Windows Product Activation Error Message at logon!

contains all delphi packages mentioned below
Post Reply
DeCoDish
Posts: 17
Joined: Wed Dec 03, 2008 3:10 pm

Windows Product Activation Error Message at logon!

Post by DeCoDish »

Hi Madshi,

I'm having a serious problem!

I'm getting the following error after I login.

A problem is preventing Windows from accurately checking the license for this computer. Error code: 0x800703e6

The service is already started BEFORE login in, and the service use the following hooks in the injected DLL

Code:
HookAPI('ntdll.dll', 'NtTerminateProcess', @NtTerminateProcessCallback, @NtTerminateProcessNext, NO_SAFE_UNHOOKING);
HookAPI('ntdll.dll', 'NtTerminateThread', @NtTerminateThreadCallback, @NtTerminateThreadNext, NO_SAFE_UNHOOKING);
HookAPI('ntdll.dll', 'NtSuspendThread', @NtSuspendThreadCallback, @NtSuspendThreadNext, NO_SAFE_UNHOOKING);
HookAPI('ntdll.dll', 'NtSuspendProcess', @NtSuspendProcessCallback, @NtSuspendProcessNext, NO_SAFE_UNHOOKING);
HookAPI(user32, 'ExitWindowsEx', @ExitWindowsExCallback, @ExitWindowsExNext);
HookAPI(advapi32, 'InitiateSystemShutdownW', @InitiateSystemShutdownWCallback, @InitiateSystemShutdownWNext);
HookAPI(advapi32, 'InitiateSystemShutdownExW', @InitiateSystemShutdownExWCallback, @InitiateSystemShutdownExWNext);



Please help!!!
Nico Bendlin
Posts: 46
Joined: Fri Apr 28, 2006 1:17 pm

Post by Nico Bendlin »

Make sure you don’t hook/patch the Software Licensing Service.
http://www.microsoft.com/whdc/system/vi ... guide.mspx
DeCoDish
Posts: 17
Joined: Wed Dec 03, 2008 3:10 pm

Post by DeCoDish »

I'm doing the hook on a Windows XP Sp3 based on the link you have provide it is for Vista & 2008 server!

I thought about something now... I'm denying the logoff (flag code 0 and 4) does windows use this flag at login or does window call the InitiateSystemShutdownExW at startup???

My second thought does wide system injection could cause this problem? perhaps using current session instead of all sessions might solve the problem? any Idea? I'll do some testing tomorrow when I get to work I'll try to change from all_session to current_session...

thankx for your advice and any help is appreciated.
Nico Bendlin
Posts: 46
Joined: Fri Apr 28, 2006 1:17 pm

Post by Nico Bendlin »

I don’t know.
Error code 0x800703e6 is HRESULT_FROM_WIN32(ERROR_NOACCESS) ("Invalid access to memory location.")

http://support.microsoft.com/kb/914232/en-us
DeCoDish
Posts: 17
Joined: Wed Dec 03, 2008 3:10 pm

Post by DeCoDish »

Happy New year everyone!

It's wierd but it works I just commented the following hooks and it works! Also the NtTerminateProcess, NtTerminateThread, NtSuspendThread and NtSuspendProcess are still working!!! Anyone know how this could happened??? I tough if I commented these hooks it will disactive it but it's not!!!

Why in the original Madshi example he is using hookApi(...)? in the hook dll and in my code it's working without using it.???

Thanks in advanced for explanation.


Code:
//HookAPI('ntdll.dll', 'NtTerminateProcess', @NtTerminateProcessCallback, @NtTerminateProcessNext, NO_SAFE_UNHOOKING);
//HookAPI('ntdll.dll', 'NtTerminateThread', @NtTerminateThreadCallback, @NtTerminateThreadNext, NO_SAFE_UNHOOKING);
//HookAPI('ntdll.dll', 'NtSuspendThread', @NtSuspendThreadCallback, @NtSuspendThreadNext, NO_SAFE_UNHOOKING);
//HookAPI('ntdll.dll', 'NtSuspendProcess', @NtSuspendProcessCallback, @NtSuspendProcessNext, NO_SAFE_UNHOOKING);
HookAPI(user32, 'ExitWindowsEx', @ExitWindowsExCallback, @ExitWindowsExNext);
HookAPI(advapi32, 'InitiateSystemShutdownW', @InitiateSystemShutdownWCallback, @InitiateSystemShutdownWNext);
HookAPI(advapi32, 'InitiateSystemShutdownExW', @InitiateSystemShutdownExWCallback, @InitiateSystemShutdownExWNext);
ismaelst
Posts: 1
Joined: Mon May 26, 2008 2:15 pm

Any new information

Post by ismaelst »

Hi guys,

I have been the same problem, does someone find out something about this case ??

I hooking some spoolers APIs, like:

HookAPI("spoolss.dll", "StartDocPrinterW", StartDocPrinterWCallback, (PVOID*) &StartDocPrinterWNext );

HookAPI("gdi32.dll", "StartDocW", StartDocWCallback, (PVOID*) &StartDocWNext );
HookAPI("gdi32.dll", "StartDocA", StartDocACallback, (PVOID*) &StartDocANext);

Thanks
madshi
Site Admin
Posts: 10754
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

Are you using the latest madCodeHook release?

http://madshi.net/madCollection.exe
Post Reply