(更新签名版)MTP补丁失效免替换文件解决方法

martin313 · 发表于 2025-7-7 22:54:18

YWFhYmJi 发表于 2025-7-7 22:35
我现在收集了微软官网的100多个services.exe（不全，明天继续收集）包含win10-11的大部分版本，明天测试 ...

win10与win11 23h2 的都不用看了，都不含的

win11 24h2 的，也要2024年12月版本及之后的才有

nianyueriPE · 发表于 2025-7-7 23:58:56

martin313 发表于 2025-7-7 22:54
win10与win11 23h2 的都不用看了，都不含的

win11 24h2 的，也要2024年12月版本及之后的才有

我刚刚弄了个合法签名，不知道能不能用。链接https://pan.huang1111.cn/s/QzRZbfm

martin313 · 发表于 2025-7-8 06:26:13

nianyueriPE 发表于 2025-7-7 23:58
我刚刚弄了个合法签名，不知道能不能用。链接https://pan.huang1111.cn/s/QzRZbfm

最新版可用

martin313 · 发表于 2025-7-8 06:59:50

nianyueriPE 发表于 2025-7-7 23:58
我刚刚弄了个合法签名，不知道能不能用。链接https://pan.huang1111.cn/s/QzRZbfm

可用；但 dll 体积大了好多，签名内容那么多？

YWFhYmJi · 发表于 2025-7-8 07:40:37

nianyueriPE 发表于 2025-7-7 23:58
我刚刚弄了个合法签名，不知道能不能用。链接https://pan.huang1111.cn/s/QzRZbfm

