Welcome to Windows XP Service Pack 4

[harkaz]

Windows XP SP4 Unofficial Final Version 3.1b is now available!

Windows XP Unofficial SP4 Download Locations:

• Google Drive: https://drive.google.com/drive/folders/ ... sp=sharing

(ATTENTION: Only the XPSP4 folder comes from me, not the top directory).

• Internet Archive (Official): https://archive.org/details/xp-unoffici ... 2_20220113

• OLD Torrent [MAGNET]:

  Code: Select all

  magnet:?xt=urn:btih:8E6110BEA5612725BB4567A7EA14819C3A526DFC&dn=Windows%20XP%20Unofficial%20SP4%20Final&tr=udp%3a%2f%2ftracker.leechers-paradise.org%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.kicks-ass.net%3a80%2fannounce&tr=udp%3a%2f%2ftracker.mg64.net%3a2710%2fannounce&tr=udp%3a%2f%2ftracker.mg64.net%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.openbittorrent.com%3a80%2fannounce&tr=udp%3a%2f%2ftracker.openbittorrent.com%3a80%2fannounce&tr=udp%3a%2f%2ftracker.opentrackr.org%3a1337%2fannounce

  Note: The MUI ISO in this torrent is outdated. Use the latest torrent from Internet Archive.

Verification information and description:

• 1. WindowsXP-USP4-v3.1b-x86-ENU.exe
  Description: Windows XP SP4 Installer with POSReady Update support
  Includes March 2016 Windows Update registry fix.
  Version: 3.1b
  MD5: 7D2DB4F4C47355BB8C006DEF7A8AB563
  SHA1: 2C868FEEE1C078B1CBB7E9A8B4D035ED936B6BEA
  OS Date/Time Stamp: 8 March 2016 23:00:00 UTC
  Size: 993 MB (1040964815 bytes)
  
  2. WindowsXP-USP4-v3.1b-NODOTNET-x86-ENU
  Description: Windows XP SP4 Installer WITHOUT .NET Framework installation.
  POSReady Update support.
  Includes March 2016 Windows Update registry fix.
  Version: 3.1b
  MD5: fead3d46ceeb3b06d193f63ff3cb874a
  SHA1: 666e8f2720b447dafbb08cecc3381487c36a9b71
  OS Date/Time Stamp: 8 March 2016 23:00:00 UTC
  Size: 992 MB (1040862421 bytes)
  
  3. PATCHES-V3.1a.ZIP
  Description: Windows XP SP4 Patches
  Version: 3.1a
  MD5: DC525005FB33A2EB0FA3130F6B83DFA4
  SHA1: 8447159AACD6D45D3E9C54B30B5C46BFD9B77139
  Date/Time Stamp: 27 January 2016 15:00:00 UTC
  Size: 79.7 MB (83624817 bytes)
  
  Tools to create 6 Bootable Floppy Disks for older systems:
  
  4. WindowsXP-USP4-v3.1-Floppy-ic.exe
  Description: Windows XP Home Edition SP4 Floppy Disk Utility
  Version: 3.1
  MD5: F11756F6E50784050D0B9E1464F4B851
  SHA1: 3CD956D79D92C19358242479F1FD458C34DB132A
  Date/Time Stamp: 25 January 2016 15:00:00 UTC
  Size: 4.46 MB (4679426 bytes)
  
  5. WindowsXP-USP4-v3.1-Floppy-ip.exe
  Description: Windows XP Professional SP4 Floppy Disk Utility
  Version: 3.1
  MD5: EC486E7317B6D7FA62246703AC9BD0E4
  SHA1: 07FB0E312931E413553A50FFE896F02CDEEBC800
  Date/Time Stamp: 25 January 2016 15:00:00 UTC
  Size: 4.46 MB (4678992 bytes)
  
  6. PRODUKEYMODIFIER-V3.1.ZIP
  Description: Windows XP Product Key Update Tool
  Version: 3.1
  MD5: 4BAA040957CCE7C89B180BE00B2D8CE2
  SHA1: 12466D53C653B56CF7B69FE6ACB859B3D25DB4E4
  Date/Time Stamp: 25 January 2016 15:00:00 UTC
  Size: 1.05 MB (1102383 bytes)

WARNING! This RyanVM.net thread is the most trusted download location for Windows XP Unofficial SP4. Although some other sites can be trusted, users download at their own risk. Generally avoid other untrusted download locations!

DISCLAIMER: The author shall not be held responsible for any damage caused to your system. It is strongly recommended that you test this update before deployment!

Please contact me at har.kaz94@gmail.com. You can also post you comments below.

UPDATE [June 7, 2019]: Post-SP4 Update Pack released!
[2019 Christmas Special]: Post-SP4 Update Rollup released!

This final update pack should be applied to Windows XP installation media immediately after slipstreaming SP4 v3.1b to a Windows XP RTM/SP1/SP2/SP3 source. This will update installation media to May 2019, including every single update released until the POSReady 2009 end-of-life in May 2019. The update rollup can be installed on a live system with SP4 v3.1b, more info available here: viewtopic.php?p=157225#p157225

To integrate this update pack:

1. Download PostSP4-May19-UpdatePack-harkaz-070619-v2.zip from the Post-SP4 Update Pack Cloud folder, link: https://drive.google.com/file/d/17870mk ... sp=sharing
(Version 2 was released in January 2022 and fixes a bug with ntoskrnl.exe).
SHA-1: 818CE8D08E3F19BFF06CDA49A21FC0EC09B399AF
SHA-256: 6864C77EEDAD59D9F19F37239E60EA781B8898FE1139DAF72F3553738F69F7AB
2. Extract zip contents
3. Double click slipstream.bat and follow on-screen instructions (you need to provide the path to the directory containing both CMPNENTS and I386 folders).
4. If you want .NET Framework 3.5 not to be installed by default, after completing steps 1-3: copy and overwrite the netfx35.in_ file in the I386 folder of Windows XP installation media from the PostSP4-May19-UpdatePack-harkaz-070619-NETFX35-OFF.zip file in the Post-SP4 Update Pack Cloud folder (download link: https://drive.google.com/open?id=1qqx7s ... Yw_YVD9v7c ), OR the istart\netfx35.in_ from the same zip archive only if you are slipstreaming to Windows XP Starter installation source.

