admin/rescatux-chntpw
1
0
Fork 0
mirror of https://github.com/rescatux/chntpw synced 2026-06-21 14:07:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Initial commit of 11 May 2011 chntpw source code

Browse Source
This commit is contained in:
Adrian Gibanel Lopez
2013-08-11 00:02:31 +02:00
commit 05445b7200
19 changed files with 12153 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
COPYING.txt
+340
View File
@@ -0,0 +1,340 @@
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it. (Some other Free Software Foundation software is covered by
the GNU Library General Public License instead.) You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it
if you want it, that you can change the software or use pieces of it
in new free programs; and that you know you can do these things.
To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have. You must make sure that they, too, receive or can get the
source code. And you must show them these terms so they know their
rights.
We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.
Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software. If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.
Finally, any free program is threatened constantly by software
patents. We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary. To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and
modification follow.
GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License applies to any program or other work which contains
a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License. The "Program", below,
refers to any such program or work, and a "work based on the Program"
means either the Program or any derivative work under copyright law:
that is to say, a work containing the Program or a portion of it,
either verbatim or with modifications and/or translated into another
language. (Hereinafter, translation is included without limitation in
the term "modification".) Each licensee is addressed as "you".
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.
1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the
notices that refer to this License and to the absence of any warranty;
and give any other recipients of the Program a copy of this License
along with the Program.
You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a fee.
2. You may modify your copy or copies of the Program or any portion
of it, thus forming a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) You must cause the modified files to carry prominent notices
stating that you changed the files and the date of any change.
b) You must cause any work that you distribute or publish, that in
whole or in part contains or is derived from the Program or any
part thereof, to be licensed as a whole at no charge to all third
parties under the terms of this License.
c) If the modified program normally reads commands interactively
when run, you must cause it, when started running for such
interactive use in the most ordinary way, to print or display an
announcement including an appropriate copyright notice and a
notice that there is no warranty (or else, saying that you provide
a warranty) and that users may redistribute the program under
these conditions, and telling the user how to view a copy of this
License. (Exception: if the Program itself is interactive but
does not normally print such an announcement, your work based on
the Program is not required to print an announcement.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.
In addition, mere aggregation of another work not based on the Program
with the Program (or with a work based on the Program) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:
a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,
c) Accompany it with the information you received as to the offer
to distribute corresponding source code. (This alternative is
allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such
an offer, in accord with Subsection b above.)
The source code for a work means the preferred form of the work for
making modifications to it. For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable. However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.
If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.
4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License. Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.
5. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Program or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Program or works based on it.
6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.
7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all. For example, if a patent
license would not permit royalty-free redistribution of the Program by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.
If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system, which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded. In such case, this License incorporates
the limitation as if written in the body of this License.
9. The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation. If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.
10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the author
to ask for permission. For software which is copyrighted by the Free
Software Foundation, write to the Free Software Foundation; we sometimes
make exceptions for this. Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.
NO WARRANTY
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
Also add information on how to contact you by electronic and paper mail.
If the program is interactive, make it output a short notice like this
when it starts in an interactive mode:
Gnomovision version 69, Copyright (C) year name of author
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, the commands you use may
be called something other than `show w' and `show c'; they could even be
mouse-clicks or menu items--whatever suits your program.
You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the program, if
necessary. Here is a sample; alter the names:
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
`Gnomovision' (which makes passes at compilers) written by James Hacker.
<signature of Ty Coon>, 1 April 1989
Ty Coon, President of Vice
This General Public License does not permit incorporating your program into
proprietary programs. If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library. If this is what you want to do, use the GNU Library General
Public License instead of this License.
GPL.txt
+340
View File
@@ -0,0 +1,340 @@
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it. (Some other Free Software Foundation software is covered by
the GNU Library General Public License instead.) You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it
if you want it, that you can change the software or use pieces of it
in new free programs; and that you know you can do these things.
To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have. You must make sure that they, too, receive or can get the
source code. And you must show them these terms so they know their
rights.
We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.
Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software. If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.
Finally, any free program is threatened constantly by software
patents. We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary. To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and
modification follow.
GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License applies to any program or other work which contains
a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License. The "Program", below,
refers to any such program or work, and a "work based on the Program"
means either the Program or any derivative work under copyright law:
that is to say, a work containing the Program or a portion of it,
either verbatim or with modifications and/or translated into another
language. (Hereinafter, translation is included without limitation in
the term "modification".) Each licensee is addressed as "you".
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.
1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the
notices that refer to this License and to the absence of any warranty;
and give any other recipients of the Program a copy of this License
along with the Program.
You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a fee.
2. You may modify your copy or copies of the Program or any portion
of it, thus forming a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) You must cause the modified files to carry prominent notices
stating that you changed the files and the date of any change.
b) You must cause any work that you distribute or publish, that in
whole or in part contains or is derived from the Program or any
part thereof, to be licensed as a whole at no charge to all third
parties under the terms of this License.
c) If the modified program normally reads commands interactively
when run, you must cause it, when started running for such
interactive use in the most ordinary way, to print or display an
announcement including an appropriate copyright notice and a
notice that there is no warranty (or else, saying that you provide
a warranty) and that users may redistribute the program under
these conditions, and telling the user how to view a copy of this
License. (Exception: if the Program itself is interactive but
does not normally print such an announcement, your work based on
the Program is not required to print an announcement.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.
In addition, mere aggregation of another work not based on the Program
with the Program (or with a work based on the Program) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:
a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,
c) Accompany it with the information you received as to the offer
to distribute corresponding source code. (This alternative is
allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such
an offer, in accord with Subsection b above.)
The source code for a work means the preferred form of the work for
making modifications to it. For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable. However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.
If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.
4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License. Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.
5. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Program or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Program or works based on it.
6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.
7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all. For example, if a patent
license would not permit royalty-free redistribution of the Program by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.
If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system, which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded. In such case, this License incorporates
the limitation as if written in the body of this License.
9. The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation. If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.
10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the author
to ask for permission. For software which is copyrighted by the Free
Software Foundation, write to the Free Software Foundation; we sometimes
make exceptions for this. Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.
NO WARRANTY
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
Also add information on how to contact you by electronic and paper mail.
If the program is interactive, make it output a short notice like this
when it starts in an interactive mode:
Gnomovision version 69, Copyright (C) year name of author
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, the commands you use may
be called something other than `show w' and `show c'; they could even be
mouse-clicks or menu items--whatever suits your program.
You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the program, if
necessary. Here is a sample; alter the names:
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
`Gnomovision' (which makes passes at compilers) written by James Hacker.
<signature of Ty Coon>, 1 April 1989
Ty Coon, President of Vice
This General Public License does not permit incorporating your program into
proprietary programs. If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License.
HISTORY.txt
+316
View File
@@ -0,0 +1,316 @@
The Offline NT Password Editor
(c) 1997-2011 Petter Nordahl-Hagen
See README for general info, copyright & credits.
See INSTALL for compile/installation instructions.
Revision history
(tools only, see website for info on bootdisk revisions)
* v 0.99.6 110511
regedit library (chntpw and reged uses it):
- Hive expansion! Library now does hive file expansion by
default! (but you can turn it off, safe mode). If expansion occured, you
will get a warning when saving the hive.
- There were a lot of goofs by me in the add/delete key and value
handling, which made windows complain and lose data. Hope I managed
to fix them.
- Also, found out more about how Windows does things, for example:
- Empty name (default) value, flag field is 0 (not 1 as usual)
- Values with data size 0 to 4 the value data itself is stored in
the data pointer field, typical for DWORD (this I knew a long time
ago), sign bit of data size field is then set. BUT..
- In a lot of cases in SAM, for null name values, size is 0 with sign
set. In that case, the data dword is stored in the TYPE field,
and the rest is unused. This saves a few bytes of course.. but why?
The rest of the stuff registry is used for is often seriously bloated
anyway. Did the guys at MS who actually wrote the SAM stuff back
in the NT3 days actually do it because they cared? or just because
they found something new and exiting they smoked? :)
- Large values (seems to be from around 16k) are split internally in
several parts. Sounds smart. But it goes via 2 (two) separate data
structures that has to be allocated.
For regular small values the data pointer simply points to the data
itself. For this split large value it points to a "db" struct. This
contais a count of how many parts there are. And then the list of
pointers to the data parts? Nope. It points to another area where
the list of pointers are stored.
Pseudo: vk.ofs_data -> db.list -> list[n] -> raw data block n
The last raw data block always allocates the whole hbin (usually
16k) it is in, even if all of it is not needed. Of course only the correct
amount of data is copied out based on the value length.
On new Vista64 bit SP2, this happens at least 2 times in
SOFTWARE\Microsoft tree.
reged:
- On popular demand: .reg file import!! (-I)
- Will read files from regedit.exe in most cases
(UTF-16) but can miss on some international characters. Also reads
"latin" (8 bit) files.
- Only one .reg and hive at a time supported.
- Did quite a lot of testing by importing for example the
SOFTWARE\Classes tree with regedit.exe and importing it again into
the DEFAULT hive with my tool, then ask windows to "Load hive" (in
regedit.exe). If it does not complain in the event log, it is good.
(Also, seems like windows has gotten better at not bluescreening on
a corrupt registry hive, did not get a single one when doing this
with pretty messed up hives in win7 and Vista)
- Be aware that .reg import is currently very slow, since I messed
up the design for the string reading badly, and also the add routines is
not exactly optimized. Consider it a proof of concept! Example:
Import of SOFTWARE\Microsoft tree (exported by regedit.exe) into the
small DEFAULT hive took more than 10 minutes on a pretty fast
machine. Especially hex data is slow (one byte at a time.. lazy me..)
- WARNING: .reg file import does not do much sanity checking of the
input .reg file. It will either crash during import or mess up
the registry if the .reg file is bad.
- WARNING2: Limitation: Be careful when importing keys that has large
number of subkeys (like several 1000) since it does not split up
into indirect indexes (lh) yet, and windows may not like it.
- -N and -E options for safe mode edit (no alloc and no expand hive)
- Importing (-I) and then into edit (-e) before save possible,
by specifying both options.
- -I and -C (-IC) will import and auto-save, use this in scripts.
chntpw:
- This version has no significant changes in the password (reset)
handling part of the tools.
TODO list:
- Windows like API. Faster .reg import. Fix bugs! Maybe not in that
order :)
* v 0.99.6 100627
chntpw:
- Syskey not visible in menu anymore, but is still selectable as # 2
This because too many people just went ahead without understanding
its purpose, and the emailed me when things went as expected, that
is it went *boom*
- Interactive menu adapts to show most relevant selections based
on what is loaded
reged:
- Patches from Frediano Ziglio adding or fixing:
buffer overflow in export_subkey printing keyname
some quoting error (name and string values must be quoted)
missing support for wide character encoding in keys and value names
regedit library (chntpw and reged uses it):
- New function from Aleksander Wojdyga: dpi, to decode product IDs
Can be used on for example \Microsoft\Windows NT\CurrentVersion\DigitalProductId
to find the systems product ID in cleartext.
Now as command in registry editor, but may be moved to chnpw menu later.
* v 0.99.6 080526
reged:
- NEW TOOL: It's actually just the interactive registry edit
(still also available in chntpw) plus
the registry export to .reg-file from command line.
This tool contains no password functions, thus no crypto.
chntpw:
- Interactive reg ed moved out of chntpw, into edlib.c
- 64 bit compatible patch by Mike Doty, via Alon Bar-Lev
http://bugs.gentoo.org/show_bug.cgi?id=185411
- Some minor tweaks and fixes
ntreg library:
- Type QWORD (XP/Vista and newer) now recognized
- Most functions accepting a path now also have a parameter specifying if
the search should be exact or on first match basis, thus
this libary version breaks build with older programs.
- Fixed bug which skipped first indirect index table when deleting keys,
usually leading to endless loop when recursive deleting.
- Export to .reg file by Leo von Klenze, expanded a bit by me.
- 64 bit compatible patch by Mike Doty, via Alon Bar-Lev
http://bugs.gentoo.org/show_bug.cgi?id=185411
- A few other small fixes and tweaks.
* v 0.99.5 070923
- User edit is now menu-driven, better visuals / tables / listings.
- Group memberships are listen on the user
- User promotion (put into admin group) is now public, with it's own
menu selection in the user menu. Still considered EXPERIMENTAL!
- Some other verbosity/visual changes
- Changed the verbosity (-v) option to be more useful for debug
or advanced information
* v 0.99.4 070406 (decade)
- 10 year anniversary!
- Changed to GPL license
- Support for Windows Vista was already there, but only blanking
password works.
- Some small insignificant changes, mainly to output or text.
* v 0.99.3 041205
- Fixed bug in loadhive(), caused a crash when last page pointer
was out of range, which seems to happen a lot on some
installations. Guess it is correct to just assume it is
end of file. Thanks to Michael Rothstein for supplying a
hive with this.
* v 0.99.3 040818
chntpw:
- Lot of nasty bugs fixed in REG_SZ and REG_MULTI_SZ input, often
trashed the heap, leading to later crashes.
- New regedit command "hex" to see value in hexdump regardles
of type.
- Some other minor fixes on hive load.
ntreg: Major bugfixes in key add/delete,
and support for more of the registry:
- Now full support of key add/del on NT351 ('li' index)
as a bi-effect this also adds support for NT4/win2k edits
in keys with indirect index (when it contains ~>500 subkeys)
since the index tables then switches from 'lf' (semi-hashed)
to 'li' (unhashed table).
- WinXP and newer uses 'lh' (true hash) always, even when going
via indirect tables ('ri'). I wasn't aware of this, so reading
or traversing that in earlier versions usually crashed.
- Critical bugs fixed in the allocation of space in the hive,
older versions may in several occations corrupt the hive.
- Fixed some hive load bugs, deallocate properly on close etc.
* v 0.99.2 040105
- Added RecoveryConsole parameter change
- Try to guess type of hive loaded (sam, system, security etc), this
is used by the user edit, syskey edit, RecoveryConsole edit
to look up into the right hive.
- Do not confirm save if the change-tracking option is set (-L)
(assume wrapper does it..)
- Hid the hash-stuff during password reset. I got all kinds of
confusing questions about it (most often: can I find the original
pw? Answer: NO if win2k or higher)
Option -v turns this on again for debugging.
- Also reduced some other debug output, -t and/or -v turns on again
most of it.
- Fixed some bugs:
- check of return value from open()
- corrected prototype defs for some calls into OpenSSL,
this fixes some compilation errors people have reported.
Thanks to Alexander Poquet for that.
- Probably _added_ more bugs :-} but they are yet unknown :)
* v 0.99.1 030126
- Fixed bug in ntreg, seems some files has garbage instead of zero
pages at end. Now stops enumerating on first non 'hbin' page.
Thanks to Jim Andersen for giving me a hive file that showed this.
- Reports strongly indicates that blanking a password
(* at the prompt) works more often than changing passwords.
Changed some wording regarding this.
* v 0.99.0 030112
- There is now full registry edit support with expansion of value
size and add / delete of keys and values!
See regedit.txt for more info on registry editing
See source for details on data block allocation etc in registry.
- Changed interactive mode (-i) a bit, now features menues.
- Syskeystatus/change not shown unless selected from menu.
- New option: -N to set it in old-edit mode, ie only exact
overwrites. This is for safety in testing etc.
* v 0.98.6 021213
- Added parsing of users F and SAMs F value, which stores account type bits
and lockout information. Ability to reset it if locked.
- As usual, see source (especially sam.h for details) on this.
* v 0.98.5 021208
- Added ability to enter RID (in hex) instead of username by
starting the entry with 0x. Works interactive and on commandline.
This will enable edit of users that has names which actually
use unicode, like some russian and asian systems.
- Only entering * for password will blank password by setting
hash lengths to zero. Seems to be working ok in 2k and XP.
This may also clear up an earlier failed change.
One bug/drawback: Seems to leak about 30-50 bytes in the V struct.
- Fixed bug in handling of blank LANMAN-pass.
* v 0.98.4 011022
- Fixed input buffer overflow that made it impossible to enter
usernames at 16 chars (the \n would flow over into the password
prompt thus not changing it)
- New option -L that will write the names of changed hives to
/tmp/changed. Mainly for use in my bootfloppy scripts.
* v 0.98.3 010808
- Blank password detection rewritten. The NT or LANMAN hash seems
to actually be missing from the sam entry if password is blank.
This will now be detected, and if only LANMAN is present, it
will be convertet to NT password.
- Some minor changes in text & prompts.
* v 0.98.2 010107
- Changed to use OpenSSL for MD4 & DES encryption instead of
the old libraries. Only change of build process from source
is to point the Makefile to wherever your OpenSSL libraries & includes are.
- Minor changes in wording of Syskey warnings.
- No functional changes.
- Known bugs: Hive statistics often wrong (but the numbers are not used
later, so it's not critical)
* v 0.98.1 000607
- Discovered that when a key has lots of subkeys (typically about
300 or more?) its hashtable is split and accessed through an
indirect ('ri') table, almost as some filesystems do with
datablock lists on large files. This caused an error "Not 'nk' node"
and sometimes a crash in earlier versions. In SAM this happens in
\SAM\Domains\Account\Users when the number of users are large
(which often is the case on domain controllers).
