Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Messages - JFX

Pages: [1] 2 3 ... 24
Yes it's IDA 6.8 with loaded x64 explorer.exe version 14393.

I guess the CTray object has it's own function to enable\disable the show desktop functionallity.

You rock man  :thumbup:

Seems it's explorer himself who send this message.


Questions and Support / Re: SysWoW64 - some observations
« on: March 23, 2017, 12:58:39 AM »
Hi Misty,

They should not be replaced, but could be added.
But there is no need. SMI key is handled by SxS_Unknow Section of the WoW64 Plugin.

IA64 is an old architecture already superseded by AMD64.

ARM and ARM64 are very new architectures. You can ignore them for now.
It see Microsoft does not really know what they want with ARM and their Windows RT version.

Questions and Support / Re: SysWoW64 - some observations
« on: March 22, 2017, 07:55:59 AM »
By SxS error always check the manifest of an application.

This DMDE version 3.2 properly need a newer VCRuntime-

Questions and Support / Re: SysWoW64 - some observations
« on: March 22, 2017, 06:48:25 AM »
Hi misty,

Microsoft is moving a lot of code into *base.dll or *.core.dll files.
To have a good application compatibility you should add all of them to your WinPE.

Hmm, will be difficult to find it for other version.
Would be easier if we could find the reason why this byte is set in WinPE.

Great work Noel  :thumbsup:

For x86 it's *CTrayObj + 0x231


good news today on a new Windows 10 RS2 machine, I could reproduce all problems.
The memory patching of wimgapi.dll used by the winload extraction causes quite some memory corruption
and leads to strange results. Actually I wonder why I does not crash.

For the percent progress, it's really a math problem.
The language have no unsigned integer, so I have to change quite a bit.

I couldn't really reproduce the this locked folder problem you mentioned. But so far the x64 version is now fully working here.

Hi trashy,

GetBinaryType API has couple of problems, when running from older Os on never files.
Maybe this can be a better way.

Code: [Select]
Func GetDriverSys_Info($sDriverFile)

Local $hFile, $Buffer, $aReturn[3]
$hFile = FileOpen($sDriverFile, 16)
IF Not $hFile Then Return SetError(1, 0, 0)

$Buffer = FileRead($hFile, 1024)
IF not @error Then
IF BinaryMid($Buffer, 1, 2) = 0x5A4D Then
Switch BinaryMid($Buffer, Int(BinaryMid($Buffer, 0x3D, 4)) + 5, 2)
Case 0x8664
$aReturn[0] = 'x64'
Case 0x014C
$aReturn[0] = 'x86'
Case 0x01C4
$aReturn[0] = 'ARM'
Case 0xAA64
$aReturn[0] = 'ARM64'



IF $aReturn[0] Then
$aReturn[1] = FileGetVersion($sDriverFile, 'FileVersion')
$aReturn[2] = FileGetVersion($sDriverFile, 'FileDescription')
Return $aReturn

Return SetError (2, 0, 0)


Local $aDriverInfo = GetDriverSys_Info("C:\Windows\System32\drivers\3ware.sys")
IF not @error Then
ConsoleWrite('Architecture: ' & $aDriverInfo[0] & @CRLF)
ConsoleWrite('Version: ' & $aDriverInfo[1] & @CRLF)
ConsoleWrite('Description: ' & $aDriverInfo[2] & @CRLF)

It's a known problem and not limited to WinPE only.

Hi BunBoy,

thank you very much for these bug reports.
I'm currently doesn't have much time and also playing with compiler update.
So here a test version, I hope I addresses all problems.

In the same folder as were the gwt.exe is located.

Good that they fixed it  :smile:

The bcdedit.exe is still linked against win10 API set and therefor can not run on Windows 7.
Does anyone noticed any improvement over the 1511 version?

Win10 / Re: I can not see the mouse cursor before the shell
« on: February 25, 2017, 11:48:48 PM »
Well you have to wait until Chris is back.

On a normal Windows 8+ PE, the mouse cursor is hidden until winpeshl.exe enables it.
The Startup of our WinPE's got a bit to much complexity to just make a small change without breaking something.

Is there really the need to call PENM before shell?

Win7PE SE HomePage / Re: Change X:/Boot Drive Letter from X:/ to C:/?
« on: February 03, 2017, 10:38:09 PM »
First remove the drive letter of C:\ drive, if it exists.

Code: [Select]
mountvol C: /D

Than use subst

Code: [Select]
subst C: X:\

Win7PE SE HomePage / Re: Change X:/Boot Drive Letter from X:/ to C:/?
« on: February 03, 2017, 12:21:59 AM »
No, there is no option.

Just use subst to add another drive letter for the systemdrive.

Win10 / Re: ShutdownPE
« on: January 28, 2017, 07:58:37 AM »
Hi Homes32,

welcome back after quite a long time  :smile:

Not true. ShutdownPE was updated for Win 8.1. the latest release is 1.5.x and was posted back in Jan of 2015 script version is .17
I do not know why chrisR continued to use the old 1.4.x version. He never reported any issues on the 1.5 beta. as far as I am aware there are no outstanding issues with 1.5.x
Oh, my bad. Can you post a link to it, cause I'm still can not find this 1.5.x version.  :confused:

Makes no sense to me.
There is no guarantee that the project will work with such a source.

Pages: [1] 2 3 ... 24
Powered by EzPortal