Windows XP SP4 Final Update Pack Debugging Symbols Update (original files from Microsoft Symbols Server):
(Also available from the 'Debugging Symbols Update' Cloud folder)

https://drive.google.com/open?id=1T_4BD ... Z-3RNo5U69

UPDATE - 15 OCT 2018:
For novice users that do not want to wait for 20-30 minutes after installing XP SP4 AND rebooting
For all .NET haters...

A NEW RELEASE OF UNOFFICIAL SP4 3.1B WITHOUT .NET FRAMEWORK

This release will not install .NET Framework in both live and slipstreamed install, unless:
- Media Center Edition is used -> .NET Framework 1.1 SP1 is installed
- Tablet PC Edition is used -> .NET Framework 1.0 SP3 is installed
Users can still install .NET FWs of their choice from the Add/Remove Components wizard in Control Panel
This alternative SP4 release is called:
WindowsXP-USP4-v3.1b-NODOTNET-x86-ENU.exe

In addition, XP SP4 OEM Preinstallation Kit ISOs with SCSI drivers, and an updated MUI ISO have been released!
More information can be found at the side notes below.

Removing the POSReady registry hack with XP SP4 OPK:
You should remove the POSReady registry hack, that allows for XP SP4 to receive updates for POSReady 2009, when:
1. You no longer want to receive POSReady updates (e.g. non-SSE2 systems that have been silently dropped by Microsoft since August 2018)
2. You have uninstalled SP4 from your system.
3. You want to use the Product Key modification tool found below - you can reapply the POSReady hack afterwards
4. You want to activate Windows by phone (Internet activation is no longer available) - you can reapply the POSReady hack afterwards.
To achieve this, you have to boot your computer from this ISO: https://drive.google.com/open?id=1xTvx6 ... WUdim2Kszu and follow the instructions at this video: https://drive.google.com/open?id=1aunn2 ... Y2TJsEtrGd

March 2016: SP4 v3.1b Release Notes

IMPORTANT NOTICE: All SP4 users running SP4 v3.1a or earlier must delete this registry key to receive the latest WU updates:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WindowsEmbedded
The sp4_march16_wufix.zip file in Google Drive contains a reg file that will automate the task. Double-click on the reg file, click Yes on the popup message and you're done! Just make sure you have administrative privileges! No further action is needed. SP4 v3.1b is intended only for new installations and removes just this key.

SP4 v3.1b is the final build I intend to release. Thank you all for your support and assistance all these years.

Windows XP official support has ended. Many users - including me - who won't be able to upgrade their old machines to a newer OS would like to easily install all Windows updates in one convenient package. For this reason I started working on a Service Pack 4 package in September 2013.

Windows XP Unofficial SP4 ENU is a cumulative update rollup for Windows XP (x86) English. It can be applied to a live Windows XP system which has SP1, at minimum, installed or it can be slipstreamed (integrated) in any Windows XP installation media.

It includes updates for most Windows XP components, including MCE and Tablet PC. Request-only hotfixes have been included. Currently, Microsoft .NET Frameworks 4.0, 3.5, 1.1 and 1.0 (Tablet PC only) are included in the Windows XP SP4 package. In addition, all post-eol updates for .NET Framework 1.1, 3.5 and 4.0 until January 2016 have been included. The .NET 1.x, 3.5 versions are automatically installed/updated in live installations. Only Microsoft .NET Framework 3.5 is enabled by default in integrated installation. Microsoft .NET Framework 1.1 will be always installed if Media Center Edition is present.

If you download the WindowsXP-USP4-v3.1b-x86-ENU.exe you can also scan Windows Update for POSReady updates, because the POSReady trick has been included.

Windows XP SP4 security enhancements: Windows XP SP4 includes registry updates to enhance security. I want to thank Stefan Kanthak, a security expert who has kindly given me the necessary information. These security enhancements address issues not fixed by Microsoft updates.
This is an example of security vulnerabilities fixed by Stefan's registry updates: http://seclists.org/fulldisclosure/2013/Oct/151

Windows XP SP4 Documentation

The Documentation Cloud folder contains all Windows XP SP4 documentation files.

• - Windows XP SP4 Deployment Guide [folder]: A series of 6 WMV videos discussing some special SP4 installation scenarios.
  - Windows XP SP4 Components Reference: A PDF file containing every update and component included in Windows XP SP4.
  - You can also find HTML copies of the SP4 Release Notes, SP4 Live Installation Instructions and SP4 CD-ROM Installation Instructions. These files are also included in the SP4 installer.
  
  - What has changed in Version 3.1b (current): http://www.ryanvm.net/forum/viewtopic.p ... 144#141144
  - What has changed in Version 3.1a (replaced by 3.1b): http://www.ryanvm.net/forum/viewtopic.p ... 710#140710
  - What has changed in Version 3.0 (replaced by 3.1a): http://www.ryanvm.net/forum/viewtopic.p ... 574#140574
  - What has changed in Version 2.0 (legacy): http://www.ryanvm.net/forum/viewtopic.p ... 710#138710
  - Security Enhancements by GH0st: http://www.ryanvm.net/forum/viewtopic.p ... 610#138610
  - SP4 Optional Components explained by Maxtorix: http://www.ryanvm.net/forum/viewtopic.p ... 282#141282
  - Alternative 4GB Patch (128 GB RAM limit, December 2019): https://icedrive.net/0/75j2Iu6YDC from http://retrosystemsrevival.blogspot.com ... patch.html
  - How to create 2 650MB CD-ROMs with SP4 slipstreamed for installation on older systems: http://www.ryanvm.net/forum/viewtopic.p ... 033#141033
  - Compare USP4 to Onepiece's post-SP3 Update Pack (OPWXPUP): http://www.ryanvm.net/forum/viewtopic.p ... 327#137327
  
  - Legacy (v2) version information: http://www.ryanvm.net/forum/viewtopic.p ... 573#140573

NOTE: Before installing SP4 on a system with many post-SP3 updates installed, follow the steps described here (do not restart your PC after applying these steps, just run the SP4 installer and then reboot):

http://www.rarst.net/software/failed-in ... log-files/

This will prevent a common error message: "Failed to install catalog files".
Although the SP4 installer takes steps to automatically delete these files, it may require manual intervention in some cases.

