Sp3 has a different version than what this patch refers to.
Is there a way to see what the code is at 0xECE9?

How to Disable WFP in XP SP2

Starting with Windows 2000 Service packs, and now introduced in Windows XP SP2, Microsoft removed the ability to disable Windows File Protection.

The version of %SystemRoot%\System32\sfc_os.dll that is included in Windows XP SP2 is 5.1.2600.2180. As you can see from the file on a pre- SP2 system, this is what you want to see. If you have the SP2 version, then you will want to remove that.

To Disable WFP in Windows XP SP2:

  1. Copy %SystemRoot%\System32\SFC_OS.DLL to %SystemRoot%\System32\SFC_Patch.DLL

  2. Open %SystemRoot%\System32\SFC_Patch.DLL in a hex editor as seen below. You can get a free one at http://www.genkisoft.com/turbohex.shtml

  3. At offset 0xECE9, change 33C040 to 909090 and save the changes.
Posted on 2010-08-19 08:35:07 by skywalker