Jump to content











Photo
- - - - -

offlinereg


  • Please log in to reply
314 replies to this topic

#301 alacran

alacran

    Gold Member

  • .script developer
  • 1620 posts
  •  
    Mexico

Posted 17 December 2019 - 06:31 PM

No, the suggested change didn't work, we don't have now the two extra lines at the end, (wich is good) but the "ImagePath"=system32\DRIVERS\wofadk.sys is uncomplete, it seems to me it is necessary to increase the length for the acepted values on the program.

 

I think this is a change erwan.l needs to  do to his program, to make it more reliable.

 

EDIT: But for now it is better to check all hex entries on the GUI, particularly the long ones, and if we know the meaning of the hex value in a human readable way, we can edit that value on the GUI.

 

See attached picture.

 

alacran

Attached Thumbnails

  • Fail.png


#302 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 2905 posts
  • Location:Nantes - France
  •  
    France

Posted 18 December 2019 - 06:23 PM

No, the suggested change didn't work, we don't have now the two extra lines at the end, (wich is good) but the "ImagePath"=system32\DRIVERS\wofadk.sys is uncomplete, it seems to me it is necessary to increase the length for the acepted values on the program.

 

I think this is a change erwan.l needs to  do to his program, to make it more reliable.

 

EDIT: But for now it is better to check all hex entries on the GUI, particularly the long ones, and if we know the meaning of the hex value in a human readable way, we can edit that value on the GUI.

 

See attached picture.

 

alacran

 

Hi Alacran,

 

I am not very present these days (busy life, changing job, etc) but do read all posts i subscribed.

This one looks like an easy one to fix.

Provide with me the inputs (a reg file?) and the command line you use and I'll tshoot/fix it.

 

Cheers,

Erwan


  • ReTokener and alacran like this

#303 alacran

alacran

    Gold Member

  • .script developer
  • 1620 posts
  •  
    Mexico

Posted 18 December 2019 - 06:54 PM

Hi erwan.l

 

It is good to talk with you, always very friendly and ready to hear comments.

 

This is the reg file:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WofAdk]
"DebugFlags"=dword:00000000
"ErrorControl"=dword:00000001
"Start"=dword:00000000
"SupportedFeatures"=dword:00000003
"Tag"=dword:00000002
"Type"=dword:00000002
"DependOnService"=hex(7):46,00,6c,00,74,00,4d,00,67,00,72,00,00,00
"Description"="WofAdk Mini-Filter Driver"
"DisplayName"="WofAdk"
"Group"="FSFilter Compression"
"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\
  52,00,49,00,56,00,45,00,52,00,53,00,5c,00,77,00,6f,00,66,00,61,00,64,00,6b,\
  00,2e,00,73,00,79,00,73,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WofAdk\Instances]
"DefaultInstance"="WofAdk Instance"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WofAdk\Instances\WofAdk Instance]
"Altitude"="40730"
"Flags"=dword:00000000

And I used this command:

 

offlinereg-win64 "C:\temp\Windows\System32\config\system" "D:\Aplicaciones\offlinereg\WofAdk.reg" import WofAdk.reg

 

For more info and some images you can take a look of all details starting from this post: http://reboot.pro/to...-12#entry213603on previous page

 

Thanks very much for this fantastic tool, and for your interest in fixing this issue.

 

Your friend

 

alacran



#304 alacran

alacran

    Gold Member

  • .script developer
  • 1620 posts
  •  
    Mexico

Posted 20 December 2019 - 07:26 PM

Also tried offlinereg-win64 "C:\temp\Windows\System32\config\system" " " import WofAdk.reg with same result.  (offlinereg-win64 and WofAdk.reg are on same folder).

