mirror of
https://github.com/rescatux/chntpw
synced 2026-06-21 14:07:44 +00:00
Initial commit of 11 May 2011 chntpw source code
This commit is contained in:
Adrian Gibanel Lopez
+340
@@ -0,0 +1,340 @@
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
|
||||
51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
License is intended to guarantee your freedom to share and change free
|
||||
software--to make sure the software is free for all its users. This
|
||||
General Public License applies to most of the Free Software
|
||||
Foundation's software and to any other program whose authors commit to
|
||||
using it. (Some other Free Software Foundation software is covered by
|
||||
the GNU Library General Public License instead.) You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
this service if you wish), that you receive source code or can get it
|
||||
if you want it, that you can change the software or use pieces of it
|
||||
in new free programs; and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
anyone to deny you these rights or to ask you to surrender the rights.
|
||||
These restrictions translate to certain responsibilities for you if you
|
||||
distribute copies of the software, or if you modify it.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must give the recipients all the rights that
|
||||
you have. You must make sure that they, too, receive or can get the
|
||||
source code. And you must show them these terms so they know their
|
||||
rights.
|
||||
|
||||
We protect your rights with two steps: (1) copyright the software, and
|
||||
(2) offer you this license which gives you legal permission to copy,
|
||||
distribute and/or modify the software.
|
||||
|
||||
Also, for each author's protection and ours, we want to make certain
|
||||
that everyone understands that there is no warranty for this free
|
||||
software. If the software is modified by someone else and passed on, we
|
||||
want its recipients to know that what they have is not the original, so
|
||||
that any problems introduced by others will not reflect on the original
|
||||
authors' reputations.
|
||||
|
||||
Finally, any free program is threatened constantly by software
|
||||
patents. We wish to avoid the danger that redistributors of a free
|
||||
program will individually obtain patent licenses, in effect making the
|
||||
program proprietary. To prevent this, we have made it clear that any
|
||||
patent must be licensed for everyone's free use or not licensed at all.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License applies to any program or other work which contains
|
||||
a notice placed by the copyright holder saying it may be distributed
|
||||
under the terms of this General Public License. The "Program", below,
|
||||
refers to any such program or work, and a "work based on the Program"
|
||||
means either the Program or any derivative work under copyright law:
|
||||
that is to say, a work containing the Program or a portion of it,
|
||||
either verbatim or with modifications and/or translated into another
|
||||
language. (Hereinafter, translation is included without limitation in
|
||||
the term "modification".) Each licensee is addressed as "you".
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running the Program is not restricted, and the output from the Program
|
||||
is covered only if its contents constitute a work based on the
|
||||
Program (independent of having been made by running the Program).
|
||||
Whether that is true depends on what the Program does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Program's
|
||||
source code as you receive it, in any medium, provided that you
|
||||
conspicuously and appropriately publish on each copy an appropriate
|
||||
copyright notice and disclaimer of warranty; keep intact all the
|
||||
notices that refer to this License and to the absence of any warranty;
|
||||
and give any other recipients of the Program a copy of this License
|
||||
along with the Program.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy, and
|
||||
you may at your option offer warranty protection in exchange for a fee.
|
||||
|
||||
2. You may modify your copy or copies of the Program or any portion
|
||||
of it, thus forming a work based on the Program, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) You must cause the modified files to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
b) You must cause any work that you distribute or publish, that in
|
||||
whole or in part contains or is derived from the Program or any
|
||||
part thereof, to be licensed as a whole at no charge to all third
|
||||
parties under the terms of this License.
|
||||
|
||||
c) If the modified program normally reads commands interactively
|
||||
when run, you must cause it, when started running for such
|
||||
interactive use in the most ordinary way, to print or display an
|
||||
announcement including an appropriate copyright notice and a
|
||||
notice that there is no warranty (or else, saying that you provide
|
||||
a warranty) and that users may redistribute the program under
|
||||
these conditions, and telling the user how to view a copy of this
|
||||
License. (Exception: if the Program itself is interactive but
|
||||
does not normally print such an announcement, your work based on
|
||||
the Program is not required to print an announcement.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Program,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Program, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Program.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Program
|
||||
with the Program (or with a work based on the Program) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may copy and distribute the Program (or a work based on it,
|
||||
under Section 2) in object code or executable form under the terms of
|
||||
Sections 1 and 2 above provided that you also do one of the following:
|
||||
|
||||
a) Accompany it with the complete corresponding machine-readable
|
||||
source code, which must be distributed under the terms of Sections
|
||||
1 and 2 above on a medium customarily used for software interchange; or,
|
||||
|
||||
b) Accompany it with a written offer, valid for at least three
|
||||
years, to give any third party, for a charge no more than your
|
||||
cost of physically performing source distribution, a complete
|
||||
machine-readable copy of the corresponding source code, to be
|
||||
distributed under the terms of Sections 1 and 2 above on a medium
|
||||
customarily used for software interchange; or,
|
||||
|
||||
c) Accompany it with the information you received as to the offer
|
||||
to distribute corresponding source code. (This alternative is
|
||||
allowed only for noncommercial distribution and only if you
|
||||
received the program in object code or executable form with such
|
||||
an offer, in accord with Subsection b above.)
|
||||
|
||||
The source code for a work means the preferred form of the work for
|
||||
making modifications to it. For an executable work, complete source
|
||||
code means all the source code for all modules it contains, plus any
|
||||
associated interface definition files, plus the scripts used to
|
||||
control compilation and installation of the executable. However, as a
|
||||
special exception, the source code distributed need not include
|
||||
anything that is normally distributed (in either source or binary
|
||||
form) with the major components (compiler, kernel, and so on) of the
|
||||
operating system on which the executable runs, unless that component
|
||||
itself accompanies the executable.
|
||||
|
||||
If distribution of executable or object code is made by offering
|
||||
access to copy from a designated place, then offering equivalent
|
||||
access to copy the source code from the same place counts as
|
||||
distribution of the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
4. You may not copy, modify, sublicense, or distribute the Program
|
||||
except as expressly provided under this License. Any attempt
|
||||
otherwise to copy, modify, sublicense or distribute the Program is
|
||||
void, and will automatically terminate your rights under this License.
|
||||
However, parties who have received copies, or rights, from you under
|
||||
this License will not have their licenses terminated so long as such
|
||||
parties remain in full compliance.
|
||||
|
||||
5. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Program or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Program (or any work based on the
|
||||
Program), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Program or works based on it.
|
||||
|
||||
6. Each time you redistribute the Program (or any work based on the
|
||||
Program), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute or modify the Program subject to
|
||||
these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties to
|
||||
this License.
|
||||
|
||||
7. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Program at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Program by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Program.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under
|
||||
any particular circumstance, the balance of the section is intended to
|
||||
apply and the section as a whole is intended to apply in other
|
||||
circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system, which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
8. If the distribution and/or use of the Program is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Program under this License
|
||||
may add an explicit geographical distribution limitation excluding
|
||||
those countries, so that distribution is permitted only in or among
|
||||
countries not thus excluded. In such case, this License incorporates
|
||||
the limitation as if written in the body of this License.
|
||||
|
||||
9. The Free Software Foundation may publish revised and/or new versions
|
||||
of the General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Program
|
||||
specifies a version number of this License which applies to it and "any
|
||||
later version", you have the option of following the terms and conditions
|
||||
either of that version or of any later version published by the Free
|
||||
Software Foundation. If the Program does not specify a version number of
|
||||
this License, you may choose any version ever published by the Free Software
|
||||
Foundation.
|
||||
|
||||
10. If you wish to incorporate parts of the Program into other free
|
||||
programs whose distribution conditions are different, write to the author
|
||||
to ask for permission. For software which is copyrighted by the Free
|
||||
Software Foundation, write to the Free Software Foundation; we sometimes
|
||||
make exceptions for this. Our decision will be guided by the two goals
|
||||
of preserving the free status of all derivatives of our free software and
|
||||
of promoting the sharing and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
||||
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
||||
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
||||
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
||||
REPAIR OR CORRECTION.
|
||||
|
||||
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
||||
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
||||
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
||||
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
||||
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
convey the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 2 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program; if not, write to the Free Software
|
||||
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program is interactive, make it output a short notice like this
|
||||
when it starts in an interactive mode:
|
||||
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, the commands you use may
|
||||
be called something other than `show w' and `show c'; they could even be
|
||||
mouse-clicks or menu items--whatever suits your program.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or your
|
||||
school, if any, to sign a "copyright disclaimer" for the program, if
|
||||
necessary. Here is a sample; alter the names:
|
||||
|
||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
|
||||
`Gnomovision' (which makes passes at compilers) written by James Hacker.
|
||||
|
||||
<signature of Ty Coon>, 1 April 1989
|
||||
Ty Coon, President of Vice
|
||||
|
||||
This General Public License does not permit incorporating your program into
|
||||
proprietary programs. If your program is a subroutine library, you may
|
||||
consider it more useful to permit linking proprietary applications with the
|
||||
library. If this is what you want to do, use the GNU Library General
|
||||
Public License instead of this License.
|
||||
@@ -0,0 +1,340 @@
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
License is intended to guarantee your freedom to share and change free
|
||||
software--to make sure the software is free for all its users. This
|
||||
General Public License applies to most of the Free Software
|
||||
Foundation's software and to any other program whose authors commit to
|
||||
using it. (Some other Free Software Foundation software is covered by
|
||||
the GNU Library General Public License instead.) You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
this service if you wish), that you receive source code or can get it
|
||||
if you want it, that you can change the software or use pieces of it
|
||||
in new free programs; and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
anyone to deny you these rights or to ask you to surrender the rights.
|
||||
These restrictions translate to certain responsibilities for you if you
|
||||
distribute copies of the software, or if you modify it.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must give the recipients all the rights that
|
||||
you have. You must make sure that they, too, receive or can get the
|
||||
source code. And you must show them these terms so they know their
|
||||
rights.
|
||||
|
||||
We protect your rights with two steps: (1) copyright the software, and
|
||||
(2) offer you this license which gives you legal permission to copy,
|
||||
distribute and/or modify the software.
|
||||
|
||||
Also, for each author's protection and ours, we want to make certain
|
||||
that everyone understands that there is no warranty for this free
|
||||
software. If the software is modified by someone else and passed on, we
|
||||
want its recipients to know that what they have is not the original, so
|
||||
that any problems introduced by others will not reflect on the original
|
||||
authors' reputations.
|
||||
|
||||
Finally, any free program is threatened constantly by software
|
||||
patents. We wish to avoid the danger that redistributors of a free
|
||||
program will individually obtain patent licenses, in effect making the
|
||||
program proprietary. To prevent this, we have made it clear that any
|
||||
patent must be licensed for everyone's free use or not licensed at all.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License applies to any program or other work which contains
|
||||
a notice placed by the copyright holder saying it may be distributed
|
||||
under the terms of this General Public License. The "Program", below,
|
||||
refers to any such program or work, and a "work based on the Program"
|
||||
means either the Program or any derivative work under copyright law:
|
||||
that is to say, a work containing the Program or a portion of it,
|
||||
either verbatim or with modifications and/or translated into another
|
||||
language. (Hereinafter, translation is included without limitation in
|
||||
the term "modification".) Each licensee is addressed as "you".
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running the Program is not restricted, and the output from the Program
|
||||
is covered only if its contents constitute a work based on the
|
||||
Program (independent of having been made by running the Program).
|
||||
Whether that is true depends on what the Program does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Program's
|
||||
source code as you receive it, in any medium, provided that you
|
||||
conspicuously and appropriately publish on each copy an appropriate
|
||||
copyright notice and disclaimer of warranty; keep intact all the
|
||||
notices that refer to this License and to the absence of any warranty;
|
||||
and give any other recipients of the Program a copy of this License
|
||||
along with the Program.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy, and
|
||||
you may at your option offer warranty protection in exchange for a fee.
|
||||
|
||||
2. You may modify your copy or copies of the Program or any portion
|
||||
of it, thus forming a work based on the Program, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) You must cause the modified files to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
b) You must cause any work that you distribute or publish, that in
|
||||
whole or in part contains or is derived from the Program or any
|
||||
part thereof, to be licensed as a whole at no charge to all third
|
||||
parties under the terms of this License.
|
||||
|
||||
c) If the modified program normally reads commands interactively
|
||||
when run, you must cause it, when started running for such
|
||||
interactive use in the most ordinary way, to print or display an
|
||||
announcement including an appropriate copyright notice and a
|
||||
notice that there is no warranty (or else, saying that you provide
|
||||
a warranty) and that users may redistribute the program under
|
||||
these conditions, and telling the user how to view a copy of this
|
||||
License. (Exception: if the Program itself is interactive but
|
||||
does not normally print such an announcement, your work based on
|
||||
the Program is not required to print an announcement.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Program,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Program, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Program.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Program
|
||||
with the Program (or with a work based on the Program) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may copy and distribute the Program (or a work based on it,
|
||||
under Section 2) in object code or executable form under the terms of
|
||||
Sections 1 and 2 above provided that you also do one of the following:
|
||||
|
||||
a) Accompany it with the complete corresponding machine-readable
|
||||
source code, which must be distributed under the terms of Sections
|
||||
1 and 2 above on a medium customarily used for software interchange; or,
|
||||
|
||||
b) Accompany it with a written offer, valid for at least three
|
||||
years, to give any third party, for a charge no more than your
|
||||
cost of physically performing source distribution, a complete
|
||||
machine-readable copy of the corresponding source code, to be
|
||||
distributed under the terms of Sections 1 and 2 above on a medium
|
||||
customarily used for software interchange; or,
|
||||
|
||||
c) Accompany it with the information you received as to the offer
|
||||
to distribute corresponding source code. (This alternative is
|
||||
allowed only for noncommercial distribution and only if you
|
||||
received the program in object code or executable form with such
|
||||
an offer, in accord with Subsection b above.)
|
||||
|
||||
The source code for a work means the preferred form of the work for
|
||||
making modifications to it. For an executable work, complete source
|
||||
code means all the source code for all modules it contains, plus any
|
||||
associated interface definition files, plus the scripts used to
|
||||
control compilation and installation of the executable. However, as a
|
||||
special exception, the source code distributed need not include
|
||||
anything that is normally distributed (in either source or binary
|
||||
form) with the major components (compiler, kernel, and so on) of the
|
||||
operating system on which the executable runs, unless that component
|
||||
itself accompanies the executable.
|
||||
|
||||
If distribution of executable or object code is made by offering
|
||||
access to copy from a designated place, then offering equivalent
|
||||
access to copy the source code from the same place counts as
|
||||
distribution of the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
4. You may not copy, modify, sublicense, or distribute the Program
|
||||
except as expressly provided under this License. Any attempt
|
||||
otherwise to copy, modify, sublicense or distribute the Program is
|
||||
void, and will automatically terminate your rights under this License.
