/*
[SFPDisable - Disables the Windows File Protection]
Copyright (C) [2003]  [Delikon]

This program is free software; you can redistribute it and/or modify it 
under the terms of the GNU General Public License as published by the Free Software Foundation;
either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, 
but WITHOUT ANY WARRANTY; without even the implied warranty of 
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program;
if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, 
MA 02111-1307, USA.


The C implementation based on 
http://29a.host.sk/29a-6/29a-6.201

and 

thanks to Zoltan Csizmadia, zoltan_csizmadia@yahoo.com, 
for makes me much easier to write this code.


ich@delikon.de / www.delikon.de
*/

-----------FIRST STEPS--------------------------------------------------------------------------------

-First compile both workspaces
-Copy injectDll.Dll in your system32 folder.

double-click winlogoninject.exe
------------------------------------------------------------------------------------------------------
-----------HOW DOES IT WORK?--------------------------------------------------------------------------
winlogoninject.exe starts a remote thread in the winlogon process, which loads and starts a dll function.
This function patch the sfc.dll or sfc_os.dll(XP) with a ExitThread(0) in memory.
After rebooting the sfc.dll is, of course the originally one ;-)
------------------------------------------------------------------------------------------------------


----------NOtize-------------------------------------------------------------------------------------
After disabling SFP, you can delete, manipulate and backdoor every file.
After rebooting, windows DOESN'T change the manipulated file!
But if the SFP is enabled again please, don't manipulate it again, because then it will be replaced.
-----------------------------------------------------------------------------------------------------

----------Sourcecode and Binary---------------------------------------------------------------------

http://www.delikon.de/zips/SFPDisable.zip

http://www.delikon.de/zips/SFPDisable-binary.zip

-----------------------------------------------------------------------------------------------------


I have successfully tested it under win2k and win XP.

