3

No matter what I do, I can't seem to be able to get my Windows 10 (64-bit, build 1607) to apply any patches in custom SDB's (as described in the article of Jon Erickson from 2014).

I'm using Jon's sdb-explorer to generate a patch SDB from the following source (assuming calc.exe's PE checksum is 0000BE15 and the entrypoint RVA is 0x2900):

!sdbpatch
APP=calc.exe
DBNAME=calc_test
P:calc.exe,0xbe15
R:calc.exe,0x2900,CCCCCCC3
!endsdbpatch

The exact commands are:

sdb-explorer.exe -C calc-test.txt -o calc-test.sdb
sdbinst.exe -p calc-test.sdb

The install is successful but has no effect - calc.exe still starts and runs normally.

Hence my question - has the PATCH mechanism been removed or somehow crippled in Windows 10?


p.s. I need this for legitimate reasons - I'm trying to patch the touchpad utility which is posting mouse wheel messages which don't work in Windows 10 UWP apps, but the utility is signed with uiAccess="true", so I can't just patch the executable.

2

From preliminary investigation by Jon, it seems patching functionality has been indeed removed on Windows 10:

I've compared apphelp.dll on Windows 7 versus Windows 10. The Windows 10 version does not have the function SeiApplyPatch. This is what is responsible for performing the PATCH. It appears that Microsoft has removed this feature.

However, it seems you can still use shims, although apparently not on all binaries.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.