ALL SP3 installer-related Knowledge Base Articles apply to SP4 as well.

SIDE NOTES:

1. Windows XP Unofficial SP4 can be used in English only. Howewer, it is possible to translate to other languages using MUI packs.
SP4 v3.1b MUI, updated October 2018: viewtopic.php?f=5&t=10321&p=145117#p145117
Legacy info (no longer available for download): http://www.ryanvm.net/forum/viewtopic.p ... 755#140755

2. At first reboot after SP4 is installed on a 'live' system, setup will run several .NET-related tasks in the background. This will make your computer temporarily slower and you may unable to install/remove software during that time. It is thus recommended you wait until all pending processes have been completed. This willl take about 20-30 minutes and you can roughly tell by the CPU usage in the Task manager. The on-screen keyboard will not work in TABLET PC EDITION after first reboot. This is normal; it will reappear at next reboot.

3. MS may release new updates for .NET Framework according to http://blogs.msdn.com/b/windows-embedde ... ducts.aspx
Windows XP SP4 v3.1 by default SHOWS .NET Framework 2.0 and 3.0 updates from the Control Panel.
To HIDE these updates run this reg file: https://drive.google.com/open?id=0B7k-l ... Tg2TzJVeTA

4. If you're using .NET Framework 4.0 make sure you run:
%systemroot%\Microsoft.NET\Framework\v4.0.30319\ngen.exe executequeueditems
every time you install a new update or application for .NET Framework. This will boost system's performance and ensure reliability.

IMPORTANT: There is an issue with post-sp4 .NET FW 4.0 updates I would like to report, which is not caused by the SP4 itself. (Also applies to legacy v2 of Unofficial SP4).

Scenario: Install SP4 -> Enable .NET Framework 4.0-> Run Windows Update Manual Check. -> Install Updates -> reboot -> Installed all updates successfully -> Run Windows Update Manual Check.

You will get the .NET Framework 4 GDR update (KB2468871) in the optional updates.
Reason: This happens because one of the newest updates deletes the:
HKLM, "SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 4 Client Profile\KB2468871" and
HKLM, "SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 4 Extended Profile\KB2468871"registry keys.

These keys are necessary to satisfy the WU detection algorithm for the XP product family (not the POSReady one), but they play no other significant role whatsoever; this is actually a flaw in WU detection algorithm.

SOLUTION: You can let Windows Update download and install the update automatically (it should not be removed afterwards).

5. Apply the patches in patches-v3.1a.zip selectively: The files inside the OC-PATCHES subfolders will change the default installation state of each respective component in slipstreamed install. The files in 4GB_PATCH directory will add support for 4GB+ RAM. You just need to copy-paste the files in a SP4v3-slipstremed installation disk and reinstall Windows.
YOU WILL LOSE THE 4GB+ PATCH IF A FUTURE HAL/KERNEL UPDATE GETS INSTALLED ON YOUR SYSTEM.

To enable .NET Framework 4.0 and other components automatically at Runonce follow Kurt_Aust's instructions here: http://www.ryanvm.net/forum/viewtopic.p ... 756#140756

6. Windows XP SP4 Source Files: These files have been used to build Windows XP SP4 Final (legacy version). They are provided to You under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License. Download available at the Unofficial SP4 Source Files Cloud Folder.
MD5: 50FF5BB78E7F93C2E219974F382D7EF2

7. Windows XP Debugging Symbols: For the convenience of any developer who would like to test software on Windows XP SP4 or improve the functionality of Windows, I provide a complete list of debugging symbols available for Windows XP SP4 at the Windows XP Debugging Symbols Cloud Folder. Remember that Windows XP SP4 is a retail, not checked build - and cannot be applied to checked builds of Windows XP. (For more information about checked builds visit: https://docs.microsoft.com/en-us/window ... ifferences). There are 2 files inside that folder:

- symbolsXPUSP4-v3.1_i386_release.7z: Contains all updated symbol files for Windows XP Unofficial SP4 version 3.1b. Symbols files downloaded from Microsoft Symbol Server. Some updated files do not have matching symbols. For these files, you can refer to the original SP3 and MCE 2005 update 2 ones, available for download from the same folder. 7z file content was created using the symchk.exe tool from the Windows 10 Debugging tools kit.
SHA1: 3f374947827c5fa46d4bfe7d2abf58bf042b1130
- mui_winxp_mce_2005_update2_symbols.iso: Contains Media Center 2005 Update 2 Debug symbols. Original ISO from MSDN.
SHA1: 6389aa7334ff226aaba6ff11889b2d7fe01e3db1

Download the SP3 Retail Debug Symbols from here: https://web.archive.org/web/20160730104 ... ll-ENU.exe
- WindowsXP-KB936929-SP3-x86-symbols-full-ENU.exe: Contains all Windows XP SP3 Build 5512 Retail debug symbols.
SHA1: 1ca88aa576ccec46f4a561117059ced2f87920dc

8. Windows XP OEM Preinstallation Kit: viewtopic.php?p=145116#p145116

Note: This thread contains some offtopic posts about the SARS-CoV-2 pandemic (2020, 2021, 2022). A few select posts that may be worth reading: "The Ventavia scandal: Can we trust the clinical trial data?" (viewtopic.php?p=158390#p158390) and 'A predictive model for Operation "Freedom" ' (viewtopic.php?p=158364#p158364). (Offtopic discussion continues in a second thread, which is apparently not present in Google Search results: viewtopic.php?p=158510)

[ELiTE]

Two thumbs up. EXCELLENT idea. Not my thing, contribution wise, but BEST OF LUCK with your project...........

[harkaz]

Thanks for you support. I am organising the SP3 files and preparing to update them later. I have decided to remove MSN Messenger completely, because it's no more functional.

I will also replace MSN Explorer with its latest free release. The current version is 13.562.5 Build 560 (source:Wikipedia) but I have only found MSN Explorer 10 as a free download. Is this the latest free MSN Explorer version available?