|
||||
However, parties who have received copies, or rights, from you under
|
||||
this License will not have their licenses terminated so long as such
|
||||
parties remain in full compliance.
|
||||
|
||||
5. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Program or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Program (or any work based on the
|
||||
Program), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Program or works based on it.
|
||||
|
||||
6. Each time you redistribute the Program (or any work based on the
|
||||
Program), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute or modify the Program subject to
|
||||
these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties to
|
||||
this License.
|
||||
|
||||
7. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Program at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Program by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Program.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under
|
||||
any particular circumstance, the balance of the section is intended to
|
||||
apply and the section as a whole is intended to apply in other
|
||||
circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system, which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
8. If the distribution and/or use of the Program is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Program under this License
|
||||
may add an explicit geographical distribution limitation excluding
|
||||
those countries, so that distribution is permitted only in or among
|
||||
countries not thus excluded. In such case, this License incorporates
|
||||
the limitation as if written in the body of this License.
|
||||
|
||||
9. The Free Software Foundation may publish revised and/or new versions
|
||||
of the General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Program
|
||||
specifies a version number of this License which applies to it and "any
|
||||
later version", you have the option of following the terms and conditions
|
||||
either of that version or of any later version published by the Free
|
||||
Software Foundation. If the Program does not specify a version number of
|
||||
this License, you may choose any version ever published by the Free Software
|
||||
Foundation.
|
||||
|
||||
10. If you wish to incorporate parts of the Program into other free
|
||||
programs whose distribution conditions are different, write to the author
|
||||
to ask for permission. For software which is copyrighted by the Free
|
||||
Software Foundation, write to the Free Software Foundation; we sometimes
|
||||
make exceptions for this. Our decision will be guided by the two goals
|
||||
of preserving the free status of all derivatives of our free software and
|
||||
of promoting the sharing and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
||||
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
||||
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
||||
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
||||
REPAIR OR CORRECTION.
|
||||
|
||||
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
||||
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
||||
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
||||
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
||||
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
convey the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 2 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program; if not, write to the Free Software
|
||||
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
||||
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program is interactive, make it output a short notice like this
|
||||
when it starts in an interactive mode:
|
||||
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, the commands you use may
|
||||
be called something other than `show w' and `show c'; they could even be
|
||||
mouse-clicks or menu items--whatever suits your program.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or your
|
||||
school, if any, to sign a "copyright disclaimer" for the program, if
|
||||
necessary. Here is a sample; alter the names:
|
||||
|
||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
|
||||
`Gnomovision' (which makes passes at compilers) written by James Hacker.
|
||||
|
||||
<signature of Ty Coon>, 1 April 1989
|
||||
Ty Coon, President of Vice
|
||||
|
||||
This General Public License does not permit incorporating your program into
|
||||
proprietary programs. If your program is a subroutine library, you may
|
||||
consider it more useful to permit linking proprietary applications with the
|
||||
library. If this is what you want to do, use the GNU Lesser General
|
||||
Public License instead of this License.
|
||||
+316
@@ -0,0 +1,316 @@
|
||||
|
||||
The Offline NT Password Editor
|
||||
|
||||
(c) 1997-2011 Petter Nordahl-Hagen
|
||||
|
||||
See README for general info, copyright & credits.
|
||||
See INSTALL for compile/installation instructions.
|
||||
|
||||
Revision history
|
||||
(tools only, see website for info on bootdisk revisions)
|
||||
|
||||
* v 0.99.6 110511
|
||||
|
||||
regedit library (chntpw and reged uses it):
|
||||
- Hive expansion! Library now does hive file expansion by
|
||||
default! (but you can turn it off, safe mode). If expansion occured, you
|
||||
will get a warning when saving the hive.
|
||||
- There were a lot of goofs by me in the add/delete key and value
|
||||
handling, which made windows complain and lose data. Hope I managed
|
||||
to fix them.
|
||||
- Also, found out more about how Windows does things, for example:
|
||||
- Empty name (default) value, flag field is 0 (not 1 as usual)
|
||||
- Values with data size 0 to 4 the value data itself is stored in
|
||||
the data pointer field, typical for DWORD (this I knew a long time
|
||||
ago), sign bit of data size field is then set. BUT..
|
||||
- In a lot of cases in SAM, for null name values, size is 0 with sign
|
||||
set. In that case, the data dword is stored in the TYPE field,
|
||||
and the rest is unused. This saves a few bytes of course.. but why?
|
||||
The rest of the stuff registry is used for is often seriously bloated
|
||||
anyway. Did the guys at MS who actually wrote the SAM stuff back
|
||||
in the NT3 days actually do it because they cared? or just because
|
||||
they found something new and exiting they smoked? :)
|
||||
- Large values (seems to be from around 16k) are split internally in
|
||||
several parts. Sounds smart. But it goes via 2 (two) separate data
|
||||
structures that has to be allocated.
|
||||
For regular small values the data pointer simply points to the data
|
||||
itself. For this split large value it points to a "db" struct. This
|
||||
contais a count of how many parts there are. And then the list of
|
||||
pointers to the data parts? Nope. It points to another area where
|
||||
the list of pointers are stored.
|
||||
Pseudo: vk.ofs_data -> db.list -> list[n] -> raw data block n
|
||||
The last raw data block always allocates the whole hbin (usually
|
||||
16k) it is in, even if all of it is not needed. Of course only the correct
|
||||
amount of data is copied out based on the value length.
|
||||
On new Vista64 bit SP2, this happens at least 2 times in
|
||||
SOFTWARE\Microsoft tree.
|
||||
reged:
|
||||
- On popular demand: .reg file import!! (-I)
|
||||
- Will read files from regedit.exe in most cases
|
||||
(UTF-16) but can miss on some international characters. Also reads
|
||||
"latin" (8 bit) files.
|
||||
- Only one .reg and hive at a time supported.
|
||||
- Did quite a lot of testing by importing for example the
|
||||
SOFTWARE\Classes tree with regedit.exe and importing it again into
|
||||
the DEFAULT hive with my tool, then ask windows to "Load hive" (in
|
||||
regedit.exe). If it does not complain in the event log, it is good.
|
||||
(Also, seems like windows has gotten better at not bluescreening on
|
||||
a corrupt registry hive, did not get a single one when doing this
|
||||
with pretty messed up hives in win7 and Vista)
|
||||
- Be aware that .reg import is currently very slow, since I messed
|
||||
up the design for the string reading badly, and also the add routines is
|
||||
not exactly optimized. Consider it a proof of concept! Example:
|
||||
Import of SOFTWARE\Microsoft tree (exported by regedit.exe) into the
|
||||
small DEFAULT hive took more than 10 minutes on a pretty fast
|
||||
machine. Especially hex data is slow (one byte at a time.. lazy me..)
|
||||
- WARNING: .reg file import does not do much sanity checking of the
|
||||
input .reg file. It will either crash during import or mess up
|
||||
the registry if the .reg file is bad.
|
||||
- WARNING2: Limitation: Be careful when importing keys that has large
|
||||
number of subkeys (like several 1000) since it does not split up
|
||||
into indirect indexes (lh) yet, and windows may not like it.
|
||||
- -N and -E options for safe mode edit (no alloc and no expand hive)
|
||||
- Importing (-I) and then into edit (-e) before save possible,
|
||||
by specifying both options.
|
||||
- -I and -C (-IC) will import and auto-save, use this in scripts.
|
||||
chntpw:
|
||||
- This version has no significant changes in the password (reset)
|
||||
handling part of the tools.
|
||||
TODO list:
|
||||
- Windows like API. Faster .reg import. Fix bugs! Maybe not in that
|
||||
order :)
|
||||
|
||||
|
||||
* v 0.99.6 100627
|
||||
chntpw:
|
||||
- Syskey not visible in menu anymore, but is still selectable as # 2
|
||||
This because too many people just went ahead without understanding
|
||||
its purpose, and the emailed me when things went as expected, that
|
||||
is it went *boom*
|
||||
- Interactive menu adapts to show most relevant selections based
|
||||
on what is loaded
|
||||
reged:
|
||||
- Patches from Frediano Ziglio adding or fixing:
|
||||
buffer overflow in export_subkey printing keyname
|
||||
some quoting error (name and string values must be quoted)
|
||||
missing support for wide character encoding in keys and value names
|
||||
regedit library (chntpw and reged uses it):
|
||||
- New function from Aleksander Wojdyga: dpi, to decode product IDs
|
||||
Can be used on for example \Microsoft\Windows NT\CurrentVersion\DigitalProductId
|
||||
to find the systems product ID in cleartext.
|
||||
Now as command in registry editor, but may be moved to chnpw menu later.
|
||||
|
||||
* v 0.99.6 080526
|
||||
reged:
|
||||
- NEW TOOL: It's actually just the interactive registry edit
|
||||
(still also available in chntpw) plus
|
||||
the registry export to .reg-file from command line.
|
||||
This tool contains no password functions, thus no crypto.
|
||||
chntpw:
|
||||
- Interactive reg ed moved out of chntpw, into edlib.c
|
||||
- 64 bit compatible patch by Mike Doty, via Alon Bar-Lev
|
||||
http://bugs.gentoo.org/show_bug.cgi?id=185411
|
||||
- Some minor tweaks and fixes
|
||||
ntreg library:
|
||||
- Type QWORD (XP/Vista and newer) now recognized
|
||||
- Most functions accepting a path now also have a parameter specifying if
|
||||
the search should be exact or on first match basis, thus
|
||||
this libary version breaks build with older programs.
|
||||
- Fixed bug which skipped first indirect index table when deleting keys,
|
||||
usually leading to endless loop when recursive deleting.
|
||||
- Export to .reg file by Leo von Klenze, expanded a bit by me.
|
||||
- 64 bit compatible patch by Mike Doty, via Alon Bar-Lev
|
||||
http://bugs.gentoo.org/show_bug.cgi?id=185411
|
||||
- A few other small fixes and tweaks.
|
||||
|
||||
* v 0.99.5 070923
|
||||
- User edit is now menu-driven, better visuals / tables / listings.
|
||||
- Group memberships are listen on the user
|
||||
- User promotion (put into admin group) is now public, with it's own
|
||||
menu selection in the user menu. Still considered EXPERIMENTAL!
|
||||
- Some other verbosity/visual changes
|
||||
- Changed the verbosity (-v) option to be more useful for debug
|
||||
or advanced information
|
||||
|
||||
* v 0.99.4 070406 (decade)
|
||||
- 10 year anniversary!
|
||||
- Changed to GPL license
|
||||
- Support for Windows Vista was already there, but only blanking
|
||||
password works.
|
||||
- Some small insignificant changes, mainly to output or text.
|
||||
|
||||
* v 0.99.3 041205
|
||||
- Fixed bug in loadhive(), caused a crash when last page pointer
|
||||
was out of range, which seems to happen a lot on some
|
||||
installations. Guess it is correct to just assume it is
|
||||
end of file. Thanks to Michael Rothstein for supplying a
|
||||
hive with this.
|
||||
|
||||
* v 0.99.3 040818
|
||||
chntpw:
|
||||
- Lot of nasty bugs fixed in REG_SZ and REG_MULTI_SZ input, often
|
||||
trashed the heap, leading to later crashes.
|
||||
- New regedit command "hex" to see value in hexdump regardles
|
||||
of type.
|
||||
- Some other minor fixes on hive load.
|
||||
ntreg: Major bugfixes in key add/delete,
|
||||
and support for more of the registry:
|
||||
- Now full support of key add/del on NT351 ('li' index)
|
||||
as a bi-effect this also adds support for NT4/win2k edits
|
||||
in keys with indirect index (when it contains ~>500 subkeys)
|
||||
since the index tables then switches from 'lf' (semi-hashed)
|
||||
to 'li' (unhashed table).
|
||||
- WinXP and newer uses 'lh' (true hash) always, even when going
|
||||
via indirect tables ('ri'). I wasn't aware of this, so reading
|
||||
or traversing that in earlier versions usually crashed.
|
||||
- Critical bugs fixed in the allocation of space in the hive,
|
||||
older versions may in several occations corrupt the hive.
|
||||
- Fixed some hive load bugs, deallocate properly on close etc.
|
||||
|
||||
* v 0.99.2 040105
|
||||
- Added RecoveryConsole parameter change
|
||||
- Try to guess type of hive loaded (sam, system, security etc), this
|
||||
is used by the user edit, syskey edit, RecoveryConsole edit
|
||||
to look up into the right hive.
|
||||
- Do not confirm save if the change-tracking option is set (-L)
|
||||
(assume wrapper does it..)
|
||||
- Hid the hash-stuff during password reset. I got all kinds of
|
||||
confusing questions about it (most often: can I find the original
|
||||
pw? Answer: NO if win2k or higher)
|
||||
Option -v turns this on again for debugging.
|
||||
- Also reduced some other debug output, -t and/or -v turns on again
|
||||
most of it.
|
||||
- Fixed some bugs:
|
||||
- check of return value from open()
|
||||
- corrected prototype defs for some calls into OpenSSL,
|
||||
this fixes some compilation errors people have reported.
|
||||
Thanks to Alexander Poquet for that.
|
||||
- Probably _added_ more bugs :-} but they are yet unknown :)
|
||||
|
||||
* v 0.99.1 030126
|
||||
- Fixed bug in ntreg, seems some files has garbage instead of zero
|
||||
pages at end. Now stops enumerating on first non 'hbin' page.
|
||||
Thanks to Jim Andersen for giving me a hive file that showed this.
|
||||
- Reports strongly indicates that blanking a password
|
||||
(* at the prompt) works more often than changing passwords.
|
||||
Changed some wording regarding this.
|
||||
|
||||
* v 0.99.0 030112
|
||||
- There is now full registry edit support with expansion of value
|
||||
size and add / delete of keys and values!
|
||||
See regedit.txt for more info on registry editing
|
||||
See source for details on data block allocation etc in registry.
|
||||
- Changed interactive mode (-i) a bit, now features menues.
|
||||
- Syskeystatus/change not shown unless selected from menu.
|
||||
- New option: -N to set it in old-edit mode, ie only exact
|
||||
overwrites. This is for safety in testing etc.
|
||||
|
||||
* v 0.98.6 021213
|
||||
- Added parsing of users F and SAMs F value, which stores account type bits
|
||||
and lockout information. Ability to reset it if locked.
|
||||
- As usual, see source (especially sam.h for details) on this.
|
||||
|
||||
* v 0.98.5 021208
|
||||
- Added ability to enter RID (in hex) instead of username by
|
||||
starting the entry with 0x. Works interactive and on commandline.
|
||||
This will enable edit of users that has names which actually
|
||||
use unicode, like some russian and asian systems.
|
||||
- Only entering * for password will blank password by setting
|
||||
hash lengths to zero. Seems to be working ok in 2k and XP.
|
||||
This may also clear up an earlier failed change.
