Windows XP/2003 Leak Info

XP-Tan


USE THIS INSTEAD

https://rentry.co/build-win2k3

Yotsuba Project

Underground Windows development.

This is the original rentry guide for the /wxp/ threads after the leak. Several other guides have now spawned from this and provide a wealth of information. the centralizer-info guide has been pasted below.
https://rentry.co/centralizer-info

The main idea of this project is to create a simple and reliable method to build a custom Windows XP from the available source.

Check out this guide if you want to get started https://rentry.co/build-win2k3

noexit4237wjhu6v.onion - gitea server
~~yotsuba7pverpfs5.onion - nt5src.7z/toolset.zip/NTDEV videos

Matrix Chat - https://matrix.to/#/!gaxpoQqVZuAKwRucaK:privacytools.io

Direct DL:

http://yotsuba7pverpfs5.onion/files/nt5src.7z

Contents


Build Script

Requirements

  • Decent computer skills
  • yotsuba.zip
    OR
  • 7zip installed to default path
  • nt5src.7z NOTREPACKED (It's hash checked so get it)
  • win2003_prepatched_v10a.zip
  • win2003_x86-missing-binaries_v2.7
  • Access to Linux or WSL (Linux is preferred)
  • Patience

Run this script as the local Administrator user on your machine or Razzle environment will not work properly.

<#
Yotsuba XP & Yotsuba Server 2K build script

Get more info here:
https://rentry.co/wxp
#>

$7z = "${env:ProgramFiles}\7-Zip\"

$script_root = $pwd
$clover_bin = "$pwd\binaries"
$clover_src = "$pwd\nt5src"
$clover_patches = "$pwd\patches"

$src_root = "G:\"
$src_tree = "srv03rtm"

$src_hash = "94DEA413D439DDA8ABCAC83CFE799FC7"

# BANNER
<#
$banner = @"
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣤⣤⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣤⣤⣶⣤⣤⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣰⣿⣿⣿⣿⣷⣀⣤⣤⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣾⣿⣿⣿⣿⣿⣿⣿⣷⡀⠀⠀⠀⠀⠀⠀⢰⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡄⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⣠⣶⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡄⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣧⠀⠀⠀⠀⠸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠈⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⠀⠀⠀⢻⣿⣿⣿⣿⣿⣿⣿⠟⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠙⠛⠛⠿⠿⠿⠛⠛⠛⠉⠁⠀⠀⠀⠀⠀⠀⠈⣿⠿⠿⠛⠋⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⣤⣶⣾⣆⠀⠀⠀⠀⠀⢀⣀⣤⣤⣤⣶⣶⣶⣤⣤⣄⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣠⣶⣿⣿⣿⣿⣿⣿⡆⠀⠀⠀⠘⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣦⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣰⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡀⠀⠀⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠇⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢰⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣇⠀⠀⠀⠸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠋⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⠀⠀⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣦⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⠀⠀⠀⠀⠀⠙⢿⣿⣿⣿⣿⣿⣿⣿⠏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠻⢿⡿⠟⠻⣿⣿⣿⣿⣿⠃⠀⠀⠀⠀⠀⠀⠀⠉⠛⠛⠛⠛⠋⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠛⠛⠛⠁⠀⠀
"@
#>

