enable shutdown buttons on 64Bit Win7PE/Win8PE

Alternative to reboottrace and reboot.dll for x64 PE.

hooking start menu Shutdown button --> runs wpeutil.exe Shutdown
hooking start menu Restart button      --> runs wpeutil.exe Reboot

Shutdown_x64.script

New dll's (Win8PE ready) Reboot-Hook.7z

suggestions and feedback welcome

 

Thank you. Works nice.

At reeboottrace.exe and reboot.dll what i have seen is reboottrace.exe waits at background if the shutdown command given or not. When i use procmon  i can see reboottrace.exe activity. As i see there is no exe file here. Will only use a dll stop this unwanted activity seen at procmon? Is this dll works same as reboottrace.exe and reboot.dll? (i did not look source code of them). Reboottrace.exe and reboot.dll works nice until now but can you code x86 version of this as an option?

Thank you. Works nice.

At reeboottrace.exe and reboot.dll what i have seen is reboottrace.exe waits at background if the shutdown command given or not. When i use procmon  i can see reboottrace.exe activity. As i see there is no exe file here. Will only use a dll stop this unwanted activity seen at procmon? Is this dll works same as reboottrace.exe and reboot.dll? (i did not look source code of them). Reboottrace.exe and reboot.dll works nice until now but can you code x86 version of this as an option?

reboottrace.exe is just a loader to put reboot.dll into memory. reboot.dll does all the work.
ShutdownPE (SPEHook.dll) and JFX's ReBoot.dll are loaded into memory on windows startup so there is no need for the "loader" .exe

Alternative to reboottrace and reboot.dll for x64 PE.

suggestions and feedback welcome

 

I am interested in how you are doing the x64 hooking if you are willing to share the information.

hi vurrat,

nice you joined our forum here 
reboot.dll is loaded, like homes32 said, by windows. Every app that loads user32.dll (basicly every GUI-app) will load reboot.dll.

Sorry but i can't make a stable x86 version.

I am interested in how you are doing the x64 hooking if you are willing to share the information.

I found that post of DarkDragon from PureBasic forum

intercept API

And just change the hook form MessageBoxA to ExitWindowsEx.

 

Thank you. It was the most need and and last problem for my x64. It is very surprising that when i need something in short a while you make a working patch to that situation without any communicate each others. Like you read my mind. When i post something in my topics i always take care to original link to the authors posts (mostly yours) i think there is no problem by your side?

I found that post of DarkDragon from PureBasic forum

intercept API

And just change the hook form MessageBoxA to ExitWindowsEx.

 

thanks for sharing. unfortunately the dissembler doesn't seem to be all that great. :(
but I have been having good progress on another method and soon ShutdownPE will be able to handle x64 shell integration!

Thank you. It was the most need and and last problem for my x64. It is very surprising that when i need something in short a while you make a working patch to that situation without any communicate each others. Like you read my mind. When i post something in my topics i always take care to original link to the authors posts (mostly yours) i think there is no problem by your side?

he he no mind reader, just very same interests for our WinPE stuff. Sure no problem you can share and use all as you like.

ShutdownPE will be able to handle x64 shell integration!

Thanks 

ok here is the RC for shutdownpe with x64 shell intergration. let me know if you find any issues.

JFX I wasn't able to use the intercept API you posted but thanks for brining up the x64 issue again and getting my brain running on the problem! :)

looks very good 

But please avoid using Mpress specially for dll's.

With earlier version of mpress all worked nice with vista x64, but then all app were crashing with windows 7 x64.
Now same story with Windows 8 prerelease 

 

looks very good 

But please avoid using Mpress specially for dll's.

With earlier version of mpress all worked nice with vista x64, but then all app were crashing with windows 7 x64.
Now same story with Windows 8 prerelease 

 

interesting. I haven't seen this on any of my win7 x64 computers/builds...is the issue reproduceable?
main reason for usign mpress is the x64 support and slightly better compression than UPX...but the dlls are ony ~60KB unpacked and most of that is from static link to msvc10 so if its an issue it would not be a big deal to leave them unpacked. do you know of any other good packers that support x64?

The problem with window7 was fixed with mpress 2.1? . But there no solution for Windows 8 build 7989 x64, every x64 app will crash.

Well compile Autoit product can always be recovered by cut&paste the a3x to a clean AU3 interpreter, but the dll would much more difficult.
Would stick with mpress for x64 Autoit files, as there no good alternative.

Sure that mpress has better compression?

for autoit files: upx --lzma --best --filter=0x49 %1

 

The problem with window7 was fixed with mpress 2.1? . But there no solution for Windows 8 build 7989 x64, every x64 app will crash.

Well compile Autoit product can always be recovered by cut&paste the a3x to a clean AU3 interpreter, but the dll would much more difficult.
Would stick with mpress for x64 Autoit files, as there no good alternative.

Sure that mpress has better compression?

for autoit files: upx --lzma --best --filter=0x49 %1

 

hmmm. I'm using MPRESS 2.1.8 good information for me to keep in mind anyways.
anyways here is an unpacked x64 dll if you want to test with win 8

Thank you very much guys for the shutdown reboot in x64  .
I integrated JFX reboot.dll for x64 in script explorer and µexplorer (with x86 RebootTrace), it works very well.
I tried shutdownPE in x64, it works very well too.

I let you see for mpress, if there is any doubt, is not it better SPEHook x64 unpacked, the gain is only 46 KB.
Hoping to see soon upx for x64 with a difficult beginning in version 3.08 beta.

 

 explorer.7z (246.8 kB - downloaded 372 times.)

Works perfect now, also on win8 prerelease, and use 1 MB less RAM

Well, just read that now with windows 8 ExitWindowsEx can set a new flag called EWX_HYBRID_SHUTDOWN.
So I updated my Reboot hooks Reboot-Hook.7z

You can use them with the old AppInit_DLLs method:

Code: [Select]

[HKEY_LOCAL_MACHINE\PE-SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="ReBoot.dll"
"LoadAppInit_DLLs"=dword:00000001
"RequireSignedAppInit_DLLs"=dword:00000000

 

Thanks JFX,

It is nice to see you continue with starting being The Man of W8 world around