This is in regard to the authui.dll that hilton shared with us, but didn’t tell us where he got it from… I have been trying to figure out what the difference is that allows the mod to work. Firstly though, the authui.dll file from Server 2008 is per-byte identical to the authui.dll from Vista SP1. Here is what I found on the modified authui.dll file…
EDIT: Found branding. “This Logon was created by iSoftech a.k.a Yusuff for Leopard Skin. (c) 2007 iSoftech .”
– It is from Vista without SP1 [version is 6.0.6000.x instead of 6.0.6001.x] which could cause issues for Server 2008 [because they are all Vista SP1 equivalent system files]
– Resources 11200, 11300 and 11400 under BITMAP are added – it appears to be an alternative [better IMO] icon for the Accessibility Settings that usually appears bottom-left corner of the logon screen. [see attatchment 01]
– Resources 1700x under IMAGE, which is the ‘glowing vista orb’ animation that appears before the logon screen, is modded to an Apple/Macintosh icon. So this DLL was probably taken from some kind of “OSX Makeover for Vista”. Couldn’t be bothered investigating, no point. [See attatchment 02]
– MUI resource is different in both filesize and content – unknown whether it is a SP1 change or a mod. As it is binary data, I still need to investigate what exactly the difference is.
– Both of the UIFILE resources are different. I have a good feeling that something in here is what we need to change to get logon screens in 2008… or at least I hope, as they are just massive text files as opposed to unreadable binary data =)
– Version data resource is different, as stated in my first point
– In the WEVT_TEMPLATE resource, around the header, the modified file has for some reason 4 bytes modifed to FF FF FF FF instead of the 01 00 00 90 from Vista SP1. Absolutely no idea why this is the case, although usually hackers/crackers use FF-byte sequences to brand files to show people like me/us that “yes this file has been modified and is not the original”, usually in a padded data area [which is never read by the system] for obvious reasons.
Anyway i’m looking into this right now, hopefully I can make a one-click-patch-EXE that will turn your authui.dll from Server 2008 into a modified one that will be version/future proof [with a seek and replace method of patching]. I’ll let you guys know. Peace.
[attachment=1:iaxc0uzi]attatchment 01.jpg[/attachment:iaxc0uzi]
[attachment=0:iaxc0uzi]attatchment 02.jpg[/attachment:iaxc0uzi]
