[Q] Mod Windows RT to enable Remote Desktop

Search This thread
By:
Advanced…
S

sionicion

Senior Member
Mar 23, 2011
75
15
In the past, Windows has had editions for consumers that did not include Remote Desktop enabled. Usually there was a patch to enable it. Recently it has been proved how there is almost no difference between Windows 8 and Windows RT and that RT is just a port of Windows 8. So what about all the system files? They can be changed just like x86 Windows. So what about enabling Remote Desktop, so we don't need a ARM remote app that we need to unlock Windows for, and we can use what comes with Windows. In the past we modified the termsrv.dll file and changed some registry settings. I've included the Windows 8 and the Windows RT versions of termsrv.dll so that maybe some clever ones might try and crack a solution to enabling it on Windows RT. :)
 

Attachments

  • termsrv.zip
    1.2 MB · Views: 753
  • Like
Reactions: x86corez and ingramator
W

windowsrtc

Senior Member
Nov 21, 2012
94
35
sionicion said:
In the past, Windows has had editions for consumers that did not include Remote Desktop enabled. Usually there was a patch to enable it. Recently it has been proved how there is almost no difference between Windows 8 and Windows RT and that RT is just a port of Windows 8. So what about all the system files? They can be changed just like x86 Windows. So what about enabling Remote Desktop, so we don't need a ARM remote app that we need to unlock Windows for, and we can use what comes with Windows. In the past we modified the termsrv.dll file and changed some registry settings. I've included the Windows 8 and the Windows RT versions of termsrv.dll so that maybe some clever ones might try and crack a solution to enabling it on Windows RT. :)
Click to expand...
Click to collapse

termsrv is a system service and how can we use a modified termsrv.dll before we use the Jailbreak tool?maybe we can edit termsrv.dll in the memory.
 
Last edited:
G

GoodDayToDie

Inactive Recognized Developer
Jan 20, 2011
6,066
2,933
Seattle
We can't, I suspect. Even after jailbreaking, the lack of a signature on a system file may be a problem. It's worth a shot, though.
 
S

sionicion

Senior Member
Mar 23, 2011
75
15
I am able to take ownership of the file and replace it. But it won't use the termsrv.dll from my windows 8… I'm almost positive it is because the dll is different depending on architecture. But it should be as easily replaceable as any system file on windows 8, am I right? I don't see why it wouldn't but I could be wrong.
 
G

GoodDayToDie

Inactive Recognized Developer
Jan 20, 2011
6,066
2,933
Seattle
Yeah, pretty much. You definitely won't be able to use the Win8 version (x86 machine code, ARM processor, not gonna fly...) but a modified version of the Windows RT version might work. Bear in mind that since modifying the DLL will invalidate the signature, this won't work if the signature validation is enforced (i.e. you'll have to jailbreak).
 
C

clrokr

Senior Member
Aug 2, 2009
69
54
Should be possible using the Remote Debugging Tools or, even better, cdb. Put it in a .cmd file in autorun and voila :)
 
  • Like
Reactions: ingramator
M

mamaich

Retired Recognized Developer
Apr 29, 2004
1,150
228
mamaich-eng.blogspot.ru
I've already posted a method that should enable RDP here: http://xdaforums.com/showpost.php?p=36386089&postcount=211 - no need to patch DLL, and would work on an a locked device. But you'll have to manually edit binary registry value, instead of using a provided tool.
I have not tested RDP, but after using this method I was able to recover an option of joining device to Active Directory domain (it was blocked by the similar policies).
 
A

apatcas

Senior Member
May 25, 2007
627
165
mamaich said:
I've already posted a method that should enable RDP here: http://xdaforums.com/showpost.php?p=36386089&postcount=211 - no need to patch DLL, and would work on an a locked device. But you'll have to manually edit binary registry value, instead of using a provided tool.
I have not tested RDP, but after using this method I was able to recover an option of joining device to Active Directory domain (it was blocked by the similar policies).
Click to expand...
Click to collapse

Can you share how you managed to get the rt joined to a domain?
 
