Making IIS 6.0 think the system locale is English US

[Yoni]

Synposis

On my system, the GetSystemDefaultLCID and GetSystemDefaultLangID functions (kernel32.dll) return 0x0000040d (Hebrew locale).

I set up a simple web site that allows the visitor to browse C:\Web (no html pages or anything, just the IIS directory browser).
The problem was that the file dates were displayed in Hebrew.

I wanted them to be displayed in English, but I didn't want to change my system default language ID/locale ID.



Solution

I looked for a simple, "official" solution but couldn't find one. So the only thing I could do was to "force" IIS into thinking the system locale is English US.

File: C:\Windows\System32\inetsrv\w3core.dll
Position: 0x34656

Original code:
call kernel32.GetSystemDefaultLCID

New code:
mov eax, 00000409 // English US
nop // space filler

Original data: FF 15 70 10 39 5A
New data: B8 09 04 00 00 90



Notes

1. w3core.dll is covered by WFP (Windows File Protection). However, I was happy to find that just modifying the file (instead of deleting it) doesn't trigger WFP, and IIS lives happily with the 6 different bytes. (I had to iisreset /stop to prevent the file from being in use.)

2. Is there a real solution to this problem? If so, please reply and tell me.

[Adron]

Microsoft says:

Changing the system locale installs the necessary bitmap font files to support non-Unicode applications in the specified language. To select a system locale, the appropriate language group must be installed; that is, you need the script support to select a system locale. The system locale is a per-system setting and requires a restart to be implemented.

There is no API to set the system locale. However, users can change it by using the Advanced tab of the Regional and Language Options in the Control Panel.

Further, my kernel32 says:

Code Select Expand


_text:79809A86 GetSystemDefaultLCID proc near          ; CODE XREF: _text:79812EA2p
_text:79809A86                                         ; _text:79814505p ...
_text:79809A86                 mov     eax, SystemDefaultLocale
_text:79809A8B                 retn
_text:79809A8B GetSystemDefaultLCID endp



This variable is filled in by:

Code Select Expand


_text:797F8125                 push    offset SystemDefaultLocale
_text:797F812A                 push    edi
_text:797F812B                 call    ds:NtQueryDefaultLocale


Which calls:

Code Select Expand


_text:77F8E964 ZwQueryDefaultLocale proc near          ; CODE XREF: _text:77F869D9p
_text:77F8E964                                         ; _text:77FA1844p ...
_text:77F8E964
_text:77F8E964 arg_0           = byte ptr  4
_text:77F8E964
_text:77F8E964                 mov     eax, 7Bh        ; NtQueryDefaultLocale
_text:77F8E969                 lea     edx, [esp+arg_0]
_text:77F8E96D                 int     2Eh
_text:77F8E96D
_text:77F8E96F                 retn    8
_text:77F8E96F ZwQueryDefaultLocale endp


Since it chooses not to read this from the registry at each call, or even once for loading kernel32.dll, I'd say it makes sense that you have to reboot after setting it. Did you?

You could try calling NtSetDefaultLocale and see if that helps...

[Yoni]

Yes, Adron, I looked at the ntdll.dll and kernel32.dll disassembly.
The thing is I don't want to change the system default locale/language... Just the locale/language that IIS uses.

(The system default language/locale is used for non-Unicode apps, which makes it important that it's set to Hebrew, so I can use Hebrew in ANSI only apps.)

In my opinion, IIS should use GetUserDefaultLCID instead. Oh well.

(And I did reboot after changing the default user's locale to English. That didn't fix the problem. This did, though...)

[Adron]

Why isn't user default LCID used for non-unicode apps?

[Yoni]

Interesting question. In fact, why is there a system default LCID? Everything runs in the context of a user.

[Skywing]

Interesting question. In fact, why is there a system default LCID? Everything runs in the context of a user.

Perhaps that is the default LCID for LocalSystem?

[Yoni]

Ok, then, why is there a GetSystemDefaultLCID call? The LCID for LocalSystem should be returned when GetUserDefaultLCID is called in the context of LocalSystem.

[Skywing]

Ok, then, why is there a GetSystemDefaultLCID call? The LCID for LocalSystem should be returned when GetUserDefaultLCID is called in the context of LocalSystem.

LocalSystem isn't a normal user.  IIRC, it doesn't have a profile or an HKEY_CURRENT_USER.

[Adron]

LocalSystem isn't a normal user.  IIRC, it doesn't have a profile or an HKEY_CURRENT_USER.

I was thinking it used HKEY_USERS\.Default

[Yoni]

That doesn't matter... When code that runs under the context of LocalSystem calls GetUserDefaultLCID, then it should get the so called "system default", and therefore there should be no GetSystemDefaultLCID function at all. (Is there a reason for this that I'm missing?)

[Adron]

Probably that things like the Administrator account are named according to the system locale? I.e. some kind of global resources that can have different languages, and that an application might be interested in knowing about?

[Skywing]

Probably that things like the Administrator account are named according to the system locale? I.e. some kind of global resources that can have different languages, and that an application might be interested in knowing about?

No.  You can rename the Administrator account.  Thus, the Administrator account name would have to be fixed at install time based on your language, if it is even localized.  If it were simply a lookup into a resource table, I don't think you could easily rename it.

[Yoni]

On my sister's computer (which uses the Hebrew UI edition of Win2k, with everything set to Hebrew/Israel by default), the Administrator account is by default named Administrator (in English).

[Adron]

Probably that things like the Administrator account are named according to the system locale? I.e. some kind of global resources that can have different languages, and that an application might be interested in knowing about?

No.  You can rename the Administrator account.  Thus, the Administrator account name would have to be fixed at install time based on your language, if it is even localized.  If it were simply a lookup into a resource table, I don't think you could easily rename it.

Of course, but what locale would it be running at install time other than the system default locale?

[Skywing]

Probably that things like the Administrator account are named according to the system locale? I.e. some kind of global resources that can have different languages, and that an application might be interested in knowing about?

No.  You can rename the Administrator account.  Thus, the Administrator account name would have to be fixed at install time based on your language, if it is even localized.  If it were simply a lookup into a resource table, I don't think you could easily rename it.

Of course, but what locale would it be running at install time other than the system default locale?

Probably the locale you pick during install.  Although, I can't remember if you do that before or after you select the Administrator password...

Anyways, the point I was trying to make is that given that you can rename the Administrator account, it is probably not just a localized string resource somewhere.