_____ __ .__ __ ____________ _____ ________
/ _ \ _____/ |_|__/ \ / \______ \/ _ \ \_____ \
/ /_\ \ / \ __| \ \/\/ /| ___/ /_\ \ _(__ <
/ | | | | | | |\ / | | / | \ / \
\____|__ |___| |__| |__| \__/\ / |____| \____|__ / /______ /
\/ \/ \/ \/ \/
Let's activate later...
Version 3.4.2 for x64 and x86
--------------------------------------------------------------------
How to use:
Start AntiWPA3.cmd to install/uninstall the patch
What the patch modifies:
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AntiWPA
is added to Registry
* File C:\windows\system32\AntiWPA.dll is added
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WPAEvents]
data for "OOBETimer" is changed {=OOBE}
* rundll32 setupapi,InstallHinfSection DEL_OOBE_ACTIVATE 132 syssetup.inf
rundll32 setupapi,InstallHinfSection RESTORE_OOBE_ACTIVATE 132 syssetup.inf
is executed which will remove/restore WPA-links from the startmenu
How it works:
It tricks (hooks user32.dll! GetSystemMetrics(SM_CLEANBOOT) & ntdll.dll!NtLockProductActivation)
winlogon.exe to make it believe it was booted in safemode,thus, winlogon skips
the WPA-Check. *Note (...because some ppl were concered about): The hooks *ONLY*
affect winlogon.exe! They *DO NOT* affect any other exe or dll.
The patch auto-runs on each start before the WPA-check via:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AntiWPA
The hooks are applied when AntiWPA.dll!onLogon is called by winlogon.exe.
The Winlogon.exe file on the harddisk is not altered anymore.
Patching (API-Hooking) is done in memory, so there are no problems with
Windows System File Protection.
Installation is performed via AntiWPA.dll!DllRegisterServer ("regsvr32 AntiWPA.dll").
The file is copied to systemdir and the registrykeys are added.
(Note: AntiWPA.dll is no ActiveX selfregisterdll.)
Uninstallation is done via AntiWPA.dll!DllUnRegisterServer ("regsvr32 -u AntiWPA.dll").
Notes:
Build for 64-bit Intel Itanium(IA64) is not included, because I think
this kind of system is rather uncommon. Send me a mail if you really
need an IA64 build and I will try to get it for IA64. So far, I haven't tried.
Or, if you want, download the sourcecode and compile it yourself.
==================================================
F A Q - Frequently Asked Questions
==================================================
????????????????????????????????????????????????????????????????????????????????
How to check if it's really active
????????????????????????????????????????????????????????????????????????????????
check if antiwpa.dll is loaded
enter in console (cmd.exe)
TASKLIST /M /FI "MODULES eq antiwpa.dll"
Check and see if you have the Process Winlogon.exe as output
????????????????????????????????????????????????????????????????????????????????
I have Install AntiWPA 2.00. Should I uninstall it to update?
????????????????????????????????????????????????????????????????????????????????
They both work well. They both ætargetÆ the same function in
Winlogon.exe, so itÆs running well - donÆt touch it (Never touch a running system.)
????????????????????????????????????????????????????????????????????????????????
Do I have to reinstall every AntiWPA 3 after I've installed a servicepack ?
????????????????????????????????????????????????????????????????????????????????
No, you don't need to. The patch isnÆt undone by service packs anymore.
Since it doesn't modify winlogon.exe, it's no problem if winlogon.exe is
replaced by a new version.
????????????????????????????????????????????????????????????????????????????????
What is the difference between AntiWPA 2 & AntiWPA 3?
????????????????????????????????????????????????????????????????????????????????
AntiWPA 2 directly modified winlogon.exe (on hard disk) to make it skip
over the product activation check.
AntiWPA 3 intercepts (in memory via API-Import-Hooking) winlogon.exe's request to
the OS whether Windows was booted into Safe-Mode or not.
It makes the OS always return "yes", even if Windows is running in 'normal mode',
winlogon is thinking it's running in safemode and skips the product activation check.
????????????????????????????????????????????????????????????????????????????????
How do I integrate it into Windows Setup?
????????????????????????????????????????????????????????????????????????????????
I haven't done/tried this yet.