S

sionicion

Senior Member
Mar 23, 2011
75
15
mamaich said:
I've already posted a method that should enable RDP here: http://xdaforums.com/showpost.php?p=36386089&postcount=211 - no need to patch DLL, and would work on an a locked device. But you'll have to manually edit binary registry value, instead of using a provided tool.
I have not tested RDP, but after using this method I was able to recover an option of joining device to Active Directory domain (it was blocked by the similar policies).
Click to expand...
Click to collapse

Wouldn't both methods work though? Your method works by enabling features from other editions by telling Windows that's what edition it is running. It disables it when the Software Protection service restores it to the original template according to the edition. By patching the DLL file, you could trigger Remote Desktop to work without it needing to check in with the kernel policies.

I mean unless you have a way to modify these policies without all the extra occuring, it would work. But Bitlocker and the Software Protection service getting involved...it just sounds like a lot of extra work for something much bigger in the end, and I know there must be an easier way to force Remote Desktop to work without listening to these policies because it has been done in the past.
 
N

netham45

Inactive Recognized Developer
Jun 24, 2009
886
569
Denver
mamaich said:
I've already posted a method that should enable RDP here: http://xdaforums.com/showpost.php?p=36386089&postcount=211 - no need to patch DLL, and would work on an a locked device. But you'll have to manually edit binary registry value, instead of using a provided tool.
I have not tested RDP, but after using this method I was able to recover an option of joining device to Active Directory domain (it was blocked by the similar policies).
Click to expand...
Click to collapse

I tried to enable one of the Remote Desktop vars last night, allowRemoteConnections I think it was called, but I didn't get anything from it.
 
  • Like
Reactions: Dwain77
A

apatcas

Senior Member
May 25, 2007
627
165
mamaich said:
I've already posted a method that should enable RDP here: http://xdaforums.com/showpost.php?p=36386089&postcount=211 - no need to patch DLL, and would work on an a locked device. But you'll have to manually edit binary registry value, instead of using a provided tool.
I have not tested RDP, but after using this method I was able to recover an option of joining device to Active Directory domain (it was blocked by the similar policies).
Click to expand...
Click to collapse

Again, please if you were able to join an RT to the domain. Please let me know what you did. Would love to not get prompted to log in into PowerShell.
 
M

mamaich

Retired Recognized Developer
Apr 29, 2004
1,150
228
mamaich-eng.blogspot.ru
apatcas said:
Again, please if you were able to join an RT to the domain. Please let me know what you did. Would love to not get prompted to log in into PowerShell.
Click to expand...
Click to collapse
As I've already wrote - use this method: http://xdaforums.com/showpost.php?p=36386089&postcount=211
1. Edit registry:
Code: 
HKEY_LOCAL_MACHINE\SYSTEM\Setup
SetupType=1
CmdLine="cmd.exe"
and reboot. You will enter the setup mode. You would not see the mouse cursor in this mode, and you'll need a hardware keyboard.
2. Open this reg_binary value: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions\ProductPolicy. Look for unicode string "WorkstationService-DomainJoinEnabled", it is near offset 0x4000. Look at this screenshot:
http://imageshack.us/photo/my-images/526/35796208.png/
Select the "00" byte that follows the zero byte after the 64 (64 00 == unicode "d" letter) as you see on the screenshot. Overwrite it with 01. Be careful not to insert a byte, you need to overwrite the existing byte!
3. Rename sppsvc.exe to anything else so that it would not run on boot and reset ProductPolicy ("ren sppsvc.exe sppsvc.bak")
4. Reboot. Now the option to join the domain would be available.