 

Just for testing I decided to make a command.txt, to test it this way, this is my manually converted reg to commands:

 

wofadk.txt:

CurrentControlSet\services createkey WofAdk
CurrentControlSet\services\WofAdk setvalue DebugFlags 00000000 4
CurrentControlSet\services\WofAdk setvalue ErrorControl 00000001 4
CurrentControlSet\services\WofAdk setvalue Start 00000000 4
CurrentControlSet\services\WofAdk setvalue SupportedFeatures 00000003 4
CurrentControlSet\services\WofAdk setvalue Tag 00000002 4
CurrentControlSet\services\WofAdk setvalue Type 00000002 4
CurrentControlSet\services\WofAdk setvalue DependOnService FltMgr 7
CurrentControlSet\services\WofAdk setvalue Description "WofAdk Mini-Filter Driver"
CurrentControlSet\services\WofAdk setvalue DisplayName WofAdk
CurrentControlSet\services\WofAdk setvalue Group "FSFilter Compression"
CurrentControlSet\services\WofAdk setvalue ImagePath "system32\DRIVERS\wofadk.sys" 2
CurrentControlSet\services\WofAdk createkey Instances
CurrentControlSet\services\WofAdk\Instances setvalue DefaultInstance "WofAdk Instance"
CurrentControlSet\services\WofAdk\Instances createkey "WofAdk Instance"
"CurrentControlSet\services\WofAdk\Instances\WofAdk Instance" setvalue Altitude 40730
"CurrentControlSet\services\WofAdk\Instances\WofAdk Instance" setvalue Flags 00000000 4

Where the final numbers are:

NO Number = REG_SZ

4 = dword

7 = hex(7) = REG_MULTI_SZ

2 = hex(2) = REG_EXPAND_SZ

 

when running offlinereg-win64 "C:\temp\Windows\System32\config\system" " " run wofadk.txt all is applied fine.
 

Unfortunately it is a tedious and time consuming work to conver the reg file to commands, and in some cases we may not know the human readable translation of the REG_MULTI_SZ [hex(7)] or REG_EXPAND_SZ [hex(2)] values.

 

I found this free tool to convert from both to a human readable translation and vice versa, valid for Windows Registry Editor Versions 4.00 and 5.00, just select what conversion you want, copy the value and make a click on Convert it!, it works fine.

 

OTConvertIt page and dowmload: http://www.geekstogo...04-otconvertit/

 

Hope our fellow erwan.l fix the reg import issue soon, as he mentioned.

 

But on the meantime we have this alternative too.

 

Merry christmas to all

 

alacran


  • ReTokener likes this

#305 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 2905 posts
  • Location:Nantes - France
  •  
    France

Posted 20 December 2019 - 08:48 PM

...

 

For more info and some images you can take a look of all details starting from this post: http://reboot.pro/to...-12#entry213603on previous page

 

Thanks very much for this fantastic tool, and for your interest in fixing this issue.

 

Your friend

 

alacran

 

 

I copy pasted the registry entries from this post to woadk.reg.

 

Then used this command : offlinereg-win64 alacran WofAdk.reg import WofAdk.reg

 

This gave the below output 

[CurrentControlSet\services\WofAdk]
added -> DebugFlags=dword:0
added -> ErrorControl=dword:1
added -> Start=dword:0
added -> SupportedFeatures=dword:3
added -> Tag=dword:2
added -> Type=dword:2
added -> DependOnService=hex(7):FltMgr
added -> Description=string:WofAdk Mini-Filter Driver
added -> DisplayName=string:WofAdk
added -> Group=string:FSFilter Compression
added -> ImagePath=hex(2):system32\DRIVERS\wofadk.sys
[CurrentControlSet\services\WofAdk\Instances]
added -> DefaultInstance=string:WofAdk Instance
[CurrentControlSet\services\WofAdk\Instances\WofAdk Instance]
added -> Altitude=string:40730
added -> Flags=dword:0
saved to alacran ok 

And did not encounter the issue?

Are you using latest version 1.0.3?

 

I copy pasted the registry entries from this post to woadk.reg.