|
||||
One bug/drawback: Seems to leak about 30-50 bytes in the V struct.
|
||||
- Fixed bug in handling of blank LANMAN-pass.
|
||||
|
||||
* v 0.98.4 011022
|
||||
- Fixed input buffer overflow that made it impossible to enter
|
||||
usernames at 16 chars (the \n would flow over into the password
|
||||
prompt thus not changing it)
|
||||
- New option -L that will write the names of changed hives to
|
||||
/tmp/changed. Mainly for use in my bootfloppy scripts.
|
||||
|
||||
* v 0.98.3 010808
|
||||
- Blank password detection rewritten. The NT or LANMAN hash seems
|
||||
to actually be missing from the sam entry if password is blank.
|
||||
This will now be detected, and if only LANMAN is present, it
|
||||
will be convertet to NT password.
|
||||
- Some minor changes in text & prompts.
|
||||
|
||||
* v 0.98.2 010107
|
||||
- Changed to use OpenSSL for MD4 & DES encryption instead of
|
||||
the old libraries. Only change of build process from source
|
||||
is to point the Makefile to wherever your OpenSSL libraries & includes are.
|
||||
- Minor changes in wording of Syskey warnings.
|
||||
- No functional changes.
|
||||
- Known bugs: Hive statistics often wrong (but the numbers are not used
|
||||
later, so it's not critical)
|
||||
|
||||
* v 0.98.1 000607
|
||||
|
||||
- Discovered that when a key has lots of subkeys (typically about
|
||||
300 or more?) its hashtable is split and accessed through an
|
||||
indirect ('ri') table, almost as some filesystems do with
|
||||
datablock lists on large files. This caused an error "Not 'nk' node"
|
||||
and sometimes a crash in earlier versions. In SAM this happens in
|
||||
\SAM\Domains\Account\Users when the number of users are large
|
||||
(which often is the case on domain controllers).
|
||||
See source code for technical details on this. (WinReg.txt not updated)
|
||||
|
||||
* v 0.98 000401
|
||||
|
||||
- Disabling syskey on Win2000 corrupts the SAM somehow, makes it
|
||||
unable to reenable + leaves it in a partial mode 1 syskey.
|
||||
Also corrupts the Domain Trust password, making it impossible
|
||||
to join og leave a domain.
|
||||
Delete HKLM\SECURITY\Policy\Secrets\$MACHINE.ACC (the trust key,
|
||||
may need to change ACLs to get to it) to leave the domain and make it
|
||||
possible to rejoin.
|
||||
- Added support for changing passwords without disabling or
|
||||
changing syskey, simply by inserting old type password hash
|
||||
into the sam. It gets converted to syskey-hash on next boot.
|
||||
Why I didn't discover this before is beyond me.
|
||||
- A few smaller bugfixes.
|
||||
|
||||
* v 0.98 000215
|
||||
|
||||
- Can now write, too, but only existing values, & same datalength.
|
||||
- Internals rewritten, registry manipulation functions
|
||||
now in separate "library".
|
||||
- Added ability to check for and disable syskey. (see syskey.txt
|
||||
& sourcecode for details)
|
||||
- "Command line"-type registry-editor improved a bit.
|
||||
- Possible to load and edit several hives at once
|
||||
- Several minor changes.
|
||||
- Since a lot has been rewritten, there's probably more bugs.
|
||||
|
||||
* v 0.90 990307
|
||||
|
||||
Major updates:
|
||||
|
||||
- Full registry parse/read/viever. Can follow the tree like a filesystem.
|
||||
No write-support yet.
|
||||
- 3.51 & 4.0 support. Seems to be working on NT5 betas, too.
|
||||
- 100% sure to find usernames/passwords.
|
||||
- Support for localized admin-names (will automatically find it)
|
||||
- Several minor bugs from earlier versions fixed.
|
||||
- Sorry, but still no syskey support. (but since full registry
|
||||
read capabilities exsist, it's now easier to make it)
|
||||
|
||||
* PRE-1 970611
|
||||
- Got reports on "Netlogon service not started"
|
||||
(and then it was impossible to logon)
|
||||
if attempt to change blank password into something else.
|
||||
This was because if the password is set blank (from NT), the NT-logon
|
||||
hash (md4) is not stored in SAM at all (the LANmanager hash seems to be
|
||||
there..) However, chntpw didn't know about this, and happily(?) wrote away
|
||||
and corrupted the SAM file, causing Netlogon to fail.
|
||||
This version will flag accounts with blank passwords, and refuse to change it.
|
||||
|
||||
- The -i (interactive) option now loops. Will ask for a new name repeatedly,
|
||||
until '!' is entered. This enables you to change multiple passwords in
|
||||
one run.
|
||||
|
||||
- No support for syskey, yet.
|
||||
|
||||
* PRE-1 970528:
|
||||
- First public release
|
||||
|
||||
+48
@@ -0,0 +1,48 @@
|
||||
|
||||
The Offline NT Password & Registry Editor
|
||||
|
||||
(c) 1997-2011 Petter Nordahl-Hagen
|
||||
|
||||
This file is meant for developers.
|
||||
|
||||
General usage is via the provided boot CD images, but
|
||||
static linux builds of the tools are also available
|
||||
in the source zip file.
|
||||
|
||||
See REAMDE for general instructions and license info,
|
||||
HISTORY.txt for version info.
|
||||
|
||||
If you want to build yourself, it should compile
|
||||
with most gcc compilers. However, I am not particulary good
|
||||
with types, so there may be some warnings.
|
||||
|
||||
You may have to install the openssl-devel package from you
|
||||
linux distro to compile/link, since I need the static variant.
|
||||
(change the makefile to link dynamic if you wish)
|
||||
I link statically with libcrypto.a from OpenSSL.
|
||||
(chntpw only, other tools does not require crypto)
|
||||
|
||||
Thanks to Denis Ducamp for modifying chntpw to use OpenSSL.
|
||||
|
||||
Thanks to Mike Doty, via Alon Bar-Lev for 64 bit build compatible patch.
|
||||
(from http://bugs.gentoo.org/show_bug.cgi?id=185411)
|
||||
|
||||
Look into Makefile, you may need to change things to fit your env.
|
||||
(also if you need 64 bit)
|
||||
|
||||
If make goes well, you should have:
|
||||
chntpw - Password tool, dynamic with libc, static with OpenSSL
|
||||
chntpw.static - Completely static passord tool
|
||||
reged - Registry edit tool, dynamic linked with libc. No crypto.
|
||||
reged.static - Registry too, statically linked.
|
||||
cpnt - Simple copy utility, does not truncate file on write
|
||||
Now deprecated, was at least needed earlier for NTFS writes.
|
||||
|
||||
Also, the floppies and CDs are build under a different
|
||||
environment for small libc size (uClibc), see website
|
||||
for details. (build scripts not currently available..)
|
||||
|
||||
So, note that the binary then contains cryptographic code
|
||||
which may be illegal for you to export.
|
||||
|
||||
Good luck.
|
||||
@@ -0,0 +1,504 @@
|
||||
GNU LESSER GENERAL PUBLIC LICENSE
|
||||
Version 2.1, February 1999
|
||||
|
||||
Copyright (C) 1991, 1999 Free Software Foundation, Inc.
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
[This is the first released version of the Lesser GPL. It also counts
|
||||
as the successor of the GNU Library Public License, version 2, hence
|
||||
the version number 2.1.]
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
Licenses are intended to guarantee your freedom to share and change
|
||||
free software--to make sure the software is free for all its users.
|
||||
|
||||
This license, the Lesser General Public License, applies to some
|
||||
specially designated software packages--typically libraries--of the
|
||||
Free Software Foundation and other authors who decide to use it. You
|
||||
can use it too, but we suggest you first think carefully about whether
|
||||
this license or the ordinary General Public License is the better
|
||||
strategy to use in any particular case, based on the explanations below.
|
||||
|
||||
When we speak of free software, we are referring to freedom of use,
|
||||
not price. Our General Public Licenses are designed to make sure that
|
||||
you have the freedom to distribute copies of free software (and charge
|
||||
for this service if you wish); that you receive source code or can get
|
||||
it if you want it; that you can change the software and use pieces of
|
||||
it in new free programs; and that you are informed that you can do
|
||||
these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
distributors to deny you these rights or to ask you to surrender these
|
||||
rights. These restrictions translate to certain responsibilities for
|
||||
you if you distribute copies of the library or if you modify it.
|
||||
|
||||
For example, if you distribute copies of the library, whether gratis
|
||||
or for a fee, you must give the recipients all the rights that we gave
|
||||
you. You must make sure that they, too, receive or can get the source
|
||||
code. If you link other code with the library, you must provide
|
||||
complete object files to the recipients, so that they can relink them
|
||||
with the library after making changes to the library and recompiling
|
||||
it. And you must show them these terms so they know their rights.
|
||||
|
||||
We protect your rights with a two-step method: (1) we copyright the
|
||||
library, and (2) we offer you this license, which gives you legal
|
||||
permission to copy, distribute and/or modify the library.
|
||||
|
||||
To protect each distributor, we want to make it very clear that
|
||||
there is no warranty for the free library. Also, if the library is
|
||||
modified by someone else and passed on, the recipients should know
|
||||
that what they have is not the original version, so that the original
|
||||
author's reputation will not be affected by problems that might be
|
||||
introduced by others.
|
||||
|
||||
Finally, software patents pose a constant threat to the existence of
|
||||
any free program. We wish to make sure that a company cannot
|
||||
effectively restrict the users of a free program by obtaining a
|
||||
restrictive license from a patent holder. Therefore, we insist that
|
||||
any patent license obtained for a version of the library must be
|
||||
consistent with the full freedom of use specified in this license.
|
||||
|
||||
Most GNU software, including some libraries, is covered by the
|
||||
ordinary GNU General Public License. This license, the GNU Lesser
|
||||
General Public License, applies to certain designated libraries, and
|
||||
is quite different from the ordinary General Public License. We use
|
||||
this license for certain libraries in order to permit linking those
|
||||
libraries into non-free programs.
|
||||
|
||||
When a program is linked with a library, whether statically or using
|
||||
a shared library, the combination of the two is legally speaking a
|
||||
combined work, a derivative of the original library. The ordinary
|
||||
General Public License therefore permits such linking only if the
|
||||
entire combination fits its criteria of freedom. The Lesser General
|
||||
Public License permits more lax criteria for linking other code with
|
||||
the library.
|
||||
|
||||
We call this license the "Lesser" General Public License because it
|
||||
does Less to protect the user's freedom than the ordinary General
|
||||
Public License. It also provides other free software developers Less
|
||||
of an advantage over competing non-free programs. These disadvantages
|
||||
are the reason we use the ordinary General Public License for many
|
||||
libraries. However, the Lesser license provides advantages in certain
|
||||
special circumstances.
|
||||
|
||||
For example, on rare occasions, there may be a special need to
|
||||
encourage the widest possible use of a certain library, so that it becomes
|
||||
a de-facto standard. To achieve this, non-free programs must be
|
||||
allowed to use the library. A more frequent case is that a free
|
||||
library does the same job as widely used non-free libraries. In this
|
||||
case, there is little to gain by limiting the free library to free
|
||||
software only, so we use the Lesser General Public License.
|
||||
|
||||
In other cases, permission to use a particular library in non-free
|
||||
programs enables a greater number of people to use a large body of
|
||||
free software. For example, permission to use the GNU C Library in
|
||||
non-free programs enables many more people to use the whole GNU
|
||||
operating system, as well as its variant, the GNU/Linux operating
|
||||
system.
|
||||
|
||||
Although the Lesser General Public License is Less protective of the
|
||||
users' freedom, it does ensure that the user of a program that is
|
||||
linked with the Library has the freedom and the wherewithal to run
|
||||
that program using a modified version of the Library.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow. Pay close attention to the difference between a
|
||||
"work based on the library" and a "work that uses the library". The
|
||||
former contains code derived from the library, whereas the latter must
|
||||
be combined with the library in order to run.
|
||||
|
||||
GNU LESSER GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License Agreement applies to any software library or other
|
||||
program which contains a notice placed by the copyright holder or
|
||||
other authorized party saying it may be distributed under the terms of
|
||||
this Lesser General Public License (also called "this License").
|
||||
Each licensee is addressed as "you".
|
||||
|
||||
A "library" means a collection of software functions and/or data
|
||||
prepared so as to be conveniently linked with application programs
|
||||
(which use some of those functions and data) to form executables.
|
||||
|
||||
The "Library", below, refers to any such software library or work
|
||||
which has been distributed under these terms. A "work based on the
|
||||
Library" means either the Library or any derivative work under
|
||||
copyright law: that is to say, a work containing the Library or a
|
||||
portion of it, either verbatim or with modifications and/or translated
|
||||
straightforwardly into another language. (Hereinafter, translation is
|
||||
included without limitation in the term "modification".)
|
||||
|
||||
"Source code" for a work means the preferred form of the work for
|
||||
making modifications to it. For a library, complete source code means
|
||||
all the source code for all modules it contains, plus any associated
|
||||
interface definition files, plus the scripts used to control compilation
|
||||
and installation of the library.
