Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.

Windows File Protection

[es] :: Windows desktop :: Windows File Protection

[ Pregleda: 4477 | Odgovora: 4 ] > FB > Twit

Postavi temu Odgovori

Autor

Pretraga teme: Traži
Markiranje Štampanje RSS

eskim

Član broj: 587
Poruke: 128
213.149.104.*

Jabber: eskim@elitesecurity.org


+2 Profil

icon Windows File Protection28.07.2003. u 03:29 - pre 221 meseci
Gdje se gasi Windows File Protection system koji je zaduzen za device driver basu podataka. Evo o chemu se radi imam problem sa njim jer napr imam driver za modem koji neche da rade a kad instaliram nove koji navodno nisu digitaly signed sve radi kako treba sve dok ne resetujem rachunar i onda se sam vrache na drivere koji nisu bili u redu, uf muke zive. Dio systema koji je zaduzen bash za ove stvari se zove Windows File Protection i pishe da moze da se disable ali nisam mogao da ,mu nadjem kroz services nijedan file koji je povezan sa pomenutim programom, korisitm WinXP,
Pozdrav.
n/a
 
Odgovor na temu

kUdtiHaEX
Beograd, Yugoslavia

Član broj: 3372
Poruke: 2598
*.beograd-3.tehnicom.net

ICQ: 167621705
Sajt: www.webhost.co.yu


+4 Profil

icon Re: Windows File Protection28.07.2003. u 11:41 - pre 221 meseci
A ti prvo iskljuci proveru da li su drajveri potpisani digitalno od strane proizvodjaca u CP-System-Hardware-Driver Sgning-Ignore i obelezi Make this action default...
Internet ne cini ljude glupima. Internet cini ljudsku glupost dostupnijom (TM by me)

Webhost Hosting Services
 
Odgovor na temu

xkolja
Kolja Kuzev

Član broj: 6475
Poruke: 31
195.252.103.*



Profil

icon Re: Windows File Protection31.07.2003. u 09:36 - pre 220 meseci
System Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon]
Value Name: SFCDisable
Data Type: REG_DWORD (DWORD Value)
Value Data: 0 = enabled (default), ffffff9d = disabled

to bi trebalo da odradis u registri
mozes da ga pokrenes sa regedit

ja sam probao i opet mi izlazi ono
Windows file protection system
stavi CD pa da sve sredim, a kad ga "sredi", "pola" operativnog sistema mi ne radi.

pogledaj na:
http://www.techspot.com/tweaks/wfp/index.shtml
http://msdn.microsoft.com/libr...indows_2000_and_windows_xp.asp
http://www.safenet.no/article/articleview/64/1/3/
 
Odgovor na temu

Goran Mijailovic

Član broj: 12684
Poruke: 6907



+437 Profil

icon Re: Windows File Protection04.08.2003. u 19:10 - pre 220 meseci
Ako se dobro secam XP drzi te zasticene sistemske fajlove na dva mesta jedno je system32 a drugo je skriveni folder dllcashe obrisi nepotrebne fajlove sa obadva mesta pa nece imati odakle da ih vrati, ako neda iz windowsa a ti onda udri iz dosa
ako imas ntfs onda je ntfs for dos za tebe prava stvar...
 
Odgovor na temu

xkolja
Kolja Kuzev

Član broj: 6475
Poruke: 31
195.252.103.*



Profil

icon Re: Windows File Protection05.08.2003. u 08:46 - pre 220 meseci
Predpostavljam da je problem koji ti se javlja ovaj:

http://www.techspot.com/tweaks/wfp/1.gif

kao odgovor na oval problem na netu sam nasao ovo:
i svi pisu jedno te isto.
------------------------------------------

http://www.overclockersclub.com/disablesystemfilechecker.shtml

---------------------------------------
Addendum 7:37pm 6/24/00 At End

6:13am 6/24/00

Summary: Undocumented registry setting allows for
Windows File Protection (aka System File Checker)
to be fully disabled.