 

Then used this command : offlinereg-win64 alacran WofAdk.reg import WofAdk.reg

 

This gave the below output 

[CurrentControlSet\services\WofAdk]
added -> DebugFlags=dword:0
added -> ErrorControl=dword:1
added -> Start=dword:0
added -> SupportedFeatures=dword:3
added -> Tag=dword:2
added -> Type=dword:2
added -> DependOnService=hex(7):FltMgr
added -> Description=string:WofAdk Mini-Filter Driver
added -> DisplayName=string:WofAdk
added -> Group=string:FSFilter Compression
added -> ImagePath=hex(2):system32\DRIVERS\wofadk.sys
[CurrentControlSet\services\WofAdk\Instances]
added -> DefaultInstance=string:WofAdk Instance
[CurrentControlSet\services\WofAdk\Instances\WofAdk Instance]
added -> Altitude=string:40730
added -> Flags=dword:0
saved to alacran ok 

And did not encounter the issue?

Are you using latest version 1.0.3?

 

jQBRPIO.png



#306 alacran

alacran

    Gold Member

  • .script developer
  • 1620 posts
  •  
    Mexico

Posted 20 December 2019 - 09:12 PM

I downloaded your program from the downlad on link on fist post, Is that the 1.03 version?

 

EDIT: Just checked and it is labeled as offlinereg 1.0.3, but, just in case Could you give me a link to your site please?

 

Thanks in advance

 

alacran



#307 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 2905 posts
  • Location:Nantes - France
  •  
    France

Posted 20 December 2019 - 09:22 PM

I downloaded your program from the downlad on link on fist post,Is that the 1.03 version?

 

EDIT: Just checked and it is labeled as offlinereg 1.0.3, but, just in case Could you give me a link to your site please?

 

Thanks in advance

 

alacran

 

direct link 



#308 Atari800XL

Atari800XL

    Frequent Member

  • Advanced user
  • 125 posts
  •  
    Netherlands

Posted 20 December 2019 - 09:27 PM

Sorry if I forgot something, but why are we using the double mention of the .reg file?

 

offlinereg-win64 alacran WofAdk.reg import WofAdk.reg

Should we not use this?

 

offlinereg-win64 alacran " " import WofAdk.reg

 

Sorry, the double .reg confuses me...?

 



#309 alacran

alacran

    Gold Member

  • .script developer
  • 1620 posts
  •  
    Mexico

Posted 20 December 2019 - 09:30 PM

Just tested again, the issue is present here see attached image, I'm on Win7x64, (AV disabled), if this can be a factor to influence this issue.

 

alacran

 

EDIT: I was writing when you put the link, I will test now with a download from your new link, and report back.

Attached Thumbnails

  • offlinereg.png


#310 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 2905 posts
  • Location:Nantes - France
  •  
    France

Posted 20 December 2019 - 09:33 PM

Sorry if I forgot something, but why are we using the double mention of the .reg file?

 

offlinereg-win64 alacran WofAdk.reg import WofAdk.reg

Should we not use this?

 

offlinereg-win64 alacran " " import WofAdk.reg

 

Sorry, the double .reg confuses me...?

 

correct, type on my end, it should be : offlinereg-win64 alacran " " import WofAdk.reg

 

alacran here is my hive.



#311 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 2905 posts
  • Location:Nantes - France
  •  
    France

Posted 20 December 2019 - 09:37 PM

Just tested again, the issue is present here see attached image, I'm on Win7x64, (AV disabled), if this can be a factor to influence this issue.

 

alacran

 

EDIT: I was writing when you put the link, I will test now with a download from your new link, and report back.

 

I believe the issue is either with crlf and/or the ucs-2 format (your file has "magical" chars $fffe at the start of the file which you can see in a hex editor).

 

Copy paste the below to fresh new text file and try again to exclude the ucs-2 issue (i.e do not use the reg file generated by regedit).

