خود وارد شوید یا ثبت نام کنید ]
ti export binary regdata to a file first)
section "datablock"
goto 0x14
uint16 "blocklen"
uint16 "StrLen"
uint16 "dataType"
uint16 "datasize"
uint32 "unused"
uint32 "unused2"
string16 (StrLen/2) "label"
hex (datasize) "data"
endsection
but you can also edit it directly in regedit so for ex. right after
"SMBServer-WindowsMaxInSMBConns" follows
0a 00 00 00 what means only '10' incoming network connection for fileshares are allowed.
X64-winlogon patch
.text:00000001000152CF 49 8B 4F 10 mov rcx, [r15+10h]
.text:00000001000152D3 E8 48 3C 00 00 call sub_100018F20
.text:00000001000152D8 8D 4E 43 lea ecx, [rsi+43h]
.text:00000001000152DB FF 15 07 C4 FE FF call cs:GetSystemMetrics
.text:00000001000152E1 8D 5E 01 lea ebx, [rsi+1]
.text:00000001000152E4 3B C3 cmp eax, ebx
.text:00000001000152E6 0F 84 0F 02 00 00 jz ok2
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~
90 nop
.text:00000001000152E6 E9 0F 02 00 00 jmp ok2
.text:00000001000152EC 49 8B 4F 18 mov rcx, [r15+18h]
.text:00000001000152F0 E8 47 5D 00 00 call sub_10001B03C
Possible Search'n'Replace Pattern for x64 winlogon.exe
Search for : 8D 5E 01 3B C3 0F 84 (?? ?? 00 00) lea ebx, [rsi+1]; cmp eax, ebx; jz 0000????
Replace with : 8D 5E 01 3B C3 90 E9