签名可用，而且是SHA256的。那这种证书的合法签名一般就没问题了，除非证书被吊销，但一般情况不会。

YWFhYmJi · 发表于 2025-7-8 10:00:13

martin313 发表于 2025-7-7 22:54
win10与win11 23h2 的都不用看了，都不含的

win11 24h2 的，也要2024年12月版本及之后的才有

统计出来了，大概是从10.0.26100.2454开始之后就有了
具体157个services.exe统计情况：

x64/x64/services.exe/559F384870000/services.exe,10.0.10240.16384,Unsupported
x64/x64/services.exe/59EED31F70000/services.exe,10.0.10240.17673,Unsupported
x64/x64/services.exe/5DE78E8870000/services.exe,10.0.10240.18427,Unsupported
x64/x64/services.exe/5632D1826f000/services.exe,10.0.10586.0,Unsupported
x64/x64/services.exe/5699D08F6f000/services.exe,10.0.10586.71,Unsupported
x64/x64/services.exe/578997B372000/services.exe,10.0.14393.0,Unsupported
x64/x64/services.exe/5825886E72000/services.exe,10.0.14393.479,Unsupported
x64/x64/services.exe/59027FD571000/services.exe,10.0.14393.1198,Unsupported
x64/x64/services.exe/5989432D71000/services.exe,10.0.14393.1613,Unsupported
x64/x64/services.exe/5A0FA86C71000/services.exe,10.0.14393.1914,Unsupported
x64/x64/services.exe/5AE408A771000/services.exe,10.0.14393.2273,Unsupported
x64/x64/services.exe/5C89E9DC72000/services.exe,10.0.14393.2879,Unsupported
x64/x64/services.exe/5DDCB9BB72000/services.exe,10.0.14393.3383,Unsupported
x64/x64/services.exe/5FF78C9673000/services.exe,10.0.14393.4169,Unsupported
x64/x64/services.exe/66BAD24673000/services.exe,10.0.14393.7330,Unsupported
x64/x64/services.exe/50A26C8C83000/services.exe,10.0.15063.468,Unsupported
x64/x64/services.exe/32F0FE6D83000/services.exe,10.0.15063.502,Unsupported
x64/x64/services.exe/A7673F0883000/services.exe,10.0.15063.968,Unsupported
x64/x64/services.exe/A486DC7E83000/services.exe,10.0.15063.1112,Unsupported
x64/x64/services.exe/926701FF83000/services.exe,10.0.15063.1356,Unsupported
x64/x64/services.exe/2F9AA49283000/services.exe,10.0.15063.2223,Unsupported
x64/x64/services.exe/0BDD439B98000/services.exe,10.0.16299.64,Unsupported
x64/x64/services.exe/2C1B900098000/services.exe,10.0.16299.123,Unsupported
x64/x64/services.exe/6D2C40C798000/services.exe,10.0.16299.192,Unsupported
x64/x64/services.exe/DBD0FE8498000/services.exe,10.0.16299.461,Unsupported
x64/x64/services.exe/6CDC2BF498000/services.exe,10.0.16299.699,Unsupported
x64/x64/services.exe/058C147298000/services.exe,10.0.16299.1565,Unsupported
x64/x64/services.exe/CA0DFD509d000/services.exe,10.0.17134.1,Unsupported
x64/x64/services.exe/3C2B9F439d000/services.exe,10.0.17134.191,Unsupported
x64/x64/services.exe/43BE002A9d000/services.exe,10.0.17134.1184,Unsupported
x64/x64/services.exe/5FD774159e000/services.exe,10.0.17134.2145,Unsupported
x64/x64/services.exe/FD6BAC5Aa8000/services.exe,10.0.17763.557,Unsupported
x64/x64/services.exe/F69B1107a7000/services.exe,10.0.17763.652,Unsupported
x64/x64/services.exe/0A0BB7E2a7000/services.exe,10.0.17763.914,Unsupported
x64/x64/services.exe/CC2C433Ba9000/services.exe,10.0.17763.1637,Unsupported
x64/x64/services.exe/D35FFBD6a9000/services.exe,10.0.17763.1823,Unsupported
x64/x64/services.exe/A1376688a9000/services.exe,10.0.17763.1879,Unsupported
x64/x64/services.exe/1042691Ba9000/services.exe,10.0.17763.6780,Unsupported
x64/x64/services.exe/0D1E531Da7000/services.exe,10.0.17763.10087,Unsupported
x64/x64/services.exe/D6C7312Da9000/services.exe,10.0.17763.10877,Unsupported
x64/x64/services.exe/3A1E9E1Aa7000/services.exe,10.0.18362.476,Unsupported
x64/x64/services.exe/D67DF688a7000/services.exe,10.0.18362.535,Unsupported
x64/x64/services.exe/6D20A7DCa7000/services.exe,10.0.18362.1020,Unsupported
x64/x64/services.exe/B61854DAa8000/services.exe,10.0.18362.1171,Unsupported
x64/x64/services.exe/AC6BB341a7000/services.exe,10.0.18362.1216,Unsupported
x64/x64/services.exe/31CC54A8a8000/services.exe,10.0.18362.1441,Unsupported
x64/x64/services.exe/56ABB4ADa8000/services.exe,10.0.18362.2158,Unsupported
x64/x64/services.exe/C75BB2EAa7000/services.exe,10.0.18362.10000,Unsupported
x64/x64/services.exe/D92B0724ae000/services.exe,10.0.19041.488,Unsupported
x64/x64/services.exe/4BB9E8D4ae000/services.exe,10.0.19041.546,Unsupported
x64/x64/services.exe/C4808C1Db0000/services.exe,10.0.19041.631,Unsupported
x64/x64/services.exe/15736EFCb0000/services.exe,10.0.19041.870,Unsupported
x64/x64/services.exe/A9FB6BC9b0000/services.exe,10.0.19041.928,Unsupported
x64/x64/services.exe/63F36801ae000/services.exe,10.0.19041.1006,Unsupported
x64/x64/services.exe/EB29E852b0000/services.exe,10.0.19041.1131,Unsupported
x64/x64/services.exe/FED0265Cb0000/services.exe,10.0.19041.2965,Unsupported
x64/x64/services.exe/E1AAEFD2b0000/services.exe,10.0.19041.4106,Unsupported
x64/x64/services.exe/9AB9B86Eb0000/services.exe,10.0.19041.5607,Unsupported
x64/x64/services.exe/7CBE7C41b0000/services.exe,10.0.19041.6033,Unsupported
x64/x64/services.exe/F645A6DEb5000/services.exe,10.0.22000.51,Unsupported
x64/x64/services.exe/0376FF14b5000/services.exe,10.0.22000.2836,Unsupported
x64/x64/services.exe/B988BDE6b6000/services.exe,10.0.22621.741,Unsupported
insider/x64/services.exe/348D9514b6000/services.exe,10.0.22621.1240,Unsupported
x64/x64/services.exe/FAE9B53Cb6000/services.exe,10.0.22621.1409,Unsupported
x64/x64/services.exe/11E6ACE8b6000/services.exe,10.0.22621.1424,Unsupported
x64/x64/services.exe/6DD4D411b6000/services.exe,10.0.22621.1485,Unsupported