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WofAdk]
"DebugFlags"=dword:00000000
"ErrorControl"=dword:00000001
"Start"=dword:00000000
"SupportedFeatures"=dword:00000003
"Tag"=dword:00000002
"Type"=dword:00000002
"DependOnService"=hex(7):46,00,6c,00,74,00,4d,00,67,00,72,00,00,00
"Description"="WofAdk Mini-Filter Driver"
"DisplayName"="WofAdk"
"Group"="FSFilter Compression"
"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\
  52,00,49,00,56,00,45,00,52,00,53,00,5c,00,77,00,6f,00,66,00,61,00,64,00,6b,\
  00,2e,00,73,00,79,00,73,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WofAdk\Instances]
"DefaultInstance"="WofAdk Instance"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WofAdk\Instances\WofAdk Instance]
"Altitude"="40730"
"Flags"=dword:00000000

If still not working, try again with the below

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WofAdk]
"DebugFlags"=dword:00000000
"ErrorControl"=dword:00000001
"Start"=dword:00000000
"SupportedFeatures"=dword:00000003
"Tag"=dword:00000002
"Type"=dword:00000002
"DependOnService"=hex(7):46,00,6c,00,74,00,4d,00,67,00,72,00,00,00
"Description"="WofAdk Mini-Filter Driver"
"DisplayName"="WofAdk"
"Group"="FSFilter Compression"
"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,77,00,6f,00,66,00,61,00,64,00,6b,00,2e,00,73,00,79,00,73,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WofAdk\Instances]
"DefaultInstance"="WofAdk Instance"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WofAdk\Instances\WofAdk Instance]
"Altitude"="40730"
"Flags"=dword:00000000


#312 Atari800XL

Atari800XL

    Frequent Member

  • Advanced user
  • 125 posts
  •  
    Netherlands

Posted 20 December 2019 - 09:42 PM

I agree, I think Alacran's reg file got screwed...

Anyway, thanks for clearing up that double .reg thingy (who thought of that, and WHY did it even work!!?



#313 alacran

alacran

    Gold Member

  • .script developer
  • 1620 posts
  •  
    Mexico

Posted 20 December 2019 - 09:43 PM

@ erwan.l

 

The files donwnloaded from your last link are the same as I have, but anyway I tested with the just downloaded and same thing.

 

alacran



#314 alacran

alacran

    Gold Member

  • .script developer
  • 1620 posts
  •  
    Mexico

Posted 20 December 2019 - 09:55 PM

@ erwan.l

 

Just copied:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WofAdk]
"DebugFlags"=dword:00000000
"ErrorControl"=dword:00000001
"Start"=dword:00000000
"SupportedFeatures"=dword:00000003
"Tag"=dword:00000002
"Type"=dword:00000002
"DependOnService"=hex(7):46,00,6c,00,74,00,4d,00,67,00,72,00,00,00
"Description"="WofAdk Mini-Filter Driver"
"DisplayName"="WofAdk"
"Group"="FSFilter Compression"
"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\
  52,00,49,00,56,00,45,00,52,00,53,00,5c,00,77,00,6f,00,66,00,61,00,64,00,6b,\
  00,2e,00,73,00,79,00,73,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WofAdk\Instances]
"DefaultInstance"="WofAdk Instance"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WofAdk\Instances\WofAdk Instance]
"Altitude"="40730"
"Flags"=dword:00000000

And made new WofAdk.reg and used same command I have been using:

 

offlinereg-win64 "C:\temp\Windows\System32\config\system" " " import WofAdk.reg

 

And all worked fine see attached picture, so this means we can't use reg files generated by regedit or we need to do some trick to them before using, please explain me.

 

EDIT: This test was made on win 7x64 too, I saw your last post after writing mine.

 

alacran

Attached Thumbnails

  • Fine.png


#315 alacran

alacran

    Gold Member

  • .script developer
  • 1620 posts
  •  
    Mexico

Posted 20 December 2019 - 10:23 PM

Answering myself: (after just testing the following)

 

If we copy the content of a reg file generated by regedit.exe to a new text file and then save it as xxxxx.reg, then it can be used without any problem on Offlinereg.

 

@ erwan.l

 

It is good the issue is very easy to avoid. I suggest you to make a note on first post and on download page about this issue and how to avoid it.

 

Thanks for all your time, I am sorry to disturb you, but I think at the end, it was good to find the cause of the issue and let other people not have same troubles.

 

Offlinereg is working fantastic, thanks for this tool erwan.l, I appreciate a lot your contributions for us.

 

Your friend

 

alacran






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users