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running a program using the Library is not restricted, and output from
|
||||
such a program is covered only if its contents constitute a work based
|
||||
on the Library (independent of the use of the Library in a tool for
|
||||
writing it). Whether that is true depends on what the Library does
|
||||
and what the program that uses the Library does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Library's
|
||||
complete source code as you receive it, in any medium, provided that
|
||||
you conspicuously and appropriately publish on each copy an
|
||||
appropriate copyright notice and disclaimer of warranty; keep intact
|
||||
all the notices that refer to this License and to the absence of any
|
||||
warranty; and distribute a copy of this License along with the
|
||||
Library.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy,
|
||||
and you may at your option offer warranty protection in exchange for a
|
||||
fee.
|
||||
|
||||
2. You may modify your copy or copies of the Library or any portion
|
||||
of it, thus forming a work based on the Library, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) The modified work must itself be a software library.
|
||||
|
||||
b) You must cause the files modified to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
c) You must cause the whole of the work to be licensed at no
|
||||
charge to all third parties under the terms of this License.
|
||||
|
||||
d) If a facility in the modified Library refers to a function or a
|
||||
table of data to be supplied by an application program that uses
|
||||
the facility, other than as an argument passed when the facility
|
||||
is invoked, then you must make a good faith effort to ensure that,
|
||||
in the event an application does not supply such function or
|
||||
table, the facility still operates, and performs whatever part of
|
||||
its purpose remains meaningful.
|
||||
|
||||
(For example, a function in a library to compute square roots has
|
||||
a purpose that is entirely well-defined independent of the
|
||||
application. Therefore, Subsection 2d requires that any
|
||||
application-supplied function or table used by this function must
|
||||
be optional: if the application does not supply it, the square
|
||||
root function must still compute square roots.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Library,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Library, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote
|
||||
it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Library.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Library
|
||||
with the Library (or with a work based on the Library) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may opt to apply the terms of the ordinary GNU General Public
|
||||
License instead of this License to a given copy of the Library. To do
|
||||
this, you must alter all the notices that refer to this License, so
|
||||
that they refer to the ordinary GNU General Public License, version 2,
|
||||
instead of to this License. (If a newer version than version 2 of the
|
||||
ordinary GNU General Public License has appeared, then you can specify
|
||||
that version instead if you wish.) Do not make any other change in
|
||||
these notices.
|
||||
|
||||
Once this change is made in a given copy, it is irreversible for
|
||||
that copy, so the ordinary GNU General Public License applies to all
|
||||
subsequent copies and derivative works made from that copy.
|
||||
|
||||
This option is useful when you wish to copy part of the code of
|
||||
the Library into a program that is not a library.
|
||||
|
||||
4. You may copy and distribute the Library (or a portion or
|
||||
derivative of it, under Section 2) in object code or executable form
|
||||
under the terms of Sections 1 and 2 above provided that you accompany
|
||||
it with the complete corresponding machine-readable source code, which
|
||||
must be distributed under the terms of Sections 1 and 2 above on a
|
||||
medium customarily used for software interchange.
|
||||
|
||||
If distribution of object code is made by offering access to copy
|
||||
from a designated place, then offering equivalent access to copy the
|
||||
source code from the same place satisfies the requirement to
|
||||
distribute the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
5. A program that contains no derivative of any portion of the
|
||||
Library, but is designed to work with the Library by being compiled or
|
||||
linked with it, is called a "work that uses the Library". Such a
|
||||
work, in isolation, is not a derivative work of the Library, and
|
||||
therefore falls outside the scope of this License.
|
||||
|
||||
However, linking a "work that uses the Library" with the Library
|
||||
creates an executable that is a derivative of the Library (because it
|
||||
contains portions of the Library), rather than a "work that uses the
|
||||
library". The executable is therefore covered by this License.
|
||||
Section 6 states terms for distribution of such executables.
|
||||
|
||||
When a "work that uses the Library" uses material from a header file
|
||||
that is part of the Library, the object code for the work may be a
|
||||
derivative work of the Library even though the source code is not.
|
||||
Whether this is true is especially significant if the work can be
|
||||
linked without the Library, or if the work is itself a library. The
|
||||
threshold for this to be true is not precisely defined by law.
|
||||
|
||||
If such an object file uses only numerical parameters, data
|
||||
structure layouts and accessors, and small macros and small inline
|
||||
functions (ten lines or less in length), then the use of the object
|
||||
file is unrestricted, regardless of whether it is legally a derivative
|
||||
work. (Executables containing this object code plus portions of the
|
||||
Library will still fall under Section 6.)
|
||||
|
||||
Otherwise, if the work is a derivative of the Library, you may
|
||||
distribute the object code for the work under the terms of Section 6.
|
||||
Any executables containing that work also fall under Section 6,
|
||||
whether or not they are linked directly with the Library itself.
|
||||
|
||||
6. As an exception to the Sections above, you may also combine or
|
||||
link a "work that uses the Library" with the Library to produce a
|
||||
work containing portions of the Library, and distribute that work
|
||||
under terms of your choice, provided that the terms permit
|
||||
modification of the work for the customer's own use and reverse
|
||||
engineering for debugging such modifications.
|
||||
|
||||
You must give prominent notice with each copy of the work that the
|
||||
Library is used in it and that the Library and its use are covered by
|
||||
this License. You must supply a copy of this License. If the work
|
||||
during execution displays copyright notices, you must include the
|
||||
copyright notice for the Library among them, as well as a reference
|
||||
directing the user to the copy of this License. Also, you must do one
|
||||
of these things:
|
||||
|
||||
a) Accompany the work with the complete corresponding
|
||||
machine-readable source code for the Library including whatever
|
||||
changes were used in the work (which must be distributed under
|
||||
Sections 1 and 2 above); and, if the work is an executable linked
|
||||
with the Library, with the complete machine-readable "work that
|
||||
uses the Library", as object code and/or source code, so that the
|
||||
user can modify the Library and then relink to produce a modified
|
||||
executable containing the modified Library. (It is understood
|
||||
that the user who changes the contents of definitions files in the
|
||||
Library will not necessarily be able to recompile the application
|
||||
to use the modified definitions.)
|
||||
|
||||
b) Use a suitable shared library mechanism for linking with the
|
||||
Library. A suitable mechanism is one that (1) uses at run time a
|
||||
copy of the library already present on the user's computer system,
|
||||
rather than copying library functions into the executable, and (2)
|
||||
will operate properly with a modified version of the library, if
|
||||
the user installs one, as long as the modified version is
|
||||
interface-compatible with the version that the work was made with.
|
||||
|
||||
c) Accompany the work with a written offer, valid for at
|
||||
least three years, to give the same user the materials
|
||||
specified in Subsection 6a, above, for a charge no more
|
||||
than the cost of performing this distribution.
|
||||
|
||||
d) If distribution of the work is made by offering access to copy
|
||||
from a designated place, offer equivalent access to copy the above
|
||||
specified materials from the same place.
|
||||
|
||||
e) Verify that the user has already received a copy of these
|
||||
materials or that you have already sent this user a copy.
|
||||
|
||||
For an executable, the required form of the "work that uses the
|
||||
Library" must include any data and utility programs needed for
|
||||
reproducing the executable from it. However, as a special exception,
|
||||
the materials to be distributed need not include anything that is
|
||||
normally distributed (in either source or binary form) with the major
|
||||
components (compiler, kernel, and so on) of the operating system on
|
||||
which the executable runs, unless that component itself accompanies
|
||||
the executable.
|
||||
|
||||
It may happen that this requirement contradicts the license
|
||||
restrictions of other proprietary libraries that do not normally
|
||||
accompany the operating system. Such a contradiction means you cannot
|
||||
use both them and the Library together in an executable that you
|
||||
distribute.
|
||||
|
||||
7. You may place library facilities that are a work based on the
|
||||
Library side-by-side in a single library together with other library
|
||||
facilities not covered by this License, and distribute such a combined
|
||||
library, provided that the separate distribution of the work based on
|
||||
the Library and of the other library facilities is otherwise
|
||||
permitted, and provided that you do these two things:
|
||||
|
||||
a) Accompany the combined library with a copy of the same work
|
||||
based on the Library, uncombined with any other library
|
||||
facilities. This must be distributed under the terms of the
|
||||
Sections above.
|
||||
|
||||
b) Give prominent notice with the combined library of the fact
|
||||
that part of it is a work based on the Library, and explaining
|
||||
where to find the accompanying uncombined form of the same work.
|
||||
|
||||
8. You may not copy, modify, sublicense, link with, or distribute
|
||||
the Library except as expressly provided under this License. Any
|
||||
attempt otherwise to copy, modify, sublicense, link with, or
|
||||
distribute the Library is void, and will automatically terminate your
|
||||
rights under this License. However, parties who have received copies,
|
||||
or rights, from you under this License will not have their licenses
|
||||
terminated so long as such parties remain in full compliance.
|
||||
|
||||
9. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Library or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Library (or any work based on the
|
||||
Library), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Library or works based on it.
|
||||
|
||||
10. Each time you redistribute the Library (or any work based on the
|
||||
Library), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute, link with or modify the Library
|
||||
subject to these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties with
|
||||
this License.
|
||||
|
||||
11. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Library at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Library by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Library.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under any
|
||||
particular circumstance, the balance of the section is intended to apply,
|
||||
and the section as a whole is intended to apply in other circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
12. If the distribution and/or use of the Library is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Library under this License may add
|
||||
an explicit geographical distribution limitation excluding those countries,
|
||||
so that distribution is permitted only in or among countries not thus
|
||||
excluded. In such case, this License incorporates the limitation as if
|
||||
written in the body of this License.
|
||||
|
||||
13. The Free Software Foundation may publish revised and/or new
|
||||
versions of the Lesser General Public License from time to time.
|
||||
Such new versions will be similar in spirit to the present version,
|
||||
but may differ in detail to address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Library
|
||||
specifies a version number of this License which applies to it and
|
||||
"any later version", you have the option of following the terms and
|
||||
conditions either of that version or of any later version published by
|
||||
the Free Software Foundation. If the Library does not specify a
|
||||
license version number, you may choose any version ever published by
|
||||
the Free Software Foundation.
|
||||
|
||||
14. If you wish to incorporate parts of the Library into other free
|
||||
programs whose distribution conditions are incompatible with these,
|
||||
write to the author to ask for permission. For software which is
|
||||
copyrighted by the Free Software Foundation, write to the Free
|
||||
Software Foundation; we sometimes make exceptions for this. Our
|
||||
decision will be guided by the two goals of preserving the free status
|
||||
of all derivatives of our free software and of promoting the sharing
|
||||
and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
|
||||
WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
|
||||
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
|
||||
OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
|
||||
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
|
||||
LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
|
||||
THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
|
||||
WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
|
||||
AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
|
||||
FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
|
||||
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
|
||||
LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
|
||||
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
|
||||
FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
|
||||
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
|
||||
DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Libraries
|
||||
|
||||
If you develop a new library, and you want it to be of the greatest
|
||||
possible use to the public, we recommend making it free software that
|
||||
everyone can redistribute and change. You can do so by permitting
|
||||
redistribution under these terms (or, alternatively, under the terms of the
|
||||
ordinary General Public License).
|
||||
|
||||
To apply these terms, attach the following notices to the library. It is
|
||||
safest to attach them to the start of each source file to most effectively
|
||||
convey the exclusion of warranty; and each file should have at least the
|
||||
"copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the library's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This library is free software; you can redistribute it and/or
|
||||
modify it under the terms of the GNU Lesser General Public
|
||||
License as published by the Free Software Foundation; either
|
||||
version 2.1 of the License, or (at your option) any later version.
|
||||
|
||||
This library is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
Lesser General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Lesser General Public
|
||||
License along with this library; if not, write to the Free Software
|
||||
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or your
|
||||
school, if any, to sign a "copyright disclaimer" for the library, if
|
||||
necessary. Here is a sample; alter the names:
|
||||
|
||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the
|
||||
library `Frob' (a library for tweaking knobs) written by James Random Hacker.
|
||||
|
||||
<signature of Ty Coon>, 1 April 1990
|
||||
Ty Coon, President of Vice
|
||||
|
||||
That's all there is to it!
|
||||
|
||||
|
||||
@@ -0,0 +1,55 @@
|
||||
#
|
||||
# Makefile for the Offline NT Password Editor
|
||||
#
|
||||
#
|
||||
# Change here to point to the needed OpenSSL libraries & .h files
|
||||
# See INSTALL for more info.
|
||||
#
|
||||
|
||||
#SSLPATH=/usr/local/ssl
|
||||
OSSLPATH=/usr
|
||||
OSSLINC=$(OSSLPATH)/include
|
||||
|
||||
CC=gcc
|
||||
|
||||
# Force 32 bit
|
||||
CFLAGS= -DUSEOPENSSL -g -I. -I$(OSSLINC) -Wall -m32
|
||||
OSSLLIB=$(OSSLPATH)/lib
|
||||
|
||||
# 64 bit if default for compiler setup
|
||||
#CFLAGS= -DUSEOPENSSL -g -I. -I$(OSSLINC) -Wall
|
||||
#OSSLLIB=$(OSSLPATH)/lib64
|
||||
|
||||
|
||||
# This is to link with whatever we have, SSL crypto lib we put in static
|
||||
LIBS=-L$(OSSLLIB) $(OSSLLIB)/libcrypto.a
|
||||
|
||||
all: chntpw chntpw.static cpnt reged reged.static
|
||||
|
||||
chntpw: chntpw.o ntreg.o edlib.o
|
||||
$(CC) $(CFLAGS) -o chntpw chntpw.o ntreg.o edlib.o $(LIBS)
|
||||
|
||||
chntpw.static: chntpw.o ntreg.o edlib.o
|
||||
$(CC) -static $(CFLAGS) -o chntpw.static chntpw.o ntreg.o edlib.o $(LIBS)
|
||||
|
||||
cpnt: cpnt.o
|
||||
$(CC) $(CFLAGS) -o cpnt cpnt.o $(LIBS)
|
||||
|
||||
reged: reged.o ntreg.o edlib.o
|
||||
$(CC) $(CFLAGS) -o reged reged.o ntreg.o edlib.o
|
||||
|
||||
reged.static: reged.o ntreg.o edlib.o
|
||||
$(CC) -static $(CFLAGS) -o reged.static reged.o ntreg.o edlib.o
|
||||
|
||||
|
||||
#ts: ts.o ntreg.o
|
||||
# $(CC) $(CFLAGS) -nostdlib -o ts ts.o ntreg.o $(LIBS)
|
||||
|
||||
# -Wl,-t
|
||||
|
||||
.c.o:
|
||||
$(CC) -c $(CFLAGS) $<
|
||||
|
||||
clean:
|
||||
rm -f *.o chntpw chntpw.static cpnt reged reged.static *~
|
||||
|
||||
+249
@@ -0,0 +1,249 @@
|
||||
|
||||
The Offline NT Password Editor
|
||||
|
||||
(c) 1997-2011 Petter Nordahl-Hagen
|
||||
|
||||
This is free software, licensed under the following:
|
||||
|
||||
"ntreg" (the registry library) is licensed under the GNU Lesser Public
|
||||
License. See LGPL.txt.
|
||||
|
||||
"chntpw" (the password reset / registry editor frontend) is licensed
|
||||
under the GNU General Public License, see GPL.txt.
|
||||
|
||||
"reged" (registry editor /export tool) is licensed
|
||||
under the GNU General Public License, see GPL.txt.
|
||||
|
||||
See INSTALL.txt for compile/installation instructions.
|
||||
|
||||
Where to get more info:
|
||||
-----------------------
|
||||
|
||||
http://pogostick.net/~pnh/ntpasswd/
|
||||
|
||||
At that site there's a floppy and a bootable CD that use chntpw to
|
||||
access the NT/2k/XP/Vista-system it is booted on to edit password etc.
|
||||
The instructions below are for the standalone program itself, not the floppy.
|
||||
|
||||
What does chntpw do?
|
||||
--------------------
|
||||
|
||||
This little program will enable you to view some information and
|
||||
change user passwords in a Windows (NT/XP/Vista/win7) etc SAM userdatabase file.
|
||||
You do not need to know the old passwords.
|
||||
However, you need to get at the file some way or another yourself.
|
||||
In addition it contains a simple registry editor with full write support,
|
||||
and hex-editor which enables you to
|
||||
fiddle around with bits&bytes in the file as you wish yourself.