See source code for technical details on this. (WinReg.txt not updated)
* v 0.98 000401
- Disabling syskey on Win2000 corrupts the SAM somehow, makes it
unable to reenable + leaves it in a partial mode 1 syskey.
Also corrupts the Domain Trust password, making it impossible
to join og leave a domain.
Delete HKLM\SECURITY\Policy\Secrets\$MACHINE.ACC (the trust key,
may need to change ACLs to get to it) to leave the domain and make it
possible to rejoin.
- Added support for changing passwords without disabling or
changing syskey, simply by inserting old type password hash
into the sam. It gets converted to syskey-hash on next boot.
Why I didn't discover this before is beyond me.
- A few smaller bugfixes.
* v 0.98 000215
- Can now write, too, but only existing values, & same datalength.
- Internals rewritten, registry manipulation functions
now in separate "library".
- Added ability to check for and disable syskey. (see syskey.txt
& sourcecode for details)
- "Command line"-type registry-editor improved a bit.
- Possible to load and edit several hives at once
- Several minor changes.
- Since a lot has been rewritten, there's probably more bugs.
* v 0.90 990307
Major updates:
- Full registry parse/read/viever. Can follow the tree like a filesystem.
No write-support yet.
- 3.51 & 4.0 support. Seems to be working on NT5 betas, too.
- 100% sure to find usernames/passwords.
- Support for localized admin-names (will automatically find it)
- Several minor bugs from earlier versions fixed.
- Sorry, but still no syskey support. (but since full registry
read capabilities exsist, it's now easier to make it)
* PRE-1 970611
- Got reports on "Netlogon service not started"
(and then it was impossible to logon)
if attempt to change blank password into something else.
This was because if the password is set blank (from NT), the NT-logon
hash (md4) is not stored in SAM at all (the LANmanager hash seems to be
there..) However, chntpw didn't know about this, and happily(?) wrote away
and corrupted the SAM file, causing Netlogon to fail.
This version will flag accounts with blank passwords, and refuse to change it.
- The -i (interactive) option now loops. Will ask for a new name repeatedly,
until '!' is entered. This enables you to change multiple passwords in
one run.
- No support for syskey, yet.
* PRE-1 970528:
- First public release
INSTALL.txt
+48
View File
@@ -0,0 +1,48 @@
The Offline NT Password & Registry Editor
(c) 1997-2011 Petter Nordahl-Hagen
This file is meant for developers.
General usage is via the provided boot CD images, but
static linux builds of the tools are also available
in the source zip file.
See REAMDE for general instructions and license info,
HISTORY.txt for version info.
If you want to build yourself, it should compile
with most gcc compilers. However, I am not particulary good
with types, so there may be some warnings.
You may have to install the openssl-devel package from you
linux distro to compile/link, since I need the static variant.
(change the makefile to link dynamic if you wish)
I link statically with libcrypto.a from OpenSSL.
(chntpw only, other tools does not require crypto)
Thanks to Denis Ducamp for modifying chntpw to use OpenSSL.
Thanks to Mike Doty, via Alon Bar-Lev for 64 bit build compatible patch.
(from http://bugs.gentoo.org/show_bug.cgi?id=185411)
Look into Makefile, you may need to change things to fit your env.
(also if you need 64 bit)
If make goes well, you should have:
chntpw - Password tool, dynamic with libc, static with OpenSSL
chntpw.static - Completely static passord tool
reged - Registry edit tool, dynamic linked with libc. No crypto.
reged.static - Registry too, statically linked.
cpnt - Simple copy utility, does not truncate file on write
Now deprecated, was at least needed earlier for NTFS writes.
Also, the floppies and CDs are build under a different
environment for small libc size (uClibc), see website
for details. (build scripts not currently available..)
So, note that the binary then contains cryptographic code
which may be illegal for you to export.
Good luck.
LGPL.txt
+504
View File
@@ -0,0 +1,504 @@
GNU LESSER GENERAL PUBLIC LICENSE
Version 2.1, February 1999
Copyright (C) 1991, 1999 Free Software Foundation, Inc.
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
[This is the first released version of the Lesser GPL. It also counts
as the successor of the GNU Library Public License, version 2, hence
the version number 2.1.]
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
Licenses are intended to guarantee your freedom to share and change
free software--to make sure the software is free for all its users.
This license, the Lesser General Public License, applies to some
specially designated software packages--typically libraries--of the
Free Software Foundation and other authors who decide to use it. You
can use it too, but we suggest you first think carefully about whether
this license or the ordinary General Public License is the better
strategy to use in any particular case, based on the explanations below.
When we speak of free software, we are referring to freedom of use,
not price. Our General Public Licenses are designed to make sure that
you have the freedom to distribute copies of free software (and charge
for this service if you wish); that you receive source code or can get
it if you want it; that you can change the software and use pieces of
it in new free programs; and that you are informed that you can do
these things.
To protect your rights, we need to make restrictions that forbid
distributors to deny you these rights or to ask you to surrender these
rights. These restrictions translate to certain responsibilities for
you if you distribute copies of the library or if you modify it.
For example, if you distribute copies of the library, whether gratis
or for a fee, you must give the recipients all the rights that we gave
you. You must make sure that they, too, receive or can get the source
code. If you link other code with the library, you must provide
complete object files to the recipients, so that they can relink them
with the library after making changes to the library and recompiling
it. And you must show them these terms so they know their rights.
We protect your rights with a two-step method: (1) we copyright the
library, and (2) we offer you this license, which gives you legal
permission to copy, distribute and/or modify the library.
To protect each distributor, we want to make it very clear that
there is no warranty for the free library. Also, if the library is
modified by someone else and passed on, the recipients should know
that what they have is not the original version, so that the original
author's reputation will not be affected by problems that might be
introduced by others.
Finally, software patents pose a constant threat to the existence of
any free program. We wish to make sure that a company cannot
effectively restrict the users of a free program by obtaining a
restrictive license from a patent holder. Therefore, we insist that
any patent license obtained for a version of the library must be
consistent with the full freedom of use specified in this license.
Most GNU software, including some libraries, is covered by the
ordinary GNU General Public License. This license, the GNU Lesser
General Public License, applies to certain designated libraries, and
is quite different from the ordinary General Public License. We use
this license for certain libraries in order to permit linking those
libraries into non-free programs.
When a program is linked with a library, whether statically or using
a shared library, the combination of the two is legally speaking a
combined work, a derivative of the original library. The ordinary
General Public License therefore permits such linking only if the
entire combination fits its criteria of freedom. The Lesser General
Public License permits more lax criteria for linking other code with
the library.
We call this license the "Lesser" General Public License because it
does Less to protect the user's freedom than the ordinary General
Public License. It also provides other free software developers Less
of an advantage over competing non-free programs. These disadvantages
are the reason we use the ordinary General Public License for many
libraries. However, the Lesser license provides advantages in certain
special circumstances.
For example, on rare occasions, there may be a special need to
encourage the widest possible use of a certain library, so that it becomes
a de-facto standard. To achieve this, non-free programs must be
allowed to use the library. A more frequent case is that a free
library does the same job as widely used non-free libraries. In this
case, there is little to gain by limiting the free library to free
software only, so we use the Lesser General Public License.
In other cases, permission to use a particular library in non-free
programs enables a greater number of people to use a large body of
free software. For example, permission to use the GNU C Library in
non-free programs enables many more people to use the whole GNU
operating system, as well as its variant, the GNU/Linux operating
system.
Although the Lesser General Public License is Less protective of the
users' freedom, it does ensure that the user of a program that is
linked with the Library has the freedom and the wherewithal to run
that program using a modified version of the Library.
The precise terms and conditions for copying, distribution and
modification follow. Pay close attention to the difference between a
"work based on the library" and a "work that uses the library". The
former contains code derived from the library, whereas the latter must
be combined with the library in order to run.
GNU LESSER GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License Agreement applies to any software library or other
program which contains a notice placed by the copyright holder or
other authorized party saying it may be distributed under the terms of
this Lesser General Public License (also called "this License").
Each licensee is addressed as "you".
A "library" means a collection of software functions and/or data
prepared so as to be conveniently linked with application programs
(which use some of those functions and data) to form executables.
The "Library", below, refers to any such software library or work
which has been distributed under these terms. A "work based on the
Library" means either the Library or any derivative work under
copyright law: that is to say, a work containing the Library or a
portion of it, either verbatim or with modifications and/or translated
straightforwardly into another language. (Hereinafter, translation is
included without limitation in the term "modification".)
"Source code" for a work means the preferred form of the work for
making modifications to it. For a library, complete source code means
all the source code for all modules it contains, plus any associated
interface definition files, plus the scripts used to control compilation
and installation of the library.
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running a program using the Library is not restricted, and output from
such a program is covered only if its contents constitute a work based
on the Library (independent of the use of the Library in a tool for
writing it). Whether that is true depends on what the Library does
and what the program that uses the Library does.
1. You may copy and distribute verbatim copies of the Library's
complete source code as you receive it, in any medium, provided that
you conspicuously and appropriately publish on each copy an
appropriate copyright notice and disclaimer of warranty; keep intact
all the notices that refer to this License and to the absence of any
warranty; and distribute a copy of this License along with the
Library.
You may charge a fee for the physical act of transferring a copy,
and you may at your option offer warranty protection in exchange for a
fee.
2. You may modify your copy or copies of the Library or any portion
of it, thus forming a work based on the Library, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) The modified work must itself be a software library.
b) You must cause the files modified to carry prominent notices
stating that you changed the files and the date of any change.
c) You must cause the whole of the work to be licensed at no
charge to all third parties under the terms of this License.
d) If a facility in the modified Library refers to a function or a
table of data to be supplied by an application program that uses
the facility, other than as an argument passed when the facility
is invoked, then you must make a good faith effort to ensure that,
in the event an application does not supply such function or
table, the facility still operates, and performs whatever part of
its purpose remains meaningful.
(For example, a function in a library to compute square roots has
a purpose that is entirely well-defined independent of the
application. Therefore, Subsection 2d requires that any
application-supplied function or table used by this function must
be optional: if the application does not supply it, the square
root function must still compute square roots.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Library,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Library, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote
it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Library.
In addition, mere aggregation of another work not based on the Library
with the Library (or with a work based on the Library) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may opt to apply the terms of the ordinary GNU General Public
License instead of this License to a given copy of the Library. To do
this, you must alter all the notices that refer to this License, so
that they refer to the ordinary GNU General Public License, version 2,
instead of to this License. (If a newer version than version 2 of the
ordinary GNU General Public License has appeared, then you can specify
that version instead if you wish.) Do not make any other change in
these notices.
Once this change is made in a given copy, it is irreversible for
that copy, so the ordinary GNU General Public License applies to all
subsequent copies and derivative works made from that copy.
This option is useful when you wish to copy part of the code of
the Library into a program that is not a library.
4. You may copy and distribute the Library (or a portion or
derivative of it, under Section 2) in object code or executable form
under the terms of Sections 1 and 2 above provided that you accompany
it with the complete corresponding machine-readable source code, which
must be distributed under the terms of Sections 1 and 2 above on a
medium customarily used for software interchange.
If distribution of object code is made by offering access to copy
from a designated place, then offering equivalent access to copy the
source code from the same place satisfies the requirement to
distribute the source code, even though third parties are not
compelled to copy the source along with the object code.
5. A program that contains no derivative of any portion of the
Library, but is designed to work with the Library by being compiled or
linked with it, is called a "work that uses the Library". Such a
work, in isolation, is not a derivative work of the Library, and
therefore falls outside the scope of this License.
However, linking a "work that uses the Library" with the Library
creates an executable that is a derivative of the Library (because it
contains portions of the Library), rather than a "work that uses the
library". The executable is therefore covered by this License.
Section 6 states terms for distribution of such executables.
When a "work that uses the Library" uses material from a header file
that is part of the Library, the object code for the work may be a
derivative work of the Library even though the source code is not.
Whether this is true is especially significant if the work can be
linked without the Library, or if the work is itself a library. The
threshold for this to be true is not precisely defined by law.
If such an object file uses only numerical parameters, data
structure layouts and accessors, and small macros and small inline
functions (ten lines or less in length), then the use of the object
file is unrestricted, regardless of whether it is legally a derivative
work. (Executables containing this object code plus portions of the
Library will still fall under Section 6.)
Otherwise, if the work is a derivative of the Library, you may
distribute the object code for the work under the terms of Section 6.
Any executables containing that work also fall under Section 6,
whether or not they are linked directly with the Library itself.
6. As an exception to the Sections above, you may also combine or
link a "work that uses the Library" with the Library to produce a
work containing portions of the Library, and distribute that work
under terms of your choice, provided that the terms permit
modification of the work for the customer's own use and reverse
engineering for debugging such modifications.
You must give prominent notice with each copy of the work that the
Library is used in it and that the Library and its use are covered by
this License. You must supply a copy of this License. If the work
during execution displays copyright notices, you must include the
copyright notice for the Library among them, as well as a reference
directing the user to the copy of this License. Also, you must do one
of these things:
a) Accompany the work with the complete corresponding
machine-readable source code for the Library including whatever
changes were used in the work (which must be distributed under
Sections 1 and 2 above); and, if the work is an executable linked
with the Library, with the complete machine-readable "work that
uses the Library", as object code and/or source code, so that the
user can modify the Library and then relink to produce a modified
executable containing the modified Library. (It is understood
that the user who changes the contents of definitions files in the
Library will not necessarily be able to recompile the application
to use the modified definitions.)
b) Use a suitable shared library mechanism for linking with the
Library. A suitable mechanism is one that (1) uses at run time a
copy of the library already present on the user's computer system,
rather than copying library functions into the executable, and (2)
will operate properly with a modified version of the library, if
the user installs one, as long as the modified version is
interface-compatible with the version that the work was made with.
c) Accompany the work with a written offer, valid for at
least three years, to give the same user the materials
specified in Subsection 6a, above, for a charge no more
than the cost of performing this distribution.
d) If distribution of the work is made by offering access to copy
from a designated place, offer equivalent access to copy the above
specified materials from the same place.
e) Verify that the user has already received a copy of these
materials or that you have already sent this user a copy.
For an executable, the required form of the "work that uses the
Library" must include any data and utility programs needed for
reproducing the executable from it. However, as a special exception,
the materials to be distributed need not include anything that is
normally distributed (in either source or binary form) with the major
components (compiler, kernel, and so on) of the operating system on
which the executable runs, unless that component itself accompanies
the executable.
It may happen that this requirement contradicts the license
restrictions of other proprietary libraries that do not normally
accompany the operating system. Such a contradiction means you cannot
use both them and the Library together in an executable that you
distribute.
7. You may place library facilities that are a work based on the
Library side-by-side in a single library together with other library
facilities not covered by this License, and distribute such a combined
library, provided that the separate distribution of the work based on
the Library and of the other library facilities is otherwise
permitted, and provided that you do these two things:
a) Accompany the combined library with a copy of the same work
based on the Library, uncombined with any other library
facilities. This must be distributed under the terms of the
Sections above.
b) Give prominent notice with the combined library of the fact
that part of it is a work based on the Library, and explaining
where to find the accompanying uncombined form of the same work.
8. You may not copy, modify, sublicense, link with, or distribute
the Library except as expressly provided under this License. Any
attempt otherwise to copy, modify, sublicense, link with, or
distribute the Library is void, and will automatically terminate your
rights under this License. However, parties who have received copies,
or rights, from you under this License will not have their licenses
terminated so long as such parties remain in full compliance.
9. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Library or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Library (or any work based on the
Library), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Library or works based on it.
10. Each time you redistribute the Library (or any work based on the
Library), the recipient automatically receives a license from the
original licensor to copy, distribute, link with or modify the Library
subject to these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties with
this License.
11. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Library at all. For example, if a patent
license would not permit royalty-free redistribution of the Library by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Library.
If any portion of this section is held invalid or unenforceable under any
particular circumstance, the balance of the section is intended to apply,
and the section as a whole is intended to apply in other circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
12. If the distribution and/or use of the Library is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Library under this License may add
an explicit geographical distribution limitation excluding those countries,
so that distribution is permitted only in or among countries not thus
excluded. In such case, this License incorporates the limitation as if
written in the body of this License.
13. The Free Software Foundation may publish revised and/or new
versions of the Lesser General Public License from time to time.
Such new versions will be similar in spirit to the present version,
but may differ in detail to address new problems or concerns.
Each version is given a distinguishing version number. If the Library
specifies a version number of this License which applies to it and
"any later version", you have the option of following the terms and
conditions either of that version or of any later version published by
the Free Software Foundation. If the Library does not specify a
license version number, you may choose any version ever published by
the Free Software Foundation.
14. If you wish to incorporate parts of the Library into other free
programs whose distribution conditions are incompatible with these,
write to the author to ask for permission. For software which is
copyrighted by the Free Software Foundation, write to the Free
Software Foundation; we sometimes make exceptions for this. Our
decision will be guided by the two goals of preserving the free status
of all derivatives of our free software and of promoting the sharing
and reuse of software generally.