$banner_b64 = "4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qKA4qOk4qOk4qOA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCACuKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKjgOKjpOKjpOKjtuKjpOKjpOKhgOKggOKggOKggOKggOKggOKggOKggOKggOKggOKjsOKjv+Kjv+Kjv+Kjv+Kjt+KjgOKjpOKjpOKjhOKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKggArioIDioIDioIDioIDioIDioIDioIDioIDioIDiooDio77io7/io7/io7/io7/io7/io7/io7/io7fioYDioIDioIDioIDioIDioIDioIDiorDio7/io7/io7/io7/io7/io7/io7/io7/io7/io7/io7fioYDioIDioIDioIDioIDioIDioIDioIDioIDioIAK4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCY4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qGE4qCA4qCA4qCA4qCA4qCA4qK44qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO34qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCACuKggOKggOKggOKggOKggOKggOKggOKggOKjoOKjtuKjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+KhhOKggOKggOKggOKggOKiuOKjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Khv+KggOKggOKggOKggOKggOKggOKggOKggOKggArioIDioIDioIDioIDioIDioIDioIDiorjio7/io7/io7/io7/io7/io7/io7/io7/io7/io7/io7/io7/io7/io6fioIDioIDioIDioIDioLjio7/io7/io7/io7/io7/io7/io7/io7/io7/io7/iob/ioIHioIDioIDioIDioIDioIDioIDioIDioIDioIAK4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCI4qK/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qCA4qCA4qCA4qCA4qCA4qK74qO/4qO/4qO/4qO/4qO/4qO/4qO/4qCf4qCL4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCACuKggOKggOKggOKggOKggOKggOKggOKggOKggOKgiOKgmeKgm+Kgm+Kgv+Kgv+Kgv+Kgm+Kgm+Kgm+KgieKggeKggOKggOKggOKggOKggOKggOKgiOKjv+Kgv+Kgv+Kgm+Kgi+KgieKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKggArioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIAK4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCACuKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKigOKjgOKjpOKjtuKjvuKjhuKggOKggOKggOKggOKggOKigOKjgOKjpOKjpOKjpOKjtuKjtuKjtuKjpOKjpOKjhOKjgOKggOKggOKggOKggOKggOKggOKggOKggOKggOKggArioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDiooDio6Dio7bio7/io7/io7/io7/io7/io7/ioYbioIDioIDioIDioJjio7/io7/io7/io7/io7/io7/io7/io7/io7/io7/io7/io7/io7fio6bioIDioIDioIDioIDioIDioIDioIDioIAK4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qOw4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qGA4qCA4qCA4qCA4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qCH4qCA4qCA4qCA4qCA4qCA4qCA4qCACuKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKisOKjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjh+KggOKggOKggOKguOKjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kjv+Kgv+Kgi+KggOKggOKggOKggOKggOKggOKggOKggArioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDiorvio7/io7/io7/io7/io7/io7/io7/io7/io7/io7/io7/io7/ioIDioIDioIDioIDiorvio7/io7/io7/io7/io7/io7/io7/io7/io7/io6bioIDioIDioIDioIDioIDioIDioIDioIDioIDioIAK4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCY4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qGf4qCA4qCA4qCA4qCA4qCA4qCZ4qK/4qO/4qO/4qO/4qO/4qO/4qO/4qO/4qCP4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCA4qCACuKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKgiOKgu+Kiv+Khv+Kgn+Kgu+Kjv+Kjv+Kjv+Kjv+Kjv+Kgg+KggOKggOKggOKggOKggOKggOKggOKgieKgm+Kgm+Kgm+Kgm+Kgi+KggeKggOKggOKggOKggOKggOKggOKggOKggOKggOKggOKggArioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIDioIjioJvioJvioJvioIHioIDioIA="
$banner = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($banner_b64))
Write-Host -ForegroundColor Green "Yotsuba XP / Server 2K builder`nyotsuba7pverpfs5.onion`n`n$banner"
Write-Host $script_root

# BUILD PREP
# ----------

Get-PSDrive -PSProvider FileSystem
Write-Host -ForegroundColor Yellow "`n`nSelect a drive letter (besides C:) to be used as the root (i.e. Z)"
$src_root = Read-Host -Prompt '> '
Write-Host -ForegroundColor Yellow "Using $src_root as root drive and creating directory $src_tree"
$src_path = "${src_root}:\$src_tree"
New-Item -Path "$src_root\$src_tree" -ItemType Directory

$src_md5 = Get-FileHash $clover_src\nt5src.7z -Algorithm md5 | Select-Object -ExpandProperty Hash
$src_md5 -eq $src_hash
#Write-Host -ForegroundColor Red "MD5 hash of nt5src.7z does not match. It is recommended to reacquire the source files. This script will only build using NOTREPACKED version"

Write-Host -ForegroundColor Yellow "Extracting source, please be patient..."
& $7z\7z.exe x $clover_src\nt5src.7z "-o$($clover_src)" -y
$src_cab = Get-ChildItem $clover_src\Win2K3\*.cab
foreach ($file in $src_cab) {
    Write-Host "`n"$file
    & $7z\7z.exe x $clover_src\Win2K3\$($file.Name) "-o$($src_path)" -y
}

Write-Host -ForegroundColor Yellow "Unsetting Read Only for all extracted files"
attrib -r "$src_path\*.*" /s /d

Write-Host -ForegroundColor Yellow "Applying win2003 v10a patches..."
& $7z\7z.exe x $clover_patches\win2003_prepatched_v10a.zip "-o$($src_path)" -y
Copy-Item $src_path\_x64\* $src_path -Recurse -Force

Write-Host -ForegroundColor Yellow "Unsetting Read Only for all extracted files"
attrib -r "$src_path\*.*" /s /d

# Generate certs. WSL for now since it's written in bash
# can't get this part of the code to work, test certs will work
# will need a linux box to run generate certs
<#
Write-Host -ForegroundColor Yellow "Generating new certs (Hope you have WSL)"
$pwd_wsl = bash -c "pwd"
$certutil_root = "$pwd_wsl/patches/certutil"

bash -c "chmod -R a+rwx $certutil_root"
bash -c "ls -lah $certutil_root"
bash -c "cd $certutil_root; chmod +x generate.sh; ./generate.sh"
#>