|
||||
|
||||
Also have registry import or export
|
||||
-----------------------------------
|
||||
|
||||
"reged" is a program that can do import and export of .reg files into
|
||||
the registry hive (binary) files. Also has an editor, but still
|
||||
rudimentary text based command line type thing.
|
||||
|
||||
|
||||
Why?
|
||||
----
|
||||
|
||||
I often forget passwords. Especially on test installations (that
|
||||
I just _must_ have some stuff out of half a year later..)
|
||||
On most unix-based boxes you just boot the thingy off some kind
|
||||
of rescue bootmedia (cd/floppy etc), and simply edit the
|
||||
password file.
|
||||
On Windows NT however, as far as I know, there is no way except reinstalling
|
||||
the userdatabase, losing all users except admin.
|
||||
(ok, some companies let you pay lotsa $$$$$ for some rescue service..)
|
||||
|
||||
How?
|
||||
----
|
||||
|
||||
Currently, this thing only runs under linux, but it may just happen
|
||||
to compile on other platforms, too.
|
||||
(there are dos-versions available, look for links on my webpage)
|
||||
So, to set a new adminpassword on your NT installation you either:
|
||||
1) Take the harddrive and mount it on a linux-box
|
||||
2) Use a linux-bootdisk or CD
|
||||
one is available at: http://pogostick.net/~pnh/ntpasswd/
|
||||
ie. you do it offline, with the NT system down.
|
||||
|
||||
Usage:
|
||||
------
|
||||
|
||||
This is usage of the "chntpw" program binary only.
|
||||
For info on the bootdisk, see the web site.
|
||||
Some of the output format has changed a little since the docs were
|
||||
first written.
|
||||
|
||||
chntpw version 0.99.2 040105, (c) Petter N Hagen
|
||||
chntpw: change password of a user in a NT SAM file, or invoke registry editor.
|
||||
chntpw [OPTIONS] <samfile> [systemfile] [securityfile] [otherreghive] [...]
|
||||
-h This message
|
||||
-u <user> Username to change, Administrator is default
|
||||
-l list all users in SAM file
|
||||
-i Interactive. List users (as -l) then ask for username to change
|
||||
-e Registry editor. Now with full write support!
|
||||
-d Enter buffer debugger instead (hex editor),
|
||||
-t Trace. Show hexdump of structs/segments. (deprecated debug function)
|
||||
-v Be a little more verbose (for debuging)
|
||||
-L Write names of changed files to /tmp/changed
|
||||
-N No allocation mode. Only (old style) same length overwrites possible
|
||||
|
||||
Normal usage is:
|
||||
|
||||
> chntpw sam system security
|
||||
- open registry hives 'sam' and 'system' and change administrator account.
|
||||
Verions dated later from Feb 1999 and later also supports
|
||||
and will find the admin account, even if the name has been changed,
|
||||
or the name has been localized (different languageversion of NT
|
||||
use different admin-names)
|
||||
|
||||
The -u option:
|
||||
Specifies user to change:
|
||||
|
||||
> chntpw -u jabbathehutt mysam
|
||||
- Prompt for password for 'jabbathehutt', if found (otherwise do nothing)
|
||||
|
||||
Or you may give RID number in hex:
|
||||
> chntpw -u 0x1f4 mysam
|
||||
- Will edit administrator.
|
||||
|
||||
Names does not support multibyte (unicode) characters like
|
||||
some russian and asian locales. Give RID in hex to edit users
|
||||
with such names. Must start with 0x. Ex: 0x2fa
|
||||
|
||||
The -l option:
|
||||
Will list all users in the sam-file.
|
||||
|
||||
The -i option:
|
||||
Go into the interactive menu system.
|
||||
|
||||
The -d option:
|
||||
This will load the file, and then immediately enter the
|
||||
buffer debugger.
|
||||
This is a simple hex-editor with only a few commands,
|
||||
enter ? at the . prompt to se a short command overview.
|
||||
'q' exits without saving, 's' exit and saves.
|
||||
|
||||
The -e option:
|
||||
Will enter the registry editor.
|
||||
You can navigate the registry like a filesystem at the command-line prompt:
|
||||
See regedit.txt file for more info.
|
||||
|
||||
The -t option:
|
||||
This is a debug function (extended -l) to show how it traces the chain
|
||||
of structs in the file. This also includes a raw interpretation
|
||||
of the different registry structures + a hex dump.
|
||||
|
||||
The -L option:
|
||||
Drops the filenames of the changed hives in /tmp/changed
|
||||
Used by the bootdisk scripts.
|
||||
|
||||
The -N option:
|
||||
Will fall back to old edit mode, disable the block allocations
|
||||
and only support overwrite-same-size. Used to ensure safety
|
||||
in testing period.
|
||||
|
||||
How does it work:
|
||||
-----------------
|
||||
|
||||
A struct, called the V value of a key in the NT registry
|
||||
was suddenly somewhat documented through the pwdump utility
|
||||
included in the unix Samba distribution.
|
||||
This struct contains some info on a user of the NT machine,
|
||||
along with 2 crypted versions of the password associated
|
||||
with the account.
|
||||
|
||||
One password is the NT console login password,
|
||||
the other the LANMAN network share password
|
||||
(which essentially is the first one in uppercase only,
|
||||
and no unicode)
|
||||
|
||||
This is how NT encrypts the passwords:
|
||||
|
||||
The logon cleartext password a user enters is:
|
||||
1) Converted to unicode
|
||||
2) A MD4 hash is made out of the unicode string
|
||||
3) Then the hash is crypted with DES, using the RID (lower
|
||||
part of the SID, userid) as the crypt key.
|
||||
This is the so called "obfuscation" step, so
|
||||
it's not obvious on a hex dump of the file
|
||||
that two or more users have the same password.
|
||||
4) The result of stage 3 (16 bytes) is put into the V struct.
|
||||
|
||||
For the LANMAN password:
|
||||
1) Uppercased (and illegal characters probably removed)
|
||||
14 bytes max, if less the remaining bytes are zeroed.
|
||||
2) A known (constant) string is DES-encrypted
|
||||
using 7 first characters of the password as the key.
|
||||
Another constant is encrypted using the last 7 chars
|
||||
as the key.
|
||||
The result of these two crypts are simply appended,
|
||||
resulting in a 16 byte string.
|
||||
3) The same obfuscation DES stage as 3 above.
|
||||
4) 16 bytes result put into the V struct.
|
||||
|
||||
Since the number of possible combinations in the lanman
|
||||
password is relatively low compared to the other one,
|
||||
and it's easy to see if it's shorter than 8 chars or not
|
||||
it's used first in brute-force-crackers.
|
||||
|
||||
This program, however, don't care at all what the old
|
||||
one is, it just overwrites it with the new one.
|
||||
|
||||
Ok. So, how do we find and identify the V struct?
|
||||
Yeah.. that was the hard part.. The files structure
|
||||
is not documented (as far as I know..)
|
||||
|
||||
But, with help from an unnamed German, and a lot of testing
|
||||
and guesswork from myself, it's now possible to follow
|
||||
the actual registry tree. (see source code for struct-defines
|
||||
and comments on the registry structure)
|
||||
|
||||
The usernames are listed in:
|
||||
\SAM\Domains\Account\Users\Names\
|
||||
|
||||
[2d18] \SAM\Domains\Account\Users\Names> l
|
||||
ls of node at offset 0x2d1c
|
||||
Node has 4 subkeys and 1 values
|
||||
nk-offset name
|
||||
0x003290 - <Administrator>
|
||||
0x003630 - <Guest>
|
||||
0x001c88 - <luser>
|
||||
0x003428 - <pnh>
|
||||
|
||||
Each name is a subkey, with one namless value containing
|
||||
the RID.
|
||||
|
||||
[2d18] \SAM\Domains\Account\Users\Names> cd pnh
|
||||
|
||||
[3428] \SAM\Domains\Account\Users\Names\pnh> l
|
||||
ls of node at offset 0x342c
|
||||
Node has 0 subkeys and 1 values
|
||||
vk-offs size type name
|
||||
0x003688 0 (unknown) <> INLINE: val (in type field?): 1000 (0x3e8)
|
||||
|
||||
To get the userinfo (V struct), access
|
||||
\SAM\Domains\Account\Users\<RID>\V
|
||||
|
||||
[2c90] \SAM\Domains\Account\Users> l
|
||||
ls of node at offset 0x2c94
|
||||
Node has 5 subkeys and 1 values
|
||||
nk-offset name
|
||||
0x003320 - <000001F4>
|
||||
0x0036b8 - <000001F5>
|
||||
0x003550 - <000003E8>
|
||||
0x001d00 - <000003E9>
|
||||
0x002d18 - <Names>
|
||||
|
||||
[2c90] \SAM\Domains\Account\Users> cd 000003E8
|
||||
|
||||
[3550] \SAM\Domains\Account\Users\000003E8> l
|
||||
ls of node at offset 0x3554
|
||||
Node has 0 subkeys and 2 values
|
||||
vk-offs size type name
|
||||
0x0035a8 80 REG_BINARY <F>
|
||||
0x003228 508 REG_BINARY <V>
|
||||
|
||||
For more techincal info, look it up in the source code.
|
||||
+663
@@ -0,0 +1,663 @@
|
||||
Agreement:
|
||||
==========
|
||||
|
||||
The author of this document will not be responsible for any damage and/or
|
||||
license violation that may occur. The information within this document is
|
||||
provided "as is" without warranty of any kind...
|
||||
This information was "collected" during sleepless nights, and is NOT
|
||||
officially released by Microsoft! It shall give you a peek at the Windows(tm)
|
||||
internals to give you a chance to recover from corrupted data.
|
||||
|
||||
The author has nothing to do with Microsoft, except that he uses their
|
||||
products...
|
||||
|
||||
If you don't agree with this, stop reading this document, and delete it at
|
||||
once!
|
||||
|
||||
|
||||
History:
|
||||
========
|
||||
|
||||
What is the registry? Where did it came from? Two questions, which I will try to
|
||||
answer here. The registry is a database (at least microsoft thinks so:)
|
||||
which contains configuration information about the system.
|
||||
It mainly is a memory dump which is saved to one or more files on the windows
|
||||
host drive. It is loaded every system-boot and remains resident until
|
||||
shutdown. Since parts of it are not used during normal operation it will be
|
||||
swapped out very soon. The registry appeared with windows 3.?? (sorry, I can't
|
||||
remember any earlier version :-), where it was used for file associations and
|
||||
the "OLE" functions (the conection between ole-id's and the applications).
|
||||
This is a critical information and since the registry has (almost) NO
|
||||
CHECKSUM information (!), it sometimes gets corrupted. This is the main
|
||||
reason for this doc.
|
||||
|
||||
Using windows 3.x, almost every configuration was done using good old ".INI"-
|
||||
files, which were readable but slow and limited in size (64k). In windows 95
|
||||
(and NT), the registry was used instead of these files. So, to edit a
|
||||
particular setting, you would have to run the application which manages these
|
||||
settings. :( but what if this app won't start? MS included a tool named
|
||||
REGEDIT in windows 3.?? and 95, and a REGEDT32 in windows NT. You can use
|
||||
these apps to edit ALL contents of the registry (in windows NT the registry
|
||||
supports security, as well as it provides the security for the whole system!)
|
||||
|
||||
An application can open a "key", write values (variables) to it and fill them
|
||||
with data. Each key represents also a value called "default" and can contain
|
||||
any number of sub-keys. This will form a tree-structure as you can see at
|
||||
the left half of REGEDIT. (note: REGEDIT from windows 3.?? has to be started
|
||||
with /V or /Y, I can't remember now)
|
||||
|
||||
|
||||
Where can I find the registry???
|
||||
================================
|
||||
|
||||
That differs for each windows-version:
|
||||
|
||||
Version File(s) Contents
|
||||
3.1x REG.DAT Complete windows 3.?? Registry
|
||||
|
||||
95 SYSTEM.DAT System-values (HKEY_LOCAL_MACHINE)
|
||||
USER.DAT User-values (HKEY_USERS)
|
||||
|
||||
NT SYSTEM32\CONFIG\SAM SAM-part of the registry (=NT Security)
|
||||
SYSTEM32\CONFIG\SOFTWARE Software-Specific part
|
||||
(HKEY_LOCAL_MACHINE\SOFTWARE)
|
||||
SYSTEM32\CONFIG\SYSTEM System-specific part
|
||||
(HKEY_LOCAL_MACHINE\System)
|
||||
PROFILES\%USERNAME%\NTUSER.DAT User-Specific part
|
||||
(HKEY_CURRENT_USER\{S-1-xxx...})
|
||||
PROFILES\%USERNAME%\NTUSER.MAN like NTUSER.DAT but a
|
||||
MANDATORY-profile
|
||||
|
||||
If you are using a ROAMING-profile with windows NT, NTUSER.xxx can be on
|
||||
a network-share as well...
|
||||
|
||||
|
||||
|
||||
Terms
|
||||
=====
|
||||
|
||||
The registry consists of the following elements:
|
||||
|
||||
Hive: strating point of the structure. The name of an hive starts
|
||||
with the "HKEY_"-prefix. Can be seen as a "drive" in a file
|
||||
system.
|
||||
|
||||
Hive name Beschreibung 3.1 95 NT4
|
||||
HKEY_CLASSES_ROOT Points to the "class" key in
|
||||
the "HKEY_LOCAL_MACHINE" hive,
|
||||
the only hive in windows 3.?? X X X
|
||||
|
||||
HKEY_CURRENT_USER Information and settings valid
|
||||
for the currently logged in
|
||||
user. (Points to the correct X X
|
||||
key under "HKEY_USERS")
|
||||
|
||||
HKEY_CURRENT_CONFIG Settings for the currently
|
||||
active hardware profile.
|
||||
Points to "HKEY_LOCAL_MACHINE\ X X
|
||||
CONTROL\CONTROLSETxxx
|
||||
|
||||
HKEY_USERS Contains all currently active
|
||||
user settings. Since NT is a
|
||||
single user system, there
|
||||
will be only one key (the S-ID X X
|
||||
of the active user), and a
|
||||
".DEFUALT" key (The settings
|
||||
for the CTRL-ALT-DEL environment)
|
||||
|
||||
HKEY_LOCALMACHINE All local settings X X
|
||||
|
||||
HKEY_DYN_DATA As the name says, here you'll find X
|
||||
dynamic data (CPU-usage,...)
|
||||
|
||||
|
||||
Key: A key to the registry can be seen as a directory in a file
|
||||
system.
|
||||
Value: can be seen as the registrys "file"
|
||||
Data: is the actual setting, can be seen as the contents of a
|
||||
file
|
||||
|
||||
|
||||
Windows 3.x
|
||||
===========
|
||||
|
||||
This registry is the easiest one. It consists of 3 blocks, which are not
|
||||
"signed" at all:
|
||||
|
||||
Block Position Size
|
||||
Header 0 32 Bytes
|
||||
Navigation-Info 0x00000020 ???