NO WARRANTY
15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Libraries
If you develop a new library, and you want it to be of the greatest
possible use to the public, we recommend making it free software that
everyone can redistribute and change. You can do so by permitting
redistribution under these terms (or, alternatively, under the terms of the
ordinary General Public License).
To apply these terms, attach the following notices to the library. It is
safest to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least the
"copyright" line and a pointer to where the full notice is found.
<one line to give the library's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
Also add information on how to contact you by electronic and paper mail.
You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the library, if
necessary. Here is a sample; alter the names:
Yoyodyne, Inc., hereby disclaims all copyright interest in the
library `Frob' (a library for tweaking knobs) written by James Random Hacker.
<signature of Ty Coon>, 1 April 1990
Ty Coon, President of Vice
That's all there is to it!
Makefile
+55
View File
@@ -0,0 +1,55 @@
#
# Makefile for the Offline NT Password Editor
#
#
# Change here to point to the needed OpenSSL libraries & .h files
# See INSTALL for more info.
#
#SSLPATH=/usr/local/ssl
OSSLPATH=/usr
OSSLINC=$(OSSLPATH)/include
CC=gcc
# Force 32 bit
CFLAGS= -DUSEOPENSSL -g -I. -I$(OSSLINC) -Wall -m32
OSSLLIB=$(OSSLPATH)/lib
# 64 bit if default for compiler setup
#CFLAGS= -DUSEOPENSSL -g -I. -I$(OSSLINC) -Wall
#OSSLLIB=$(OSSLPATH)/lib64
# This is to link with whatever we have, SSL crypto lib we put in static
LIBS=-L$(OSSLLIB) $(OSSLLIB)/libcrypto.a
all: chntpw chntpw.static cpnt reged reged.static
chntpw: chntpw.o ntreg.o edlib.o
$(CC) $(CFLAGS) -o chntpw chntpw.o ntreg.o edlib.o $(LIBS)
chntpw.static: chntpw.o ntreg.o edlib.o
$(CC) -static $(CFLAGS) -o chntpw.static chntpw.o ntreg.o edlib.o $(LIBS)
cpnt: cpnt.o
$(CC) $(CFLAGS) -o cpnt cpnt.o $(LIBS)
reged: reged.o ntreg.o edlib.o
$(CC) $(CFLAGS) -o reged reged.o ntreg.o edlib.o
reged.static: reged.o ntreg.o edlib.o
$(CC) -static $(CFLAGS) -o reged.static reged.o ntreg.o edlib.o
#ts: ts.o ntreg.o
# $(CC) $(CFLAGS) -nostdlib -o ts ts.o ntreg.o $(LIBS)
# -Wl,-t
.c.o:
$(CC) -c $(CFLAGS) $<
clean:
rm -f *.o chntpw chntpw.static cpnt reged reged.static *~
README.txt
+249
View File
@@ -0,0 +1,249 @@
The Offline NT Password Editor
(c) 1997-2011 Petter Nordahl-Hagen
This is free software, licensed under the following:
"ntreg" (the registry library) is licensed under the GNU Lesser Public
License. See LGPL.txt.
"chntpw" (the password reset / registry editor frontend) is licensed
under the GNU General Public License, see GPL.txt.
"reged" (registry editor /export tool) is licensed
under the GNU General Public License, see GPL.txt.
See INSTALL.txt for compile/installation instructions.
Where to get more info:
-----------------------
http://pogostick.net/~pnh/ntpasswd/
At that site there's a floppy and a bootable CD that use chntpw to
access the NT/2k/XP/Vista-system it is booted on to edit password etc.
The instructions below are for the standalone program itself, not the floppy.
What does chntpw do?
--------------------
This little program will enable you to view some information and
change user passwords in a Windows (NT/XP/Vista/win7) etc SAM userdatabase file.
You do not need to know the old passwords.
However, you need to get at the file some way or another yourself.
In addition it contains a simple registry editor with full write support,
and hex-editor which enables you to
fiddle around with bits&bytes in the file as you wish yourself.
Also have registry import or export
-----------------------------------
"reged" is a program that can do import and export of .reg files into
the registry hive (binary) files. Also has an editor, but still
rudimentary text based command line type thing.
Why?
----
I often forget passwords. Especially on test installations (that
I just _must_ have some stuff out of half a year later..)
On most unix-based boxes you just boot the thingy off some kind
of rescue bootmedia (cd/floppy etc), and simply edit the
password file.
On Windows NT however, as far as I know, there is no way except reinstalling
the userdatabase, losing all users except admin.
(ok, some companies let you pay lotsa $$$$$ for some rescue service..)
How?
----
Currently, this thing only runs under linux, but it may just happen
to compile on other platforms, too.
(there are dos-versions available, look for links on my webpage)
So, to set a new adminpassword on your NT installation you either:
1) Take the harddrive and mount it on a linux-box
2) Use a linux-bootdisk or CD
one is available at: http://pogostick.net/~pnh/ntpasswd/
ie. you do it offline, with the NT system down.
Usage:
------
This is usage of the "chntpw" program binary only.
For info on the bootdisk, see the web site.
Some of the output format has changed a little since the docs were
first written.
chntpw version 0.99.2 040105, (c) Petter N Hagen
chntpw: change password of a user in a NT SAM file, or invoke registry editor.
chntpw [OPTIONS] <samfile> [systemfile] [securityfile] [otherreghive] [...]
-h This message
-u <user> Username to change, Administrator is default
-l list all users in SAM file
-i Interactive. List users (as -l) then ask for username to change
-e Registry editor. Now with full write support!
-d Enter buffer debugger instead (hex editor),
-t Trace. Show hexdump of structs/segments. (deprecated debug function)
-v Be a little more verbose (for debuging)
-L Write names of changed files to /tmp/changed
-N No allocation mode. Only (old style) same length overwrites possible
Normal usage is:
> chntpw sam system security
- open registry hives 'sam' and 'system' and change administrator account.
Verions dated later from Feb 1999 and later also supports
and will find the admin account, even if the name has been changed,
or the name has been localized (different languageversion of NT
use different admin-names)
The -u option:
Specifies user to change:
> chntpw -u jabbathehutt mysam
- Prompt for password for 'jabbathehutt', if found (otherwise do nothing)
Or you may give RID number in hex:
> chntpw -u 0x1f4 mysam
- Will edit administrator.
Names does not support multibyte (unicode) characters like
some russian and asian locales. Give RID in hex to edit users
with such names. Must start with 0x. Ex: 0x2fa
The -l option:
Will list all users in the sam-file.
The -i option:
Go into the interactive menu system.
The -d option:
This will load the file, and then immediately enter the
buffer debugger.
This is a simple hex-editor with only a few commands,
enter ? at the . prompt to se a short command overview.
'q' exits without saving, 's' exit and saves.
The -e option:
Will enter the registry editor.
You can navigate the registry like a filesystem at the command-line prompt:
See regedit.txt file for more info.
The -t option:
This is a debug function (extended -l) to show how it traces the chain
of structs in the file. This also includes a raw interpretation
of the different registry structures + a hex dump.
The -L option:
Drops the filenames of the changed hives in /tmp/changed
Used by the bootdisk scripts.
The -N option:
Will fall back to old edit mode, disable the block allocations
and only support overwrite-same-size. Used to ensure safety
in testing period.
How does it work:
-----------------
A struct, called the V value of a key in the NT registry
was suddenly somewhat documented through the pwdump utility
included in the unix Samba distribution.
This struct contains some info on a user of the NT machine,
along with 2 crypted versions of the password associated
with the account.
One password is the NT console login password,
the other the LANMAN network share password
(which essentially is the first one in uppercase only,
and no unicode)
This is how NT encrypts the passwords:
The logon cleartext password a user enters is:
1) Converted to unicode
2) A MD4 hash is made out of the unicode string
3) Then the hash is crypted with DES, using the RID (lower
part of the SID, userid) as the crypt key.
This is the so called "obfuscation" step, so
it's not obvious on a hex dump of the file
that two or more users have the same password.
4) The result of stage 3 (16 bytes) is put into the V struct.
For the LANMAN password:
1) Uppercased (and illegal characters probably removed)
14 bytes max, if less the remaining bytes are zeroed.
2) A known (constant) string is DES-encrypted
using 7 first characters of the password as the key.
Another constant is encrypted using the last 7 chars
as the key.
The result of these two crypts are simply appended,
resulting in a 16 byte string.
3) The same obfuscation DES stage as 3 above.
4) 16 bytes result put into the V struct.
Since the number of possible combinations in the lanman
password is relatively low compared to the other one,
and it's easy to see if it's shorter than 8 chars or not
it's used first in brute-force-crackers.
This program, however, don't care at all what the old
one is, it just overwrites it with the new one.
Ok. So, how do we find and identify the V struct?
Yeah.. that was the hard part.. The files structure
is not documented (as far as I know..)
But, with help from an unnamed German, and a lot of testing
and guesswork from myself, it's now possible to follow
the actual registry tree. (see source code for struct-defines
and comments on the registry structure)
The usernames are listed in:
\SAM\Domains\Account\Users\Names\
[2d18] \SAM\Domains\Account\Users\Names> l
ls of node at offset 0x2d1c
Node has 4 subkeys and 1 values
nk-offset name
0x003290 - <Administrator>
0x003630 - <Guest>
0x001c88 - <luser>
0x003428 - <pnh>
Each name is a subkey, with one namless value containing
the RID.
[2d18] \SAM\Domains\Account\Users\Names> cd pnh
[3428] \SAM\Domains\Account\Users\Names\pnh> l
ls of node at offset 0x342c
Node has 0 subkeys and 1 values
vk-offs size type name
0x003688 0 (unknown) <> INLINE: val (in type field?): 1000 (0x3e8)
To get the userinfo (V struct), access
\SAM\Domains\Account\Users\<RID>\V
[2c90] \SAM\Domains\Account\Users> l
ls of node at offset 0x2c94
Node has 5 subkeys and 1 values
nk-offset name
0x003320 - <000001F4>
0x0036b8 - <000001F5>
0x003550 - <000003E8>
0x001d00 - <000003E9>
0x002d18 - <Names>
[2c90] \SAM\Domains\Account\Users> cd 000003E8
[3550] \SAM\Domains\Account\Users\000003E8> l
ls of node at offset 0x3554
Node has 0 subkeys and 2 values
vk-offs size type name
0x0035a8 80 REG_BINARY <F>
0x003228 508 REG_BINARY <V>
For more techincal info, look it up in the source code.
WinReg.txt
+663
View File
@@ -0,0 +1,663 @@
Agreement:
==========
The author of this document will not be responsible for any damage and/or
license violation that may occur. The information within this document is
provided "as is" without warranty of any kind...
This information was "collected" during sleepless nights, and is NOT
officially released by Microsoft! It shall give you a peek at the Windows(tm)
internals to give you a chance to recover from corrupted data.
The author has nothing to do with Microsoft, except that he uses their
products...
If you don't agree with this, stop reading this document, and delete it at
once!
History:
========
What is the registry? Where did it came from? Two questions, which I will try to
answer here. The registry is a database (at least microsoft thinks so:)
which contains configuration information about the system.
It mainly is a memory dump which is saved to one or more files on the windows
host drive. It is loaded every system-boot and remains resident until
shutdown. Since parts of it are not used during normal operation it will be
swapped out very soon. The registry appeared with windows 3.?? (sorry, I can't
remember any earlier version :-), where it was used for file associations and
the "OLE" functions (the conection between ole-id's and the applications).
This is a critical information and since the registry has (almost) NO
CHECKSUM information (!), it sometimes gets corrupted. This is the main
reason for this doc.
Using windows 3.x, almost every configuration was done using good old ".INI"-
files, which were readable but slow and limited in size (64k). In windows 95
(and NT), the registry was used instead of these files. So, to edit a
particular setting, you would have to run the application which manages these
settings. :( but what if this app won't start? MS included a tool named
REGEDIT in windows 3.?? and 95, and a REGEDT32 in windows NT. You can use
these apps to edit ALL contents of the registry (in windows NT the registry
supports security, as well as it provides the security for the whole system!)
An application can open a "key", write values (variables) to it and fill them
with data. Each key represents also a value called "default" and can contain
any number of sub-keys. This will form a tree-structure as you can see at
the left half of REGEDIT. (note: REGEDIT from windows 3.?? has to be started
with /V or /Y, I can't remember now)
Where can I find the registry???
================================
That differs for each windows-version:
Version File(s) Contents
3.1x REG.DAT Complete windows 3.?? Registry
95 SYSTEM.DAT System-values (HKEY_LOCAL_MACHINE)
USER.DAT User-values (HKEY_USERS)
NT SYSTEM32\CONFIG\SAM SAM-part of the registry (=NT Security)
SYSTEM32\CONFIG\SOFTWARE Software-Specific part
(HKEY_LOCAL_MACHINE\SOFTWARE)
SYSTEM32\CONFIG\SYSTEM System-specific part
(HKEY_LOCAL_MACHINE\System)
PROFILES\%USERNAME%\NTUSER.DAT User-Specific part
(HKEY_CURRENT_USER\{S-1-xxx...})
PROFILES\%USERNAME%\NTUSER.MAN like NTUSER.DAT but a
MANDATORY-profile
If you are using a ROAMING-profile with windows NT, NTUSER.xxx can be on
a network-share as well...
Terms
=====
The registry consists of the following elements:
Hive: strating point of the structure. The name of an hive starts
with the "HKEY_"-prefix. Can be seen as a "drive" in a file
system.
Hive name Beschreibung 3.1 95 NT4
HKEY_CLASSES_ROOT Points to the "class" key in
the "HKEY_LOCAL_MACHINE" hive,
the only hive in windows 3.?? X X X
HKEY_CURRENT_USER Information and settings valid
for the currently logged in
user. (Points to the correct X X
key under "HKEY_USERS")
HKEY_CURRENT_CONFIG Settings for the currently
active hardware profile.
Points to "HKEY_LOCAL_MACHINE\ X X
CONTROL\CONTROLSETxxx
HKEY_USERS Contains all currently active
user settings. Since NT is a
single user system, there
will be only one key (the S-ID X X
of the active user), and a
".DEFUALT" key (The settings
for the CTRL-ALT-DEL environment)
HKEY_LOCALMACHINE All local settings X X
HKEY_DYN_DATA As the name says, here you'll find X
dynamic data (CPU-usage,...)
Key: A key to the registry can be seen as a directory in a file
system.
Value: can be seen as the registrys "file"
Data: is the actual setting, can be seen as the contents of a
file
Windows 3.x
===========
This registry is the easiest one. It consists of 3 blocks, which are not
"signed" at all:
Block Position Size
Header 0 32 Bytes
Navigation-Info 0x00000020 ???
Data-Block ??? ???
The "???" marked values can be read from the header.
Header
======
Offset Size Description
0x0000 8 Byte ASCII-Text: "SHCC3.10"
0x0008 D-Word ?
0x000C D-Word ? (always equal the D-Word at 0x0008)
0x0010 D-Word Number of entrys in the navigation-block
0x0014 D-Word Offset of the data-block
0x0018 D-Word Size of the data-block
0x001C Word ?
0x001E Word ?
Values marked "?" are not important for a read-access, and therefore unknown
to me...
Navigation-Block
================
This is where chaos rules! It consists of two different, 8 byte long blocks:
* Navigation-Info-Record,
* Text-Info-Record
The first record in the navigation block is a navigation info record.
Navigation-Info-Record
Offset Size Contents
0x00 Word Next Key (same level)
0x02 Word First Sub-Key (one level deeper)
0x04 Word Text-Info-Record Key-Namens
0x06 Word Text-Info-Record Key-Value (default)
The values are the locical number of the block inside the file:
offset=blocksize*blocknumber+headersize
since 2 of this values are constant:
offset=8*blocknumber+0x20
Text-Info-Record
================
Offset Size Contents
0x00 Word ?
0x02 Word number of references to this text
0x04 Word Text-length
0x06 Word Offset of the text-string inside the data-block
To get the text-offset inside the file you have to add this offset to the
data-offset inside the header.
Data-Block
==========
The data-block only consists of a collection of text-strings. Right in front
of every text is a word which may or may not have a meaning. The offset in
the text-info record points directly to the text, the text-size has to be
defined in the text-info record too.
Windows 95
==========
the Windows95-Registry Files:
inside the windows-directory (default: C:\WINDOWS) are 2 files which are
loaded to form the registry:
SYSTEM.DAT
and
USER.DAT
This files are mapped to the following hives:
HKEY_LOCAL_MACHINE in SYSTEM.DAT
and
HKEY_USERS in USER.DAT
The file structure:
===================
Both files have the same structure. Each of them consists of 3 blocks where
1 of these blocks can be repeated.
Every block has a 4 byte long signature to help identify its contents.
ID Block-contents Max. size
CREG Header 32 Bytes @ Offset 0
RGKN Directory information
(Tree-structure) ??? @ Offset 32
RGDB The real data
(Values and data) max. 65535 Bytes an Offset ??
these blocks are "sticked together" with no space between them, but always
a multiple of 16 in size.
the CREG-Block
==============
Offset Size Inhalt
0x00000000 D-Word ASCII-"CREG" = 0x47455243
0x00000008 D-Word Offset of 1st RGDB-block
0x00000010 D-Word # of RGDB-blocks
all other values are not needed to read the registry...
the RGKN-Block
==============
I assume that RGKN stands for ReGistry-Key-Navigation. This block contains
the information needed to built the tree-structure of the registry. This
block will be larger then 65536 bytes (0xFFFF)!