x64/x64/services.exe/7B392F88b6000/services.exe,10.0.22621.2067,Unsupported
x64/x64/services.exe/FEAFAAF5b6000/services.exe,10.0.22621.3209,Unsupported
x64/x64/services.exe/26E5DAADb6000/services.exe,10.0.22621.3640,Unsupported
x64/x64/services.exe/68DA0BB0b6000/services.exe,10.0.22621.4034,Unsupported
x64/x64/services.exe/1DCDBEDCb6000/services.exe,10.0.22621.4746,Unsupported
insider/x64/services.exe/0631E26Cb6000/services.exe,10.0.22621.5097,Unsupported
x64/x64/services.exe/8A5CCFA1b6000/services.exe,10.0.22621.5192,Unsupported
x64/x64/services.exe/3DAFA997b6000/services.exe,10.0.22621.5541,Unsupported
x64/x64/services.exe/A8F85A16b6000/services.exe,10.0.22621.5547,Unsupported
x64/x64/services.exe/CDB0C102d7000/services.exe,10.0.26100.1,Unsupported
x64/x64/services.exe/6180520Cd7000/services.exe,10.0.26100.712,Unsupported
x64/x64/services.exe/F60C6E00d7000/services.exe,10.0.26100.1150,Unsupported
x64/x64/services.exe/FC6C25D4d8000/services.exe,10.0.26100.1301,Unsupported
x64/x64/services.exe/82A5508Bd8000/services.exe,10.0.26100.1591,Unsupported
x64/x64/services.exe/24A32C6Bd8000/services.exe,10.0.26100.1882,Unsupported
x64/x64/services.exe/8CC8B013dd000/services.exe,10.0.26100.2161,Unsupported
x64/x64/services.exe/48266B5Add000/services.exe,10.0.26100.2454,Supported
x64/x64/services.exe/9A971085de000/services.exe,10.0.26100.3037,Supported
insider/x64/services.exe/DA63BED8de000/services.exe,10.0.26100.3281,Supported
insider/x64/services.exe/53802E52de000/services.exe,10.0.26100.3291,Supported
x64/x64/services.exe/E2ED82BCde000/services.exe,10.0.26100.3323,Supported
insider/x64/services.exe/4DD6009Cde000/services.exe,10.0.26100.3380,Supported
insider/x64/services.exe/6063F8B2de000/services.exe,10.0.26100.3575,Supported
insider/x64/services.exe/B70F9652de000/services.exe,10.0.26100.3585,Supported
x64/x64/services.exe/EDE4495Fde000/services.exe,10.0.26100.3624,Supported
insider/x64/services.exe/171D1DEFe0000/services.exe,10.0.26100.3653,Supported
insider/x64/services.exe/8354A516e2000/services.exe,10.0.26100.3671,Supported
insider/x64/services.exe/5D382A3Ee2000/services.exe,10.0.26100.3863,Supported
insider/x64/services.exe/0188E820e2000/services.exe,10.0.26100.3872,Supported
x64/x64/services.exe/D215F30Be2000/services.exe,10.0.26100.3912,Supported
insider/x64/services.exe/71F67640e2000/services.exe,10.0.26100.3950,Supported
insider/x64/services.exe/37353033e0000/services.exe,10.0.26100.3964,Supported
insider/x64/services.exe/72D803D8e0000/services.exe,10.0.26100.4151,Supported
insider/x64/services.exe/FE2368C9e0000/services.exe,10.0.26100.4161,Supported
x64/x64/services.exe/63D0C02Ee0000/services.exe,10.0.26100.4202,Supported
insider/x64/services.exe/DB690E02e0000/services.exe,10.0.26100.4230,Supported
insider/x64/services.exe/2EA6A6D6e3000/services.exe,10.0.26100.4250,Supported
insider/x64/services.exe/3D7E85C5e3000/services.exe,10.0.26100.4441,Supported
x64/x64/services.exe/AB24BCB6e3000/services.exe,10.0.26100.4484,Supported
insider/x64/services.exe/59F70A09e3000/services.exe,10.0.26100.4520,Supported
insider/x64/services.exe/59F0B00Bde000/services.exe,10.0.26100.5510,Supported
insider/x64/services.exe/6FCD2EEFe0000/services.exe,10.0.26100.5516,Supported
insider/x64/services.exe/D5FD2506e2000/services.exe,10.0.26100.5518,Supported
insider/x64/services.exe/2AC5524Ce2000/services.exe,10.0.26100.5551,Supported
insider/x64/services.exe/AE853369e2000/services.exe,10.0.26100.5562,Supported
insider/x64/services.exe/A181CCC0e2000/services.exe,10.0.26100.5581,Supported
insider/x64/services.exe/398052EFe0000/services.exe,10.0.26100.5600,Supported
insider/x64/services.exe/8025629Be0000/services.exe,10.0.26100.5603,Supported
insider/x64/services.exe/35EAA0AAe0000/services.exe,10.0.26100.5622,Supported
insider/x64/services.exe/9658E484e3000/services.exe,10.0.26100.5641,Supported
insider/x64/services.exe/6A0E49EAe3000/services.exe,10.0.26100.5651,Supported
insider/x64/services.exe/5DDD18A9e3000/services.exe,10.0.26100.5670,Supported
insider/x64/services.exe/B56F834Fdc000/services.exe,10.0.27768.1000,Supported
insider/x64/services.exe/442AB9A1dc000/services.exe,10.0.27774.1000,Supported
insider/x64/services.exe/6342E45Ddc000/services.exe,10.0.27783.1000,Supported
insider/x64/services.exe/F50EA0F2dc000/services.exe,10.0.27788.1000,Supported
insider/x64/services.exe/D8774222db000/services.exe,10.0.27802.1000,Supported
insider/x64/services.exe/51D665CCdb000/services.exe,10.0.27808.1000,Supported
insider/x64/services.exe/DE096E8Ddb000/services.exe,10.0.27813.1000,Supported
insider/x64/services.exe/048B7B5Edc000/services.exe,10.0.27818.1000,Supported
insider/x64/services.exe/3F7A3065dc000/services.exe,10.0.27823.1000,Supported
insider/x64/services.exe/E5FCEB1Cdd000/services.exe,10.0.27842.1000,Supported
insider/x64/services.exe/416AB4DEdd000/services.exe,10.0.27858.1000,Supported
insider/x64/services.exe/3CDCB33Edd000/services.exe,10.0.27863.1000,Supported
insider/x64/services.exe/7442A706dd000/services.exe,10.0.27868.1000,Supported
insider/x64/services.exe/45B02A60dd000/services.exe,10.0.27871.1000,Supported
insider/x64/services.exe/77AFBFE5dd000/services.exe,10.0.27881.1000,Supported
insider/x64/services.exe/FF1DAD34dd000/services.exe,10.0.27891.1000,Supported