[ricktendo64]

Ask OnePiece or user_hidden, they may have the complete set of post sp3 updates for XP (with no superseded updates)

[harkaz]

Thanks for the tip. I'll send them a PM later. Right now, I'm working on Windows Messenger removal. It's hard work after all. I have just finished modifying the update.inf and will proceed with the other setup files.

[Kelsenellenelvian]

I have a "fixed" copy of sfxcab.exe.

Are you interested?

It is what was used to build the usp5 for win2k.

[harkaz]

Yes, why not? It may be useful...

[harkaz]

I have a problem with editing syssetup.inf file. It seems that the file is digitally signed. How do I patch the syssetup.dll file to bypass this check?

Update: I tried copying the syssetup.dl_ from an Nlite'd disk, but it failed.
I can't find a patched syssetup.dll anywhere, msfn.org seems to be down at the moment and all other links are dead.

[5eraph]

Have you tried Zacam's patch addon, PatchAddon_SYSSETUP_InfSkip_v14.7z? Apply it to a Windows source, then pull the file from the source once patched.

[harkaz]

Thanks for the link. I tried with nLite under Windows 7 (XP SP3 compatibility mode) but it failed to patch the file. I will retry on a real XP SP3 machine and update this post.

UPDATE: Nothing happens. syssetup.dll is still the original
I'm using this addon:

INF Unlock Only: PatchAddon_SYSSETUP_InfSkip_v14.7z
SHA1: 99522BBBEA3C529170A2FE059ACC394793BB380C

[5eraph]

It must be used with the RyanVM Integrator:

Requires Integrator 1.3.0 or higher Service Pack 2 or 3.

[harkaz]

I used RyanVMi for the patch. But now Windows XP Setup shows messages about installing unsigned drivers. Is there something wrong I'm doing? Is there a way to avoid this?

I also had this problem with a manual patch I did.

UPDATE: This does not happen with the original syssetup.inf file.
The only modification I've made is to comment out the

msmsgs.cat file

in [ProductCatalogsToInstall] section.

[ELiTE]

Not a pro but you could possibly run an ignoreprompt.cmd in your install package:

Code: Select all

Thank you for visiting Microsoft answers.

To turn OFF the Digital signature do these steps:-

1. Open the Command Prompt window by clicking the Start button, clicking All Programs, clicking Accessories, and then Right clicking Command Prompt and select 
     "Run as Administrator".

2. On the Command Prompt type in the command “Bcdedit.exe /set nointegritychecks ON” without the quotes.

This will disable the Digital Signature.

http://answers.microsoft.com/en-us/windows/forum/windows_7-windows_programs/how-to-i-turn-off-digital-signature/a7047647-bf29-468f-a885-8e23d60f3daa

I know, Go AWAY ELiTE..............

[5eraph]

Try the following code in your WINNT.SIF file, harkaz:

Code: Select all

[Unattended]
DriverSigningPolicy=Ignore
NonDriverSigningPolicy=Ignore

[Kelsenellenelvian]

I used RyanVMi for the patch. But now Windows XP Setup shows messages about installing unsigned drivers. Is there something wrong I'm doing? Is there a way to avoid this?

I also had this problem with a manual patch I did.

UPDATE: This does not happen with the original syssetup.inf file.
The only modification I've made is to comment out the

msmsgs.cat file

in [ProductCatalogsToInstall] section.

This is the reason I gave up on making a new usp5

[harkaz]

Elite's solution is intended for Windows 7 but not for XP.
Creating WINNT.SIF and adding these lines is not a solution for a service pack, because it has to be as generic as possible.

@Kelsenellenelvian: It seems I have 3 options here:

1. Find a different patch for syssetup.dll, if possible.
2. Don't modify syssetup.inf at all, but this may impose limitations in creating the service pack.
3. Abandon the project, as you did.

I will start with number 1 to see if I can do something. A kernel debugger may be useful. Have you tried this before?

[harkaz]

The pSetupVerifyFile in setupapi.dll is responsible for this check. I will start working on it. I search Setup API SDK, but it's not documented there... My goal right now is to understand how pSetupVerifyFile works and change its parameters, not to prevent calling it.

A quick look with MASM: Can somebody help me understanding the Assembly language?

Code: Select all

1. The "hot spot" in SYSSETUP.DLL:

6974F086                    loc_6974F086:               ; Xref 6974F063
6974F086 56                     push    esi
6974F087 57                     push    edi
6974F088 33F6                   xor     esi,esi
6974F08A 56                     push    esi
6974F08B 56                     push    esi
6974F08C 56                     push    esi
6974F08D 56                     push    esi
6974F08E 56                     push    esi
6974F08F 56                     push    esi
6974F090 8D85F4FDFFFF           lea     eax,[ebp-20Ch]
6974F096 50                     push    eax
6974F097 50                     push    eax
6974F098 E871310200             call    jmp_pSetupGetFileTitle
6974F09D 50                     push    eax
6974F09E 56                     push    esi
6974F09F 56                     push    esi
6974F0A0 56                     push    esi
6974F0A1 56                     push    esi
6974F0A2 E85B310200             call    jmp_pSetupVerifyFile
6974F0A7 8BF8                   mov     edi,eax
6974F0A9 3BFE                   cmp     edi,esi
6974F0AB 7421                   jz      loc_6974F0CE
6974F0AD 57                     push    edi
6974F0AE 68608A7169             push    offset off_69718A60	; 'Setup: MyLoadLibraryWithSignatureCheck failed pSetupVerifyFile, le = %x',00Ah,000h
6974F0B3 56                     push    esi
6974F0B4 6A58                   push    58h
6974F0B6 68F88A7169             push    offset off_69718AF8	; 'd:\xpsp\base\ntsetup\syssetup\misc.c',000h
6974F0BB E8158CFFFF             call    pSetupDebugPrint
6974F0C0 83C414                 add     esp,14h
6974F0C3 57                     push    edi
6974F0C4 FF153C137169           call    dword ptr [SetLastError]
6974F0CA 33C0                   xor     eax,eax
6974F0CC EB0D                   jmp     loc_6974F0DB



