Replacing system serial.sys

NTDEV
1

Hi All,

I remember seeing this on the forum somewhere. I just can’t open the
archived post, probably something is wrong with the mail server.
Anyways, how can I replace serial.sys by my driver ?
If I simply copy it over the system restores the original files and goes on
as if nothing happened. I tried to update driver with msport.inf and my
serial.sys. Still in vain.
Any ideas ?

Regards,
Stas Desy,
Powernet.

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

You need to disable WFP (Windows File protection).

Open the registry editor and select the

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

key. Then set the SFCDisable to ffffff9d
Reboot. And replace serial.sys. Windows shouldn’t replace the file anymore.

Matteo

----- Original Message -----
From: “stas”
To: “NT Developers Interest List”
Sent: Monday, April 09, 2001 10:49 AM
Subject: [ntdev] Replacing system serial.sys

> Hi All,
>
> I remember seeing this on the forum somewhere. I just can’t open the
> archived post, probably something is wrong with the mail server.
> Anyways, how can I replace serial.sys by my driver ?
> If I simply copy it over the system restores the original files and goes
on
> as if nothing happened. I tried to update driver with msport.inf and my
> serial.sys. Still in vain.
> Any ideas ?
>
> Regards,
> Stas Desy,
> Powernet.
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@dolce.it
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

From the MSDN article I see the below description for SFCDisable

SFCDisable (REG_DWORD)
0 = enabled (default)
1 = disabled, prompt at boot to re-enable
2 = disabled at next boot only, no prompt to re-enable
4 = enabled, with popups disabled

NOTE: For options 1 and 2: Both of these options require a kernel debugger
to be hooked up for those options to become useable. If a kernel debugger is
not hooked up, Windows File Protection is not disabled

http://support.microsoft.com/support/kb/articles/Q222/4/73.ASP

It says for option 1 and 2 kernel debugger is required… Is there
anyway i can replace standard files without kernel debugger enabled?

best regards,
Anoop

-----Original Message-----
From: Matteo Pelati [mailto:xxxxx@dolce.it]
Sent: Monday, April 09, 2001 3:44 PM
To: NT Developers Interest List
Subject: [ntdev] Re: Replacing system serial.sys

You need to disable WFP (Windows File protection).

Open the registry editor and select the

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

key. Then set the SFCDisable to ffffff9d
Reboot. And replace serial.sys. Windows shouldn’t replace the file anymore.

Matteo

----- Original Message -----
From: “stas”
To: “NT Developers Interest List”
Sent: Monday, April 09, 2001 10:49 AM
Subject: [ntdev] Replacing system serial.sys

> Hi All,
>
> I remember seeing this on the forum somewhere. I just can’t open the
> archived post, probably something is wrong with the mail server.
> Anyways, how can I replace serial.sys by my driver ?
> If I simply copy it over the system restores the original files and goes
on
> as if nothing happened. I tried to update driver with msport.inf and my
> serial.sys. Still in vain.
> Any ideas ?
>
> Regards,
> Stas Desy,
> Powernet.
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@dolce.it
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntdev as: xxxxx@nestec.net
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

Read this message again. Matteo Pelati told you how to do it.

----- Original Message -----
From: “ANOOP.G”
To: “NT Developers Interest List”
Sent: Tuesday, April 10, 2001 1:56 AM
Subject: [ntdev] Re: Replacing system serial.sys

