DISCLAIMER NOTICE:
The author is not responsible for any loss or damage of any kind. Be wary of your legal responsibilities. This is a "guide" purely meant for educational purpose. This is NOT a step-by-step tutorial. You follow at your own risk.
This guide is written for users who are comfortable with C++/Assembly/OllyDbg. Feel free to drop your comments if you wish to see more comprehensive instructions or have something to say or ask.
Intro:
This is a guide to permanently disabling the file name extension change warning while renaming a file:
This guide is specific to Windows 10 but things should be similar in other Windows versions too.
Gist:
Our target file:%windir%\system32\windows.storage.dll
As per the antique tradition, the first step is to backup the original DLL file in a safe and accessible media/location.
Then, we patch the DLL using x64dbg.
Later we replace the cached version under %windir%\WinSxS with the newly patched version.
(There are multiple versions of windows.storage.dll cached. Be sure to replace the one with exactly same size and md5 fingerprint as %windir%\system32\windows.storage.dll)
Finally we replace the one in system32 folder.
A bit deeper guide:
Download x64dbg from http://x64dbg.com/
Close all file browser windows like My Documents, Music, Desktop etc.
Start an elevated command prompt (as Administrator), and then type:
explorer.exe C:
Note the PID of the newly opened window [using Task Manager (shown in decimal format).]
Run xdbg64 (please don't confuse with the 32-bit version of it) as Administrator. Attach to explorer.exe process with the PID from previous step (Hex notation is used in x64dbg).
Under the symbols tab, find shlwapi.dll and look for all export functions. Set breakpoint on ShellMessageBoxW.
Now try to rename any filename's extension in that file browser window.
The program should have paused by now, with the instruction pointer at the beginning of ShellMessageBoxW. Go to x64dbg, and under CPU tab, use the Execute till return option.
Now respond the the dialog box by clicking Yes or No.
Program would pause again at the RET instruction of ShellMessageBoxW function.
Now Step In and eventually, you should land at windows.storage.dll module.
You should see something like this:
CMP AX,6 is clearly comparison of return value with IDYES. Replace the CALL, CMP, and JNE instructions with NOPs.
As usual, Go to File->Patch file..., select these changes, and click on Patch file to save the patched version of DLL.
[You could also try setting breakpoints on user32.MessageBoxW and moving up in the call tree]
Issue a dir windows.storage.dll /a /s command in an elevated command prompt, under %windir% directory. Save the command prompt output in a text file for future reference.
Find which directory has the exact copy of DLL found as in system32 directory (Filesize/MD5). Take ownership of that object, its containing folder, and set Full Control Allow permissions for Administrators. Replace it with the newly patched version.
At this point, if we use SFC to verify the integrity of windows.storage.dll in system32 directory, it should report problems.
Save all unsaved works, if any.
Right click on Start->Power, and in the menu containing list of shutdown options, hold the Shift key and click on Restart.
Choose the troubleshoot option, and choose to open a Command Prompt. Use it to replace the windows.storage.dll file in system32 directory. [Be sure to backup the original file.]
Reboot.
Hope it helped you. Your comments are welcome :)