All offset-values are RELATIVE to the RGKN-block!
Offset Size Contents
0x00000000 D-Word ASCII-"RGKN" = 0x4E4B4752
0x00000004 D-Word Size of the RGKN-block in bytes
0x00000008 D-Word Rel. Offset of the root-record
0x00000020 ???? Tree-Records (often the 1st Record)
the Tree-Record
===============
The tree-record is a "complete" registry-key. It contains the "hash"-info
for the real data stored in this key.
Offset Size Contents
0x0000 D-Word Always 0
0x0004 D-Word Hash of the key-name
0x0008 D-Word Always -1 (0xFFFFFFFF)
0x000C D-Word Offset of the owner (parent)-records
0x0010 D-Word Offset of the 1st sub-sey record
0x0014 D-Word Offset of the next record in this level
0x0018 D-Word ID-number of the real key
the 1st entry in a "usual" registry file is a nul-entry with subkeys: the
hive itself. It looks the same like other keys. Even the ID-number can
be any value.
The "hash"-value is a value representing the key's name. Windows will not
search for the name, but for a matching hash-value. if it finds one, it
will compare the actual string info, otherwise continue with the next key.
End of list-pointers are filled with -1 (0xFFFFFFFF)
The ID-field has the following format:
Bits 31..16: Number of the corresponding RGDB-blocks
Bits 15..0: continuous number inside this RGDB-block.
The hash-method:
================
you are looking for the key: Software\Microsoft
first you take the first part of the string and convert it to upper case
SOFTWARE
The "\" is used as a seperator only and has no meaning here.
Next you initialize a D-Word with 0 and add all ASCII-values of the string
which are smaller than 0x80 (128) to this D-Word.
SOFTWARE = 0x0000026B
Now you can start looking for this hash-value in the tree-record.
If you want to modify key names, also modify the hash-values, since they
cannot be found again (although they would be displayed in REGEDIT)
the RGDB-Block
==============
Header:
Offset Size Contents
0x0000 D-Word ASCII-"RGDB" = 0x42444752
0x0004 D-Word Size of this RGDB-block
0x0020 ???? RGDB Records
RGDB-Record (Key-Information)
=============================
Offset Size Contents
0x0000 D-Word record length in bytes
0x0004 D-Word ID-number
0x0008 D-Word ??? Size ???
0x000C Word text length of key name
0x000E Word Number of values inside this key
0x0010 D-Word always 0
0x0014 ???? Key-name
0x???? ???? Values
The first size (record length) can be used to find the next record.
The second size value is only correct if the key has at least one value,
otherwise it is a little lower.
The key-name is not 0-terminated, its length is defined by the key-
text length field. The values are stored as records.
Value-Record
============
Offset Size Contents
0x0000 D-Word Type of data
0x0004 D-Word always 0
0x0008 Word length of value-name
0x000A Word length of value-data
0x000C ???? value-name
0x???? ???? data
Data-Types
==========
value Contents
0x00000001 RegSZ - 0-terminated string (sometimes without the 0!)
0x00000003 RegBin - binary value (a simple data-block)
0x00000004 RegDWord - D-Word (always 4 bytes in size)
Windows NT (Version 4.0)
========================
Whoever thought that the registry of windows 95 and windows nt are similar
will be surprised! They only look much the same, but have completely other
structures!
Since the RGDB-blocks in the windows 95 registry are not larger than
0xFFFF, we can see that it is optimized for a 16-bit OS...
Windows NT stores its registry in a page-oriented format with blocks
of 4kb (4096 = 0x1000 bytes)
The windows NT registry has 2 different blocks, where one can occure many
times...
the "regf"-Block
================
"regf" is obviosly the abbreviation for "Registry file". "regf" is the
signature of the header-block which is always 4kb in size, although only
the first 64 bytes seem to be used and a checksum is calculated over
the first 0x200 bytes only!
Offset Size Contents
0x00000000 D-Word ID: ASCII-"regf" = 0x66676572
0x00000004 D-Word ????
0x00000008 D-Word ???? Always the same value as at 0x00000004
0x0000000C Q-Word last modify date in WinNT date-format
0x00000014 D-Word 1
0x00000018 D-Word 3
0x0000001C D-Word 0
0x00000020 D-Word 1
0x00000024 D-Word Offset of 1st key record
0x00000028 D-Word Size of the data-blocks (Filesize-4kb)
0x0000002C D-Word 1
0x000001FC D-Word Sum of all D-Words from 0x00000000 to 0x000001FB
I have analyzed more registry files (from multiple machines running
NT 4.0 german version) and could not find an explanation for the values
marked with ???? the rest of the first 4kb page is not important...
the "hbin"-Block
================
I don't know what "hbin" stands for, but this block is always a multiple
of 4kb in size.
Inside these hbin-blocks the different records are placed. The memory-
management looks like a C-compiler heap management to me...
hbin-Header
===========
Offset Size Contents
0x0000 D-Word ID: ASCII-"hbin" = 0x6E696268
0x0004 D-Word Offset from the 1st hbin-Block
0x0008 D-Word Offset to the next hbin-Block
0x001C D-Word Block-size
The values in 0x0008 and 0x001C should be the same, so I don't know
if they are correct or swapped...
From offset 0x0020 inside a hbin-block data is stored with the following
format:
Offset Size Contents
0x0000 D-Word Data-block size
0x0004 ???? Data
If the size field is negative (bit 31 set), the corresponding block
is free and has a size of -blocksize!
The data is stored as one record per block. Block size is a multiple
of 4 and the last block reaches the next hbin-block, leaving no room.
Records in the hbin-blocks
==========================
nk-Record
The nk-record can be treated as a kombination of tree-record and
key-record of the win 95 registry.
lf-Record
The lf-record is the counterpart to the RGKN-record (the hash-function)
vk-Record
The vk-record consists information to a single value.
sk-Record
sk (? Security Key ?) is the ACL of the registry.
Value-Lists
The value-lists contain information about which values are inside a
sub-key and don't have a header.
Datas
The datas of the registry are (like the value-list) stored without a
header.
All offset-values are relative to the first hbin-block and point to the block-
size field of the record-entry. to get the file offset, you have to add
the header size (4kb) and the size field (4 bytes)...
the nk-Record
=============
Offset Size Contents
0x0000 Word ID: ASCII-"nk" = 0x6B6E
0x0002 Word for the root-key: 0x2C, otherwise 0x20
0x0004 Q-Word write-date/time in windows nt notation
0x0010 D-Word Offset of Owner/Parent key
0x0014 D-Word number of sub-Keys
0x001C D-Word Offset of the sub-key lf-Records
0x0024 D-Word number of values
0x0028 D-Word Offset of the Value-List
0x002C D-Word Offset of the sk-Record
0x0030 D-Word Offset of the Class-Name
0x0044 D-Word Unused (data-trash)
0x0048 Word name-length
0x004A Word class-name length
0x004C ???? key-name
the Value-List
==============
Offset Size Contents
0x0000 D-Word Offset 1st Value
0x0004 D-Word Offset 2nd Value
0x???? D-Word Offset nth Value
To determine the number of values, you have to look at the
owner-nk-record!
Der vk-Record
=============
Offset Size Contents
0x0000 Word ID: ASCII-"vk" = 0x6B76
0x0002 Word name length
0x0004 D-Word length of the data
0x0008 D-Word Offset of Data
0x000C D-Word Type of value
0x0010 Word Flag
0x0012 Word Unused (data-trash)
0x0014 ???? Name
If bit 0 of the flag-word is set, a name is present, otherwise the
value has no name (=default)
If the data-size is lower 5, the data-offset value is used to store
the data itself!
The data-types
==============
Wert Beteutung
0x0001 RegSZ: character string (in UNICODE!)
0x0002 ExpandSZ: string with "%var%" expanding (UNICODE!)
0x0003 RegBin: raw-binary value
0x0004 RegDWord: Dword
0x0007 RegMultiSZ: multiple strings, seperated with 0
(UNICODE!)
The "lf"-record
===============
Offset Size Contents
0x0000 Word ID: ASCII-"lf" = 0x666C
0x0002 Word number of keys
0x0004 ???? Hash-Records
Hash-Record
===========
Offset Size Contents
0x0000 D-Word Offset of corresponding "nk"-Record
0x0004 D-Word ASCII: the first 4 characters of the key-name,
padded with 0's. Case sensitiv!
Keep in mind, that the value at 0x0004 is used for checking the
data-consistency! If you change the key-name you have to change the
hash-value too!
The "sk"-block
==============
(due to the complexity of the SAM-info, not clear jet)
Offset Size Contents
0x0000 Word ID: ASCII-"sk" = 0x6B73
0x0002 Word Unused
0x0004 D-Word Offset of previous "sk"-Record
0x0008 D-Word Offset of next "sk"-Record
0x000C D-Word usage-counter
0x0010 D-Word Size of "sk"-record in bytes
????
???? ???? Security and auditing settings...
????
The usage counter counts the number of references to this
"sk"-record. You can use one "sk"-record for the entire registry!
Windows nt date/time format
===========================
The time-format is a 64-bit integer which is incremented every
0,0000001 seconds by 1 (I don't know how accurate it realy is!)
It starts with 0 at the 1st of january 1601 0:00! All values are
stored in GMT time! The time-zone is important to get the real
time!
Common values for win95 and win-nt
==================================
Offset values marking an "end of list", are either 0 or -1 (0xFFFFFFFF).
If a value has no name (length=0, flag(bit 0)=0), it is treated as the
"Default" entry...
If a value has no data (length=0), it is displayed as empty.
simplyfied win-3.?? registry:
=============================
+-----------+
| next rec. |---+ +-----> +------------+
| first sub | | | | Usage cnt. |
| name | | +--> +------------+ | | length |
| value | | | | next rec. | | | text |-------> +-------+
+-----------+ | | | name rec. |--+ +------------+ | xxxxx |
+------------+ | | value rec. |--------> +------------+ +-------+
v | +------------+ | Usage cnt. |
+-----------+ | | length |
| next rec. | | | text |-------> +-------+
| first sub |------+ +------------+ | xxxxx |
| name | +-------+
| value |
+-----------+
Greatly simplyfied structure of the nt-registry:
================================================
+-------------------------------------------------------------------------+
v |
+---------------+ +-------------> +-----------+ +------> +---------+ |
| "nk" | | | lf-rec. | | | nk-rec. | |
| ID | | | # of keys | | | parent |---+
| Date | | | 1st key |--+ | .... |
| parent | | +-----------+ +---------+
| suk-keys |-------+
| values |---------------------> +----------+
| SK-rec. |---------------+ | 1. value |--> +----------+
| class |--+ | +----------+ | vk-rec. |
+---------------+ | | | .... |
v | | data |--> +-------+
+------------+ | +----------+ | xxxxx |
| Class name | | +-------+
+------------+ |
v
+---------+ +---------+
+-----> | next sk |---> | Next sk |--+
| +---| prev sk | <---| prev sk | |
| | | .... | | ... | |
| | +---------+ +---------+ |
| | ^ |
| +--------------------+ |
+------------------------------------+
--------------------------------------------------------------------------------
Hope this helps.... (Although it was "fun" for me to uncover this things,
it took me several sleepless nights ;)
B.D.
chntpw-before.c
+1780
View File
File diff suppressed because it is too large Load Diff
chntpw.c
+1301
View File
File diff suppressed because it is too large Load Diff
cpnt.c
+100
View File
@@ -0,0 +1,100 @@
/*
* cpnt.c - Copy over file without truncating.
* For use on my current floppy, since it's 'cp' insist
* on truncating first, and NTFS doesn't like that yet.
*
* 2003-apr: First version
*
*****
*
* Copyright (c) 1997-2007 Petter Nordahl-Hagen.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; version 2 of the License.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* See file GPL.txt for the full license.
*
*/
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <errno.h>
#include <string.h>
#include <unistd.h>
#include <inttypes.h>
#define BUFSIZE 16384
int main(int argc, char **argv)
{
void *buf;
int sf,df,rb,wb;
int going = 1;
int e = 0;
if (argc != 3) {
printf("usage: cpnt <sourcefile> <destfile>\n");
printf(" sorry, only one file at a time yet.\n");
return(1);
}
#if 0
printf("input : %s\n",argv[1]);
printf("output: %s\n",argv[2]);
#endif
buf = malloc(BUFSIZE);
if (!buf) {
printf("cpnt: could not allocate buffer\n");
return(1);
}
sf = open(argv[1],O_RDONLY);
if (sf < 0) {
e = errno;
printf("cpnt: %s: %s\n",argv[1],strerror(e));
return(1);
}
df = open(argv[2],O_WRONLY|O_CREAT,00666);
if (df < 0) {
e = errno;
printf("cpnt: %s: %s\n",argv[2],strerror(e));
return(1);
}
while (going) {
rb = read(sf,buf,BUFSIZE);
if (rb < 0) {
e = errno;
printf("cpnt: error while reading: %s\n",strerror(e));
going = 0;
break;
}
if (rb == 0) going = 0;
wb = write(df,buf,rb);
if (wb < 0) {
e = errno;
printf("cpnt: error while writing: %s\n",strerror(e));
going = 0;
}
}
close(sf);
close(df);
free(buf);
return(e ? 1 : 0);
}
edlib.c
+691
View File
@@ -0,0 +1,691 @@
/*
* edlib.c - Registry edit interactive fuctions.
*
* Point of this is so that interactive registry editor
* can be accessed from several other programs
*
* 2010-jun: New function from Aleksander Wojdyga: dpi, decode product ID
* Mostly used on \Microsoft\Windows NT\CurrentVersion\DigitalProductId
* Now as command in registry editor, but may be moved to chnpw menu later.
* 2010-apr: Lots of bugfix and other patches from
* Frediano Ziglio <freddy77@gmail.com>
* His short patch comments:
* remove leak
* fix default value, bin and quote
* support wide char in key
* support wide character into value names
* fix export for string with embedded end lines
* remove some warnings
* compute checksum writing
*
* 2008-mar: First version. Moved from chntpw.c
* See HISTORY.txt for more detailed info on history.
*
*****
*
* Copyright (c) 1997-2011 Petter Nordahl-Hagen.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; version 2 of the License.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* See file GPL.txt for the full license.