>
> From the MSDN article I see the below description for SFCDisable
>
> SFCDisable (REG_DWORD)
> 0 = enabled (default)
> 1 = disabled, prompt at boot to re-enable
> 2 = disabled at next boot only, no prompt to re-enable
> 4 = enabled, with popups disabled
>
> NOTE: For options 1 and 2: Both of these options require a kernel debugger
> to be hooked up for those options to become useable. If a kernel debugger
is
> not hooked up, Windows File Protection is not disabled
>
> http://support.microsoft.com/support/kb/articles/Q222/4/73.ASP
>
> It says for option 1 and 2 kernel debugger is required… Is there
> anyway i can replace standard files without kernel debugger enabled?
>
> best regards,
> Anoop
>
> -----Original Message-----
> From: Matteo Pelati [mailto:xxxxx@dolce.it]
> Sent: Monday, April 09, 2001 3:44 PM
> To: NT Developers Interest List
> Subject: [ntdev] Re: Replacing system serial.sys
>
>
> You need to disable WFP (Windows File protection).
>
> Open the registry editor and select the
>
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
>
> key. Then set the SFCDisable to ffffff9d
> Reboot. And replace serial.sys. Windows shouldn’t replace the file
anymore.
>
> Matteo
>
>
> ----- Original Message -----
> From: “stas”
> To: “NT Developers Interest List”
> Sent: Monday, April 09, 2001 10:49 AM
> Subject: [ntdev] Replacing system serial.sys
>
>
> > Hi All,
> >
> > I remember seeing this on the forum somewhere. I just can’t open the
> > archived post, probably something is wrong with the mail server.
> > Anyways, how can I replace serial.sys by my driver ?
> > If I simply copy it over the system restores the original files and goes
> on
> > as if nothing happened. I tried to update driver with msport.inf and my
> > serial.sys. Still in vain.
> > Any ideas ?
> >
> > Regards,
> > Stas Desy,
> > Powernet.
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@dolce.it
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@nestec.net
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
> —
> You are currently subscribed to ntdev as: xxxxx@mindspring.com
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

5

doing this for test is ok, but NEVER do this on a shipping driver. the user
can easily revert the driver back by running sfc.exe. if you’re shipping
something like this you need to get the binaries signed.

-----Original Message-----
From: David J. Craig [mailto:xxxxx@mindspring.com]
Sent: Tuesday, April 10, 2001 7:40 PM
To: NT Developers Interest List
Subject: [ntdev] Re: Replacing system serial.sys

Read this message again. Matteo Pelati told you how to do it.

----- Original Message -----
From: “ANOOP.G”
To: “NT Developers Interest List”
Sent: Tuesday, April 10, 2001 1:56 AM
Subject: [ntdev] Re: Replacing system serial.sys

>
> From the MSDN article I see the below description for SFCDisable
>
> SFCDisable (REG_DWORD)
> 0 = enabled (default)
> 1 = disabled, prompt at boot to re-enable
> 2 = disabled at next boot only, no prompt to re-enable
> 4 = enabled, with popups disabled
>
> NOTE: For options 1 and 2: Both of these options require a kernel debugger
> to be hooked up for those options to become useable. If a kernel debugger
is
> not hooked up, Windows File Protection is not disabled
>
> http://support.microsoft.com/support/kb/articles/Q222/4/73.ASP
>
> It says for option 1 and 2 kernel debugger is required… Is there
> anyway i can replace standard files without kernel debugger enabled?
>
> best regards,
> Anoop
>
> -----Original Message-----
> From: Matteo Pelati [mailto:xxxxx@dolce.it]
> Sent: Monday, April 09, 2001 3:44 PM
> To: NT Developers Interest List
> Subject: [ntdev] Re: Replacing system serial.sys
>
>
> You need to disable WFP (Windows File protection).
>
> Open the registry editor and select the
>
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
>
> key. Then set the SFCDisable to ffffff9d
> Reboot. And replace serial.sys. Windows shouldn’t replace the file
anymore.
>
> Matteo
>
>
> ----- Original Message -----
> From: “stas”
> To: “NT Developers Interest List”
> Sent: Monday, April 09, 2001 10:49 AM
> Subject: [ntdev] Replacing system serial.sys
>
>
> > Hi All,
> >
> > I remember seeing this on the forum somewhere. I just can’t open the
> > archived post, probably something is wrong with the mail server.
> > Anyways, how can I replace serial.sys by my driver ?
> > If I simply copy it over the system restores the original files and goes
> on
> > as if nothing happened. I tried to update driver with msport.inf and my
> > serial.sys. Still in vain.
> > Any ideas ?
> >
> > Regards,
> > Stas Desy,
> > Powernet.
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@dolce.it
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@nestec.net
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
> —
> You are currently subscribed to ntdev as: xxxxx@mindspring.com
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntdev as: xxxxx@veritas.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com