2. The Setuapi.dll pSetupVerifyFile:


779743A9                    pSetupVerifyFile:
779743A9 8BFF                   mov     edi,edi
779743AB 55                     push    ebp
779743AC 8BEC                   mov     ebp,esp
779743AE 8B452C                 mov     eax,[ebp+2Ch]
779743B1 33C9                   xor     ecx,ecx
779743B3 3BC1                   cmp     eax,ecx
779743B5 7410                   jz      loc_779743C7
779743B7 83381C                 cmp     dword ptr [eax],1Ch
779743BA 7506                   jnz     loc_779743C2
779743BC F6401201               test    byte ptr [eax+12h],1
779743C0 7505                   jnz     loc_779743C7
779743C2                    loc_779743C2:               ; Xref 779743BA
779743C2 6A57                   push    57h
779743C4 58                     pop     eax
779743C5 EB2D                   jmp     loc_779743F4

779743C7                    loc_779743C7:               ; Xref 779743B5 779743C0
779743C7 51                     push    ecx
779743C8 51                     push    ecx
779743C9 FF7534                 push    dword ptr [ebp+34h]
779743CC FF7530                 push    dword ptr [ebp+30h]
779743CF 6A02                   push    2
779743D1 50                     push    eax
779743D2 FF7528                 push    dword ptr [ebp+28h]
779743D5 FF7524                 push    dword ptr [ebp+24h]
779743D8 FF7520                 push    dword ptr [ebp+20h]
779743DB FF751C                 push    dword ptr [ebp+1Ch]
779743DE FF7518                 push    dword ptr [ebp+18h]
779743E1 FF7514                 push    dword ptr [ebp+14h]
779743E4 FF7510                 push    dword ptr [ebp+10h]
779743E7 FF750C                 push    dword ptr [ebp+0Ch]
779743EA 51                     push    ecx
779743EB 51                     push    ecx
779743EC FF7508                 push    dword ptr [ebp+8]
779743EF E8F0F0FFFF             call    fn_779734E4
779743F4                    loc_779743F4:               ; Xref 779743C5
779743F4 5D                     pop     ebp
779743F5 C23000                 ret     30h

779743F8 9090909090             db      5 dup (090h)

UPDATE: It seems what needs to be patched is here:

Code: Select all

6974F0A2 E85B310200             call    jmp_pSetupVerifyFile
6974F0A7 8BF8                   mov     edi,eax
6974F0A9 3BFE                   cmp     edi,esi
6974F0AB 7421                   jz      loc_6974F0CE

The jz command prevents error messages from appearing when last result zero.
The cmp combined with jz has a special role:
http://stackoverflow.com/questions/9342 ... -after-cmp

So edi and esi are subtracted. If they're equal, the result is zero, so it jumps to next routine. If it doesn't jump, it calls pSetupDebugPrint and it prints the error:

06/07/2010 20:44:24.515,d:\xpsp\base\ntsetup\syssetup\misc.c,88,,Setup: MyLoadLibraryWithSignatureCheck failed pSetupVerifyFile, le = 800b0100

The error code is 0x800B0100. This seems to be what we're looking for because the error message setup throws is:

The signature for Windows XP Professional Setup is invalid. The error code is 800b0100.
No signature was present in the subject.

I''ve located the section in HEX editor: the cmp command is at offset 3E4A9.

I need your help to create a patch here.

[bphlpt]

It's been a looooong time since I've done assembly work, and I could be totally wrong, but it seems like it might be easiest to just change the jz to a jmp, ie always jump, not just if zero. Assuming that the non-zero result, if present, won't mess up the code located at "loc_6974F0CE". Unless I'm missing something?

Cheers and Regards

[harkaz]

I will try your suggestion bphlpt, this seems to be the solution. However, I have a practical problem: How do I get the hex code (machine code) after changing jz to jmp? This is essential to know in order to patch the syssetup.dll (I've already found the offset). Should I go trial and error?

UPDATE: I just patched it. I'm testing it right now. Will report back soon.

[bphlpt]

Of course if the file you patched is also digitally signed, then ... ? Good luck!

Cheers and Regards

[harkaz]

It failed The same error message appears...

Well.. Let's start from scratch...

I haven't used a kernel debugger so far... Probably I'll need to use SoftICE after all... For the moment, I'll work on the existing patch.

[harkaz]

OK guys, I started working on the original patch.

I have GOOD NEWS: I have vastly improved the original patch.

Now the ONLY problem I face is "UNSIGNED BATTERY".
I will try to fix this later.

Code: Select all

697446FE                    loc_697446FE:               ; Xref 697446B2
697446FE 39B5B8F5FFFF           cmp     [ebp-0A48h],esi
69744704 0F84E8000000           je      loc_697447F2
6974470A C785ACF5FFFF01000000   mov     dword ptr [ebp-0A54h],1
69744714 89B5B4F5FFFF           mov     [ebp-0A4Ch],esi
6974471A                    loc_6974471A:               ; Xref 6974477B
6974471A 8B85D0F5FFFF           mov     eax,[ebp-0A30h]
69744720 8B8DB4F5FFFF           mov     ecx,[ebp-0A4Ch]
69744726 3B4804                 cmp     ecx,[eax+4]     
; SOS this is the address of the original patch:
69744729 7375                   jnb     loc_697447A0
6974472B 56                     push    esi
6974472C 6804010000             push    104h
69744731 8D95DCF7FFFF           lea     edx,[ebp-824h]
69744737 52                     push    edx
69744738 51                     push    ecx
69744739 50                     push    eax
6974473A FF1578147169           call    dword ptr [SetupQueryInfFileInformationW]
69744740 85C0                   test    eax,eax
69744742 743B                   jz      loc_6974477F
69744744 56                     push    esi
69744745 56                     push    esi
69744746 56                     push    esi
69744747 56                     push    esi
69744748 FFB5CCF5FFFF           push    dword ptr [ebp-0A34h]
6974474E 8D85DCF7FFFF           lea     eax,[ebp-824h]
69744754 FFB5C0F5FFFF           push    dword ptr [ebp-0A40h]
6974475A 50                     push    eax
6974475B 50                     push    eax
6974475C E8ADDA0200             call    jmp_pSetupGetFileTitle
69744761 50                     push    eax
69744762 56                     push    esi
69744763 56                     push    esi
69744764 8D85F4FDFFFF           lea     eax,[ebp-20Ch]
6974476A 50                     push    eax
6974476B 56                     push    esi
6974476C E891DA0200             call    jmp_pSetupVerifyFile
69744771 FF85B4F5FFFF           inc     dword ptr [ebp-0A4Ch]
69744777 8BF8                   mov     edi,eax
69744779 3BFE                   cmp     edi,esi
6974477B 749D                   jz      loc_6974471A ;patched here with jmp - succeeded, only problem with battery catalogs!
6974477D EB21                   jmp     loc_697447A0

