UPX 3.03 for MacOSX

The latest version of UPX (3.03) has just arrived and it adds support for the LZMA compression. This can enhance the overall compression ration but it's new and it's less tested. So, I decided to provide two binaries for this version : one with the LZMA support and one without. As for the previous release, these binaries will run under Tiger (10.4) , PPC and Intel alike, and Leopard (10.5). Here we go :

For UPX without LZMA support : click here . For UPX with LZMA support : click here .

Advapi32 Patch for Windows XP 64-Bit

As usual, here is the patch of advapi32 on Windows XP 64-Bit that enables testing of CSP dlls without Microsoft signature. In this platform, there is two versions of this dll : on in the System32 directory that is the real 64-bit one, and one in the SysWOW64 directory that is the 32-bit one. So, we have to patch the two dlls. You'll find below the usual patch description for each one of them. You may notice that two have an identical version number, 5.2.3790.1830, that is the same for advapi32 on Windows 2003 SP1. This is why the patch for the SysWOW64 copy is identical to the one on Windows 2003 SP1.

• Advapi32 dll in SysWOW64 directory :
• At offset 0x68CD : change 0F to EB
• At offset 0x68CE : change 84 to 42
• At offset 0x68CF : change 62 to 90
• At offset 0x68D0 : change 0B to 90
• At offset 0x68D1 : change 03 to 90
• At offset 0x68D2 : change 00 to 90

• Advapi32 dll in System32 directory :
• At offset 0x11B15 : change 0F to 90
• At offset 0x11B16 : change 84 to E9
• At offset 0x4D2AD : change 0F to 90
• At offset 0x4D2AE : change 85 to 90
• At offset 0x4D2AF : change 68 to 90
• At offset 0x4D2B0 : change 48 to 90
• At offset 0x4D2B1 : change FC to 90
• At offset 0x4D2B2 : change FF to 90

Advapi32 patch for new Windows OS versions

This is an update of my previous post about the patching of advapi32 dll. You'll find here patches for Windows 2003 Server SP2, Windows Vista, Windows Server 2008 and Windows Vista SP1. The last two platforms share the same version of the advapi32 dll.

• Windows 2003 SP2: advapi32 version = 5.2.3790.3959
• At offset 0x11E3F : change 75 to 90
• At offset 0x11E40 : change 08 to 90
• At offset 0x11E47 : change 74 to EB

• Windows Vista : advapi32 version = 6.0.6000.16386
• At offset 0x37B7D : change 0F to 90
• At offset 0x37B7E : change 84 to E9
• At offset 0x4B66D : change 0F to 90
• At offset 0x4B66E : change 85 to 90
• At offset 0x4B66F : change 10 to 90
• At offset 0x4B670 : change C5 to 90
• At offset 0x4B671 : change FE to 90
• At offset 0x4B672 : change FF to 90

• Windows 2008 and Windows Vista SP1 : advapi32 version = 6.0.6001.18000
• At offset 0x2420C : change 75 to 90
• At offset 0x2420D : change 0C to 90
• At offset 0x24214 : change 0F to 90
• At offset 0x24215 : change 84 to E9

UPX universal binary for Mac OS X

As the buzz is mounting on the Mac OS X platform these days, I decided to buy one and start hacking. On the Windows and Linux platforms, I'm used to compress all my binaries using UPX, thus saving space and bandwidth. Unfortunately, when I tried to download a version of it for Mac OS X, I couldn't find a single link, even on the official web site. So, I decided to compile a version myself. The task was not straightforward but I was able to build a universal binary Mac OS X 10.4 and 10.5. It should work on 10.3 but I didn't test it. The result can be downloaded from the link below. I hope this will help. http://www.idrix.fr/Root/MacOSX/upx-3.02-universal-macosx.tar.gz

Advapi32 patch for CSP development

Microsoft provides the use of cryptography in its operations systems by exposing an application programming interface called CAPI. It's relies on a set of dynamically-linked libraries called CSP (Cryptographic Service Provider) that actually perform all the cryptographic work. In order to be used by the system, a CSP dll must be signed by Microsoft, otherwise, CAPI will refuse to use it. The problem is that the signature process can take many days: That delay can be frustrating for a CSP developer/tester. For that, Microsoft used to ship with the CSP development kit a modified version of the advapi32 dll. This dll is responsible for the verification of the signature associated with a CSP module. The modified version bypasses this verification and thus enables the use of a development version of the CSP dll on the system where it's installed. The problem is that Windows 2000 SP2 is the last supported target for the Microsoft modified advapi32 dll!! So, for those targeting a much newer version of Windows (which is the case of 99% of CSP developers), they find themselves left with no support. Fortunately, some talented people managed to hack the advapi32 signature verification mechanism. Thus, they could provide the community with a patched version of this dll for various new versions of Windows. In the following, I will give the detail of modifications that must be applied to the advapi32 dll at the byte level. All you need for that is a good hexadecimal editor. Personally, I use HxD : it's free and you can get it from here. Once the patch dll is in your hands, you must put it on the system: of course, this can't be done while Windows is running, so you have to find another way to access the system32 directory. I suggest you to use a dual boot system. And here is the patches :

• Windows 2000 SP4: advapi32 version = 5.0.2195.6710
• At offset 0x17061 : change 0F to E9
• At offset 0x17062 : change 84 to 2C
• At offset 0x17063 : change 22 to 06
• At offset 0x17064 : change 06 to 01

• Windows 2000 SP4: advapi32 version = 5.0.2195.7038
• At offset 0xEA97 : change 0F to E9
• At offset 0xEA98 : change 84 to 93
• At offset 0xEA99 : change 89 to 83
• At offset 0xEA9A : change 83 to 01
• At offset 0xEA9B : change 01 to 00
• At offset 0xEA9C : change 00 to 90

• Windows XP SP1 : advapi32 version = 5.1.2600.1106
• At offset 0x8794 : change 0F to EB
• At offset 0x8795 : change 84 to 71
• At offset 0x8796 : change 55 to 90
• At offset 0x8797 : change 14 to 90
• At offset 0x8798 : change 02 to 90
• At offset 0x8799 : change 00 to 90

• Windows XP SP2:
• At offset 0x17C19 : change 75 to 90
• At offset 0x17C1A : change 0c to 90
• At offset 0x17C21 : change 0f to 90
• At offset 0x17C22 : change 84 to E9

• Windows 2003 SP1: advapi32 version 5.2.3790.1830
• At offset 0x68CD : change 0F to EB
• At offset 0x68CE : change 84 to 42
• At offset 0x68CF : change 62 to 90
• At offset 0x68D0 : change 0B to 90
• At offset 0x68D1 : change 03 to 90
• At offset 0x68D2 : change 00 to 90

Under windows Vista, a new architecture called CNG (Crypto NextGen) was introduced. It adds the notion of card modules that exposes cryptographic features and are called by the CNG runtime. These modules don't need to be signed, thus removing the burden of the Microsoft signature process.