About Virtualization, VDI, SBC, Application Compatibility and anything else I feel like
On Windows 2000, XP and Server 2003 a mechanism called Windows File Protection (WFP) is used to protect system integrity.
How does WFP Work?
Inside SFCFILES.DLL a list of files is kept that are monitored for changes. When a monitored file gets deleted, modified or overwritten WFP will restore the original from one of the following locations:
But what if we need to replace such a file? You could write a batch file that copies the modified file to the cache folder, installation path and destination. And this may work if it’s quick enough.
A more reliable method is to use an undocumented export from sfc_os.dll called SfcFileException (only exported by ordinal #5).
It’s signature is: DWORD WINAPI SfcFileException(RPC_BINDING_HANDLE hServer, LPCWSTR lpSrc, DWORD dwUnknown)
DWORD __stdcall SfcFileException(RPC_BINDING_HANDLE hServer, LPCWSTR lpSrc, int Unknown)
RPC_BINDING_HANDLE hServerVar; // [email protected]
int nts; // [email protected]
__int32 dwResult; // [email protected]
DWORD dwResultVar; // [email protected]
int v8; // [sp+8h] [bp-8h]@1
int v9; // [sp+Ch] [bp-4h]@1
LOWORD(v8) = 0;
*(int *)((char *)&v8 + 2) = 0;
HIWORD(v9) = 0;
if ( !hServer )
hServerVar = _pRpcHandle;
if ( !_pRpcHandle )
hServerVar = SfcConnectToServer(0);
_pRpcHandle = hServerVar;
if ( !hServerVar )
return 0x6BA; // RPC_S_SERVER_UNAVAILABLE
hServer = hServerVar;
nts = SfcRedirectPath(lpSrc, (int)&v8);
if ( nts >= 0 )
dwResult = SfcCli_FileException((int)hServer, v9, Unknown).Simple;
dwResult = RtlNtStatusToDosError(nts);
dwResultVar = dwResult;
After calling the SfcFileException the given file is not monitored for a minute. After this minute it will be monitored again but only for new changes, the modified file that was places within the minute will not be restored.
This makes the call to this API very easy so I wrote a commandline tool that calls the SfcFileException.
The tool takes one parameter: the filename:
When the call was successful you have one minute to update the given file. After this minute WFP starts monitoring the file again.WfpReplace.zip (822)
.NET .NET FrameWork Active Directory Altiris Apple Automation Manager Citrix Dell Delphi Excel Exchange Exchange2003 Exchange2010 Hack HP iOS Java LinkedIn Linux Lync MSI Office Office 2010 Passat Password PowerPoint PowerShell RES RNS510 SasLibEx SCOM Security Terminal Server ThinApp TSAdminEx VBS VCDS Visual Basic Visual Studio VMWare Volkswagen VW Windows PE Wordpress XenApp