*
*****
*/
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include "ntreg.h"
const char edlib_version[] = "edlib version 0.1 110511, (c) Petter N Hagen";
#define ALLOC_DEBUG 0 /* Reg allocation debug hooks */
#define ADDBIN_DEBUG 0 /* Reg expansion debug hooks */
extern char *val_types[REG_MAX+1];
struct cmds {
char cmd_str[12];
int cmd_num;
};
#define MCMD_CD 1
#define MCMD_LS 2
#define MCMD_QUIT 3
#define MCMD_CAT 4
#define MCMD_STRUCT 5
#define MCMD_DEBUG 6
#define MCMD_HELP 7
#define MCMD_EXPORTKEY 8
#define MCMD_HIVE 9
#define MCMD_EDIT 10
#define MCMD_ALLOC 11
#define MCMD_FREE 12
#define MCMD_ADDV 13
#define MCMD_DELV 14
#define MCMD_DELVALL 15
#define MCMD_NEWKEY 16
#define MCMD_DELKEY 17
#define MCMD_CATHEX 18
#define MCMD_RDEL 19
#define MCMD_CK 20
#define MCMD_CAT_DPI 21
#define MCMD_ADDBIN 22
struct cmds maincmds[] = {
{ "cd" , MCMD_CD } ,
{ "ls" , MCMD_LS } ,
{ "dir", MCMD_LS } ,
{ "q" , MCMD_QUIT } ,
{ "cat", MCMD_CAT } ,
{ "type",MCMD_CAT } ,
{ "st" , MCMD_STRUCT } ,
{ "debug", MCMD_DEBUG } ,
{ "hive", MCMD_HIVE } ,
{ "ed", MCMD_EDIT } ,
#if ALLOC_DEBUG
{ "alloc", MCMD_ALLOC } ,
{ "free", MCMD_FREE } ,
#endif
#if ADDBIN_DEBUG
{ "addbin", MCMD_ADDBIN },
#endif
{ "nv", MCMD_ADDV } ,
{ "dv", MCMD_DELV } ,
{ "delallv", MCMD_DELVALL } ,
{ "nk", MCMD_NEWKEY } ,
{ "dk", MCMD_DELKEY } ,
{ "hex", MCMD_CATHEX } ,
{ "rdel", MCMD_RDEL } ,
{ "ek", MCMD_EXPORTKEY },
{ "ck", MCMD_CK } ,
{ "?", MCMD_HELP } ,
{ "dpi", MCMD_CAT_DPI } ,
{ "", 0 }
};
/* display decoded DigitalProductId
* nkofs = node
* path = "DigitalProductId" or some other
*/
void cat_dpi(struct hive *hdesc, int nkofs, char *path)
{
void *data;
int len,i,type;
type = get_val_type(hdesc, nkofs, path, 0);
if (type == -1) {
printf("cat_dpi: No such value <%s>\n",path);
return;
}
len = get_val_len(hdesc, nkofs, path, 0);
if (len < 67) {
printf("cat_dpi: Value <%s> is too short for decoding\n",path);
return;
}
data = (void *)get_val_data(hdesc, nkofs, path, 0, 0);
if (!data) {
printf("cat_dpi: Value <%s> references NULL-pointer (bad boy!)\n",path);
abort();
return;
}
if (type != REG_BINARY) {
printf ("Only binary values\n");
return;
}
printf("Value <%s> of type %s, data length %d [0x%x]\n", path,
(type < REG_MAX ? val_types[type] : "(unknown)"), len, len);
char digits[] = {'B','C','D','F','G','H','J','K','M','P','Q','R','T','V','W','X','Y','2','3','4','6','7','8','9'};
#define RESULT_LEN 26
char result[RESULT_LEN];
memset (result, 0, RESULT_LEN);
#define START_OFFSET 52
#define BUF_LEN 15
unsigned char buf[BUF_LEN];
memcpy (buf, data + START_OFFSET, BUF_LEN);
for (i = RESULT_LEN - 2; i >= 0; i--) {
unsigned int x = 0;
int j;
for (j = BUF_LEN - 1; j >= 0; j--) {
x = (x << 8) + buf[j];
buf[j] = x / 24;
x = x % 24;
}
result[i] = digits[x];
}
printf ("\nDecoded product ID: [%s]\n", result);
}
/* display (cat) the value,
* vofs = offset to 'nk' node, paths relative to this (or 0 for root)
* path = path string to value
* Does not handle all types yet (does a hexdump instead)
*/
void cat_vk(struct hive *hdesc, int nkofs, char *path, int dohex)
{
void *data;
int len,i,type;
// char string[SZ_MAX+1];
char *string = NULL;
struct keyval *kv = NULL;
type = get_val_type(hdesc, nkofs, path, TPF_VK);
if (type == -1) {
printf("cat_vk: No such value <%s>\n",path);
return;
}
len = get_val_len(hdesc, nkofs, path, TPF_VK);
if (!len) {
printf("cat_vk: Value <%s> has zero length\n",path);
return;
}
#if 0
data = (void *)get_val_data(hdesc, nkofs, path, 0, TPF_VK);
if (!data) {
printf("cat_vk: Value <%s> references NULL-pointer (bad boy!)\n",path);
abort();
return;
}
#endif
kv = get_val2buf(hdesc, NULL, nkofs, path, 0, TPF_VK);
if (!kv) {
printf("cat_vk: Value <%s> could not fetch data\n",path);
abort();
}
data = (void *)&(kv->data);
printf("Value <%s> of type %s, data length %d [0x%x]\n", path,
(type < REG_MAX ? val_types[type] : "(unknown)"), len, len);
if (dohex) type = REG_BINARY;
switch (type) {
case REG_SZ:
case REG_EXPAND_SZ:
case REG_MULTI_SZ:
string = string_regw2prog(data, len);
// cheap_uni2ascii(data,string,len);
for (i = 0; i < (len>>1)-1; i++) {
if (string[i] == 0) string[i] = '\n';
if (type == REG_SZ) break;
}
puts(string);
FREE(string);
break;
case REG_DWORD:
printf("0x%08x",*(unsigned short *)data);
break;
default:
printf("Don't know how to handle type yet!\n");
case REG_BINARY:
hexdump((char *)data, 0, len, 1);
}
putchar('\n');
FREE(kv);
}
/* Edit value: Invoke whatever is needed to edit it
* based on its type
*/
void edit_val(struct hive *h, int nkofs, char *path)
{
struct keyval *kv, *newkv;
int type,len,n,i,in,go, newsize, d = 0, done, insert = 0;
char inbuf[SZ_MAX+4];
char origstring[SZ_MAX+4];
char *newstring;
char *dbuf;
type = get_val_type(h, nkofs, path, TPF_VK);
if (type == -1) {
printf("Value <%s> not found!\n",path);
return;
}
kv = get_val2buf(h, NULL, nkofs, path, type, TPF_VK);
if (!kv) {
printf("Unable to get data of value <%s>\n",path);
return;
}
len = kv->len;
printf("EDIT: <%s> of type %s with length %d [0x%x]\n", path,
(type < REG_MAX ? val_types[type] : "(unknown)"),
len, len);
switch(type) {
case REG_DWORD:
printf("DWORD: Old value %d [0x%x], ", kv->data, kv->data);
fmyinput("enter new value (prepend 0x if hex, empty to keep old value)\n-> ",
inbuf, 12);
if (*inbuf) {
sscanf(inbuf,"%i",&kv->data);
d = 1;
}
printf("DWORD: New value %d [0x%x], ", kv->data, kv->data);
break;
case REG_SZ:
case REG_EXPAND_SZ:
case REG_MULTI_SZ:
newstring = NULL;
dbuf = (char *)&kv->data;
cheap_uni2ascii(dbuf,origstring,len);
n = 0; i = 0;
while (i < (len>>1)-1) {
printf("[%2d]: %s\n",n,origstring+i);
i += strlen(origstring+i) + 1;
n++;
}
printf("\nNow enter new strings, one by one.\n");
printf("Enter nothing to keep old.\n");
if (type == REG_MULTI_SZ) {
printf("'--n' to quit (remove rest of strings)\n");
printf("'--i' insert new string at this point\n");
printf("'--q' to quit (leaving remaining strings as is)\n");
printf("'--Q' to quit and discard all changes\n");
printf("'--e' for empty string in this position\n");
}
n = 0; i = 0; in = 0; go = 0; done = 0;
/* Now this one is RATHER UGLY :-} */
while (i < (len>>1)-1 || !done) {
printf("[%2d]: %s\n",n, insert == 1 ? "[INSERT]" : ((i < (len>>1)-1 ) ? origstring+i : "[NEW]"));
if (insert) insert++;
if (!go) fmyinput("-> ",inbuf, 500);
else *inbuf = 0;
if (*inbuf && strcmp("--q", inbuf)) {
if (!strcmp("--n", inbuf) || !strcmp("--Q", inbuf)) { /* Zap rest */
i = (len>>1) ; done = 1;
} else if (strcmp("--i", inbuf)) { /* Copy out given string */
if (!strcmp("--e",inbuf)) *inbuf = '\0';
if (newstring) newstring = realloc(newstring, in+strlen(inbuf)+1);
else newstring = malloc(in+strlen(inbuf)+1);
strcpy(newstring+in, inbuf);
in += strlen(inbuf)+1;
} else {
insert = 1;
}
} else { /* Copy out default string */
if (newstring) newstring = realloc(newstring, in+strlen(origstring+i)+1);
else newstring = malloc(in + strlen(origstring+i) + 1);
strcpy(newstring+in, origstring+i);
in += strlen(origstring+i)+1;
if (!strcmp("--q", inbuf)) {
go = 1; done = 1;
if (!(i < (len>>1)-1 )) {
in--; /* remove last empty if in NEW-mode */
}
}
}
if (!insert) i += strlen(origstring+i) + 1;
if (insert != 1) n++;
if (insert == 2) insert = 0;
if (type != REG_MULTI_SZ) {
i = (len<<1);
done = 1;
}
}
if (strcmp("--Q", inbuf)) { /* We didn't bail out */
if (newstring) newstring = realloc(newstring, in+1);
else newstring = malloc(in+1);
if (type == REG_MULTI_SZ) {
in++;
*(newstring+in) = '\0'; /* Must add null termination */
}
ALLOC(newkv,1,(in<<1)+sizeof(int));
newkv->len = in<<1;
printf("newkv->len: %d\n",newkv->len);
cheap_ascii2uni(newstring, (char *)&(newkv->data), in);
d = 1;
FREE(kv);
kv = newkv;
}
break;
default:
printf("Type not handeled (yet), invoking hex editor on data!\n");
case REG_BINARY:
fmyinput("New length (ENTER to keep same): ",inbuf,90);
if (*inbuf) {
newsize = atoi(inbuf);
ALLOC(newkv,1,newsize+sizeof(int)+4);
bzero(newkv,newsize+sizeof(int)+4);
memcpy(newkv, kv, ((len < newsize) ? (len) : (newsize)) + sizeof(int));
FREE(kv);
kv = newkv;
kv->len = newsize;
}
d = debugit((char *)&kv->data, kv->len);
break;
}
if (d) {
if (!(put_buf2val(h, kv, nkofs, path, type, TPF_VK))) {
printf("Failed to set value!?\n");
}
}
FREE(kv);
}
/* look up command in array
*/
int parsecmd(char **s, struct cmds *cmd)
{
int l = 0;
while ((*s)[l] && ((*s)[l] != ' ')) {
l++;
}
while (cmd->cmd_num) {
if (!strncmp(*s, cmd->cmd_str, l)) {
*s += l;
return(cmd->cmd_num);
}
cmd++;
}
return(0);
}
/* Lot of people didn't understand the "nv" command.
* Actually the command should understand the type names too, but.. some later time
*/
void nv_help(void)
{
int i;
printf("Command syntax is:\n\n"
" nv <type> <valuename>\n\n"
"where <type> should be the HEX NUMBER from one of these registry value types:\n\n");
for (i=0; i < REG_MAX; i++) {
printf(" %2x : %s\n",i,val_types[i]);
}
printf("\nExample:\n nv 4 foobar\n");
printf("to make a new value named foobar of the type REG_DWORD\n\n");
}
/* Interactive registry editor
* hive - list of loaded hives (array pointing to hive structs)
* no_hives - max number of hives loaded
*/
void regedit_interactive(struct hive *hive[], int no_hives)
{
struct hive *hdesc;
int cdofs, newofs;
struct nk_key *cdkey;
char inbuf[100], *bp, *file, *prefix;
char path[1000];
int l, vkofs, nh, i;
int usehive = 0;
struct keyval *kv;
#if ALLOC_DEBUG
int pagestart;
int freetest;
#endif
hdesc = hive[usehive];
cdofs = hdesc->rootofs;
printf("Simple registry editor. ? for help.\n");
while (1) {
cdkey = (struct nk_key *)(hdesc->buffer + cdofs);
*path = 0;
get_abs_path(hdesc,cdofs+4, path, 50);
#if ALLOC_DEBUG
pagestart = find_page_start(hdesc,cdofs);
printf("find_page_start: 0x%x\n",pagestart);
freetest = find_free_blk(hdesc,pagestart,10);
printf("find_free_blk: 0x%x\n",freetest);
#endif
if (hdesc->state & HMODE_VERBOSE) printf("\n[%0x] %s> ",cdofs,path);
else printf("\n%s> ",path);
l = fmyinput("",inbuf,90);
bp = inbuf;
skipspace(&bp);
if (l > 0 && *bp) {
switch(parsecmd(&bp,maincmds)) {
case MCMD_HELP:
printf("Simple registry editor:\n");
printf("hive [<n>] - list loaded hives or switch to hive numer n\n");
printf("cd <key> - change current key\n");
printf("ls | dir [<key>] - show subkeys & values,\n");
printf("cat | type <value> - show key value\n");
printf("dpi <value> - show decoded DigitalProductId value\n");
printf("hex <value> - hexdump of value data\n");
printf("ck [<keyname>] - Show keys class data, if it has any\n");
printf("nk <keyname> - add key\n");
printf("dk <keyname> - delete key (must be empty)\n");
printf("ed <value> - Edit value\n");
printf("nv <type#> <valuename> - Add value\n");
printf("dv <valuename> - Delete value\n");
printf("delallv - Delete all values in current key\n");
printf("rdel <keyname> - Recursively delete key & subkeys\n");
printf("ek <filename> <prefix> <keyname> - export key to <filename> (Windows .reg file format)\n");
printf("debug - enter buffer hexeditor\n");
printf("st [<hexaddr>] - debug function: show struct info\n");
printf("q - quit\n");
break;
case MCMD_DELKEY :
bp++;
skipspace(&bp);
del_key(hdesc, cdofs + 4, bp);
break;
case MCMD_NEWKEY :
bp++;
skipspace(&bp);
add_key(hdesc, cdofs + 4, bp);
break;
case MCMD_DELVALL :
bp++;
skipspace(&bp);
del_allvalues(hdesc, cdofs + 4);
break;
case MCMD_DELV :
bp++;
skipspace(&bp);
del_value(hdesc, cdofs + 4, bp, 0);
break;
case MCMD_ADDV :
bp++;
skipspace(&bp);
if (!isxdigit(*bp)) {
nv_help();
break;
}
nh = gethex(&bp);
skipspace(&bp);
if (!*bp) {
nv_help();
break;
}
add_value(hdesc, cdofs+4, bp, nh);
break;
#if ALLOC_DEBUG
case MCMD_FREE :
bp++;
skipspace(&bp);
nh = gethex(&bp);
free_block(hdesc, nh);
break;
case MCMD_ALLOC :
bp++;
skipspace(&bp);
nh = gethex(&bp);
alloc_block(hdesc, cdofs+4, nh);
break;
#endif
#if ADDBIN_DEBUG
case MCMD_ADDBIN :
bp++;
skipspace(&bp);
nh = gethex(&bp);
add_bin(hdesc, nh);
break;
#endif
case MCMD_LS :
bp++;
skipspace(&bp);
nk_ls(hdesc, bp, cdofs+4, 0);
break;
case MCMD_CK :
bp++;
skipspace(&bp);
kv = get_class(hdesc, cdofs+4, bp);
if (kv) {
hexdump((char *)&kv->data, 0, kv->len, 1);
FREE(kv);
}
break;
case MCMD_RDEL :
bp++;
skipspace(&bp);
rdel_keys(hdesc, bp, cdofs+4);
break;
case MCMD_EDIT :
bp++;
skipspace(&bp);
edit_val(hdesc, cdofs+4, bp);
break;
case MCMD_HIVE :
bp++;
skipspace(&bp);
if (*bp) {
nh = gethex(&bp);
if (nh >= 0 && nh < no_hives) {
usehive = nh;
printf("Switching to hive #%d, named <%s>, size %d [0x%x]\n",
usehive, hive[usehive]->filename,
hive[usehive]->size,
hive[usehive]->size);
hdesc = hive[usehive];
cdofs = hdesc->rootofs;
}
} else {
for (nh = 0; nh < no_hives; nh++) {
printf("%c %c %2d %9d 0x%08x <%s>\n", (nh == usehive) ? '*' : ' ',
(hive[nh]->state & HMODE_DIRTY) ? 'D' : ' ',
nh,
hive[nh]->size,
hive[nh]->size, hive[nh]->filename);
}
}
break;
case MCMD_CD :
bp++;
skipspace(&bp);
newofs = trav_path(hdesc, cdofs+4,bp,TPF_NK);
if (newofs) cdofs = newofs;
else printf("Key %s not found!\n",bp);
break;
case MCMD_CAT:
bp++;
skipspace(&bp);
cat_vk(hdesc,cdofs+4,bp,0);
break;
case MCMD_CAT_DPI:
bp++;
skipspace(&bp);
cat_dpi (hdesc, cdofs+4, bp);
break;
case MCMD_CATHEX:
bp++;
skipspace(&bp);
cat_vk(hdesc,cdofs+4,bp,1);
break;
case MCMD_EXPORTKEY :
bp++;
skipspace(&bp);
file = bp;
i = 0;
while(*bp != ' ' && (*bp))
{
i++;
bp++;
}
file[i] = '\0';
bp++;
skipspace(&bp);
prefix = bp;
i = 0;
while(*bp != ' ' && (*bp))
{
i++;
bp++;
}
prefix[i] = '\0';
bp++;
skipspace(&bp);
export_key(hdesc, cdofs + 4, bp, file, prefix);
break;
case MCMD_STRUCT:
bp++;
skipspace(&bp);
vkofs = cdofs;
if (*bp) {
vkofs = gethex(&bp);
}
parse_block(hdesc,vkofs,2);
break;
case MCMD_DEBUG:
if (debugit(hdesc->buffer,hdesc->size)) hdesc->state |= HMODE_DIRTY;
break;
case MCMD_QUIT:
return;
break;
default:
printf("Unknown command: %s, type ? for help\n",bp);
break;
}
}
}
}
hash.c
+66
View File
@@ -0,0 +1,66 @@
/* Mickeysoft hashroutine in XP 'lh' key index lists */
#include <stdio.h>
#include <ctype.h>
#include <string.h>
static const unsigned char charset2upper[] = {
0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, /* 0x00-0x07 */
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /* 0x08-0x0f */
0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, /* 0x10-0x17 */
0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, /* 0x18-0x1f */
0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, /* 0x20-0x27 */
0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, /* 0x28-0x2f */
0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, /* 0x30-0x37 */
0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, /* 0x38-0x3f */
0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, /* 0x40-0x47 */
0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, /* 0x48-0x4f */
0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, /* 0x50-0x57 */
0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f, /* 0x58-0x5f */
0x60, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, /* 0x60-0x67 */
0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, /* 0x68-0x6f */
0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, /* 0x70-0x77 */
0x58, 0x59, 0x5a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, /* 0x78-0x7f */
0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, /* 0x80-0x87 */
0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, /* 0x88-0x8f */
0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, /* 0x90-0x97 */
0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, /* 0x98-0x9f */
0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, /* 0xa0-0xa7 */
0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf, /* 0xa8-0xaf */
0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0x00, 0xb6, 0xb7, /* 0xb0-0xb7 */
0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf, /* 0xb8-0xbf */
0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, /* 0xc0-0xc7 */
0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, /* 0xc8-0xcf */
0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, /* 0xd0-0xd7 */
0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, /* 0xd8-0xdf */
0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, /* 0xe0-0xe7 */
0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, /* 0xe8-0xef */
0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xf7, /* 0xf0-0xf7 */
0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0x00, /* 0xf8-0xff */
};
int main(void)
{
char str[500];
long hash = 0;
int i;
FILE *f;
f = fdopen(0,"r");
fgets(str, 499, f);
str[strlen(str)-1] = 0;
for (i = 0; i < strlen(str); i++) {
hash *= 37;
hash += charset2upper[(unsigned char)str[i]];
}
printf("hash = %08x\n",hash);
}
ntreg.c
+4239
View File
File diff suppressed because it is too large Load Diff
ntreg.h
+444
View File
@@ -0,0 +1,444 @@
/*
* ntreg.h - NT Registry Hive access library, constants & structures
*
* NOTE: defines are not frozen. It can and will change every release.
