Need help disabling WFP in SP2

Bunchofstuff · 07-18-2005, 02:54 AM

Ok, im trying to disable the windows file protection in windows xp home sp2 , i know you have to open up the SFC_OS.DLL file and modify it with a hex editor, but i need to know what to change, i found some stuff on it by searching google but i think its for sp1 or professional only.....also i found a sfc_os.dll that somebody already hacked so i tried to replace the non-hacked one with the hacked on and the windows file protection replaces it with a non-hacked one ( yes i switched it out in the dll-cache too)

im trying to just make it where i can edit explorer.exe with resouce hacker, theres another way of doing it where you go here %systemroot%\system32\Restore and edit the xml file to include explorer.exe but i can't get that to work etheir on my computer, but i got it to work on another one that has windows xp home edition no service packs

thanks for the help....

kof2000 · 07-18-2005, 12:40 PM

Disabling Windows File Protection

You may disable WFP by setting the value SFCDisable (REG_DWORD) in HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows NT\ CurrentVersion\ Winlogon. By default, SFCDisable is set to 0, which means WFP is active. Setting SFCDisable to 1 will disable WFP. Setting SFCDisable to 2 will disable WFP for the next system restart only (without a prompt to re-enable).

Important: You must have a kernel debugger attached to the system via null modem cable (for example:I386kd.exe or Windbg.exe) to use SFCDisable = 1 or SFCDisable = 2.

After WFP is disabled using the SFCDisable = 1 setting, the following message will appear after logon:

Warning! Windows File Protection is not active on this system. Would you like to enable Windows File Protection now? This will enable Windows File Protection until the next system restart. <Yes> <No>.

Clicking Yes will reactivate WFP until the next system restart. This message will appear at every successful logon until SFCDisable is set to 0.

NOTE: The above message will only be presented to Administrators.

Bunchofstuff · 07-18-2005, 09:15 PM

Ok , thanks, i finally figured it out, with SP2 i guess you have to boot into safe mode to switch out the explorer.exe files instead of doing the control+shift+Esc method

07-18-2005, 02:54 AM	#1 (permalink)
Bunchofstuff banned Join Date: Dec 2004 Location: USA , Georgia Age: 19 Posts: 491	Need help disabling WFP in SP2 Ok, im trying to disable the windows file protection in windows xp home sp2 , i know you have to open up the SFC_OS.DLL file and modify it with a hex editor, but i need to know what to change, i found some stuff on it by searching google but i think its for sp1 or professional only.....also i found a sfc_os.dll that somebody already hacked so i tried to replace the non-hacked one with the hacked on and the windows file protection replaces it with a non-hacked one ( yes i switched it out in the dll-cache too) im trying to just make it where i can edit explorer.exe with resouce hacker, theres another way of doing it where you go here %systemroot%\system32\Restore and edit the xml file to include explorer.exe but i can't get that to work etheir on my computer, but i got it to work on another one that has windows xp home edition no service packs thanks for the help....

07-18-2005, 12:40 PM	#2 (permalink)
kof2000 Diamond Member Join Date: Aug 2004 Location: Oahu Age: 27 Posts: 6,273	Disabling Windows File Protection You may disable WFP by setting the value SFCDisable (REG_DWORD) in HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows NT\ CurrentVersion\ Winlogon. By default, SFCDisable is set to 0, which means WFP is active. Setting SFCDisable to 1 will disable WFP. Setting SFCDisable to 2 will disable WFP for the next system restart only (without a prompt to re-enable). Important: You must have a kernel debugger attached to the system via null modem cable (for example:I386kd.exe or Windbg.exe) to use SFCDisable = 1 or SFCDisable = 2. After WFP is disabled using the SFCDisable = 1 setting, the following message will appear after logon: Warning! Windows File Protection is not active on this system. Would you like to enable Windows File Protection now? This will enable Windows File Protection until the next system restart. <Yes> <No>. Clicking Yes will reactivate WFP until the next system restart. This message will appear at every successful logon until SFCDisable is set to 0. NOTE: The above message will only be presented to Administrators. __________________ QX9650@4.2 swiftech \|9600@3.0 9700 nt 780i \| 790fx 8gb ddr1200 \| 8gb ddr1200 2x150gb 3x1tb \|2x250gb 3x8800gtx \|3x2900xt 1gb 2x20xdvdrw \|2x20xdvdrw 15in1 card reader \|15in1 card reader ng15/g9 \|ng15/g9 1200w psu \|1200w psu 2x28" LCD \|2x28" LCD

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

07-18-2005, 09:15 PM	#3 (permalink)
Bunchofstuff banned Join Date: Dec 2004 Location: USA , Georgia Age: 19 Posts: 491	Ok , thanks, i finally figured it out, with SP2 i guess you have to boot into safe mode to switch out the explorer.exe files instead of doing the control+shift+Esc method