Windows Optimizing Blog

The Window File Protection (WFP) system works to keep XP running and not introduce anything that may cause the system to become unstable, a curse of older Windows based operating systems. Windows File Protection is an important tool, with it; you can run an executable (sfc.exe) that will start a process to analyze your system but other times, you will want to disable it.

WFP is part of the System File Checker, a tool used to try to keep the system stable by helping stop common problems that cause DLL inconsistencies. WFP when used may try to block the installation of software that you do want to install, but can't. Because you may run into this issue, you should know how to disable it. With Windows XP SP2, the ability to disable WFP has been removed. This article shows how to reverse this process.

Windows XP has the ability to protect itself from crashing from system instability infamously caused by third party software overwriting important system files. Once overwritten, the system can become unstable and crash. Windows File Protection is always enabled by default. It will allow ‘digitally’ signed files to replace existing system files. Windows Service Packs, Hotfix, System Upgrades, Windows Updates, Device Drivers through Device Manager and so on.

In Windows XP SP2, Microsoft removed the ability to disable Windows File Protection.

The version of C:\Windows\System32\sfc_os.dll that is included in Windows XP SP2 is 5.1.2600.2180. As you can see from the file on a pre- SP2 system, this is what you want to see. If you have the SP2 version, then you will want to remove that.



To Disable WFP in Windows XP SP2:

1. Copy C:\Windows\System32\sfc_os.dll to C:\Windows\System32\sfc_os1.dll

2. Open C:\Windows\System32\sfc_os1.dll in a hex editor as seen below

3. At offset 0xECE9, change 33 C0 40 to 90 90 90 and save the changes.
4. You can search the file for the offset with ctrl+g

5. Open a CMD prompt and type:
Copy C:\Windows\System32\sfc_os1.dll C:\Windows\System32\dllcache\sfc_os1.dll /y
and
Copy C:\Windows\System32\sfc_os1.dll C:\Windows\System32\sfc_os1.dll /y

6. If prompted to insert the Windows CD-ROM, press Cancel

7. Shutdown XP, then restart

8. Set SFCDisable to 0xffffff9d

9. Shutdown XP, then restart

You could also use the Recovery Console to perform the copy.