*
*****
*
* NTREG - Window registry file reader / writer library
* Copyright (c) 1997-2011 Petter Nordahl-Hagen.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation;
* version 2.1 of the License.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
* See file LGPL.txt for the full license.
*
*/
#ifndef _INCLUDE_NTREG_H
#define _INCLUDE_NTREG_H 1
#define SZ_MAX 4096 /* Max unicode strlen before we truncate */
#define KEY_ROOT 0x2c /* Type ID of ROOT key node */
#define KEY_NORMAL 0x20 /* Normal nk key */
#define ABSPATHLEN 4096
/* hbin page size. hbins are minimum this, and always multiple of this */
#define HBIN_PAGESIZE 0x1000
/* Hive filesize seems to always be multiple of this */
#define REGF_FILEDIVISOR 0x40000
/* Larger than this, and values seems split into several blocks */
#define VAL_DIRECT_LIMIT 0x3fd0
/* Datatypes of the values in the registry */
#define REG_NONE 0 /* No value type */
#define REG_SZ 1 /* Unicode nul terminated string */
#define REG_EXPAND_SZ 2 /* Unicode nul terminated string + env */
#define REG_BINARY 3 /* Free form binary */
#define REG_DWORD 4 /* 32-bit number */
#define REG_DWORD_BIG_ENDIAN 5 /* 32-bit number */
#define REG_LINK 6 /* Symbolic Link (unicode) */
#define REG_MULTI_SZ 7 /* Multiple Unicode strings */
#define REG_RESOURCE_LIST 8 /* Resource list in the resource map */
#define REG_FULL_RESOURCE_DESCRIPTOR 9 /* Resource list in the hardware description */
#define REG_RESOURCE_REQUIREMENTS_LIST 10 /* Uh? Rait.. */
#define REG_QWORD 11 /* Quad word 64 bit, little endian */
#define REG_MAX 12
/* The first page of the registry file is some kind of header, lot of
* it's contents is unknown, and seems to be mostly NULLs anyway.
* Note also, that this is the only place in the registry I've been
* able to find _any_ kind of checksumming
*/
struct regf_header {
int32_t id; /* 0x00000000 D-Word ID: ASCII-"regf" = 0x66676572 */
int32_t unknown1; /* 0x00000004 D-Word ???? Mount count */
int32_t unknown2; /* 0x00000008 D-Word ???? Always the same value as at 0x00000004 */
char timestamp[8]; /* 0x0000000C Q-Word last modify date in WinNT date-format */
int32_t unknown3; /* 0x00000014 D-Word 1 */
int32_t unknown4; /* 0x00000018 D-Word 3 - probably version #. 2 in NT3.51 */
int32_t unknown5; /* 0x0000001C D-Word 0 */
int32_t unknown6; /* 0x00000020 D-Word 1 */
int32_t ofs_rootkey; /* 0x00000024 D-Word Offset of 1st key record */
int32_t filesize; /* 0x00000028 D-Word Offset of first non-used data at end of file */
int32_t unknown7; /* 0x0000002C D-Word 1 */
char name[0x1fc-0x30]; /* 0x00000030 Seems like the hive's name is buried here, max len unknown */
int32_t checksum; /* 0x000001FC D-Word Xor sum of all D-Words from 0x00000000 to 0x000001FB */
};
/* The page header, I don't know if the 14 "dummy" bytes has a meaning,
* they seem to be mostly NULLS
*/
struct hbin_page {
int32_t id; /* 0x0000 D-Word ID: ASCII-"hbin" = 0x6E696268 */
int32_t ofs_self; /* 0x0004 D-Word Offset to itself, could be for sanity check */
int32_t ofs_next; /* 0x0008 D-Word Relative offset to next hbin (practically length of this one) */
char dummy1[14]; /* 0x14 to 0x001b may be timestamp in some windows versions, at least in first hbin */
int32_t len_page; /* 0x001C D-Word Block-size??? Don't look like it. Most often zero. */
int32_t firstlink; /* 0x0020 First data block likage */
/* char data[1]; 0x0020 First data block starts here */
};
/* Minimum block size utilized at end of hbin
* Make routines accept 0 size block when at end
*/
#define HBIN_ENDFILL 0
/* Security descriptor. I know how it's linked, but don't know
how the real security data is constructed, it may as well
be like the higher level security structs defined by MS in its
includes & NT docs. Currently, I have no use for it.
Note that keys sharing the exact same security settings will
most likely point to the same security descriptor, thus
saving space and making it fast to make objects inherit settings
(is inheritance supported? they speak of security inheritance as a "new"
feature in the filesystem on NT5, even though I think it was
also supported by the lower levels in the earlier versions)
*/
struct sk_key {
short id; /* 0x0000 Word ID: ASCII-"sk" = 0x6B73 */
short dummy1; /* 0x0002 Word Unused */
int32_t ofs_prevsk; /* 0x0004 D-Word Offset of previous "sk"-Record */
int32_t ofs_nextsk; /* 0x0008 D-Word Offset of next "sk"-Record */
int32_t no_usage; /* 0x000C D-Word usage-counter */
int32_t len_sk; /* 0x0010 D-Word Size of "sk"-record in bytes */
char data[4]; /* Security data up to len_sk bytes */
};
/* This is the subkeylist/hash structure. NT4.0+.
* ID + count, then count number of offset/4byte "hash". (not true hash)
* Probably changed from the 3.x version to make it faster to
* traverse the registry if you're looking for a specific name
* (saves lookups in 'nk's that have the first 4 name chars different)
*/
struct lf_key {
short id; /* 0x0000 Word ID: ASCII-"lf" = 0x666C or "lh" = 0x686c */
short no_keys; /* 0x0002 Word number of keys */
/* 0x0004 ???? Hash-Records */
union {
struct lf_hash {
int32_t ofs_nk; /* 0x0000 D-Word Offset of corresponding "nk"-Record */
char name[4]; /* 0x0004 D-Word ASCII: the first 4 characters of the key-name, */
} hash[1];
/* WinXP uses a more real hash instead (base 37 of uppercase name chars) */
/* padded with 0's. Case sensitiv! */
struct lh_hash {
int32_t ofs_nk; /* 0x0000 D-Word Offset of corresponding "nk"-Record */
int32_t hash; /* 0x0004 D-Word ASCII: the first 4 characters of the key-name, */
} lh_hash[1];
};
};
/* 3.x version of the above, contains only offset table, NOT
* any start of names "hash". Thus needs 'nk' lookups for searches.
*/
struct li_key {
short id; /* 0x0000 Word ID: ASCII-"li" = 0x696C */
short no_keys; /* 0x0002 Word number of keys */
/* 0x0004 ???? Hash-Records */
struct li_hash {
int32_t ofs_nk; /* 0x0000 D-Word Offset of corresponding "nk"-Record */
} hash[1];
};
/* Indirect pointer list for value data, vk points to this instead of values data directly
* Seems to be used when value data is large, maybe larger than 3-4k.
*/
struct db_key {
short id; /* 0x0000 Word ID: ASCII-"li" = 0x6462 */
short no_part; /* 0x0002 Word number of data parts */
/* 0x0004 ???? Pointers to data */
int32_t ofs_data; /* 0x0000 D-Word Offset to list of data blocks */
/* Something else seems to follow here, 4 bytes at least */
/* and why not list the data block in here ???? why make another list?? */
};
/* This is a list of pointers to struct li_key, ie
* an extention record if many li's.
* This happens in NT4&5 when the lf hashlist grows larger
* than about 400-500 entries/subkeys??, then the nk_key->ofs_lf points to this
* instead of directly to an lf.
* The sub-indices this points to seems to be li (yes!) in NT4 and 2k.
* In XP and newer they point to lh which is more efficient.
* Likely to happen in HKLM\Software\classes (file extention list) and
* in SAM when many users.
*/
struct ri_key {
short id; /* 0x0000 Word ID: ASCII-"ri" = 0x6972 */
short no_lis; /* 0x0002 Word number of pointers to li */
/* 0x0004 ???? Hash-Records */
struct ri_hash {
int32_t ofs_li; /* 0x0000 D-Word Offset of corresponding "li"-Record */
} hash[1];
};
/* This is the value descriptor.
* If the sign bit (31st bit) in the length field is set, the value is
* stored inline this struct, and not in a seperate data chunk -
* the data itself is then in the ofs_data field, happens for DWORD all the time
* If the name size == 0, then the struct is probably cut short right
* after the val_type or flag.
* The flag meaning is rather unknown.
*/
struct vk_key {
/* Offset Size Contents */
short id; /* 0x0000 Word ID: ASCII-"vk" = 0x6B76 */
short len_name; /* 0x0002 Word name length */
int32_t len_data; /* 0x0004 D-Word length of the data */
int32_t ofs_data; /* 0x0008 D-Word Offset of Data */
int32_t val_type; /* 0x000C D-Word Type of value */
short flag; /* 0x0010 Word Flag
0x1 ANSI encoding */
short dummy1; /* 0x0012 Word Unused (data-trash) */
char keyname[1]; /* 0x0014 ???? Name */
};
/* This is the key node (ie directory) descriptor, can contain subkeys and/or values.
* Note that for values, the count is stored here, but for subkeys
* there's a count both here and in the offset-table (lf or li struct).
* What happens if these mismatch is not known.
* What's the classname thingy? Can't remember seeing that used in
* anything I've looked at.
*/
struct nk_key {
/* Offset Size Contents */
short id; /* 0x0000 Word ID: ASCII-"nk" = 0x6B6E */
short type; /* 0x0002 Word for the root-key: 0x2C, otherwise 0x20 */
/* 0x20 seems a flag for ANSI encoding */
/* 0x1000 is used in some places in Vista and newer */
char timestamp[12]; /* 0x0004 Q-Word write-date/time in windows nt notation */
int32_t ofs_parent; /* 0x0010 D-Word Offset of Owner/Parent key */
int32_t no_subkeys; /* 0x0014 D-Word number of sub-Keys */
int32_t dummy1;
int32_t ofs_lf; /* 0x001C D-Word Offset of the sub-key lf-Records */
int32_t dummy2;
int32_t no_values; /* 0x0024 D-Word number of values */
int32_t ofs_vallist; /* 0x0028 D-Word Offset of the Value-List */
int32_t ofs_sk; /* 0x002C D-Word Offset of the sk-Record */
int32_t ofs_classnam; /* 0x0030 D-Word Offset of the Class-Name */
int32_t dummy3; /* 0x0034 unknown some of these may be used by vista */
int32_t dummy4; /* 0x0038 unknown and newer ?? */
int32_t dummy5; /* 0x003c unknown */
int32_t dummy6; /* 0x0040 unknown */
int32_t dummy7; /* 0x0044 unknown */
short len_name; /* 0x0048 Word name-length */
short len_classnam; /* 0x004A Word class-name length */
char keyname[1]; /* 0x004C ???? key-name */
};
/*********************************************************************************/
/* Structure defines for my routines */
struct ex_data {
int nkoffs;
struct nk_key *nk;
char *name;
};
struct vex_data {
int vkoffs;
struct vk_key *vk;
int type; /* Value type REG_??? */
int size; /* Values size (normalized, inline accounted for) */
int val; /* Actual value itself if type==REG_DWORD */
char *name;
};
struct keyval {
int len; /* Length of databuffer */
int data; /* Data. Goes on for length of value */
};
struct keyvala {
int len; /* Length of databuffer */
int data[1]; /* Data. Goes on for length of value */
};
/* Types to trav_path() */
#define TPF_NK 0
#define TPF_VK 1
#define TPF_ABS 64
#define TPF_EXACT 128
#define TPF_VK_SHORT 256 /* To get type field instead of data field, used in SAM */
#define TPF_NK_EXACT (TPF_NK | TPF_EXACT)
#define TPF_VK_EXACT (TPF_VK | TPF_EXACT)
#define TPF_VK_ABS (TPF_VK | TPF_ABS) /* Name is literal, not a path */
/* Hive open modes */
#define HMODE_RW 0
#define HMODE_RO 0x1
#define HMODE_OPEN 0x2
#define HMODE_DIRTY 0x4
#define HMODE_NOALLOC 0x8 /* Don't allocate new blocks */
#define HMODE_NOEXPAND 0x10 /* Don't expand file with new hbin */
#define HMODE_DIDEXPAND 0x20 /* File has been expanded */
#define HMODE_VERBOSE 0x1000
#define HMODE_TRACE 0x2000
/* Suggested type of hive loaded, guessed by library, but not used by it */
#define HTYPE_UNKNOWN 0
#define HTYPE_SAM 1
#define HTYPE_SYSTEM 2
#define HTYPE_SECURITY 3
#define HTYPE_SOFTWARE 4
/* Hive definition, allocated by openHive(), dealloc by closeHive()
* contains state data, must be passed in all functions
*/
struct hive {
char *filename; /* Hives filename */
int filedesc; /* File descriptor (only valid if state == OPEN) */
int state; /* Current state of hive */
int type; /* Suggested type of hive. NOTE: Library will guess when
it loads it, but application may change it if needed */
int pages; /* Number of pages, total */
int useblk; /* Total # of used blocks */
int unuseblk; /* Total # of unused blocks */
int usetot; /* total # of bytes in useblk */
int unusetot; /* total # of bytes in unuseblk */
int size; /* Hives size (filesize) in bytes, incl regf header */
int rootofs; /* Offset of root-node */
int lastbin; /* Offset to last HBIN */
int endofs; /* Offset of first non HBIN page, we can expand from here */
short nkindextype; /* Subkey-indextype the root key uses */
char *buffer; /* Files raw contents */
};
/***************************************************/
/* Various nice macros */
#define CREATE(result, type, number)\
{ \
if (!((result) = (type *) calloc ((number), sizeof(type)))) { \
perror("malloc failure"); \
abort() ; \
} \
}
#define ALLOC(result, size, number)\
{ \
if (!((result) = (void *) calloc ((number), (size)))) { \
perror("malloc failure"); \
abort() ; \
} \
}
#define FREE(p) { if (p) { free(p); (p) = 0; } }
/* Debug / verbosity message macro */
#define VERB(h, string) \
{ \
if ((h)->state & HMODE_VERBOSE) printf((string)); \
}
#define VERBF(h, ...) \
{ \
if ((h)->state & HMODE_VERBOSE) printf(__VA_ARGS__); \
}
/******* Function prototypes **********/
char *str_dup( const char *str );
int fmyinput(char *prmpt, char *ibuf, int maxlen);
void hexprnt(char *s, unsigned char *bytes, int len);
void hexdump(char *hbuf, int start, int stop, int ascii);
int find_in_buf(char *buf, char *what, int sz, int len, int start);
int get_int( char *array );
void cheap_uni2ascii(char *src, char *dest, int l);
void cheap_ascii2uni(char *src, char *dest, int l);
void skipspace(char **c);
int gethex(char **c);
int gethexorstr(char **c, char *wb);
int debugit(char *buf, int sz);
int parse_block(struct hive *hdesc, int vofs,int verbose);
int ex_next_n(struct hive *hdesc, int nkofs, int *count, int *countri, struct ex_data *sptr);
int ex_next_v(struct hive *hdesc, int nkofs, int *count, struct vex_data *sptr);
int get_abs_path(struct hive *hdesc, int nkofs, char *path, int maxlen);
int trav_path(struct hive *hdesc, int vofs, char *path, int type);
int get_val_type(struct hive *hdesc, int vofs, char *path, int exact);
int get_val_len(struct hive *hdesc, int vofs, char *path, int exact);
void *get_val_data(struct hive *hdesc, int vofs, char *path, int val_type, int exact);
struct keyval *get_val2buf(struct hive *hdesc, struct keyval *kv,
int vofs, char *path, int type, int exact );
int get_dword(struct hive *hdesc, int vofs, char *path, int exact);
int put_buf2val(struct hive *hdesc, struct keyval *kv,
int vofs, char *path, int type, int exact );
int put_dword(struct hive *hdesc, int vofs, char *path, int exact, int dword);
void export_key(struct hive *hdesc, int nkofs, char *name, char *filename, char *prefix);
void closeHive(struct hive *hdesc);
int writeHive(struct hive *hdesc);
struct hive *openHive(char *filename, int mode);
void nk_ls(struct hive *hdesc, char *path, int vofs, int type);
struct vk_key *add_value(struct hive *hdesc, int nkofs, char *name, int type);
void del_allvalues(struct hive *hdesc, int nkofs);
int del_value(struct hive *hdesc, int nkofs, char *name, int exact);
struct nk_key *add_key(struct hive *hdesc, int nkofs, char *name);
int del_key(struct hive *hdesc, int nkofs, char *name);
void rdel_keys(struct hive *hdesc, char *path, int nkofs);
struct keyval *get_class(struct hive *hdesc, int curnk, char *path);
int add_bin(struct hive *hdesc, int size);
void import_reg(struct hive *hdesc, char *filename, char *prefix);
int de_escape(char *s, int wide);
char *string_regw2prog(void *string, int len);
/* From edlib.c */
void regedit_interactive(struct hive *hive[], int no_hives);
void cat_dpi(struct hive *hdesc, int nkofs, char *path);
#endif
reged.c
+233
View File
@@ -0,0 +1,233 @@
/*
* reged.c - Simple Registry Edit Utility for Windows registry hives.