|
||||
Data-Block ??? ???
|
||||
|
||||
The "???" marked values can be read from the header.
|
||||
|
||||
Header
|
||||
======
|
||||
|
||||
Offset Size Description
|
||||
0x0000 8 Byte ASCII-Text: "SHCC3.10"
|
||||
0x0008 D-Word ?
|
||||
0x000C D-Word ? (always equal the D-Word at 0x0008)
|
||||
0x0010 D-Word Number of entrys in the navigation-block
|
||||
0x0014 D-Word Offset of the data-block
|
||||
0x0018 D-Word Size of the data-block
|
||||
0x001C Word ?
|
||||
0x001E Word ?
|
||||
|
||||
Values marked "?" are not important for a read-access, and therefore unknown
|
||||
to me...
|
||||
|
||||
Navigation-Block
|
||||
================
|
||||
|
||||
This is where chaos rules! It consists of two different, 8 byte long blocks:
|
||||
|
||||
* Navigation-Info-Record,
|
||||
* Text-Info-Record
|
||||
|
||||
The first record in the navigation block is a navigation info record.
|
||||
|
||||
Navigation-Info-Record
|
||||
|
||||
Offset Size Contents
|
||||
0x00 Word Next Key (same level)
|
||||
0x02 Word First Sub-Key (one level deeper)
|
||||
0x04 Word Text-Info-Record Key-Namens
|
||||
0x06 Word Text-Info-Record Key-Value (default)
|
||||
|
||||
The values are the locical number of the block inside the file:
|
||||
|
||||
offset=blocksize*blocknumber+headersize
|
||||
|
||||
since 2 of this values are constant:
|
||||
|
||||
offset=8*blocknumber+0x20
|
||||
|
||||
|
||||
Text-Info-Record
|
||||
================
|
||||
|
||||
|
||||
Offset Size Contents
|
||||
0x00 Word ?
|
||||
0x02 Word number of references to this text
|
||||
0x04 Word Text-length
|
||||
0x06 Word Offset of the text-string inside the data-block
|
||||
|
||||
To get the text-offset inside the file you have to add this offset to the
|
||||
data-offset inside the header.
|
||||
|
||||
Data-Block
|
||||
==========
|
||||
|
||||
The data-block only consists of a collection of text-strings. Right in front
|
||||
of every text is a word which may or may not have a meaning. The offset in
|
||||
the text-info record points directly to the text, the text-size has to be
|
||||
defined in the text-info record too.
|
||||
|
||||
|
||||
Windows 95
|
||||
==========
|
||||
|
||||
the Windows95-Registry Files:
|
||||
|
||||
inside the windows-directory (default: C:\WINDOWS) are 2 files which are
|
||||
loaded to form the registry:
|
||||
|
||||
SYSTEM.DAT
|
||||
|
||||
and
|
||||
|
||||
USER.DAT
|
||||
|
||||
This files are mapped to the following hives:
|
||||
|
||||
HKEY_LOCAL_MACHINE in SYSTEM.DAT
|
||||
|
||||
and
|
||||
|
||||
HKEY_USERS in USER.DAT
|
||||
|
||||
|
||||
|
||||
The file structure:
|
||||
===================
|
||||
|
||||
|
||||
Both files have the same structure. Each of them consists of 3 blocks where
|
||||
1 of these blocks can be repeated.
|
||||
Every block has a 4 byte long signature to help identify its contents.
|
||||
|
||||
ID Block-contents Max. size
|
||||
CREG Header 32 Bytes @ Offset 0
|
||||
RGKN Directory information
|
||||
(Tree-structure) ??? @ Offset 32
|
||||
RGDB The real data
|
||||
(Values and data) max. 65535 Bytes an Offset ??
|
||||
|
||||
these blocks are "sticked together" with no space between them, but always
|
||||
a multiple of 16 in size.
|
||||
|
||||
the CREG-Block
|
||||
==============
|
||||
|
||||
Offset Size Inhalt
|
||||
0x00000000 D-Word ASCII-"CREG" = 0x47455243
|
||||
0x00000008 D-Word Offset of 1st RGDB-block
|
||||
0x00000010 D-Word # of RGDB-blocks
|
||||
|
||||
all other values are not needed to read the registry...
|
||||
|
||||
|
||||
the RGKN-Block
|
||||
==============
|
||||
|
||||
I assume that RGKN stands for ReGistry-Key-Navigation. This block contains
|
||||
the information needed to built the tree-structure of the registry. This
|
||||
block will be larger then 65536 bytes (0xFFFF)!
|
||||
|
||||
All offset-values are RELATIVE to the RGKN-block!
|
||||
|
||||
Offset Size Contents
|
||||
0x00000000 D-Word ASCII-"RGKN" = 0x4E4B4752
|
||||
0x00000004 D-Word Size of the RGKN-block in bytes
|
||||
0x00000008 D-Word Rel. Offset of the root-record
|
||||
0x00000020 ???? Tree-Records (often the 1st Record)
|
||||
|
||||
the Tree-Record
|
||||
===============
|
||||
|
||||
The tree-record is a "complete" registry-key. It contains the "hash"-info
|
||||
for the real data stored in this key.
|
||||
|
||||
Offset Size Contents
|
||||
0x0000 D-Word Always 0
|
||||
0x0004 D-Word Hash of the key-name
|
||||
0x0008 D-Word Always -1 (0xFFFFFFFF)
|
||||
0x000C D-Word Offset of the owner (parent)-records
|
||||
0x0010 D-Word Offset of the 1st sub-sey record
|
||||
0x0014 D-Word Offset of the next record in this level
|
||||
0x0018 D-Word ID-number of the real key
|
||||
|
||||
the 1st entry in a "usual" registry file is a nul-entry with subkeys: the
|
||||
hive itself. It looks the same like other keys. Even the ID-number can
|
||||
be any value.
|
||||
|
||||
The "hash"-value is a value representing the key's name. Windows will not
|
||||
search for the name, but for a matching hash-value. if it finds one, it
|
||||
will compare the actual string info, otherwise continue with the next key.
|
||||
|
||||
End of list-pointers are filled with -1 (0xFFFFFFFF)
|
||||
|
||||
|
||||
The ID-field has the following format:
|
||||
|
||||
Bits 31..16: Number of the corresponding RGDB-blocks
|
||||
Bits 15..0: continuous number inside this RGDB-block.
|
||||
|
||||
|
||||
|
||||
The hash-method:
|
||||
================
|
||||
|
||||
you are looking for the key: Software\Microsoft
|
||||
|
||||
first you take the first part of the string and convert it to upper case
|
||||
|
||||
SOFTWARE
|
||||
|
||||
The "\" is used as a seperator only and has no meaning here.
|
||||
Next you initialize a D-Word with 0 and add all ASCII-values of the string
|
||||
which are smaller than 0x80 (128) to this D-Word.
|
||||
|
||||
SOFTWARE = 0x0000026B
|
||||
|
||||
Now you can start looking for this hash-value in the tree-record.
|
||||
If you want to modify key names, also modify the hash-values, since they
|
||||
cannot be found again (although they would be displayed in REGEDIT)
|
||||
|
||||
the RGDB-Block
|
||||
==============
|
||||
|
||||
Header:
|
||||
|
||||
Offset Size Contents
|
||||
0x0000 D-Word ASCII-"RGDB" = 0x42444752
|
||||
0x0004 D-Word Size of this RGDB-block
|
||||
0x0020 ???? RGDB Records
|
||||
|
||||
|
||||
RGDB-Record (Key-Information)
|
||||
=============================
|
||||
|
||||
Offset Size Contents
|
||||
0x0000 D-Word record length in bytes
|
||||
0x0004 D-Word ID-number
|
||||
0x0008 D-Word ??? Size ???
|
||||
0x000C Word text length of key name
|
||||
0x000E Word Number of values inside this key
|
||||
0x0010 D-Word always 0
|
||||
0x0014 ???? Key-name
|
||||
0x???? ???? Values
|
||||
|
||||
The first size (record length) can be used to find the next record.
|
||||
The second size value is only correct if the key has at least one value,
|
||||
otherwise it is a little lower.
|
||||
|
||||
The key-name is not 0-terminated, its length is defined by the key-
|
||||
text length field. The values are stored as records.
|
||||
|
||||
|
||||
Value-Record
|
||||
============
|
||||
|
||||
Offset Size Contents
|
||||
0x0000 D-Word Type of data
|
||||
0x0004 D-Word always 0
|
||||
0x0008 Word length of value-name
|
||||
0x000A Word length of value-data
|
||||
0x000C ???? value-name
|
||||
0x???? ???? data
|
||||
|
||||
Data-Types
|
||||
==========
|
||||
|
||||
value Contents
|
||||
0x00000001 RegSZ - 0-terminated string (sometimes without the 0!)
|
||||
0x00000003 RegBin - binary value (a simple data-block)
|
||||
0x00000004 RegDWord - D-Word (always 4 bytes in size)
|
||||
|
||||
|
||||
|
||||
Windows NT (Version 4.0)
|
||||
========================
|
||||
|
||||
Whoever thought that the registry of windows 95 and windows nt are similar
|
||||
will be surprised! They only look much the same, but have completely other
|
||||
structures!
|
||||
Since the RGDB-blocks in the windows 95 registry are not larger than
|
||||
0xFFFF, we can see that it is optimized for a 16-bit OS...
|
||||
Windows NT stores its registry in a page-oriented format with blocks
|
||||
of 4kb (4096 = 0x1000 bytes)
|
||||
|
||||
The windows NT registry has 2 different blocks, where one can occure many
|
||||
times...
|
||||
|
||||
the "regf"-Block
|
||||
================
|
||||
|
||||
"regf" is obviosly the abbreviation for "Registry file". "regf" is the
|
||||
signature of the header-block which is always 4kb in size, although only
|
||||
the first 64 bytes seem to be used and a checksum is calculated over
|
||||
the first 0x200 bytes only!
|
||||
|
||||
Offset Size Contents
|
||||
0x00000000 D-Word ID: ASCII-"regf" = 0x66676572
|
||||
0x00000004 D-Word ????
|
||||
0x00000008 D-Word ???? Always the same value as at 0x00000004
|
||||
0x0000000C Q-Word last modify date in WinNT date-format
|
||||
0x00000014 D-Word 1
|
||||
0x00000018 D-Word 3
|
||||
0x0000001C D-Word 0
|
||||
0x00000020 D-Word 1
|
||||
0x00000024 D-Word Offset of 1st key record
|
||||
0x00000028 D-Word Size of the data-blocks (Filesize-4kb)
|
||||
0x0000002C D-Word 1
|
||||
0x000001FC D-Word Sum of all D-Words from 0x00000000 to 0x000001FB
|
||||
|
||||
I have analyzed more registry files (from multiple machines running
|
||||
NT 4.0 german version) and could not find an explanation for the values
|
||||
marked with ???? the rest of the first 4kb page is not important...
|
||||
|
||||
|
||||
the "hbin"-Block
|
||||
================
|
||||
|
||||
I don't know what "hbin" stands for, but this block is always a multiple
|
||||
of 4kb in size.
|
||||
|
||||
Inside these hbin-blocks the different records are placed. The memory-
|
||||
management looks like a C-compiler heap management to me...
|
||||
|
||||
|
||||
hbin-Header
|
||||
===========
|
||||
|
||||
Offset Size Contents
|
||||
0x0000 D-Word ID: ASCII-"hbin" = 0x6E696268
|
||||
0x0004 D-Word Offset from the 1st hbin-Block
|
||||
0x0008 D-Word Offset to the next hbin-Block
|
||||
0x001C D-Word Block-size
|
||||
|
||||
The values in 0x0008 and 0x001C should be the same, so I don't know
|
||||
if they are correct or swapped...
|
||||
|
||||
From offset 0x0020 inside a hbin-block data is stored with the following
|
||||
format:
|
||||
|
||||
|
||||
Offset Size Contents
|
||||
0x0000 D-Word Data-block size
|
||||
0x0004 ???? Data
|
||||
|
||||
If the size field is negative (bit 31 set), the corresponding block
|
||||
is free and has a size of -blocksize!
|
||||
The data is stored as one record per block. Block size is a multiple
|
||||
of 4 and the last block reaches the next hbin-block, leaving no room.
|
||||
|
||||
|
||||
Records in the hbin-blocks
|
||||
==========================
|
||||
|
||||
|
||||
nk-Record
|
||||
|
||||
The nk-record can be treated as a kombination of tree-record and
|
||||
key-record of the win 95 registry.
|
||||
|
||||
lf-Record
|
||||
|
||||
The lf-record is the counterpart to the RGKN-record (the hash-function)
|
||||
|
||||
vk-Record
|
||||
|
||||
The vk-record consists information to a single value.
|
||||
|
||||
sk-Record
|
||||
|
||||
sk (? Security Key ?) is the ACL of the registry.
|
||||
|
||||
Value-Lists
|
||||
|
||||
The value-lists contain information about which values are inside a
|
||||
sub-key and don't have a header.
|
||||
|
||||
Datas
|
||||
|
||||
The datas of the registry are (like the value-list) stored without a
|
||||
header.
|
||||
|
||||
|
||||
All offset-values are relative to the first hbin-block and point to the block-
|
||||
size field of the record-entry. to get the file offset, you have to add
|
||||
the header size (4kb) and the size field (4 bytes)...
|
||||
|
||||
the nk-Record
|
||||
=============
|
||||
|
||||
Offset Size Contents
|
||||
0x0000 Word ID: ASCII-"nk" = 0x6B6E
|
||||
0x0002 Word for the root-key: 0x2C, otherwise 0x20
|
||||
0x0004 Q-Word write-date/time in windows nt notation
|
||||
0x0010 D-Word Offset of Owner/Parent key
|
||||
0x0014 D-Word number of sub-Keys
|
||||
0x001C D-Word Offset of the sub-key lf-Records
|
||||
0x0024 D-Word number of values
|
||||
0x0028 D-Word Offset of the Value-List
|
||||
0x002C D-Word Offset of the sk-Record
|
||||
0x0030 D-Word Offset of the Class-Name
|
||||
0x0044 D-Word Unused (data-trash)
|
||||
0x0048 Word name-length
|
||||
0x004A Word class-name length
|
||||
0x004C ???? key-name
|
||||
|
||||
the Value-List
|
||||
==============
|
||||
|
||||
Offset Size Contents
|
||||
0x0000 D-Word Offset 1st Value
|
||||
0x0004 D-Word Offset 2nd Value
|
||||
0x???? D-Word Offset nth Value
|
||||
|
||||
To determine the number of values, you have to look at the
|
||||
owner-nk-record!