UPDATE: Additional flaw I discovered. Setuperr.log "noticed" my syssetup.dll patch:

Error: Setup detected that the system file named [C:\windows\system32\syssetup.dll] is not signed properly by Microsoft. This file could not be restored to the correct Microsoft version.
Use the SFC utility to verify the integrity of the file.

Needless to say that sfc /scannow shows no problem.
However, I discovered that the file is not present in dllcache and propably it's not protected by SFC!

Have you faced anything similar? For example, after modifying Setup billboard DLL?

[bphlpt]

Isn't this the same kind of error that OnePiece mentions here?

Integration side effects (not UpdatePack bugs):

• setuperr.log will point out harmless error messages about some IE files like imgutil.dll, inetcpl.cpl, inseng.dll, mshtml.dll, msrating.dll, pngfilt.dll, occache.dll, webcheck.dll (caused by the patched Syssetup.dll used for integration and then restored with the original one). If you don't tolerate it you can integrate in addition this Onepiece Repair IE8 cosmetic problems addon
  (Hash MD5 5C7AF8CA9F637C993F4AEEFFB63F39ED - Filesize: 1.28 Kb - updated 2008-03-27) which does nothing else than cleaning those false errors in your setuperr.log file. Please note that in some rare configurations the integration of this addon could cause issues, so we don't suggest to use it.

Cheers and Regards

[tomasz86]

SFC won't protect unsigned files.

[harkaz]

Thanks for the tip, bphlpt, I'll check this later.
tomasz86, I've noticed that syssetup.inf is also present in the Lastgood and Lastgood.tmp directory. Is this normal?

Currently working hard on the "Battery unsigned" problem.

I'm making progress: I have been able to reproduce the problem I faced with the original patch with the new one I applied yesterday. I'm confident I'll find the solution.

UPDATE: Having tried many different patches, I haven't yet intercepted the check for battery catalogs... Can someone help me debug it to find its region in EXE?

Note: This is the region which, if changed, causes all catalogs not to be recognised correctly. This seems to be independent of battery, however. It seems that battery is checked in a previous stage:

Code: Select all

697447F2                    loc_697447F2:               ; Xref 69744704
697447F2 8D85F4FDFFFF           lea     eax,[ebp-20Ch]
697447F8 50                     push    eax
;=========== HOT SPOT: Forcing this function to jump even if successful,
; reproduces the problem with the original syssetup.dll patch!===========
697447F9 E8ECD90200             call    jmp_pSetupVerifyCatalogFile ;verify catalog files
697447FE 8BF8                   mov     edi,eax
69744800 3BFE                   cmp     edi,esi
69744802 7520                   jnz     loc_69744824 ;IF NOT SUCCESSFUL jump near
; This line MUST NOT be changed; it reproduces the problem!
;=====
69744804 56                     push    esi
69744805 FFB5C8F5FFFF           push    dword ptr [ebp-0A38h]
6974480B 8D85F4FDFFFF           lea     eax,[ebp-20Ch]
69744811 50                     push    eax
69744812 E8DFD90200             call    jmp_pSetupInstallCatalog
69744817 8BF8                   mov     edi,eax
69744819 3BFE                   cmp     edi,esi
6974481B 7469                   jz      loc_69744886 ;Possible patch with jmp (EB).
;===============================
6974481D B819F60000             mov     eax,0F619h
69744822 EB05                   jmp     loc_69744829 ; it failed installing the catalogs, so it checks for driver signing policy.

[harkaz]

Making progress: With a second patch, I managed to completely remove Messenger (its catalog was manually removed by me in syssetup.inf file). So it seems that this patch is required for some changes in syssetup.inf to actually take effect, apart from a simple change in verification routines. Now, the final step is removing the "Battery unsigned issue".

[harkaz]

Fixed the "Battery unsigned" issue, will perfrom some additional checks before giving you the essential details.

[harkaz]

Patching syssetup.dll is now completed

The required steps to get rid of all syssetup.dll-related errors are presented below:

1. Grab the original XP SP3 syssetup.dll file.
2. Using a hex editor, like XVI32, open the dll file.
3. Go to address (offset) 33B7B.
4. Replace 74 with EB.
5. Save changes to syssetup.dll
6. Using modifype -c command or a similar tool fix the PE checksum.
7. To get rid of the "Battery unsigned" issue, you have to perform this additional step: Open the syssetup.inf with notepad. Go to the [DeviceInfsToInstall] section of the INF file. Delete or comment the line with the battery.inf file. Save changes.
8. Use the new syssetup.dll and syssetup.inf files instead of the original ones.

Known side-effects: Setuperr.log file reports that syssetup.dll is not properly signed. In addition, SFC does not protect syssetup.dll after installing Windows. However, SFC does not report any problems after Windows installation.

Waiting for your comments after testing the new patch.

UPDATE: Removed some redundant steps.

Time to return to my SP4 project

[harkaz]

NEW: After reverse engineering the Gurgelmeyer's USP5 update.exe I have patched the latest update.exe (package installer version 6.3.15.0 - found it in Onepiece's update pack). This will considerably improve service pack 4 installation/unistallation experience.

[Atari800xl]

Thanks harkaz, nice to read your "adventures" every day. I'm not an expert, but I hope I can build a Dutch SP4 when you're done with all your magic...
Yesterday, I saw xdot's page at http://xdot.tk/updates.html and that looked like a nice way to collect all the updates, but of course the files on his site are English only... I still tested them with nLite and Dutch XP, but of course (?) that didn't work... (Well, it kinda worked, but there were 2 errors).
So I hope you'll tell us how we can build the SP4 when the time's right, from your last posts, I'm sure you will succeed!