*
* Frontend command line utility which uses registry library to:
* - Export (parts) of registry hive to .reg file
* - Import .reg file into registry hive
* - Do interactive registry edit
*
* Changes:
* 2011 - may: Trace flags moved here.
* 2011 - apr: Added options for import and flags for safe modes..
*
*
*****
*
* Copyright (c) 1997-2010 Petter Nordahl-Hagen.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; version 2 of the License.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* See file GPL.txt for the full license.
*
*****
*/
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include "ntreg.h"
const char reged_version[] = "reged version 0.1 110511, (c) Petter N Hagen";
/* Global verbosity flag */
int gverbose = 0;
/* Array of loaded hives */
#define MAX_HIVES 10
struct hive *hive[MAX_HIVES+1];
int no_hives = 0;
void usage(void)
{
printf("\nModes:\n"
"-x <registryhivefile> <prefixstring> <key> <output.reg>\n"
" Xport. Where <prefixstring> for example is HKEY_LOCAL_MACHINE\\SOFTWARE\n"
" <key> is key to dump (recursively), \\ or \\\\ means all keys in hive\n"
" Only one .reg and one hive file supported at the same time\n"
"-I <registryhivefile> <prefixstring> <input.reg>\n"
" Import from .reg file. Where <prefixstring> for example is HKEY_LOCAL_MACHINE\\SOFTWARE\n"
" Only one .reg and one hive file supported at the same time\n"
"-e <registryhive> ...\n"
" Interactive edit one or more of registry files\n\n"
"Options:\n"
"-L : Log changed filenames to /tmp/changed, also auto-saves\n"
"-C : Auto-save (commit) changed hives without asking\n"
"-N : No allocate mode, only allow edit of existing values with same size\n"
"-E : No expand mode, do not expand hive file (safe mode)\n"
"-t : Debug trace of allocated blocks\n"
"-v : Some more verbose messages\n"
);
}
int main(int argc, char **argv)
{
int export = 0, edit = 0, import = 0;
int d = 0;
int autocommit = 0, update = 0;
int logchange = 0, mode = 0, dd = 0;
int il;
extern int optind;
extern char* optarg;
char *hivename, *prefix, *key, *outputname, *inputname;
char c;
char yn[10];
FILE *ch;
char *options = "vhtxCLeINE";
printf("%s\n",reged_version);
while((c=getopt(argc,argv,options)) > 0) {
switch(c) {
case 'e': edit = 1; break;
case 'x': export = 1; break;
case 'I': import = 1; break;
case 'C': autocommit = 1; break;
case 'L': logchange = 1; break;
case 'v': mode |= HMODE_VERBOSE; gverbose = 1; break;
case 'N': mode |= HMODE_NOALLOC; break;
case 'E': mode |= HMODE_NOEXPAND; break;
case 't': mode |= HMODE_TRACE; break;
case 'h': usage(); exit(0); break;
default: usage(); exit(1); break;
}
}
if (!export && !edit && !import) {
usage();
exit(1);
}
if ( import && export ) {
fprintf(stderr,"Import and export cannot be done at same time\n");
usage();
exit(1);
}
if (export) { /* Call export. Works only on one hive at a time */
hivename=argv[optind];
prefix=argv[optind+1];
key=argv[optind+2];
outputname=argv[optind+3];
if (gverbose) {
printf("hivename: %s, prefix: %s, key: %s, output: %s\n",hivename,prefix,key,outputname);
}
if (!hivename || !*hivename || !prefix || !*prefix || !key || !*key || !outputname || !*outputname) {
usage(); exit(1);
}
if (!(hive[no_hives] = openHive(hivename,HMODE_RO|mode))) {
fprintf(stderr,"Unable to open/read hive %s, exiting..\n",hivename);
exit(1);
}
export_key(hive[no_hives], 0, key, outputname, prefix);
no_hives++;
}
if (import) { /* Call import. Works only on one hive at a time */
hivename=argv[optind];
prefix=argv[optind+1];
inputname=argv[optind+2];
if (gverbose) {
printf("hivename: %s, prefix: %s\n",hivename,prefix);
}
if (!hivename || !*hivename || !prefix || !*prefix || !inputname || !*inputname) {
usage(); exit(1);
}
if (!(hive[no_hives] = openHive(hivename,HMODE_RW|mode))) {
fprintf(stderr,"Unable to open/read hive %s, exiting..\n",hivename);
exit(1);
}
import_reg(hive[no_hives], inputname, prefix);
no_hives++;
update = 1;
if (edit) regedit_interactive(hive, no_hives);
edit = 0;
}
if (edit) { /* Call editor. Rest of arguments are considered hives to load */
hivename = argv[optind+no_hives];
do {
if (!(hive[no_hives] = openHive(hivename,
HMODE_RW|mode))) {
printf("Unable to open/read a hive, exiting..\n");
exit(1);
}
no_hives++;
hivename = argv[optind+no_hives];
} while (hivename && *hivename && no_hives < MAX_HIVES);
regedit_interactive(hive, no_hives);
update = 1;
}
if (update) { /* run for functions that can have changed things */
printf("\nHives that have changed:\n # Name\n");
for (il = 0; il < no_hives; il++) {
if (hive[il]->state & HMODE_DIRTY) {
if (!logchange && !autocommit) {
printf("%2d <%s>",il,hive[il]->filename);
if (hive[il]->state & HMODE_DIDEXPAND)
printf(" WARNING: File was expanded! Experimental! Use at own risk!\n");
printf("\n");
}
d = 1;
}
}
if (d) {
/* Only prompt user if logging of changed files has not been set */
/* Thus we assume confirmations are done externally if they ask for a list of changes */
if (!logchange && !autocommit) fmyinput("Commit changes to registry? (y/n) [n] : ",yn,3);
if (*yn == 'y' || logchange || autocommit) {
if (logchange) {
ch = fopen("/tmp/changed","w");
}
for (il = 0; il < no_hives; il++) {
if (hive[il]->state & HMODE_DIRTY) {
printf("%2d <%s> - ",il,hive[il]->filename);
if (!writeHive(hive[il])) {
printf("OK ");
if (hive[il]->state & HMODE_DIDEXPAND)
printf(" WARNING: File was expanded! Experimental! Use at own risk!\n");
printf("\n");
if (logchange) fprintf(ch,"%s ",hive[il]->filename);
dd = 2;
}
}
}
if (logchange) {
fprintf(ch,"\n");
fclose(ch);
}
} else {
printf("Not written!\n\n");
}
} else {
printf("None!\n\n");
}
}
while (no_hives > 0)
closeHive(hive[--no_hives]);
return(dd);
}
regedit.txt
+438
View File
@@ -0,0 +1,438 @@
The Offline NT Password Editor
(c) 1997-2011 Petter Nordahl-Hagen
Registry Editor Usermanual/docs
See COPYING for copyright & credits.
See INSTALL for compile/installation instructions.
See README for docs on the passwordpart (or website for bootdisk)
Some known limitations as of first half 2011:
This release features full basic registry edit with
add/del keys and values and resizing values, and also
expanding the file.
Renaming keys and values is not implemented yet.
Import is slow. Export is fast.
Program "reged" is used for interactive registry edit
(rudimentary command prompt type interface)
or to export or import .reg files.
Import and export can also be scripted (non-interactive)
The "chntpw" program which is for password edits, also
contains the editor, but not the import / export.
Usage of "reged":
reged version 0.1 110504, (c) Petter N Hagen
Modes:
-x <registryhivefile> <prefixstring> <key> <output.reg>
Xport. Where <prefixstring> for example is HKEY_LOCAL_MACHINE\SOFTWARE
<key> is key to dump (recursively), . or \ or \\ means all keys in hive
Only one .reg and one hive file supported at the same time
-I <registryhivefile> <prefixstring> <input.reg>
Import from .reg file. Where <prefixstring> for example is HKEY_LOCAL_MACHINE\SOFTWARE
Only one .reg and one hive file supported at the same time
-e <registryhive> ...
Interactive edit one or more of registry files
Options:
-L : Log changed filenames to /tmp/changed, also auto-saves
-C : Auto-save (commit) changed hives without asking
-N : No allocate mode, only allow edit of existing values with same size
-E : No expand mode, do not expand hive file (safe mode)
-t : Debug trace of allocated blocks
-v : Some more verbose messages
-x will do export to .reg file.
It will create files that seems to be compatible with regedit.exe in
Windows.
The prefix is the first part of the key names that windows shows/uses,
it is not stored in the hive files, so you can actually put in
anything unless you have to import in Windows.
Current version only handles one set of files at a time (and also only
one point to start export from in it)
-I does import of .reg files into the specified hive file.
It supports .reg files from Windows regedit.exe, they are usually
UTF-16 (16 bit characters) and in the few cases I tested it will
import with correct characters. Please note that the key and value
names always are 8 bit in the registry, but strings the values store
are 16 bit characters.
Will also work with latin-1 (8 bit) character files, like the export
functions creates, but again some character conversions may be wrong.
Note that the current versions are pretty slow, since they are not
optimized or well written in any way. Around 90000 keys with 120000
values just took around 10 minutes on my pretty fast machine.
(I am lazy! You don't write hex reads with one byte at a time do you? :)
-e goes into interactive editor (see below for old example)
-e can be combined with -I so that the editor is entered before saving
-after an import.
-N and -E are safe modes, can be used with any mode.
-C must be used when importing to auto-save, else it will ask first if
import succeeds.
The -L option will write changed hive file names to /tmp/changed,
I use it for scripts that need to know.
------------------------
Here is an old demo of registry edit, via the chntpw program,
but regedit is the same (except some new stuff is in there)
You can navigate the registry almost like a filesystem (only difference
being that the "files" actually are of a special datatype, instead of
just a bytestream)
Note that this demo is just some random editing, will likely
cause windows to not boot if written back to it.
>chntpw -h
chntpw version 0.99.0 030111, (c) Petter N Hagen
chntpw: change password of a user in a NT SAM file, or invoke registry editor.
chntpw [OPTIONS] <samfile> [systemfile] [securityfile] [otherreghive] [...]
-h This message
-u <user> Username to change, Administrator is default
-l list all users in SAM file
-i Interactive. List users (as -l) then ask for username to change
-e Registry editor. Now with full write support!
-d Enter buffer debugger instead (hex editor),
-t Trace. Show hexdump of structs/segments. (deprecated debug function)
-L Write names of changed files to /tmp/changed
-N No allocation mode. Only (old style) same length overwrites possible
(example edit of a SYSTEM-hive)
>chntpw -e system
chntpw version 0.99.0 030111, (c) Petter N Hagen
Hive's name (from header): <SYSTEM>
ROOT KEY at offset: 0x001020
This is probably not a sam HIVE
Simple registry editor. ? for help.
[1020] > ?
Simple registry editor:
hive [<n>] - list loaded hives or switch to hive numer n'
cd <key> - change key
ls | dir [<key>] - show subkeys & values,
cat | type <value> - show key value
st [<hexaddr>] - show struct info
nk <keyname> - add key
dk <keyname> - delete key (must be empty. recursion not supported yet)
ed <value> - Edit value
nv <type> <valuename> - Add value
dv <valuename> - Delete value
delallv - Delete all values in current key
debug - enter buffer hexeditor
q - quit
(list the contents of the current key)
[1020] > l
ls of node at offset 0x1024
Node has 6 subkeys and 0 values
offs key name
[ 11b8] <ControlSet001>
[ dff88] <ControlSet002>
[1c2040] <LastKnownGoodRecovery>
[ de448] <MountedDevices>
[ de998] <Select>
[ deab8] <Setup>
(keynames & valuenames may be abbreviated, first match is used!)
(also, it's case sensitive, but NT is not)
[1020] > cd Cont
[11b8] \ControlSet001> l
ls of node at offset 0x11bc
Node has 4 subkeys and 0 values
offs key name
[ 1348] <Control>
[ 60628] <Enum>
[ 80b60] <Hardware Profiles>
[ 820f0] <Services>
[11b8] \ControlSet001>
[11b8] \ControlSet001> cd Ser
[820f0] \ControlSet001\Services> l
ls of node at offset 0x820f4
Node has 238 subkeys and 0 values
offs key name
[ 82148] <Abiosdsk>
[ 82270] <abp480n5>
[ 824b0] <ACPI>
[ 82628] <ACPIEC>
[ 82750] <adpu160m>
....
[ dcdc0] <WmiApSrv>
[ dd228] <wuauserv>
[ dd7d8] <WZCSVC>
[b92e0] \ControlSet001\Services\perc2> l
ls of node at offset 0xb92e4
Node has 1 subkeys and 4 values
offs key name
[ b9408] <Parameters>
offs size type value name [value if type DWORD]
[ b933c] 4 REG_DWORD <ErrorControl> 1 [0x1]
[ b9364] 28 REG_SZ <Group>
[ b93b4] 4 REG_DWORD <Start> 4 [0x4]
[ b93d4] 4 REG_DWORD <Type> 1 [0x1]
[b92e0] \ControlSet001\Services\perc2> cat Group
Value <Group> of type REG_SZ, data length 28 [0x1c]
SCSI miniport
[b92e0] \ControlSet001\Services\perc2> ed Start
EDIT: <Start> of type REG_DWORD with length 4 [0x4]
DWORD: Old value 4 [0x4], enter new value (prepend 0x if hex, empty to keep old value)
-> 1
DWORD: New value 1 [0x1],
(seems like we just switched it on)
[b92e0] \ControlSet001\Services\perc2> cd \ControlSet001\Control\ServiceGroupOrder
(Multi strings are a bit awkward..)
[51048] \ControlSet001\Control\ServiceGroupOrder> ed List
EDIT: <List> of type REG_MULTI_SZ with length 1948 [0x79c]
[ 0]: System Reserved
[ 1]: Boot Bus Extender
[ 2]: System Bus Extender
[ 3]: SCSI miniport
[ 4]: Port
...
[52]: SpoolerGroup
[53]: AudioGroup
[54]: NetworkProvider
[55]: RemoteValidation
[56]: NetDDEGroup
[57]: Parallel arbitrator
[58]: Extended Base
[59]: PCI Configuration
[60]: MS Transactions
Now enter new strings, one by one.
Enter nothing to keep old.
'--n' to quit (remove rest of strings)
'--i' insert new string at this point
'--q' to quit (leaving remaining strings as is)
'--Q' to quit and discard all changes
'--e' for empty string in this position
[ 0]: System Reserved
->
(Basically, press just enter to keep string in that postition)
(or enter something to overwrite that postion)
(else give commands as described)
[ 0]: System Reserved
->
[ 1]: Boot Bus Extender
->
[ 2]: System Bus Extender
->
[ 3]: SCSI miniport
-> SCSI megaport
(This will replace the string "SCSI miniport" with "SCSI megaport",
it will probably wreck things once NT boots :)
[ 4]: Port
-> --i
[ 4]: [INSERT]
-> SuperGroup
(Inserts "SuperGroup" as string #4, rest is moved down one)
[ 5]: Port
->
[ 6]: Primary Disk
-> --e
(Will clear the string in this position, empty string)
[ 7]: SCSI Class
-> --q
(keep the rest as is)
[51048] \ControlSet001\Control\ServiceGroupOrder> cd \ControlSet001\Control\SystemResources
[578a0] \ControlSet001\Control\SystemResources> cd Bu
[57f18] (...)\Control\SystemResources\BusValues> l
ls of node at offset 0x57f1c
Node has 0 subkeys and 11 values
offs size type value name [value if type DWORD]
[ 57f7c] 8 REG_BINARY <CBus>
[ 57fac] 8 REG_BINARY <Eisa>
[ 58914] 8 REG_BINARY <Internal>
[ 58934] 8 REG_BINARY <Isa>
[ 5897c] 8 REG_BINARY <MPI>
[ 5899c] 8 REG_BINARY <MPSA>
[ 589ec] 8 REG_BINARY <NuBus>
[ 58a0c] 8 REG_BINARY <PCI>
[ 589cc] 8 REG_BINARY <PCMCIA>
[ 58a74] 8 REG_BINARY <TurboChannel>
[ 58a3c] 8 REG_BINARY <VME>
[57f18] (...)\Control\SystemResources\BusValues> cat Internal
Value <Internal> of type REG_BINARY, data length 8 [0x8]
:00000 00 00 00 00 00 00 00 00 ........
