Alternative method to disable Certificate Propagation service

Apart from disabling the Certificate Propagation service under Vista/7 using the Services MMC, you can do the same by modifying the registry: under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CertProp, set the REG_DWORD value CertPropEnabled to 0.This will forbid the service from starting until you set it again to 1.

Advapi32 patch for 64-bit Vista SP2 and Windows 2008 SP2

Recently, a reader of this blog asked for the patch of the 64-bit advapi32 dll of Windows Server 2008 SP2 64-bit (version 6.0.6002.18005). So, here it is (it also applies to Vista SP2 64-bit).
For the 32-bit advapi32 dll on these systems, I have already published the corresponding patch in the following post about Vista SP2 : http://blog.idrassi.com/2009/08/advapi32-patch-for-windows-vista-sp2.html

• Advapi32 dll in System32 directory, version 6.0.6002.18005:
• At offset 0x2BC9D : change 75 to 90
• At offset 0x2BC9E : change 0B to 90
• At offset 0x2BCA4 : change 0F to 90
• At offset 0x2BCA5 : change 84 to E9

Its new SHA-256 hash value that should be put in the manifest files is :
oUGG12aBTnJoj/xm5nagheO7ePTc0P3BfW1fxRdbwB4=

Advapi32 patch for Windows 7, 32-bit and 64-bit

It has been a log time since my last posting about the release candidate for Windows 7. I was quite busy since then and I couldn't find time to come up with a patch. Luckily, one reader of this blog, Natko Kalisnik, spent time working on this and he contacted me recently to share his findings. Hi approach is different from the one I usually follow (his is more prudent) but it leads to the same result. Without getting into more details, here it is for a 64-bit version of Windows 7. For the 32-bit version, just take the patch for the dll in SysWOW64. cryptsp.dll 32-bit in SysWOW64, version 6.1.7600.16385 : - At offset 0x3CF4 : change 0F to 90 - At offset 0x3CF5 : change 85 to E9 Its new SHA256 hash value is : +0SIH7z7WWOMju2QxD4MuCAdC4nnhijXHr8vCLIJ6HE= cryptsp.dll 64-bit in System32, version 6.1.7600.16385 : - At offset 0x32E3 : change C3 to DB - At offset 0x337D : change C3 to DB - At offset 0x33C4 : change C3 to C4 And its new SHA256 hash value is : 2STx7caFTALkBzuo3qvvdlsBddMCZNmSq/NTqtjK0Y4= Just a last word about the how to apply this patch for new comers. Some manifest files must be updated using the new hash values. They are located under C:\Windows\winsxs\Manifests : For 32-bit : x86_microsoft-windows-cryptsp-dll_31bf3856ad364e35_6.1.7600.16385_none_2933c430682017d9.manifest For 64-bit : amd64_microsoft-windows-cryptsp-dll_31bf3856ad364e35_6.1.7600.16385_none_85525fb4207d890f.manifest The hash value to be modified is in the XML node dsig:DigestValue. Also, you need to replace cryptsp.dll with the patched one in the following folders under C:\Windows\winsxs : For 32-bit : x86_microsoft-windows-cryptsp-dll_31bf3856ad364e35_6.1.7600.16385_none_2933c430682017d9 For 64-bit : amd64_microsoft-windows-cryptsp-dll_31bf3856ad364e35_6.1.7600.16385_none_85525fb4207d890f This is sufficient for having a running patched system. For a more complete patch, you can have a look at the directory C:\Windows\winsxs\Backup : it contains copies of the manifest files and dlls that you can also patch.

UPX 3.04 with patches for MacOSX

The latest version of UPX (3.04) contained a bug that prevented it from handling correctly MacOSX binaries. A correction was committed to the source tree. I have compiled a version of UPX 3.04 with this correction and you can download the corresponding universal binaries from the following links :

For UPX without LZMA support : click here . For UPX with LZMA support : click here .

Advapi32 patch for Windows Vista SP2

Hi, Here is the patch bytes for the advapi32 of Windows Vista SP2 that enable CSP testing without the MS signing process. You'll also find the value of the SHA256 hash of the resulting dll: this value must be updated on the two manifest files associated with advapi32 and which are located under winsxs\Manifests and winsxs\backup. To find them, just do a file name search containing the strings "advapi32" and "6.0.6002.18005". Do the same search to find the other folder besides winsxs\backup and system32 where you must put the patched copy. Patch for advapi32.dll version 6.0.6002.18005 : - At offset 0x2C106 : change 75 to 90 - At offset 0x2C107 : change 0C to 90 - At offset 0x2C10E : change 0F to 90 - At offset 0x2C10F : change 84 to E9 The new SHA256 hash value is : UJ03+cGhkgBS/X7C/YIy+tu0ko+6sgJmmdHUexvsWSk=