What you would have to do is manage these tasks somehow:
1. Add antiwpa.dll to the installation package
2. make it execute once "regsvr32 /s antiwpa.dll"
(or "rundll32 antiwpa.dll, DllRegisterServer")
http://forums.cjb.net/antiwpa3-about47.html for more about
Thanks to Hackedout for his solution. Let me summarized it:
1. Copy i386 folder from the cd C:\i386
2. Execute "makecab.exe antiwpa.dll"
Copy compressed file antiwpa.dl_ to C:\i386
3. Edit the following files from i386:
DOSNET.INF
...
d1,a_pnt518.ppd
d1,antiwpa.dll <-insert that line
d1,aaaamon.dll
...
HIVESFT.INF
search for 'Winlogon\Notify\cscdll' & insert the lines so it will look like that:
...HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify",,0x00000012
HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\antiwpa",,0x00000012
HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\antiwpa","DLLName",0x00000002,"antiwpa.dll"
HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\antiwpa","Asynchronous",0x00010003,0
HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\antiwpa","Impersonate",0x00010001,0
HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\antiwpa","Logon",0x00000002,"onLogon"
...HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll",,0x00000012
TXTSETUP.SIF
search for 'aaaamon.dll' ...
...a_pnt518.ppd = 1,,,,,,,,3,3
antiwpa.dll = 1,,,,,,,2,0,0
..aaaamon.dll = 1,,,,,,,2,0,0
4. Make sure that these files were saved/copied to C:\i386
Antiwpa.dl_
DOSNET.INF
HIVESFT.INF
TXTSETUP.SIF
Done!
---------------------------------------------------
And to draw some other solution posted by some guest:
1. Copy CD content to C:\WindowsCD\
2. Use setupmgr.exe to create an answer file
add the following in the "Run Once" section of setup manager:
"%SYSTEMDRIVE%\antiwpa.dll"
Unattend.txt/winnt.sif should now include the following section:
[GuiRunOnce]
Command0="regsvr32 /s %SYSTEMDRIVE%\antiwpa.dll"
Edit the [Unattended] section, changing OemPreinstall=No to
OemPreinstall=Yes
copy winnt.sif to the C:\WindowsCD\i386 folder
3. copy antiwpa.dll to C:\WindowsCD\$oem$\$1\ (Create Folder)
Note: All files contained in the "\$oem$\$1" folder will be
copied to the C: drive during installation.
Before-WPA-emerency console:
----------------------------
This will setup some kind of emerency console. The program specified in
CmdLine will be run before the normal logonscreen and before the WPA-Check.
Now you don't need to boot in safemode if something went wrong.
REGEDIT4
[HKEY_LOCAL_MACHINE\SYSTEM\Setup]
"SetupType"=dword:00000002
"CmdLine"=""C:\Total Commander\TOTALCMD.EXE"
Deny the user 'system' writeaccess(Set value) on HKEY_LOCAL_MACHINE\SYSTEM\Setup
or the system change SetupType value after each logon. Don't use explorer.exe
as CmdLine that might cause problems.
Reseting the Activation Trial:
------------------------------
Simply execute 'rundll32.exe syssetup,SetupOobeBnk'.
That is some kind of offical way to rest the Activation Trial.
Take Care it will work only work for about 4 times.
A 'total reset' is not very userfriend and described in detail in the board.
Just to draw the picture you will need to export HKLM\System to a
tmp reg-hive file. Import that reg-hive(or structure) file to delete
HKLM\System\WPA and the Rest
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion "LicenseInfo"=""
HKLM\SECURITY\Policy\Secrets\L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}
system32\WPA.DBL
shutdown window and copy/overwite the reg-hivefile to system32\config\system
from an other OS or the Windows-CD recovery console.
AntiWPA.dll was done by
______ ________ ______ __ __ _______ ____ _______
| | | | |__ | |/ | | | || | |_ _|
| ---| | | | __| < & | || |_ | |
|______|________|______|__|\__| |___|___||_______||___|
http:\\AntiWPA3.tk
[email protected]
---------------------------------------------------------------
History:
3.4.2 Bugfix: Relocating the Dll failed - set writeflag to .text-section to fix
3.4 Now it uses import hooks (instead of export ones): Disam part is not need anymore - Dll size reduced
3.3 Install/Uninstall routine for OOBE-Fix and remove activate-links added to AntiWPA.dll
3.2 Internal version (Not released)
3.1 Install/Uninstall routine via regsvr32 added to AntiWPA.dll
Version info added to AntiWPA.dll
3.0 BETA initial Release
Visit http://www.kammerl.de/ascii/AsciiSignature.php ASCII Text Signature Generator.