复制代码

脚本批量统计的数据，可能不全，但应该差不多

YWFhYmJi · 发表于 2025-7-8 10:04:48

martin313 发表于 2025-7-7 22:25
试过，没成功，正在请slore大佬研究，哈哈

我正在做一个命令行程序把这三种方法(ProductPolicy,合法签名的驱动,VerifierDll)统一处理

martin313 · 发表于 2025-7-8 10:26:23

YWFhYmJi 发表于 2025-7-8 10:04
我正在做一个命令行程序把这三种方法(ProductPolicy,合法签名的驱动,VerifierDll)统一处理

批处理修改 ProductPolicy，怎么弄？

YWFhYmJi · 发表于 2025-7-8 10:30:30

martin313 发表于 2025-7-8 10:26
批处理修改 ProductPolicy，怎么弄？

批处理好像不太好弄，因为ProductPolicy是二进制的，powershell可能可以但没试过，我现在正在做一个C++程序修改ProductPolicy。

可以参考ProductPolicyEditor的C#源码：pan.huang1111.cn/s/VLA56Ud

martin313 · 发表于 2025-7-8 10:33:13

YWFhYmJi 发表于 2025-7-8 10:30
批处理好像不太好弄，因为ProductPolicy是二进制的，powershell可能可以但没试过，我现在正在做一个C++程 ...

不会编程，也没工具

powershell 试过，会改坏二进制表头，不知道如何正确搞powershell

martin313 · 发表于 2025-7-8 10:34:14

YWFhYmJi 发表于 2025-7-8 10:30
批处理好像不太好弄，因为ProductPolicy是二进制的，powershell可能可以但没试过，我现在正在做一个C++程 ...

如果ProductPolicyEditor.exe支持批处理命令，那就好了

martin313 · 发表于 2025-7-8 11:59:26

本帖最后由 martin313 于 2025-7-8 15:37 编辑

YWFhYmJi 发表于 2025-7-8 10:30
批处理好像不太好弄，因为ProductPolicy是二进制的，powershell可能可以但没试过，我现在正在做一个C++程 ...