[57f18] (...)\Control\SystemResources\BusValues> cat MPI
Value <MPI> of type REG_BINARY, data length 8 [0x8]
:00000 0A 00 00 00 00 00 00 00 ........
(and now for editing of binary or unhandled valuetypes)
[57f18] (...)\Control\SystemResources\BusValues> ed Internal
EDIT: <Internal> of type REG_BINARY with length 8 [0x8]
New length (ENTER to keep same):
(here you may enter a new size for the binary blob.
new space will be filled with zero's)
Buffer debugger. '?' for help.
.?
d [<from>] [<to>] - dump buffer within range
a [<from>] [<to>] - same as d, but without ascii-part (for cut'n'paste)
: <offset> <hexbyte> [<hexbyte> ...] - change bytes
h <from> <to> <hexbyte> [<hexbyte> ...] - hunt (search) for bytes
ha <hexbyte> [<hexbyte] - Hunt all (whole buffer)
s - save & quit
q - quit (no save)
instead of <hexbyte> etc. you may give 'string to enter/search a string
.
.d
:00000 00 00 00 00 00 00 00 00 ........
.:1 38 39
from: 1, wlen: 2
.d 0
:00000 00 38 39 00 00 00 00 00 .89.....
.:0 'edit
from: 0, wlen: 4
.d 0
:00000 65 64 69 74 00 00 00 00 edit....
(now, s will save the value, q will throw away the changes)
.s
[6f00] (...)\Control\SystemResources\BusValues> cat Internal
Value <Internal> of type REG_BINARY, data length 8 [0x8]
:00000 68 61 68 61 00 00 00 00 haha....
[6f00] (...)\Control\SystemResources\BusValues> cd \
[1020] > l
ls of node at offset 0x1024
Node has 6 subkeys and 0 values
offs key name
[ 11b8] <ControlSet001>
[ dff88] <ControlSet002>
[1c2040] <LastKnownGoodRecovery>
[ de448] <MountedDevices>
[ de998] <Select>
[ deab8] <Setup>
(now let's make a subkey here)
[1020] > nk DemoKey
[1020] > l
ls of node at offset 0x1024
Node has 7 subkeys and 0 values
offs key name
[ 11b8] <ControlSet001>
[ dff88] <ControlSet002>
[1c2ef8] <DemoKey>
[1c2040] <LastKnownGoodRecovery>
[ de448] <MountedDevices>
[ de998] <Select>
[ deab8] <Setup>
[1020] > cd DemoKey
[1c2ef8] \DemoKey> l
ls of node at offset 0x1c2efc
Node has 0 subkeys and 0 values
(it's empty. let's add a value)
[1c2ef8] \DemoKey> nv 1 test
(type 1 is string, 3 binary, 4 dword)
(HINT: type "nv h" for help)
[1c2ef8] \DemoKey> l
ls of node at offset 0x1c2efc
Node has 0 subkeys and 1 values
offs size type value name [value if type DWORD]
[ e0144] 0 REG_SZ <test>
(well, never mind, delete it)
[1c2ef8] \DemoKey> dv test
[1c2ef8] \DemoKey> l
ls of node at offset 0x1c2efc
Node has 0 subkeys and 0 values
[1c2ef8] \DemoKey> cd ..
[1020] > l
ls of node at offset 0x1024
Node has 7 subkeys and 0 values
offs key name
[ 11b8] <ControlSet001>
[ dff88] <ControlSet002>
[1c2ef8] <DemoKey>
[1c2040] <LastKnownGoodRecovery>
[ de448] <MountedDevices>
[ de998] <Select>
[ deab8] <Setup>
(and delete the key)
[1020] > dk DemoKey
[1020] > l
ls of node at offset 0x1024
Node has 6 subkeys and 0 values
offs key name
[ 11b8] <ControlSet001>
[ dff88] <ControlSet002>
[1c2040] <LastKnownGoodRecovery>
[ de448] <MountedDevices>
[ de998] <Select>
[ deab8] <Setup>
(list hives loaded, only one this time)
[1020] > h
* D 0 2097152 0x00200000 <system>
^ ^ hive# size(dec) size(hex) name
| |
| |--- Hive dirty flag.
|
|--- Current hive, being edited.
(hive 2 will change to hive #2 listed and so on..)
(now, let's quit)
[57f18] (...)\Control\SystemResources\BusValues> q
Hives that have changed:
# Name
0 <system>
Write hive files? (y/n) [n] : y
0 <system> - OK
(done)
sam.h
+222
View File
@@ -0,0 +1,222 @@
/*
* sam.h - known structures in the SAM hive of NT registry
*
*****
*
* NTREG - Window registry file reader / writer library
* Copyright (c) 1997-2011 Petter Nordahl-Hagen.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation;
* version 2.1 of the License.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
* See file LGPL.txt for the full license.
*
*/
#ifndef _INCLUDE_SAM_H
#define _INCLUDE_SAM_H 1
#include <sys/types.h>
#include <inttypes.h>
/* This contains some policy settings for the account database */
#define ACCOUNTDB_F_PATH "\\SAM\\Domains\\Account\\F"
struct accountdb_F {
char unknown1[8]; /* 0 */
char unknown2[8]; /* 8 */
uint32_t updatecnt; /* 10 Number of times policy data updated */
char unknown3[4]; /* 14 */
char t_maxpwage[8]; /* 18 Maximum password age, GUI shows only days */
char t_minpwage[8]; /* 20 Minimum password age, GUI shows only days */
char unknown4[8]; /* 28 */
char t_lockdur[8]; /* 30 Account lockout duration, GUI shows minutes */
char t_lockrel[8]; /* 38 Release account lockout after, GUI show minutes */
char unknown5[8]; /* 40 */
uint32_t rid; /* 48 RID of user doing last edit? */
uint32_t flags; /* 4c Some flags & options, see below */
unsigned short minpwlen; /* 50 Minimum password lenght */
unsigned short numhist; /* 52 How many passwords to keep in history */
unsigned short locklimit; /*54 How many tries before lockout */
char unknown6[0x9a]; /* Rest is unknown */
}; /* Total size 0xF0 bytes, seems to be constant */
/* Known bits in flags field */
#define ACF_COMPLEX 0x0001 /* Pass must meet complexity req. */
#define ACF_REVERSIBLE 0x0010 /* Store password using reversible encryption */
/* This is users F value, contains account type & state etc */
#define USER_F_PATH "\\SAM\\Domains\\Account\\Users\\%08X\\F"
struct user_F {
char unknown1[8];
char t_lockout[8]; /* Time of lockout */
char unknown2[8];
char t_creation[8]; /* Time of account creation */
char unknown3[8];
char t_login[8]; /* Time of last login */
int32_t rid;
char unknown4[4];
unsigned short ACB_bits; /* Account type and status flags */
char unknown5[6];
unsigned short failedcnt; /* Count of failed logins, if > than policy it is locked */
unsigned short logins; /* Total logins since creation */
char unknown6 [0xc];
};
#define ACB_DISABLED 0x0001 /* Act disabled */
#define ACB_HOMDIRREQ 0x0002 /* Home directory required */
#define ACB_PWNOTREQ 0x0004 /* User password not req */
#define ACB_TEMPDUP 0x0008 /* Temporary duplicate account?? */
#define ACB_NORMAL 0x0010 /* Normal user account */
#define ACB_MNS 0x0020 /* MNS logon user account */
#define ACB_DOMTRUST 0x0040 /* Interdomain trust account */
#define ACB_WSTRUST 0x0080 /* Workstation trust account */
#define ACB_SVRTRUST 0x0100 /* Server trust account */
#define ACB_PWNOEXP 0x0200 /* User password does not expire */
/* Seems not to be used on failed console logins at least */
#define ACB_AUTOLOCK 0x0400 /* Account auto locked */
char *acb_fields[16] = {
"Disabled" ,
"Homedir req." ,
"Passwd not req." ,
"Temp. duplicate" ,
"Normal account" ,
"NMS account" ,
"Domain trust act." ,
"Wks trust act." ,
"Srv trust act" ,
"Pwd don't expire" ,
"Auto lockout" ,
"(unknown 0x08)" ,
"(unknown 0x10)" ,
"(unknown 0x20)" ,
"(unknown 0x40)" ,
"(unknown 0x80)" ,
};
/* Users V data struct */
/* First 0xCC bytes is pointer & len table, rest is data which
* the table points to
* String data is unicode, not zero terminated (must use len)
*/
struct user_V {
int unknown1_1; /* 0x00 - always zero? */
int unknown1_2; /* 0x04 - points to username? */
int unknown1_3; /* 0x08 - always 0x02 0x00 0x01 0x00 ? */
int username_ofs; /* 0x0c */
int username_len; /* 0x10 */
int unknown2_1; /* 0x14 - always zero? */
int fullname_ofs; /* 0x18 */
int fullname_len; /* 0x1c */
int unknown3_1; /* 0x20 - always zero? */
int comment_ofs; /* 0x24 */
int comment_len; /* 0x28 */
int unknown4_1; /* 0x2c - alway zero? */
int unknown4_2; /* 0x30 - points 4 or 8 byte field before hashes */
int unknown4_3; /* 0x34 - zero? or size? */
int unknown4_4; /* 0x38 - zero? */
int unknown4_5; /* 0x3c - to field 8 bytes before hashes */
int unknown4_6; /* 0x40 - zero? or size of above? */
int unknown4_7; /* 0x44 - zero? */
int homedir_ofs; /* 0x48 */
int homedir_len; /* 0x4c */
int unknown5_1; /* 0x50 - zero? */
int drvletter_ofs; /* 0x54 - drive letter for home dir */
int drvletter_len; /* 0x58 - len of above, usually 4 */
int unknown6_1; /* 0x5c - zero? */
int logonscr_ofs; /* 0x60 - users logon script path */
int logonscr_len; /* 0x64 - length of string */
int unknown7_1; /* 0x68 - zero? */
int profilep_ofs; /* 0x6c - profile path string */
int profilep_len; /* 0x70 - profile path stringlen */
char unknown7[0x90-0x74]; /* 0x74 */
int unknown8_1; /* 0x90 - pointer to some place before hashes, after comments */
int unknown8_2; /* 0x94 - size of above? */
int unknown8_3; /* 0x98 - unknown? always 1? */
int lmpw_ofs; /* 0x9c */
int lmpw_len; /* 0xa0 */
int unknown9_1; /* 0xa4 - zero? */
int ntpw_ofs; /* 0xa8 */
int ntpw_len; /* 0xac */
int unknowna_1; /* 0xb0 */
int unknowna_2; /* 0xb4 - points to field after hashes */
int unknowna_3; /* 0xb8 - size of above field */
int unknowna_4; /* 0xbc - zero? */
int unknowna_5; /* 0xc0 - points to field after that */
int unknowna_6; /* 0xc4 - size of above */
int unknowna_7; /* 0xc8 - zero ? */
char data[4]; /* Data starts here. All pointers above is relative to this,
that is V + 0xCC */
};
/* Groups C data struct
* First 0x34 bytes is pointer & len table, rest is data which
* the table points to
* String data is unicode, not zero terminated (must use len)
*/
struct group_C {
int groupid; /* 0x00 - Seems to be the group ID */
int unknown1_1; /* 0x04 - always zero? */
int unknown1_2; /* 0x08 - points to groupname? */
int unknown1_3; /* 0x0c - always 0x02 0x00 0x01 0x00 ? */
int grpname_ofs; /* 0x10 */
int grpname_len; /* 0x14 */
int unknown2_1; /* 0x18 - always zero? */
int fullname_ofs; /* 0x1c */
int fullname_len; /* 0x20 */
int unknown3_1; /* 0x24 - always zero? */
int unknown3_2; /* 0x28 - always zero? */
int unknown3_3; /* 0x2c - always zero? */
int grp_members; /* 0x30 - number of group members */
/* 0x34 - data starts here. pointers above are offset from this */
char data[];
};
#endif
syskey.txt
+124
View File
@@ -0,0 +1,124 @@
The Offline NT Password Editor
(c) 1997-2002 Petter Nordahl-Hagen
Update: 08 dec 2002
What happens when syskey is installed, and how to get rid of it
---------------------------------------------------------------
Background:
-----------
Syskey was added to NT with Service Pack 3 as a way to prevent easy
access to the actual password hashes in the SAM (Security Accounts Manager)
The original methods of making and storing the hashes makes it
rather easy to bruteforce or dictionary-attack it to find the plaintext
passwords. (mostly caused by a somewhat flawed implementation & use
of the cryptoalgorithms involved, but that's discussed elsewhere)
Enabling syskey is optional, the administrator must run syskey.exe and
answer some dialog-boxes to turn it on. On Windows 2000 it's not optional
anymore, it's enabled by default at installation time.
When syskey is active, the hashes are encrypted/obfuscated yet
another time before being stored in the SAM registry.
However, they're stored in the old form in memory after boot
(pwdump2 demonstrates this),
since the old form is needed for NTLM authentication on the network etc.
The key that obfuscates the hashes, or rather it looks like something
that decrypts the key, can be stored on floppy, generated from a
passphrase to be entered at boot, or stored (obfuscated again) in
the registry.
There's no official supported method to switch off syskey
once activated, except restoring the registry from a rescuefloppy
made before activation of syskey.
So.. what's this got to do with my utility?
-------------------------------------------
My utility doesn't try to crack passwords, it puts new hashes into
the SAM, thus changing a users password. And it does this offline.
Syskey was a showstopper for this.
As far as I can see, there's 2 ways to solve this:
1) Find the key in registry, get user to enter it, or get hold of floppy
then use the syskey on the new password too. However, it's not documented
and I haven't found any reverse engineering of it anyplace.
2) Try to turn it off. This has one drawback, and one good side:
Bad: all passwords must be reset, since the old hashes will be invalid.
VeryBAD: SWITHCHING OFF IN WINDOWS 2000 AND XP NOT PERFECT,
WILL CAUSE TROUBLE, but you can access the computer
afterwards. Domain relationships & syskey may be
impossible to change after this, requiring a reinstall
(or possibly only an upgrade)
Good: There's no need for the key (which may be lost).
3) (NEW 2000-04-01, no, not a joke) Insert old styles password-hashes
into the SAM, will be converted to syskey-hashes on next boot.
This is how syskey is enabled on NT4, the hashes won't be touched
until the first reboot after turning on syskey.
I've found out how to do #2 and #3.
What happens when syskey is turned on, and how to turn it off again:
--------------------------------------------------------------------
- 1 -
Serveral new keys are added to HKLM\System\CurrentControlSet\Control\Lsa,
it seems that most of the keys/values is used for the obfuscation of the key
they change when syskey is updated.
However the value named 'SecureBoot' holds the mode of syskey:
1 - Key in registry
2 - Enter passphrase
3 - Key on floppy
But removing this key (or setting it to 0) isn't enough to disable
syskey. There's more..
- 2 -
HKLM\SAM\Domains\Account\F is a binary structure usually containing the computer
SID and some other stuff related to that.
When syskey is installed it's expanded (about twice the size), with something
I guess is the key heavily encrypted + some flags and other values.
One of these other flag/values also contains the same mode as SecureBoot above.
So.. resetting this mode flag and SecureBoot to 0 is all that's needed
to switch off syskey in NT4 (up to SP6 at time of writing). Changing only one of them
results in a warning about inconsistencies between the SAM and system settings
on completed boot, and syskey is re-invoked.
- 3 -
On Windows 2000 there's yet another place info about syskey is stored:
HKLM\security\Policy\PolSecretEncryptionKey\<default>
which also is a binary structure, but also there the mode is stored.
Reset this to 0, and syskey is gone on win2k.
(if there's a mismatch between the three, it silently resets them
to the most likely value on boot)
- 4 -
Then there's the password hashes.
The usual (old) hashlength is 16 bytes, but all hashes are expanded to 20 bytes
with syskey, the first 4 bytes looks like some kind of counter. (maybe
history-counter?).
Strangely, they're not updated at once when syskey is turned on,
update of the hashes happens during next reboot after syskey has been turned on.
And when the key is later updated, the hashes are also updated?
NO!! Strangely it SEEMS like the password hashes REMAINS THE SAME!
(however, the binaries in the 3 keys noted above changes..)
I'll try to dig more into this. Help wanted :)
When syskey has been switched off, all passwords must be reset.
My utility will write and adjust hash-lengths of the users (usually
administrator) that you reset the password for.
NT itself will fix the rest of the hashes when you set new passwords
from NT.
And yes, it's possible to re-enable syskey after turning it off.
(not on win2k, yet!)
So, anybody reverse engineered the whole syskeystuff?
(yes, I know something's on it's way..)