HowTo: Set the SFCDisable value (see Q222473) to
0xffffff9d.

Ok, after spending 6 hours in the guts of sfc.dll, sfcfiles.dll,
and winlogon.exe I have *finally* discovered how to permanently
disable windows file protection. The more I dug into the internals
of SFC, the more I began to think that it would not be as easy as
I first thought it would be - and indeed Microsoft does not want it
to be easy. Windows File Protection, while annoying, does provide
a good degree of system stability and even some level of virus/trojan
protection by preventing system files from being modified without
at least notifying the user. Therefore, I was *very* shocked when
I was looking through a disassembly of sfc.dll and came to the code
that checks the value of the SfcDisable in the WinLogon key.
I see in the code of ordinal 1 (which is the initialization function
that winlogon calls), sticking out like a sore thumb, this:

76986A89 push 1
76986A8B cmp eax, ebx
76986A8D pop esi
76986A8E jz loc_76986B97
76986A94 cmp eax, esi
76986A96 jz loc_76986B7A
76986A9C cmp eax, 2
76986A9F jz loc_76986B69
76986AA5 cmp eax, 3
76986AA8 jz short loc_76986AE0
76986AAA cmp eax, 4
76986AAD jz short loc_76986ACF
76986AAF cmp eax, 0FFFFFF9Dh
76986AB2 push ebx
76986AB3 jz loc_76986B86
76986AB9 push offset byte_76981898
76986ABE push edi
76986ABF call sub_7698877D
76986AC4 mov dword_769901D4, ebx
76986ACA jmp loc_76986B97

Ok, values 0, 1, 2, 3, and 4 are documented at
http://support.microsoft.com/support/kb/articles/Q222/4/73.ASP , but
what the heck is this 0ffffff9dh value that it accepts?! As you can
see, any value other than 0,1,2,3,4 and 0ffffff9dh are assumed to be
zero, which is the default of SFC enabled with popups enabled. So,
without further delay, I went and plugged 0ffffff9dh into the SfcDisable
value to see what was up. Rebooted. I'll be darned, Microsoft provided
a very,very simple way to fully disable WFP!

When booting with this value in the SFCDisable value in the WinLogon
key (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon), an
event is written to the system log, ID 64032 from Windows File
Protection, with the description:
"Windows File Protection is not active on this system. ".

All attempts to replace/delete protected system files succeeded,
just as if I were in safe mode :). I rebooted a few more times and
verified that it is the one value (other than 4=popus disabled) that
is not reset to 0 after the first boot.

Needless to say, this is not what Microsoft intended.

Well, it's now 6am, hopefully I haven't mucked this up too much in
my delerium.

Jeremy Collake
[email protected]
http://www.collakesoftware.com


Addendum 7:37pm 6/24/00:
SFCDisable value 3 was not documented like I thought it was. This
value performs some check for setup.exe or sfctest.exe. WFP does
appear to end up enabled. Have not had a chance to look into it further.

-------------------------------------------------

If you would like to re-enable the undocumented value to disable Windows File Protection, you may apply the appropriate patch and then replace the DLL in the 2k/XP recovery console (boot to CD).


Windows2000 SP2:

file: SFC.DLL
virtual offset: 76986C11
physical offset: 6211
original: 8BC6
new: 9090

WindowsXP:

file: SFC_OS.DLL
virtual offset: 76C6EEB8
physical offset: 0E2B8
original: 8BC6
new: 9090

WindowsXP SP1:

file: SFC_OS.DLL
virtual offset: 76C6EFBB
physical offset: 0E3BB
original: 8BC6
new: 9090
 
Odgovor na temu

[es] :: Windows desktop :: Windows File Protection

[ Pregleda: 4477 | Odgovora: 4 ] > FB > Twit

Postavi temu Odgovori

Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.