经slore大佬指点，用winxshell添加成功了

WINXSHELL -script ProductOptTest.lua（管理员身份运行）

ProductOptTest.lua的内容：
App:Call('ProductPolicy::Load', [[Tmp_SYSTEM\ControlSet001\Control\ProductOptions]], 'ProductPolicy')
App:Call('ProductPolicy::Set', 'UMDF-WINPE-ENABLED', 1)
App:Call('ProductPolicy::Save')

YWFhYmJi · 发表于 2025-7-8 12:41:33

martin313 发表于 2025-7-8 11:59
经slore大佬指点，用winxshell添加成功了

WINXSHELL -console -script ProductOptTest.lua（管理员身 ...

用WinXShell能改那就可以。我虽然已经制作出来了ProductPolicyEditor的控制台版，但是是修改了C#版的源程序，由于我对C#不熟悉，不知道修改的程序是否有bug，是否依赖.NET

nianyueriPE · 发表于 2025-7-8 17:52:28

martin313 发表于 2025-7-8 06:59
可用；但 dll 体积大了好多，签名内容那么多？

他这个估计是特制的签名，让原本不符合whql签名要求的签名可以支持安全启动，不然他这种签名正常是过不了安全启动的

nianyueriPE · 发表于 2025-7-8 17:53:34

martin313 发表于 2025-7-8 06:59
可用；但 dll 体积大了好多，签名内容那么多？

我自己研究了一下，去除签名的sys文件确实是正常的，只是签名那边被塞了点特制代码

nianyueriPE · 发表于 2025-7-8 17:55:03

YWFhYmJi 发表于 2025-7-8 07:40
签名可用，而且是SHA256的。那这种证书的合法签名一般就没问题了，除非证书被吊销，但一般情况不会。

他这种好像是卡了BUG的特制签名，正常这种签名是过不了安全启动的，不符合whql要求，我自己看了下，签名部分被塞了特制代码

YWFhYmJi · 发表于 2025-7-8 18:10:05

本帖最后由 YWFhYmJi 于 2025-7-8 18:26 编辑

nianyueriPE 发表于 2025-7-8 17:55
他这种好像是卡了BUG的特制签名，正常这种签名是过不了安全启动的，不符合whql要求，我自己看了下，签名 ...

但是这签名看着是合法的，就是有点太大了，一个签名400k，比驱动本身都大了很多倍
更新：好像确实塞东西了，验证签名报错

ValueError: Insufficient data - 1024 bytes requested but only 513 available
while parsing asn1crypto.x509.TbsCertificate

复制代码

这个签名按照标准是有问题的，但Windows认为合法。

YWFhYmJi · 发表于 2025-7-8 18:19:51

不过就算重签名不能用，也可以直接在26100.2454以上的系统改注册表（好像ARM64也可以），或者用VerifierDll

martin313 · 发表于 2025-7-8 20:59:25

YWFhYmJi 发表于 2025-7-8 18:19
不过就算重签名不能用，也可以直接在26100.2454以上的系统改注册表（好像ARM64也可以），或者用VerifierDll

VerifierDll 是新旧全部通吃吗？

YWFhYmJi · 发表于 2025-7-8 21:05:04

martin313 发表于 2025-7-8 20:59
VerifierDll 是新旧全部通吃吗？

理论上是的，27881版本虚拟机测试没问题，但不知道之后会不会失效

martin313 · 发表于 2025-7-8 21:12:36

YWFhYmJi 发表于 2025-7-8 21:05
理论上是的，27881版本虚拟机测试没问题，但不知道之后会不会失效

我看前面的讨论是注入到winload.exe ? 但物理机启动用的是winload.efi文件，所以物理机启动的话，会不会失效？

YWFhYmJi · 发表于 2025-7-8 22:09:01

martin313 发表于 2025-7-8 21:12
我看前面的讨论是注入到winload.exe ? 但物理机启动用的是winload.efi文件，所以物理机启动的话，会不会 ...

不是，是注入到winlogon.exe。winload.exe是系统加载器，没法注入，winlogon.exe是登录应用程序，运行在用户模式下的R3进程，可以通过VerifierDll注入。

martin313 · 发表于 2025-7-9 06:26:21

YWFhYmJi 发表于 2025-7-8 22:09
不是，是注入到winlogon.exe。winload.exe是系统加载器，没法注入，winlogon.exe是登录应用程序，运行在 ...

哦，明白了。那确实是可以通用！厉害，牛逼

		自动登录	找回密码
密码			注册

(更新签名版)MTP补丁失效免替换文件解决方法

点评

点评

点评

点评

点评

点评

点评

点评

点评

浏览过的版块