Write-Host -ForegroundColor Yellow "Replacing certs and applying patches..."
Copy-Item $clover_patches\certutil\srv03rtm.certs\* $src_path -Recurse -Force

# BUILD
# -----
Write-Host -ForegroundColor Yellow "Preparing razzle prompt and building"
Set-Location $src_path
cmd /c "tools\razzle64.cmd free offline && tools\prebuild.cmd && build /cZP -M 4"

# POST-BUILD
# ----------
& $7z\7z.exe x $clover_bin\win2003_x86-missing-binaries_v2.7z "-o$($src_root):\"
cmd /c "tools\razzle64.cmd free offline && tools\postbuild.cmd"

# ISO
# ---
cmd /c "tools\razzle64.cmd free offline && tools\oscdimg.cmd srv" 

WIP

Info hoard

Source code download.
Other stuff

Windows Server 2003 (NT 5.2 / 3790) guide

https://rentry.co/build-win2k3

Patches

Following patches should be applied before building:

https://rentry.co/win2k3-certutil - Certificate Patch
https://rentry.co/win2k3-extra-patches

Additions

Why build flags are necessary

Certain parts of code are missing but present in pre-built form, using -NOCLEANBUILD and -NOSCORCH ensures that they are not removed from the tree

Removing timebomb

Comment out timebomb lines from tools\postbuildscripts\pbuild.dat before running postbuild for the first time (currently there is no guide to revert it)

Different build options

You can modify your razzle shortcut (or execute command manually inside C:\NT) to include (or remove) additional argument(s):

  • free - build 'free' bits (production, ommiting it will generated checked bits)
  • CkhKernel - build 'checked' (testing) kernel/hal/ntdll when building 'free' bits
  • no_opts - disable binary optimization (useful for debugging, but will most likely fail a full build, some code can't be built without optimization)
  • verbose - enable verbose execution of the build process
  • binaries_dir <basepath> - specifies custom output directory (default is binaries, the suffix added after . is non-customizable)

Other options are not described here, see razzle.cmd /? for details.

Creating fresh build

You can use tools\postbuild.cmd -full to create fresh package, however this has not been properly tested yet, expect the unexpected!

Original CD filenames

  • 5.2.3790.0.srv03_rtm.030324-2048_x86fre_server-standard_retail_en-us-NRMSFPP_EN.iso (SHA1: A600409482A5678EF6AF2B26D3576D6D9894178D)
  • 5.2.3790.0.srv03_rtm.030324-2048_x86fre_server-datacenter_retail_en-us-NRMDOEM_EN.iso (SHA1: E2B47A7CE45C6C6305594CEE4C1B64894805AAF4)
  • 5.2.3790.0.srv03_rtm.030324-2048_x86fre_server-enterpriseserver_retail_en-us-NRMEFPP_EN.iso (SHA1: 0309FFB4181BA5122C692A6E1079E9FC1D53FCE4)
  • 5.2.3790.0.srv03_rtm.030324-2048_x86fre_server-webserver_retail_en-us-NRMWFPP_EN.iso (SHA1: 46C1CCB2CFC96803E304A35BEF50CD71B2C1DE38)
  • 5.1.2600.0.xpclient.010817-1148_x86fre_client-home_retail_en-us-WXHFPP_EN.iso (SHA1: B273C8D41E3844E3E46722F52F5A4CF9F206C8D0)
  • 5.1.2600.0.xpclient.010817-1148_x86fre_client-professional_retail_en-us-WXPFPP_EN.iso (SHA1: 1400DED4402D50F3864ED3D8DCF5CC52BA79A04A)
  • sbs.iso (coverted from mdf; SHA1: CDB30C80FDE314C16CA11F5CD31650ECBEC7A214)

Product keys

  • Standard Edition: M6RJ9-TBJH3-9DDXM-4VX9Q-K8M8M

64-bit specific

list of tools that must be recompiled in order to build on x64

appendtool
bingen
build
cabbench
calchash
cat
chktrust
flist
gennt32t
gidl
hdivide
infparser
infutil2
makecat
mibcc
midlc
muirct
ntrelhash
pdbstr
preprocessor
rmtshare
shimdbc
symchk
symmake
symstore
tlist
updcat

TODO:

get a functional iso, provide a complete buildguide

Edit
Pub: 30 Sep 2020 13:13 UTC
Edit: 24 Apr 2022 03:44 UTC
Views: 7475