[5eraph]

The following file, when used with RVMi, will apply harkaz's SysSetup.DLL patch (steps 1-6).

Details:

• Intended for Windows XP x86 SP3
• Tested in VirtualBox 4.2.18.
• Integrates with RyanVM Integrator 1.3.0 or later only. nLite doesn't do custom patching via entries.ini files.

Download:

• Link: entries_SYSSETUP_harkaz.ini
  Size: 321 bytes
  MD5: e81dbe7290fe7bb044b2e74ec83767b3

[harkaz]

Thanks Atari800xl. I'm working on MSN Explorer 10.5 update now. I haven't tested the removed Messenger yet.

A great way to download all important updates from microsoft (no request-only hotfixes) in ALL languages, is WSUSOffline: http://download.wsusoffline.net/

I'll keep you updated with the latest changes in my project.

@5eraph: Have you tested the new patch? Is it working as it should?

[5eraph]

Tested and working as intended following steps 7 and 8 of your patching guide. Details added to my previous post.

[harkaz]

A new challenge: While installing the service pack (testing now) this error message appears:

Setup cannot copy the file syssetup.dll.

Let's see what's going on here...

UPDATE: I will also have to fix catalog installation failure.

Let's see if Gurgelmeyer has done sth on that...

... The error GetCatVersion: Failed to retrieve version information from.... .CAT is also present in Gurgelmeyer's USP5. Probably patching it is not needed...

UPDATE #2: The error message: "A component's fil soes not match the information peresent in the verification manifest" seems to be related with update.ver. . It is probably related with modified syssetup.inf verification.

Issue seems to have been fixed with a second patch I applied. Note that Gurgelmeyer's update.exe suffered from the same issue as well.

Messenger removed. The only thing I need to add for removal are the start menu messenger entries.

After that, I'll test slipstreaming to SP3 installation media.

Is there an automated way to keep the update.ver up-to-date?

[harkaz]

Some instructions to create a self extracting executable. (Example: The D:\SP4 fodler is used as a source for service pack 4 components)

Code: Select all

A. Extract the sfx from the KB942228 (for example) package for the desired language:

In the update package of the desired language, using a hex editor, search for MSCF string. (the third one). 
From that one MSCF string where the CABINET file which is integrated in the update package begins, delete from cursor 
(including that last MSCF string).

Save as D:\sp4.sfx.

This the self-extracting "header for EXE file.

B. Create the self-extracting cabinet

- Using CABARC (important, don't use makecab) run the command:

  cabarc -m LZX:21 -p -r N D:\sp4.cab D:\SP4\i386\*.*

- Mark the update.exe in the cabinet for auto-run.

The update.exe will be run each time you extract the cabinet. Any argument parsed to the sfx executable
will be parsed to the update.exe in the cabinet.

Using a hex editor, open the sp4.cab file you just created.
Search for "i386\update\update.exe" text (without the quotation marks).

Go to the hex editor section. In front of the hex numbers that translate to SP4\i386\update\update.exe there is
the number 20 00.

Change 20 to 60 and save changes.

- Append the sfx with sp4.cab file in a new self-extracting executable.

Run the command:

copy /b D:\sp4.sfx+D:\sp4.cab D:\WindowsXP-UnofficialSP4-ENU-x86.exe

(choose a suitable name for the EXE like the one above).

Optionally, add a manifest to require elevation each time the SP4 package is run.

[tomasz86]

@harkaz Good luck with the project but I think you're spending a lot of time on things which have already been done...

Same instructions as the ones above were already posted by WildBill 3 years ago here, and here you can also find my automated version.

As for Gurgelmeyer and USP5 - he didn't modify any signed system files so no additional patching was necessary (except for the installer).

[harkaz]

Thanks! This was the source of theseinstructions, and thank you for mentioning it! I posted it in this thread so that everything is one place.

Now, I have an additional problem with update.exe. No catalog file installs after SP4 installation completes. Similar problems arise when slipstreaming the SP4 to installation media.

I will try to create a new patch.

[X]

Seeing if this will subscribe me to the thread. Interested in this project. Have nothing else to say except good luck.

[harkaz]

Thanks! Right now, I'm trying to fix some issues related with modified syssetup.dll and syssetup.inf files: no catalog is installed during service pack installation.
If you know Assembly, I need your help here:

After some examination of the svcpack.log file (I tested various possible patches), I'm almost certain that the problem is related with the SetupDiCallClassInstaller function of the setupapi.dll library.

This function fails with error code: 0x800b0100 (No signature was present in the object).
However, no "unsigned driver" dialog is displayed.

Probably the SP_DEVINSTALL_PARAMS structure, which is passed to the SetupDiSetDeviceInstallParams function is the key to the solution. This function is normally called before the SetupDiCallClassInstaller and sets the device installation parameters.

Which flag of this function would cause such a behaviour? Luckily, the SP_DEVINSTALL_PARAMS structure is fully documented: http://msdn.microsoft.com/en-us/library ... s.85).aspx.
As we read there, the DI_QUIETINSTALL flag of the structure seems to do what we're looking for:

DI_QUIETINSTALL
Set if the device installer functions must be silent and use default choices wherever possible. Class installers and co-installers must not display any UI if this flag is set.

We search the update.exe disassembly for the SetupDiSetDeviceInstallParams function.