I have not tried to add workstation to domain myself - try that and post here. After adding to domain you may try to rename sppsvc.bak back to sppsvc.exe as otherwise you'll get the "unactivated" Windows RT. I think that this would only remove the add to domain UI, but the RT would be still domain-joined.

I've tried to edit the remote desktop settings keys - this unblocked the corresponding options in the computer settings, but I was unable to connect. Maybe this is due to absence of RDP code in terminal server service - I don't see anyone listening port 3398 though TermServer service is running.
 
Last edited:
A

apatcas

Senior Member
May 25, 2007
627
165
mamaich said:
As I've already wrote - use this method: http://xdaforums.com/showpost.php?p=36386089&postcount=211
1. Edit registry:
Code: 
HKEY_LOCAL_MACHINE\SYSTEM\Setup
SetupType=1
CmdLine="cmd.exe"
and reboot. You will enter the setup mode. You would not see the mouse cursor in this mode, and you'll need a hardware keyboard.
2. Open this reg_binary value: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions\ProductPolicy. Look for unicode string "WorkstationService-DomainJoinEnabled", it is near offset 0x4000. Look at this screenshot:
http://imageshack.us/photo/my-images/526/35796208.png/
Select the "00" byte that follows the zero byte after the 64 (64 00 == unicode "d" letter) as you see on the screenshot. Overwrite it with 01. Be careful not to insert a byte, you need to overwrite the existing byte!
3. Rename sppsvc.exe to anything else so that it would not run on boot and reset ProductPolicy ("ren sppsvc.exe sppsvc.bak")
4. Reboot. Now the option to join the domain would be available.

I have not tried to add workstation to domain myself - try that and post here. After adding to domain you may try to rename sppsvc.bak back to sppsvc.exe as otherwise you'll get the "unactivated" Windows RT. I think that this would only remove the add to domain UI, but the RT would be still domain-joined.

I've tried to edit the remote desktop settings keys - this unblocked the corresponding options in the computer settings, but I was unable to connect. Maybe this is due to absence of RDP code in terminal server service - I don't see anyone listening port 3398 though TermServer service is running.
Click to expand...
Click to collapse

Joined... Nice find.
 
N

netham45

Inactive Recognized Developer
Jun 24, 2009
886
569
Denver
mamaich said:
Have it remained domain-joined after restoring the original sppsvc.exe?
You have to return it back, otherwise you'll be annoyed with the activation reminders.
Click to expand...
Click to collapse

We could possibly patch sppsvc to not check, then start the service up after jailbreaking it.

I'm honestly not sure if this would be considered piracy or not, though.

Edit: I used the program to set every value to 1 in setup mode (The latest jailbreak tool works in setup mode), and I didn't see any change for anything dealing with RDP.
Edit 2: Perhaps I shouldn't have set 'Disable' to 1. Regardless, I set it to 0 and the options popped up, but I can't get anything to go. As mamaich stated, I'm not seeing anything listening on port 3389. netstat -a -b on a desktop with it enabled says it's opened by CryptSvc, but I'm not seeing anything with CryptSvc that's not there on the tablet. That could just be netstat guessing which service running under svchost is actually running it, too.
 
Last edited:
W

windowsrtc

Senior Member
Nov 21, 2012
94
35
netham45 said:
We could possibly patch sppsvc to not check, then start the service up after jailbreaking it.

I'm honestly not sure if this would be considered piracy or not, though.

Edit: I used the program to set every value to 1 in setup mode (The latest jailbreak tool works in setup mode), and I didn't see any change for anything dealing with RDP.
Edit 2: Perhaps I shouldn't have set 'Disable' to 1. Regardless, I set it to 0 and the options popped up, but I can't get anything to go. As mamaich stated, I'm not seeing anything listening on port 3389. netstat -a -b on a desktop with it enabled says it's opened by CryptSvc, but I'm not seeing anything with CryptSvc that's not there on the tablet. That could just be netstat guessing which service running under svchost is actually running it, too.
Click to expand...
Click to collapse

I think we must hack the dll file.But I find when I edit a byte in the dll,the service was not able to start.
 
coldbloc

coldbloc

Senior Member
Nov 25, 2013
60
8
@ Netham45, you could try to open up W81x86 termsrv.dll and go to these hex locations to find out what functions needed patching.

