Wood
08-02-2005, 01:53 PM
I was wondering if anyone has found a way around this yet, i've read on multiple websites that there have been exploits. Have any of you actually took the time to decode anything? I need help!
LegitCheckControl.dll
This is where Microsoft checks to see if the customer is running a valid copy of Windows XP. Well I know I am not the only one running a unvalid copy. Anyways, today I've been looking into how this whole "Validation check" works.
LegitCheckControl.dll Source code
REGISTRY
- 101
HKCR
**
NoRemove AppID
**
'%APPID%' = s 'LegitCheckControl'
'LegitCheckControl.DLL'
**
val AppID = s '%APPID%'
}
}
}
- 102
HKCR
**
LegitCheckControl.LegitCheck.1 = s 'Windows Genuine Advantage Validation Tool'
**
CLSID = s '**17492023-C23A-453E-A040-C7C580BBF700}'
}
LegitCheckControl.LegitCheck = s 'Windows Genuine Advantage Validation Tool'
**
CLSID = s '**17492023-C23A-453E-A040-C7C580BBF700}'
CurVer = s 'LegitCheckControl.LegitCheck.1'
}
NoRemove CLSID
**
ForceRemove **17492023-C23A-453E-A040-C7C580BBF700} = s 'Windows Genuine Advantage Validation Tool'
**
ProgID = s 'LegitCheckControl.LegitCheck.1'
VersionIndependentProgID = s 'LegitCheckControl.LegitCheck'
ForceRemove 'Programmable'
InprocServer32 = s '%MODULE%'
**
val ThreadingModel = s 'Apartment'
}
val AppID = s '%APPID%'
'TypeLib' = s '**5E649A63-7EE9-43F4-9926-0DEAA462A8FB}'
}
}
}
Eh...damnit
LegitCheckControl.dll
This is where Microsoft checks to see if the customer is running a valid copy of Windows XP. Well I know I am not the only one running a unvalid copy. Anyways, today I've been looking into how this whole "Validation check" works.
LegitCheckControl.dll Source code
REGISTRY
- 101
HKCR
**
NoRemove AppID
**
'%APPID%' = s 'LegitCheckControl'
'LegitCheckControl.DLL'
**
val AppID = s '%APPID%'
}
}
}
- 102
HKCR
**
LegitCheckControl.LegitCheck.1 = s 'Windows Genuine Advantage Validation Tool'
**
CLSID = s '**17492023-C23A-453E-A040-C7C580BBF700}'
}
LegitCheckControl.LegitCheck = s 'Windows Genuine Advantage Validation Tool'
**
CLSID = s '**17492023-C23A-453E-A040-C7C580BBF700}'
CurVer = s 'LegitCheckControl.LegitCheck.1'
}
NoRemove CLSID
**
ForceRemove **17492023-C23A-453E-A040-C7C580BBF700} = s 'Windows Genuine Advantage Validation Tool'
**
ProgID = s 'LegitCheckControl.LegitCheck.1'
VersionIndependentProgID = s 'LegitCheckControl.LegitCheck'
ForceRemove 'Programmable'
InprocServer32 = s '%MODULE%'
**
val ThreadingModel = s 'Apartment'
}
val AppID = s '%APPID%'
'TypeLib' = s '**5E649A63-7EE9-43F4-9926-0DEAA462A8FB}'
}
}
}
Eh...damnit