system file protection
byron
temporarily? i'm trying to replace an original system file
with a new one, a dll. i can't ever make the computer run
in dos mode so i can delete the orginal it is aggrivating
the hell outa me. if anyone knows a way to just take
complete control over the file system too, that would be
great...
thanks :o)
Torgeir Bakken (MVP)
Hi
Nope, not unless you connect a kernel debugger to the computer...
but by messing with the file in Dllcache (and removing reference to any online
ServicePack/OS folder paths), you might be able to overwrite the protected
file:
http://groups.google.com/groups?selm=O%23LvPHoBDHA.392%40TK2MSFTNGP12.phx.gbl
More about WFP:
Description of the Windows File Protection Feature
http://support.microsoft.com/default.aspx?scid=kb;EN-US;222473
Registry Settings for Windows File Protection
http://support.microsoft.com/default.aspx?scid=kb;EN-US;222473
Windows File Protection and Windows
http://www.microsoft.com/whdc/hwdev/driver/sfp/wfp.mspx
From: "Matthew Mucker [MSFT]" <mat...@online.microsoft.com>
Subject: Re: Making calls to Windows File Protection
Date: Fri, 18 Apr 2003 13:38:53 -0500
Message-ID: <eZNcEndB...@TK2MSFTNGP12.phx.gbl>
Newsgroups: microsoft.public.win2000.file_system
<quote>
You cannot interface with WFP.
You cannot disable WFP (short of connecting a kernel debugger to the
machine).
You cannot add your files to the list of protected files.
You cannot remove a file from the list of protected files.
WFP is completely and totally unconfigurable.
Only the hotfix installer and service pack installers can interface with
WFP, and the interfaces are so super secret that they haven't even told the
product support people how it works.
If your app requires that you overwrite a system protected file, you need to
change your programming practices. It's always been extremely poor
programming to overwrite operating system files. It caused so many problems
that the developers created WFP. There's a reason WFP won't let you
overwrite operating system files! Don't do it!
</quote>
--
torgeir
Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of the 1328 page
Scripting Guide: http://www.microsoft.com/technet/scriptcenter
byron
>
um.. no actually i'm trying to replace what appears to be
a corrupted opengl32.dll file...
you're saying that short of reinstalling windows there is
no way to do that? well... thanks for replying
R. C. White
While I won't argue with what Torgeir (and Matthew) said...
Files in \WinNT\system32\dllcache do not have the System or Read-only
attributes set. When I needed to revert to an earlier mshtml.dll file
recently, I simply found a copy of the older file and copied it to dllcache.
Then I copied it to \WinNT\system32. Thereafter, when WFP (and SFC)
compared the working copy to the cache file, it saw no problem and left it
alone. (A later hotfix brought me up to date with a new version of
mshtml.dll.)
I don't know if that would work for your problem file, but trying it should
be easier and quicker than reinstalling Windows. I'm running WinXP Pro, but
it should work the same way in Win2K.
RC
--
R. C. White, CPA
San Marcos, TX
r...@corridor.net
Microsoft Windows MVP
"byron" <bhi...@ferretlovers.com> wrote in message
news:02de01c3180e$2e832020$3301...@phx.gbl...
Carrie Garth (MVP)
First things first... What makes you think that opengl32.dll is corrupted? And if
it is indeed corrupted, did you run SFC /SCANNOW to let it replace it? And if yes,
what message, if any, was recorded about the file in eventvwr.msc > System Log >
Source: Windows File Protection?
MORE INFORMATION:
Quotes from the "Windows File Protection and Windows" document (...wfp.mspx) URL
provided by Torgeir:
"All SYS, DLL, EXE, and OCX files that ship on the Windows CD are protected".
"System File Checker will also check and repopulate the
%Systemroot%\system32\dllcache directory. If the dllcache directory becomes corrupted
or unusable, SFC /SCANNOW, SFC /SCANONCE, SFC /SCANBOOT, or SFC /PURGECACHE can be
used to repair the contents of the dllcache directory."
BTW, in regards to "mak[ing] the computer run in dos mode so [you] can delete the
orginal".
The procedure is to boot to the Recovery Console, and use the Expand command to
extract the file from the compressed file on the Windows 2000 CD. For example, if
your CDROM is D:\ and you want to copy opengl32.dl_ from the CDROM to
C:\WINNT\system32, you would boot to the Recovery Console and run this command:
EXPAND D:\i386\opengl32.dl_ C:\WINNT\system32\opengl32.dll
For more information about the Recovery Console, including the EXPAND command, see
the following:
Windows 2000 Help Topics after searching for: "Recovery Console"
229716 - Description of the Windows 2000 Recovery Console
http://support.microsoft.com/search/preview.aspx?scid=kb;en-us;229716
Note: if you have installed any Service Packs, you would need to extract the latest
version of opengl32.dl_ from the compressed service pack executable file, and then
use this as the source. For more information, see:
Microsoft Windows 2000 Readme for Service Pack 3 (ReadMeSP_htm)
Service Pack 3 Installation and Deployment Guide
SECTION: Command-Line Options for W2ksp3.exe Only
http://www.microsoft.com/windows2000/downloads/servicepacks/SP3/spdeploy.htm
--
Carrie Garth, Microsoft MVP for Windows 2000
-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- c x g
: "byron" <bhiller AT ferretlovers DOT com>
: Wrote in message news:02de01c3180e$2e832020$3301...@phx.gbl
: Sent: Sunday, May 11, 2003 05:39 PM
: um.. no actually i'm trying to replace what appears to be
: a corrupted opengl32.dll file...
: you're saying that short of reinstalling windows there is
: no way to do that? well... thanks for replying
: >"Torgeir Bakken (MVP)" <Torgeir.B...@hydro.com>
: >Wrote in message news:3EBEB917...@hydro.com
: >Sent: Sunday, May 11, 2003 03:56 PM
: >
: >Nope, not unless you connect a kernel debugger to the computer...
: >
: >but by messing with the file in Dllcache (and removing reference to any
: >online ServicePack/OS folder paths), you might be able to overwrite
: >the protected file:
http://groups.google.com/groups?selm=O%23LvPHoBDHA.392%40TK2MSFTNGP12.phx.gbl
: > <SNIP> http://support.microsoft.com/default.aspx?scid=kb;EN-US;222473
: > <SNIP> http://support.microsoft.com/default.aspx?scid=kb;EN-US;222473
: > <SNIP> http://www.microsoft.com/whdc/hwdev/driver/sfp/wfp.mspx
: >
: >From: "Matthew Mucker [MSFT]"
: > <SNIP> Message-ID: <eZNcEndB...@TK2MSFTNGP12.phx.gbl>
: > <SNIP>
: >> "byron" <bhiller AT ferretlovers DOT com>
: >> Wrote in message news:00a001c317fb$e803a910$a501...@phx.gbl
: >> Sent: Sunday, May 11, 2003 03:28 PM...
: >> is there any way to disable the system file protection
: >> temporarily? i'm trying to replace an original system file
: >> with a new one, a dll. i can't ever make the computer run
: >> in dos mode so i can delete the orginal it is aggrivating
: >> the hell outa me. if anyone knows a way to just take
: >> complete control over the file system too, that would be
: >> great... thanks :o)
byron
a new copy of the dll, all i had to do was start into safe
mode with command prompt and replace the file and then
when i restarted in normal mode the computer went ahead
and cached the new file...
if anyone else has ever tried to do this it can be
annoying but it seemed to be a pretty simple fix when i
got to trying some stuff, thanks for all your help.
>.
>