Hashes
File: W81x86\termsrv.dll
CRC-32: 202cd912
MD4: a879d39b8fbcd968b525af05a66aaf2c
MD5: 7a8e1158291cf4c8d8474a2091b9bf6d
SHA-1: e10028b074d24605e05b5e0bafd42f6a93ac01ad


1550F-15520
17428
A1B29

Then go into WinRT termsrv.dll, jump to those functions by name (because offsets will be different between x86 and RT) and Jmp or Nop as needed for WinRT. Afterwords it could be added via CDB / KD on-the-fly.
 
Last edited:
You must log in or register to reply here.

Similar threads

K
[Tutorial] Install Windows 10 for ARM32 on your Surface RT
Replies
239
Views
190K
itsmemario
itsmemario
A
Asus Vivo RT recovery files
Replies
214
Views
199K
Ruslan139
Ruslan139
S
Windows RT 8.1 downgrade?
Replies
41
Views
59K
M
mickel52
Myriachan
Extract Windows RT product key without jailbreak or PC
Replies
21
Views
61K
Oyemyk
Oyemyk
W
windows rt rtm
Replies
140
Views
37K
derausgewanderte
derausgewanderte

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 2
    S
    sionicion
    In the past, Windows has had editions for consumers that did not include Remote Desktop enabled. Usually there was a patch to enable it. Recently it has been proved how there is almost no difference between Windows 8 and Windows RT and that RT is just a port of Windows 8. So what about all the system files? They can be changed just like x86 Windows. So what about enabling Remote Desktop, so we don't need a ARM remote app that we need to unlock Windows for, and we can use what comes with Windows. In the past we modified the termsrv.dll file and changed some registry settings. I've included the Windows 8 and the Windows RT versions of termsrv.dll so that maybe some clever ones might try and crack a solution to enabling it on Windows RT. :)
    View
    2
    X
    x86corez
    It seems like everybody forgot about this thread...
    But I'm not. ;)

    I've commited some experimental patch codes for these builds:
    6.2.9200.16384 (Windows RT)
    6.3.9600.16384 (Windows RT 8.1)
    6.3.9600.17095 (Windows RT 8.1 with KB2959626)

    You can view it here:
    https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-arm-kb.ini

    However RDP Wrapper C++ version still needs to be updated to support and to be compiled on ARMv7 architecture. Hope somebody will help with that.

    I think, the most complex thing is to implement function hooking.
    View
    1
    C
    clrokr
    Should be possible using the Remote Debugging Tools or, even better, cdb. Put it in a .cmd file in autorun and voila :)
    View
    1
    N
    netham45
    mamaich said:
    I've already posted a method that should enable RDP here: http://xdaforums.com/showpost.php?p=36386089&postcount=211 - no need to patch DLL, and would work on an a locked device. But you'll have to manually edit binary registry value, instead of using a provided tool.
    I have not tested RDP, but after using this method I was able to recover an option of joining device to Active Directory domain (it was blocked by the similar policies).
    Click to expand...
    Click to collapse

    I tried to enable one of the Remote Desktop vars last night, allowRemoteConnections I think it was called, but I didn't get anything from it.
    View
    1
    T
    TFGBD
    I just came across this program called "RDP Wrapper Library"
    http://stascorp.com/load/1-1-0-63
    It patches the RDP API in ram so the system files aren't modified at all. In this sense it is similar to commercial solutions like Thinstuff XP/VS. It seems to be based on the ProductPolicy method that was mentioned earlier in this thread. It's also open source so maybe it can be compiled for ARM and run on jailbroken devices!
    View

New posts