What does TweakNT do to the system?

[Pae]

I have had a question for quite some time now, and it is; What does TweakNT do to the Registry/system files? I want to know so I can edit manually the pre-reset longhorn builds that can't run TweakNT due to the runtime overflow error. Any help is appreciated. Thanks!
I already posted on Reddit but didnt got a response, so im posting here again.

EDIT: I am trying to use TweakNT on 4011, but it pops me up with a "Runtime Error 6". I have tried a lot to remove this. If anyone can help directly with this, it would be appreciated. Thanks yet again!

[TinaMeineKatze]

I'd be quite interested in that as well, and haven't found anything on this online.

I've tried looking into it with

Code: Select all

strings TweakNT.exe

(on Linux, don't use Win anymore), but haven't found anything.

[Pae]

I'd be quite interested in that as well, and haven't found anything on this online.

Maybe the creator knows? Who knows if we will ever find them as TweakNT is a really old tool

EDIT: Only mention i found of somebody trying to know is on https://forums.tomshardware.com/threads ... y.2873348/, but it got turned down because the rules on that site state they wont help anybody with timebomb removal tools. Anyway, it states clearly the process that TweakNT does in the registry, so I believe somebody can find out from that.

[oscareczek]

I've tried looking into it with

Code: Select all

strings TweakNT.exe

, but haven't found anything.

It's a packed executable, so this was futile.

Timebomb is stored in HKLM\System\Setup\SystemPrefix (bytes 3-5) and HKLM\System\CurrentControlSet\Control\Session Manager\Executive\PriorityQuantumMatrix (bytes 5-8). Zeroing it (from WinPE, for example) removes the timebomb.

[Windows11RTMYT]

I've tried looking into it with

Code: Select all

strings TweakNT.exe

, but haven't found anything.

It's a packed executable, so this was futile.

Timebomb is stored in HKLM\System\Setup\SystemPrefix (bytes 3-5) and HKLM\System\CurrentControlSet\Control\Session Manager\Executive\PriorityQuantumMatrix (bytes 5-8). Zeroing it (from WinPE, for example) removes the timebomb.

Thanks for this

[Pae]

I've tried looking into it with

Code: Select all

strings TweakNT.exe

, but haven't found anything.

It's a packed executable, so this was futile.

Timebomb is stored in HKLM\System\Setup\SystemPrefix (bytes 3-5) and HKLM\System\CurrentControlSet\Control\Session Manager\Executive\PriorityQuantumMatrix (bytes 5-8). Zeroing it (from WinPE, for example) removes the timebomb.

Can you do a quick tutorial for those who dont know a lot about this (kinda me sry)? That would help within a lot of builds which can't run TweakNT. Yet again, thanks!
Btw, according to the site I previously mentioned TweakNT changes a lot of strings, so im not kinda sure if this might work by itself.

[oscareczek]

It does work by itself, I checked it. There is stuff it edits all the time even if not needed (like HKLM\System\WPA\TabletPC, anything in HKCU, WBEM-related keys), but these registry checkers can't be that precise.

Load WinPE (can be Windows setup, can be Hiren's Boot CD or whatever else you have). If you don't have a file explorer loaded, you need to load Command prompt through Shift+F10 or Repair computer menu. Launch regedit.
You need to load hive C:\WINDOWS\System32\Config\SYSTEM from WinPE. Then you go to the paths I mentioned. Both of these are of type REG_BINARY, so it's a bunch of bytes. You replace the ones I mentioned with 00, then unload hive and reboot to Windows. If you replaced incorrect bytes, you'll get SYSTEM_LICENSE_VIOLATION BSOD, but if you did it correctly, you won't get a watermark anymore.

[Pae]

It does work by itself, I checked it. There is stuff it edits all the time even if not needed (like HKLM\System\WPA\TabletPC, anything in HKCU, WBEM-related keys), but these registry checkers can't be that precise.

Load WinPE (can be Windows setup, can be Hiren's Boot CD or whatever else you have). If you don't have a file explorer loaded, you need to load Command prompt through Shift+F10 or Repair computer menu. Launch regedit.
You need to load hive C:\WINDOWS\System32\Config\SYSTEM from WinPE. Then you go to the paths I mentioned. Both of these are of type REG_BINARY, so it's a bunch of bytes. You replace the ones I mentioned with 00, then unload hive and reboot to Windows. If you replaced incorrect bytes, you'll get SYSTEM_LICENSE_VIOLATION BSOD, but if you did it correctly, you won't get a watermark anymore.

Thanks! I really appreciate your help
EDIT: It worked! Thank you so much! Anyways, I would like to get the watermark back without having to re-enable the timebomb. How do I do it?

[rafaelgs]

It does work by itself, I checked it. There is stuff it edits all the time even if not needed (like HKLM\System\WPA\TabletPC, anything in HKCU, WBEM-related keys), but these registry checkers can't be that precise.

Load WinPE (can be Windows setup, can be Hiren's Boot CD or whatever else you have). If you don't have a file explorer loaded, you need to load Command prompt through Shift+F10 or Repair computer menu. Launch regedit.
You need to load hive C:\WINDOWS\System32\Config\SYSTEM from WinPE. Then you go to the paths I mentioned. Both of these are of type REG_BINARY, so it's a bunch of bytes. You replace the ones I mentioned with 00, then unload hive and reboot to Windows. If you replaced incorrect bytes, you'll get SYSTEM_LICENSE_VIOLATION BSOD, but if you did it correctly, you won't get a watermark anymore.

Thanks! I really appreciate your help
EDIT: It worked! Thank you so much! Anyways, I would like to get the watermark back without having to re-enable the timebomb. How do I do it?

Open the Registry Editor and navigate to the following key:
HKEY_CURRENT_USER\Control Panel\Desktop\PaintDesktopVersion

If the PaintDesktopVersion key does not exist, create a new REG_DWORD key. Then, double click on PaintDesktopVersion on the right side, and in the box that appears, change the value from 0 to 1.