|
||||
|
||||
Der vk-Record
|
||||
=============
|
||||
|
||||
Offset Size Contents
|
||||
0x0000 Word ID: ASCII-"vk" = 0x6B76
|
||||
0x0002 Word name length
|
||||
0x0004 D-Word length of the data
|
||||
0x0008 D-Word Offset of Data
|
||||
0x000C D-Word Type of value
|
||||
0x0010 Word Flag
|
||||
0x0012 Word Unused (data-trash)
|
||||
0x0014 ???? Name
|
||||
|
||||
If bit 0 of the flag-word is set, a name is present, otherwise the
|
||||
value has no name (=default)
|
||||
If the data-size is lower 5, the data-offset value is used to store
|
||||
the data itself!
|
||||
|
||||
|
||||
The data-types
|
||||
==============
|
||||
|
||||
Wert Beteutung
|
||||
0x0001 RegSZ: character string (in UNICODE!)
|
||||
0x0002 ExpandSZ: string with "%var%" expanding (UNICODE!)
|
||||
0x0003 RegBin: raw-binary value
|
||||
0x0004 RegDWord: Dword
|
||||
0x0007 RegMultiSZ: multiple strings, seperated with 0
|
||||
(UNICODE!)
|
||||
|
||||
The "lf"-record
|
||||
===============
|
||||
|
||||
Offset Size Contents
|
||||
0x0000 Word ID: ASCII-"lf" = 0x666C
|
||||
0x0002 Word number of keys
|
||||
0x0004 ???? Hash-Records
|
||||
|
||||
Hash-Record
|
||||
===========
|
||||
|
||||
Offset Size Contents
|
||||
0x0000 D-Word Offset of corresponding "nk"-Record
|
||||
0x0004 D-Word ASCII: the first 4 characters of the key-name,
|
||||
padded with 0's. Case sensitiv!
|
||||
|
||||
Keep in mind, that the value at 0x0004 is used for checking the
|
||||
data-consistency! If you change the key-name you have to change the
|
||||
hash-value too!
|
||||
|
||||
The "sk"-block
|
||||
==============
|
||||
|
||||
(due to the complexity of the SAM-info, not clear jet)
|
||||
|
||||
Offset Size Contents
|
||||
0x0000 Word ID: ASCII-"sk" = 0x6B73
|
||||
0x0002 Word Unused
|
||||
0x0004 D-Word Offset of previous "sk"-Record
|
||||
0x0008 D-Word Offset of next "sk"-Record
|
||||
0x000C D-Word usage-counter
|
||||
0x0010 D-Word Size of "sk"-record in bytes
|
||||
????
|
||||
???? ???? Security and auditing settings...
|
||||
????
|
||||
|
||||
The usage counter counts the number of references to this
|
||||
"sk"-record. You can use one "sk"-record for the entire registry!
|
||||
|
||||
|
||||
Windows nt date/time format
|
||||
===========================
|
||||
|
||||
The time-format is a 64-bit integer which is incremented every
|
||||
0,0000001 seconds by 1 (I don't know how accurate it realy is!)
|
||||
It starts with 0 at the 1st of january 1601 0:00! All values are
|
||||
stored in GMT time! The time-zone is important to get the real
|
||||
time!
|
||||
|
||||
|
||||
|
||||
Common values for win95 and win-nt
|
||||
==================================
|
||||
|
||||
Offset values marking an "end of list", are either 0 or -1 (0xFFFFFFFF).
|
||||
If a value has no name (length=0, flag(bit 0)=0), it is treated as the
|
||||
"Default" entry...
|
||||
If a value has no data (length=0), it is displayed as empty.
|
||||
|
||||
|
||||
|
||||
simplyfied win-3.?? registry:
|
||||
=============================
|
||||
|
||||
|
||||
|
||||
+-----------+
|
||||
| next rec. |---+ +-----> +------------+
|
||||
| first sub | | | | Usage cnt. |
|
||||
| name | | +--> +------------+ | | length |
|
||||
| value | | | | next rec. | | | text |-------> +-------+
|
||||
+-----------+ | | | name rec. |--+ +------------+ | xxxxx |
|
||||
+------------+ | | value rec. |--------> +------------+ +-------+
|
||||
v | +------------+ | Usage cnt. |
|
||||
+-----------+ | | length |
|
||||
| next rec. | | | text |-------> +-------+
|
||||
| first sub |------+ +------------+ | xxxxx |
|
||||
| name | +-------+
|
||||
| value |
|
||||
+-----------+
|
||||
|
||||
|
||||
|
||||
Greatly simplyfied structure of the nt-registry:
|
||||
================================================
|
||||
|
||||
|
||||
+-------------------------------------------------------------------------+
|
||||
v |
|
||||
+---------------+ +-------------> +-----------+ +------> +---------+ |
|
||||
| "nk" | | | lf-rec. | | | nk-rec. | |
|
||||
| ID | | | # of keys | | | parent |---+
|
||||
| Date | | | 1st key |--+ | .... |
|
||||
| parent | | +-----------+ +---------+
|
||||
| suk-keys |-------+
|
||||
| values |---------------------> +----------+
|
||||
| SK-rec. |---------------+ | 1. value |--> +----------+
|
||||
| class |--+ | +----------+ | vk-rec. |
|
||||
+---------------+ | | | .... |
|
||||
v | | data |--> +-------+
|
||||
+------------+ | +----------+ | xxxxx |
|
||||
| Class name | | +-------+
|
||||
+------------+ |
|
||||
v
|
||||
+---------+ +---------+
|
||||
+-----> | next sk |---> | Next sk |--+
|
||||
| +---| prev sk | <---| prev sk | |
|
||||
| | | .... | | ... | |
|
||||
| | +---------+ +---------+ |
|
||||
| | ^ |
|
||||
| +--------------------+ |
|
||||
+------------------------------------+
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
Hope this helps.... (Although it was "fun" for me to uncover this things,
|
||||
it took me several sleepless nights ;)
|
||||
|
||||
B.D.
|
||||
+1780
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,100 @@
|
||||
/*
|
||||
* cpnt.c - Copy over file without truncating.
|
||||
* For use on my current floppy, since it's 'cp' insist
|
||||
* on truncating first, and NTFS doesn't like that yet.
|
||||
*
|
||||
* 2003-apr: First version
|
||||
*
|
||||
*****
|
||||
*
|
||||
* Copyright (c) 1997-2007 Petter Nordahl-Hagen.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; version 2 of the License.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* See file GPL.txt for the full license.
|
||||
*
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <fcntl.h>
|
||||
#include <errno.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include <inttypes.h>
|
||||
|
||||
|
||||
#define BUFSIZE 16384
|
||||
|
||||
int main(int argc, char **argv)
|
||||
{
|
||||
|
||||
void *buf;
|
||||
int sf,df,rb,wb;
|
||||
int going = 1;
|
||||
int e = 0;
|
||||
|
||||
if (argc != 3) {
|
||||
printf("usage: cpnt <sourcefile> <destfile>\n");
|
||||
printf(" sorry, only one file at a time yet.\n");
|
||||
return(1);
|
||||
}
|
||||
|
||||
#if 0
|
||||
printf("input : %s\n",argv[1]);
|
||||
printf("output: %s\n",argv[2]);
|
||||
#endif
|
||||
|
||||
buf = malloc(BUFSIZE);
|
||||
if (!buf) {
|
||||
printf("cpnt: could not allocate buffer\n");
|
||||
return(1);
|
||||
}
|
||||
|
||||
sf = open(argv[1],O_RDONLY);
|
||||
if (sf < 0) {
|
||||
e = errno;
|
||||
printf("cpnt: %s: %s\n",argv[1],strerror(e));
|
||||
return(1);
|
||||
}
|
||||
|
||||
df = open(argv[2],O_WRONLY|O_CREAT,00666);
|
||||
if (df < 0) {
|
||||
e = errno;
|
||||
printf("cpnt: %s: %s\n",argv[2],strerror(e));
|
||||
return(1);
|
||||
}
|
||||
|
||||
while (going) {
|
||||
rb = read(sf,buf,BUFSIZE);
|
||||
if (rb < 0) {
|
||||
e = errno;
|
||||
printf("cpnt: error while reading: %s\n",strerror(e));
|
||||
going = 0;
|
||||
break;
|
||||
}
|
||||
if (rb == 0) going = 0;
|
||||
wb = write(df,buf,rb);
|
||||
if (wb < 0) {
|
||||
e = errno;
|
||||
printf("cpnt: error while writing: %s\n",strerror(e));
|
||||
going = 0;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
close(sf);
|
||||
close(df);
|
||||
free(buf);
|
||||
|
||||
return(e ? 1 : 0);
|
||||
}
|
||||
@@ -0,0 +1,691 @@
|
||||
/*
|
||||
* edlib.c - Registry edit interactive fuctions.
|
||||
*
|
||||
* Point of this is so that interactive registry editor
|
||||
* can be accessed from several other programs
|
||||
*
|
||||
* 2010-jun: New function from Aleksander Wojdyga: dpi, decode product ID
|
||||
* Mostly used on \Microsoft\Windows NT\CurrentVersion\DigitalProductId
|
||||
* Now as command in registry editor, but may be moved to chnpw menu later.
|
||||
* 2010-apr: Lots of bugfix and other patches from
|
||||
* Frediano Ziglio <freddy77@gmail.com>
|
||||
* His short patch comments:
|
||||
* remove leak
|
||||
* fix default value, bin and quote
|
||||
* support wide char in key
|
||||
* support wide character into value names
|
||||
* fix export for string with embedded end lines
|
||||
* remove some warnings
|
||||
* compute checksum writing
|
||||
*
|
||||
* 2008-mar: First version. Moved from chntpw.c
|
||||
* See HISTORY.txt for more detailed info on history.
|
||||
*
|
||||
*****
|
||||
*
|
||||
* Copyright (c) 1997-2011 Petter Nordahl-Hagen.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; version 2 of the License.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* See file GPL.txt for the full license.
|
||||
*
|
||||
*****
|
||||
*/
|
||||
|
||||
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <ctype.h>
|
||||
|
||||
#include "ntreg.h"
|
||||
|
||||
const char edlib_version[] = "edlib version 0.1 110511, (c) Petter N Hagen";
|
||||
|
||||
#define ALLOC_DEBUG 0 /* Reg allocation debug hooks */
|
||||
#define ADDBIN_DEBUG 0 /* Reg expansion debug hooks */
|
||||
|
||||
extern char *val_types[REG_MAX+1];
|
||||
|
||||
struct cmds {
|
||||
char cmd_str[12];
|
||||
int cmd_num;
|
||||
};
|
||||
|
||||
#define MCMD_CD 1
|
||||
#define MCMD_LS 2
|
||||
#define MCMD_QUIT 3
|
||||
#define MCMD_CAT 4
|
||||
#define MCMD_STRUCT 5
|
||||
#define MCMD_DEBUG 6
|
||||
#define MCMD_HELP 7
|
||||
#define MCMD_EXPORTKEY 8
|
||||
#define MCMD_HIVE 9
|
||||
#define MCMD_EDIT 10
|
||||
#define MCMD_ALLOC 11
|
||||
#define MCMD_FREE 12
|
||||
#define MCMD_ADDV 13
|
||||
#define MCMD_DELV 14
|
||||
#define MCMD_DELVALL 15
|
||||
#define MCMD_NEWKEY 16
|
||||
#define MCMD_DELKEY 17
|
||||
#define MCMD_CATHEX 18
|
||||
#define MCMD_RDEL 19
|
||||
#define MCMD_CK 20
|
||||
#define MCMD_CAT_DPI 21
|
||||
#define MCMD_ADDBIN 22
|
||||
|
||||
struct cmds maincmds[] = {
|
||||
{ "cd" , MCMD_CD } ,
|
||||
{ "ls" , MCMD_LS } ,
|
||||
{ "dir", MCMD_LS } ,
|
||||
{ "q" , MCMD_QUIT } ,
|
||||
{ "cat", MCMD_CAT } ,
|
||||
{ "type",MCMD_CAT } ,
|
||||
{ "st" , MCMD_STRUCT } ,
|
||||
{ "debug", MCMD_DEBUG } ,
|
||||
{ "hive", MCMD_HIVE } ,
|
||||
{ "ed", MCMD_EDIT } ,
|
||||
#if ALLOC_DEBUG
|
||||
{ "alloc", MCMD_ALLOC } ,
|
||||
{ "free", MCMD_FREE } ,
|
||||
#endif
|
||||
#if ADDBIN_DEBUG
|
||||
{ "addbin", MCMD_ADDBIN },
|
||||
#endif
|
||||
{ "nv", MCMD_ADDV } ,
|
||||
{ "dv", MCMD_DELV } ,
|
||||
{ "delallv", MCMD_DELVALL } ,
|
||||
{ "nk", MCMD_NEWKEY } ,
|
||||
{ "dk", MCMD_DELKEY } ,
|
||||
{ "hex", MCMD_CATHEX } ,
|
||||
{ "rdel", MCMD_RDEL } ,
|
||||
{ "ek", MCMD_EXPORTKEY },
|
||||
{ "ck", MCMD_CK } ,
|
||||
{ "?", MCMD_HELP } ,
|
||||
{ "dpi", MCMD_CAT_DPI } ,
|
||||
{ "", 0 }
|
||||
};
|
||||
|
||||
/* display decoded DigitalProductId
|
||||
* nkofs = node
|
||||
* path = "DigitalProductId" or some other
|
||||
*/
|
||||
void cat_dpi(struct hive *hdesc, int nkofs, char *path)
|
||||
{
|
||||
void *data;
|
||||
int len,i,type;
|
||||
|
||||
type = get_val_type(hdesc, nkofs, path, 0);
|
||||
if (type == -1) {
|
||||
printf("cat_dpi: No such value <%s>\n",path);
|
||||
return;
|
||||
}
|
||||
|
||||
len = get_val_len(hdesc, nkofs, path, 0);
|
||||
if (len < 67) {
|
||||
printf("cat_dpi: Value <%s> is too short for decoding\n",path);
|
||||
return;
|
||||
}
|
||||
|
||||
data = (void *)get_val_data(hdesc, nkofs, path, 0, 0);
|
||||
if (!data) {
|
||||
printf("cat_dpi: Value <%s> references NULL-pointer (bad boy!)\n",path);
|
||||