Found this:

Code: Select all

;====POSSIBLE PATCH REGION======================
0107A549                    loc_0107A549:               ; Xref 0107A536
0107A549 8D8D8CF8FFFF           lea     ecx,[ebp-774h]
0107A54F 51                     push    ecx
0107A550 8D8DECFBFFFF           lea     ecx,[ebp-414h]
0107A556 51                     push    ecx
0107A557 8D8D98F8FFFF           lea     ecx,[ebp-768h]
0107A55D 51                     push    ecx
0107A55E 6A00                   push    0
0107A560 6800030201             push    offset loc_01020300
0107A565 50                     push    eax
0107A566 C7858CF8FFFF04010000   mov     dword ptr [ebp-774h],104h
0107A570 FF1504100001           call    dword ptr [RegQueryValueExA]
0107A576 85C0                   test    eax,eax
0107A578 0F858B020000           jne     loc_0107A809
0107A57E 83BD98F8FFFF01         cmp     dword ptr [ebp-768h],1
0107A585 0F857E020000           jne     loc_0107A809
0107A58B 8D85ECFBFFFF           lea     eax,[ebp-414h]
0107A591 50                     push    eax
0107A592 57                     push    edi
0107A593 8D85F8FEFFFF           lea     eax,[ebp-108h]
0107A599 6803010000             push    103h
0107A59E 50                     push    eax
0107A59F E8C2D0FBFF             call    fn_01037666
0107A5A4 83C410                 add     esp,10h
0107A5A7 FFB5A8F8FFFF           push    dword ptr [ebp-758h]
0107A5AD FF1508100001           call    dword ptr [RegCloseKey]
0107A5B3 838DA8F8FFFFFF         or      dword ptr [ebp-758h],0FFFFFFFFh
0107A5BA 8D85C8FBFFFF           lea     eax,[ebp-438h]
0107A5C0 50                     push    eax
0107A5C1 56                     push    esi
0107A5C2 53                     push    ebx
0107A5C3 C785C8FBFFFF28010000   mov     dword ptr [ebp-438h],128h
0107A5CD FF156C900901           call    dword ptr [SetupDiGetDeviceInstallParamsA]
0107A5D3 85C0                   test    eax,eax
0107A5D5 0F84E5020000           je      loc_0107A8C0
0107A5DB 818DD0FBFFFF00080004   or      dword ptr [ebp-430h],4000800h
0107A5E5 8D85C8FBFFFF           lea     eax,[ebp-438h]
0107A5EB 50                     push    eax
0107A5EC 56                     push    esi
0107A5ED 53                     push    ebx
0107A5EE C785CCFBFFFF00008000   mov     dword ptr [ebp-434h],800000h
0107A5F8 FF1568900901           call    dword ptr [SetupDiSetDeviceInstallParamsA]
0107A5FE 85C0                   test    eax,eax
0107A600 7511                   jnz     loc_0107A613
0107A602 FF15C8110001           call    dword ptr [GetLastError]
0107A608 50                     push    eax
0107A609 68D4720201             push    offset off_010272D4	; 'SetupDiSetDeviceInstallParams() failed with error 0x%lx ',00Ah,000h
0107A60E E9E2000000             jmp     loc_0107A6F5
;==============================================

A search in setupapi.h (in Windows SDK) for the DI_QUIETINSTALL value gives us the hex value 0x00800000.

We can find the value at offset 0107A5EE above, just before the SetupDiSetDeviceInstallParams function is called. An amazing coincidence Probably the device installation flags are retrieved using the SetupDiGetDeviceInstallParamsA call at 0107A5CD and then the DI_QUIETINSTALL value is added to them to force a silent UI.

My goal is obvious here: I want to remove the additional flag.

I will try and test this very soon afterwards, but I would like to hear your suggestions.

[harkaz]

Changing the parameter to 0 changed absolutely nothing.

Probably it requires some debugging.
For the moment I'm working on the other errors I haven't checked.

The GetCatVersion failure is a characteristic example. This error is also present in Windows 2000 USP5 when applied on top of Windows 2000 RTM. I don't know if it will solve the problem however.

[harkaz]

It's very difficult to install all catalogs with a modified syssetup.dll on a live system.

I'm abandoning the idea of using a patched syssetup.dll for installation on a LIVE system.
After all, a modified syssetup.dll is required only for syssetup.inf modification to install catalogs during Windows XP Setup.

I'm working on that.

[harkaz]

I put back the original syssetup.inf and syssetup.dll files but it did not fix the problem!

That's very interesting...

[5eraph]

Are you getting any catalog files to install? Would it help to use a command line tool to install them, like SignTool?

[harkaz]

No catalogs are installed at all. I will test signtool. It seems that the issue is related with messenger removed INF files - the catalog nt5inf.cat fails.

[5eraph]

You can find the latest known version of SignTool in an addon of mine.

[harkaz]

When I manually tried to add some catalogs with signtool, it reported no problems.

I'm trying to find out why update.exe can't do that.

UPDATE: An interesting observation: After installing SP4, the partmgr.sys driver is the only one which is signed. On the other hand, disk.sys is unsigned. However, BOTH FILES are signed by sp3.cat, as signtool indicated!

MOST interesting....

UPDATE#2: After some testing, it seems that the GetCatVersion error is strongly related wkth the patch applied to skip update.inf verification,
The same error appears even when changing almost nothing in update.inf (existing catalogs remain installed however, thus avoiding further complications).

[harkaz]

After all, I have been able to install the SP4 on top of SP3 with all the catalogs installed. (The GetCatVersion error is still present). I have to use the original layout.inf, syssetup.dll and syssetup.inf files for installation on a live system.

Are ALL these files required for a sysprep installation - I know that layout.inf is required. Is there a patch to accept a modified layout.inf in GUI mode setup?

Another issue I detected: When I create a new user profile, it tries to configure Messenger, but it complains about msmsgs.inf not being present (I've deleted it in SP4, along with messenger). How do I update the registry to remove this?

[ricktendo64]

Another issue I detected: When I create a new user profile, it tries to configure Messenger, but it complains about msmsgs.inf not being present (I've deleted it in SP4, along with messenger). How do I update the registry to remove this?

You need to delete the reg in HKLM\Software\Microsoft\Active Setup (search for the INF) and delete the GUID

[harkaz]

Thanks ricktendo64 I will update the SP installer.

Guess what? Just added a modified syssetup.dll and syssetup.inf flawlessly It seems that layout.inf is the culprit. Let's see if we can fix this issue completely...

[harkaz]

I applied the setupapi.dll patch found here:
http://www.vorck.com/windows/edit-setupapi.html

(also replaced the ,_x, with ,, in layout.inf file)

but it didn't fix the update.exe issue.

I will keep this patch for CD-ROM installations and try to intercept the check.
Probably the signtool will be useful...