Red Stars Programming, food, and rambling

22Jul/097

Hacking Windows XP PowerToy Calculator to run in Vista/Windows 7

This was more of a project than I was originally expecting, Microsoft prevents the Windows XP Powertoy Calculator from running in Vista or Windows 7 in 2 separate places, but in the end, it runs perfectly in Vista, all the limitations are false.

Don't feel like doing this yourself? No need! :)

 

Part 1: The Installer


When running PowerCalcPowertoySetup.exe, it complained that I'm not on Windows XP. Fair enough, but is that really important?

The exe installer dumped the MSI file at C:\Windows\Downloaded Installations\Calculator Powertoy for Windows XP.msi which I ran MsiDiff on to dump the MSI script. This gave me Calculator Powertoy for Windows XP.msi.MmDumpTxt which I searched for the above error in.

<$Row
	Condition="VersionNT = 501"
	Description="The powertoys require Windows XP or a service pack. They will not function on a version of Windows earlier or later than Windows XP."
>

Perfect. 501 is the Windows XP kernel version. Lets change that to the Vista kernal version in the MSI...


Sweet! It worked!

Part 2: Oh... no...

Running PowerCalc.exe causes it to exit before ever giving us a GUI. Lets do a trace in OllyDbg and see what we can figure out.

01018405	Main	JE SHORT PowerCal.0101840C
0101840C	Main	TEST BYTE PTR SS:[EBP-30],1
01018410	Main	JE SHORT PowerCal.01018423
01018412	Main	MOVZX ECX,WORD PTR SS:[EBP-2C]	ECX=0000000A
01018416	Main	JMP SHORT PowerCal.01018426
01018426	Main	PUSH ECX	Arg4 = 0000000A
01018427	Main	PUSH EAX	Arg3 = 001E1F33
01018428	Main	PUSH EBX	Arg2 = 00000000
01018429	Main	PUSH PowerCal.01000000	Arg1 = 01000000
0101842E	Main	CALL PowerCal.01001FD3	EAX=00000000, ECX=D73F2C3E, EDX=7F68081A
01018433	Main	MOV ESI,EAX
01018435	Main	MOV DWORD PTR SS:[EBP-7C],ESI
01018438	Main	CMP DWORD PTR SS:[EBP-60],EBX
0101843B	Main	JNZ SHORT PowerCal.01018444
0101843D	Main	PUSH ESI	status = 0
0101843E	Main	CALL DWORD PTR DS:[<&msvcrt.exit>]	ECX=0006FE28, EDX=00000000, EBP=0006FE84, ESI=00000001, EDI=00831BF0
    Process terminated, exit code 0

The bottom of the trace-over isn't telling us much. Lets check out some of these offsets in IDA Pro and see what we can come up with.


All the stuff around 0101843B seems to exit the program, and none of these other offsets get us anywhere... lets run a trace-into and see what we get.

Aside from a 75mb text file, we get: (search from the bottom up for our programs address space! There's a lot of external code in there!).

010180E3	Main	RETN
01001FD1	Main	LEAVE	EBP=0006FEE4
01001FD2	Main	RETN
01001FDF	Main	TEST EAX,EAX
01001FE1	Main	JE PowerCal.010020A0
010020A0	Main	XOR EAX,EAX
010020A2	Main	POP ESI
010020A3	Main	LEAVE	EBP=0006FF88
010020A4	Main	RETN 10
01018433	Main	MOV ESI,EAX
01018435	Main	MOV DWORD PTR SS:[EBP-7C],ESI
01018438	Main	CMP DWORD PTR SS:[EBP-60],EBX
0101843B	Main	JNZ SHORT PowerCal.01018444
0101843D	Main	PUSH ESI	status = 0
0101843E	Main	CALL DWORD PTR DS:[<&msvcrt.exit>]
exit	Main	MOV EDI,EDI

Now we're talking! It looks like a function returns and then the program exits. Lets check out the call to that function.

One path goes to the exit, the other... doesn't! Lets check out sub_1001F60 to see what it does...


It's our evil Windows Version Checking function!

In OllyDbg lets goto the jz loc_10020A0 after the function call, right click, and goto "nop" and press run. This causes the program to always follow the non-exiting code path.


Success!


Lets hex edit that into the executable so it's like this all the time.

We can now use our calculator!

Filed under: Software Leave a comment
Comments (7) Trackbacks (0)
  1. I’ve been using this calc for years in XP and could never find a suitable win7 replacement… until today. Your hack has made my day!

    I also missed the binary link on the first read, and did the hex edit myself.

    Thanks

  2. Congratulations on your interesting hacking. Power Calculator was a useful tool for me. I was also thinking about doing some hacking to make it work with vista…I never though I would have been so difficult, I could not have done it by myself. Thanks a lot for providing an easy way

  3. this is cool – how can i do this? any tutorials?

    thanks for this hack on powertoy calculator, i can now run it on windows 2000.

  4. is there any free software that does that? ida is pay and ollydbg has a free version (how useful not sure).

  5. There is a free version of IDA but it’s more limited. An easier way to go about this would of been to set a break point on any version checking API you can find for windows via the ollydbg console, wait for it to be hit, then follow the stack backwards into the applications code. Much simpler way to find the relevant code than to use a trace.

  6. I like this. I respect diving into the assembly; even if it’s not the easiest solution, it’s probably the most entertaining.

    For those of you looking for a calculator, I can also recommend the open source SpeedCrunch, especially if you don’t use PowerToy Calculator’s graphing features.

    @digitallyhere: I’ve found the free version of OllyDbg pleasant to use for making similar tweaks to other binaries.

    Cheers!

  7. I’ve used powertoy calc forever – for it’s easy graphing, proper windows interface, and the ability to type in long equations.

    It’s really odd that microsoft didn’t include it as the default in higher operating systems, but I can confirm that power toy calc now works in windows 8 =)

    You rock!!


Leave a comment

No trackbacks yet.