Short:Problem: Snipping Tool from Vista SKUs does not start on Server 2008 Solution:
- Create a new directory, SnipTool
- Copy System32\SnippingTool.exe to SnipTool
- Copy System32\en-US\SnippingTool.exe.mui to SnipTool\en-US
- Create a file called SnippingTool.exe.local in SnipTool directory.
- Download this Zip file
- Extract the contents of the Zip file, copy slc/x86/slc.dll to SnipTool directory (replace x86 with x64 on a 64-bit OS).
Long: Eh.. So, at work we are 'blessed' with using '08 Server as a workstation. Also, at work we sometimes like to file bugs. Also, some weird people prefer including screenshots for clarity. So here's the problem: 1. Vista has a neat component called Snipping Tool (SnippingTool.exe). 2. This component does not run on Srv'08 Task: Make it run on SRV'08 Bonus: Without patching the binary (cause that would be <scary_voice>illegal</scary_voice>) So, we fire up the debugger... 1. We figure out that the program runs if CTabLicense::GetBOOLPermission (bless the symbol server) returns 1. Cool..now, we could patch this, but we'll see if there's a (more) legal way. 2. Fire up IDA (on the afterthought, IDA was an overkill, the whole function listing fits into a single screen in ntsd), CTabLicense::GetBOOLPermission calls slc!SLGetWindowsInformationDWORD - new evil API added to Vista as a part of SPP (Software Protection Platform) that is just an obfuscated (for no obvious reason) wrapper for mysterious ntdll!NtQueryLicenseValue (19 Google results, 0 relevant..there are more results for ZwQueryLicenseValue, but still nothing relevant to SLP). 3. Look at import section in IDA, find out that SLGetWindowsInformationDWORD is the only API imported from SLC. 4. Write 10 lines of C code that implement DllMain and SLGetWindowsInformationDWORD always returning 1. 5. Compile that, place in the same directory as SnippingTool, create SnippingTool.exe.local to redirect DLL loading 6. Q.E.D. Tools used: ntsd, Idag64, VS2008