Vista x64 and driver signing.

[cyclone3d]

Well... I have been searching for a way to effectively get around the required river signing in Vista x64.

It looks like a tool in the WDK (Windows Driver Kit) is able to "test" sign drivers.

So basically you can sign a driver yourself without having MS put their "stamp of approval" on it.

I am downloading the DVD iso from MS as I type this.

One of the reasons for me doing this is to be able to use cracktcpip.sys in Vista x64 so I can up the number of half-open tcp connections ffrom 10 to 255.

Faster torrent, other p2p, faster loading of web pages, etc.

It was easy to do in XP and seems to be easy in Vista 32-bit, but is a pain in the rear in Vista x64.

[-=Antimatter=-]

You can hit F8 during boot and disable the required driver signing...however, you'll have to do it every time, unless you find a way to sign your drivers somehow.

It would be far less annoying if the thing didn't reset itself after hibernation, since I almost never shutdown.

[cyclone3d]

The F8 thing doesn't work in this situation. I've already tried it.

[l3ender]

I've always done F8. I don't see why that doesn't work...if it doesn't I don't see how you'd be able to get it working.

[cyclone3d]

F8 will NOT work with kernel mode drivers.

In any case the WDK has the same version number as the last RC build of Vista SP1
(6001.18000) which I thought was really interesting.

[cyclone3d]

O.k... so I got the driver signing utility to work.

You also have to enable the use of test signed drivers.. but it looks like it will work for any driver that is compatible with the particular Windows OS you are using.

In any case, I am going to have to try a different "hack" that involves actually replacing the tcpip.sys with a modified one as the cracktcpip.sys will not load in Vista x64 due to "compatibility" issues.

I had tried the modified tcpip.sys before but Vista refused to load because evidently the modified tcpip.sys was not signed.

I'll post back here with results as soon as I sign the modified tcpip.sys and test it out.

I think I am on to something here that could help a lot of 3rd party people that release free stuff for Windows.

[cyclone3d]

grrr... it looks like the pre-SP1 tcpip.sys will not work with SP1.

Anybody wanna figure out what needs to be hex edited in the new tcpip.sys for me?

[killerbobjr]

Do a diff on the hacked and non-hacked pre-SP1 tcpip.sys, then copy down the byte string from the area that was changed on the non-hacked one (four bytes at minimum), then look for that same byte string in the SP1 tcpip.sys and change the same byte(s). If you can't find that string in SP1, then you'll probably have to disassemble pre-SP1 tcpip.sys and work out the program logic, then disassemble SP1 tcpip.sys and look for similar program logic to find out the byte(s) that need to be changed.

[cyclone3d]

There is a person out there that knows what memory offset to modify for the RTM SP1, but from what I could find, he has not released that memory address.

This is the person who made the cracktcpip.sys driver.

All I really need is the address and then I can just use a memory address editor or a small app that changes it, then exits.

Oh yeah... the old tcpip.sys doesn't have the same byte code as the new one.

[killerbobjr]

According to here (http://www.mydigitallife.info/2008/01/07/cracktcpipsys-driver-for-vista-sp1-v668-to-patch-tcpipsys-60600117052), the offset is 0x00059722 for Vista SP1 RC v.668. More info in this thread (http://forums.mydigitallife.info/showthread.php?t=1249).

[cyclone3d]

Yep... I saw that, but the RTM version is different from what I could tell. I think the RTM would be the same as 744 but the offset is different from the 668 version.