abort();
|
||||
return;
|
||||
}
|
||||
|
||||
if (type != REG_BINARY) {
|
||||
printf ("Only binary values\n");
|
||||
return;
|
||||
}
|
||||
|
||||
printf("Value <%s> of type %s, data length %d [0x%x]\n", path,
|
||||
(type < REG_MAX ? val_types[type] : "(unknown)"), len, len);
|
||||
|
||||
|
||||
char digits[] = {'B','C','D','F','G','H','J','K','M','P','Q','R','T','V','W','X','Y','2','3','4','6','7','8','9'};
|
||||
|
||||
#define RESULT_LEN 26
|
||||
char result[RESULT_LEN];
|
||||
memset (result, 0, RESULT_LEN);
|
||||
|
||||
#define START_OFFSET 52
|
||||
#define BUF_LEN 15
|
||||
unsigned char buf[BUF_LEN];
|
||||
memcpy (buf, data + START_OFFSET, BUF_LEN);
|
||||
|
||||
for (i = RESULT_LEN - 2; i >= 0; i--) {
|
||||
unsigned int x = 0;
|
||||
|
||||
int j;
|
||||
for (j = BUF_LEN - 1; j >= 0; j--) {
|
||||
x = (x << 8) + buf[j];
|
||||
buf[j] = x / 24;
|
||||
x = x % 24;
|
||||
}
|
||||
result[i] = digits[x];
|
||||
}
|
||||
|
||||
printf ("\nDecoded product ID: [%s]\n", result);
|
||||
}
|
||||
|
||||
/* display (cat) the value,
|
||||
* vofs = offset to 'nk' node, paths relative to this (or 0 for root)
|
||||
* path = path string to value
|
||||
* Does not handle all types yet (does a hexdump instead)
|
||||
*/
|
||||
void cat_vk(struct hive *hdesc, int nkofs, char *path, int dohex)
|
||||
{
|
||||
void *data;
|
||||
int len,i,type;
|
||||
// char string[SZ_MAX+1];
|
||||
char *string = NULL;
|
||||
struct keyval *kv = NULL;
|
||||
|
||||
type = get_val_type(hdesc, nkofs, path, TPF_VK);
|
||||
if (type == -1) {
|
||||
printf("cat_vk: No such value <%s>\n",path);
|
||||
return;
|
||||
}
|
||||
|
||||
len = get_val_len(hdesc, nkofs, path, TPF_VK);
|
||||
if (!len) {
|
||||
printf("cat_vk: Value <%s> has zero length\n",path);
|
||||
return;
|
||||
}
|
||||
|
||||
#if 0
|
||||
data = (void *)get_val_data(hdesc, nkofs, path, 0, TPF_VK);
|
||||
if (!data) {
|
||||
printf("cat_vk: Value <%s> references NULL-pointer (bad boy!)\n",path);
|
||||
abort();
|
||||
return;
|
||||
}
|
||||
#endif
|
||||
|
||||
kv = get_val2buf(hdesc, NULL, nkofs, path, 0, TPF_VK);
|
||||
|
||||
if (!kv) {
|
||||
printf("cat_vk: Value <%s> could not fetch data\n",path);
|
||||
abort();
|
||||
}
|
||||
data = (void *)&(kv->data);
|
||||
|
||||
|
||||
printf("Value <%s> of type %s, data length %d [0x%x]\n", path,
|
||||
(type < REG_MAX ? val_types[type] : "(unknown)"), len, len);
|
||||
|
||||
if (dohex) type = REG_BINARY;
|
||||
switch (type) {
|
||||
case REG_SZ:
|
||||
case REG_EXPAND_SZ:
|
||||
case REG_MULTI_SZ:
|
||||
string = string_regw2prog(data, len);
|
||||
// cheap_uni2ascii(data,string,len);
|
||||
for (i = 0; i < (len>>1)-1; i++) {
|
||||
if (string[i] == 0) string[i] = '\n';
|
||||
if (type == REG_SZ) break;
|
||||
}
|
||||
puts(string);
|
||||
FREE(string);
|
||||
break;
|
||||
case REG_DWORD:
|
||||
printf("0x%08x",*(unsigned short *)data);
|
||||
break;
|
||||
default:
|
||||
printf("Don't know how to handle type yet!\n");
|
||||
case REG_BINARY:
|
||||
hexdump((char *)data, 0, len, 1);
|
||||
}
|
||||
putchar('\n');
|
||||
FREE(kv);
|
||||
|
||||
}
|
||||
|
||||
/* Edit value: Invoke whatever is needed to edit it
|
||||
* based on its type
|
||||
*/
|
||||
|
||||
void edit_val(struct hive *h, int nkofs, char *path)
|
||||
{
|
||||
struct keyval *kv, *newkv;
|
||||
int type,len,n,i,in,go, newsize, d = 0, done, insert = 0;
|
||||
char inbuf[SZ_MAX+4];
|
||||
char origstring[SZ_MAX+4];
|
||||
char *newstring;
|
||||
char *dbuf;
|
||||
|
||||
type = get_val_type(h, nkofs, path, TPF_VK);
|
||||
if (type == -1) {
|
||||
printf("Value <%s> not found!\n",path);
|
||||
return;
|
||||
}
|
||||
|
||||
kv = get_val2buf(h, NULL, nkofs, path, type, TPF_VK);
|
||||
if (!kv) {
|
||||
printf("Unable to get data of value <%s>\n",path);
|
||||
return;
|
||||
}
|
||||
len = kv->len;
|
||||
|
||||
printf("EDIT: <%s> of type %s with length %d [0x%x]\n", path,
|
||||
(type < REG_MAX ? val_types[type] : "(unknown)"),
|
||||
len, len);
|
||||
|
||||
switch(type) {
|
||||
case REG_DWORD:
|
||||
printf("DWORD: Old value %d [0x%x], ", kv->data, kv->data);
|
||||
fmyinput("enter new value (prepend 0x if hex, empty to keep old value)\n-> ",
|
||||
inbuf, 12);
|
||||
if (*inbuf) {
|
||||
sscanf(inbuf,"%i",&kv->data);
|
||||
d = 1;
|
||||
}
|
||||
printf("DWORD: New value %d [0x%x], ", kv->data, kv->data);
|
||||
break;
|
||||
case REG_SZ:
|
||||
case REG_EXPAND_SZ:
|
||||
case REG_MULTI_SZ:
|
||||
newstring = NULL;
|
||||
dbuf = (char *)&kv->data;
|
||||
cheap_uni2ascii(dbuf,origstring,len);
|
||||
n = 0; i = 0;
|
||||
while (i < (len>>1)-1) {
|
||||
printf("[%2d]: %s\n",n,origstring+i);
|
||||
i += strlen(origstring+i) + 1;
|
||||
n++;
|
||||
}
|
||||
|
||||
printf("\nNow enter new strings, one by one.\n");
|
||||
printf("Enter nothing to keep old.\n");
|
||||
if (type == REG_MULTI_SZ) {
|
||||
printf("'--n' to quit (remove rest of strings)\n");
|
||||
printf("'--i' insert new string at this point\n");
|
||||
printf("'--q' to quit (leaving remaining strings as is)\n");
|
||||
printf("'--Q' to quit and discard all changes\n");
|
||||
printf("'--e' for empty string in this position\n");
|
||||
}
|
||||
n = 0; i = 0; in = 0; go = 0; done = 0;
|
||||
|
||||
/* Now this one is RATHER UGLY :-} */
|
||||
|
||||
while (i < (len>>1)-1 || !done) {
|
||||
|
||||
printf("[%2d]: %s\n",n, insert == 1 ? "[INSERT]" : ((i < (len>>1)-1 ) ? origstring+i : "[NEW]"));
|
||||
if (insert) insert++;
|
||||
if (!go) fmyinput("-> ",inbuf, 500);
|
||||
else *inbuf = 0;
|
||||
if (*inbuf && strcmp("--q", inbuf)) {
|
||||
if (!strcmp("--n", inbuf) || !strcmp("--Q", inbuf)) { /* Zap rest */
|
||||
i = (len>>1) ; done = 1;
|
||||
} else if (strcmp("--i", inbuf)) { /* Copy out given string */
|
||||
if (!strcmp("--e",inbuf)) *inbuf = '\0';
|
||||
if (newstring) newstring = realloc(newstring, in+strlen(inbuf)+1);
|
||||
else newstring = malloc(in+strlen(inbuf)+1);
|
||||
strcpy(newstring+in, inbuf);
|
||||
in += strlen(inbuf)+1;
|
||||
} else {
|
||||
insert = 1;
|
||||
}
|
||||
} else { /* Copy out default string */
|
||||
|
||||
if (newstring) newstring = realloc(newstring, in+strlen(origstring+i)+1);
|
||||
else newstring = malloc(in + strlen(origstring+i) + 1);
|
||||
strcpy(newstring+in, origstring+i);
|
||||
in += strlen(origstring+i)+1;
|
||||
|
||||
if (!strcmp("--q", inbuf)) {
|
||||
go = 1; done = 1;
|
||||
if (!(i < (len>>1)-1 )) {
|
||||
in--; /* remove last empty if in NEW-mode */
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (!insert) i += strlen(origstring+i) + 1;
|
||||
if (insert != 1) n++;
|
||||
if (insert == 2) insert = 0;
|
||||
if (type != REG_MULTI_SZ) {
|
||||
i = (len<<1);
|
||||
done = 1;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
if (strcmp("--Q", inbuf)) { /* We didn't bail out */
|
||||
if (newstring) newstring = realloc(newstring, in+1);
|
||||
else newstring = malloc(in+1);
|
||||
if (type == REG_MULTI_SZ) {
|
||||
in++;
|
||||
*(newstring+in) = '\0'; /* Must add null termination */
|
||||
}
|
||||
ALLOC(newkv,1,(in<<1)+sizeof(int));
|
||||
newkv->len = in<<1;
|
||||
printf("newkv->len: %d\n",newkv->len);
|
||||
cheap_ascii2uni(newstring, (char *)&(newkv->data), in);
|
||||
|
||||
d = 1;
|
||||
|
||||
FREE(kv);
|
||||
kv = newkv;
|
||||
|
||||
}
|
||||
break;
|
||||
|
||||
default:
|
||||
printf("Type not handeled (yet), invoking hex editor on data!\n");
|
||||
case REG_BINARY:
|
||||
fmyinput("New length (ENTER to keep same): ",inbuf,90);
|
||||
if (*inbuf) {
|
||||
newsize = atoi(inbuf);
|
||||
ALLOC(newkv,1,newsize+sizeof(int)+4);
|
||||
bzero(newkv,newsize+sizeof(int)+4);
|
||||
memcpy(newkv, kv, ((len < newsize) ? (len) : (newsize)) + sizeof(int));
|
||||
FREE(kv);
|
||||
kv = newkv;
|
||||
kv->len = newsize;
|
||||
}
|
||||
d = debugit((char *)&kv->data, kv->len);
|
||||
break;
|
||||
}
|
||||
|
||||
if (d) {
|
||||
if (!(put_buf2val(h, kv, nkofs, path, type, TPF_VK))) {
|
||||
printf("Failed to set value!?\n");
|
||||
}
|
||||
}
|
||||
FREE(kv);
|
||||
}
|
||||
|
||||
/* look up command in array
|
||||
*/
|
||||
int parsecmd(char **s, struct cmds *cmd)
|
||||
{
|
||||
|
||||
int l = 0;
|
||||
|
||||
while ((*s)[l] && ((*s)[l] != ' ')) {
|
||||
l++;
|
||||
}
|
||||
while (cmd->cmd_num) {
|
||||
if (!strncmp(*s, cmd->cmd_str, l)) {
|
||||
*s += l;
|
||||
return(cmd->cmd_num);
|
||||
}
|
||||
cmd++;
|
||||
}
|
||||
return(0);
|
||||
}
|
||||
|
||||
|
||||
/* Lot of people didn't understand the "nv" command.
|
||||
* Actually the command should understand the type names too, but.. some later time
|
||||
*/
|
||||
|
||||
void nv_help(void)
|
||||
{
|
||||
int i;
|
||||
|
||||
printf("Command syntax is:\n\n"
|
||||
" nv <type> <valuename>\n\n"
|
||||
"where <type> should be the HEX NUMBER from one of these registry value types:\n\n");
|
||||
|
||||
for (i=0; i < REG_MAX; i++) {
|
||||
printf(" %2x : %s\n",i,val_types[i]);
|
||||
}
|
||||
printf("\nExample:\n nv 4 foobar\n");
|
||||
printf("to make a new value named foobar of the type REG_DWORD\n\n");
|
||||
}
|
||||
|
||||
|
||||
/* Interactive registry editor
|
||||
* hive - list of loaded hives (array pointing to hive structs)
|
||||
* no_hives - max number of hives loaded
|
||||
*/
|
||||
|
||||
void regedit_interactive(struct hive *hive[], int no_hives)
|
||||
{
|
||||
struct hive *hdesc;
|
||||
int cdofs, newofs;
|
||||
struct nk_key *cdkey;
|
||||
char inbuf[100], *bp, *file, *prefix;
|
||||
char path[1000];
|
||||
int l, vkofs, nh, i;
|
||||
int usehive = 0;
|
||||
struct keyval *kv;
|
||||
|
||||
#if ALLOC_DEBUG
|
||||
int pagestart;
|
||||
int freetest;
|
||||
#endif
|
||||
|
||||
hdesc = hive[usehive];
|
||||
cdofs = hdesc->rootofs;
|
||||
|
||||
printf("Simple registry editor. ? for help.\n");
|
||||
|
||||
while (1) {
|
||||
cdkey = (struct nk_key *)(hdesc->buffer + cdofs);
|
||||
|
||||
*path = 0;
|
||||
get_abs_path(hdesc,cdofs+4, path, 50);
|
||||
|
||||
#if ALLOC_DEBUG
|
||||
pagestart = find_page_start(hdesc,cdofs);
|
||||
printf("find_page_start: 0x%x\n",pagestart);
|
||||
freetest = find_free_blk(hdesc,pagestart,10);
|
||||
printf("find_free_blk: 0x%x\n",freetest);
|
||||
#endif
|
||||
if (hdesc->state & HMODE_VERBOSE) printf("\n[%0x] %s> ",cdofs,path);
|
||||
else printf("\n%s> ",path);
|
||||
l = fmyinput("",inbuf,90);
|
||||
bp = inbuf;
|
||||
skipspace(&bp);
|
||||
|
||||
if (l > 0 && *bp) {
|
||||
switch(parsecmd(&bp,maincmds)) {
|
||||
case MCMD_HELP:
|
||||
printf("Simple registry editor:\n");
|
||||
printf("hive [<n>] - list loaded hives or switch to hive numer n\n");
|
||||
printf("cd <key> - change current key\n");
|
||||
printf("ls | dir [<key>] - show subkeys & values,\n");
|
||||
printf("cat | type <value> - show key value\n");
|
||||
printf("dpi <value> - show decoded DigitalProductId value\n");
|
||||
printf("hex <value> - hexdump of value data\n");
|
||||
printf("ck [<keyname>] - Show keys class data, if it has any\n");
|
||||
printf("nk <keyname> - add key\n");
|
||||
printf("dk <keyname> - delete key (must be empty)\n");
|
||||
printf("ed <value> - Edit value\n");
|
||||
printf("nv <type#> <valuename> - Add value\n");
|
||||
printf("dv <valuename> - Delete value\n");
|
||||
printf("delallv - Delete all values in current key\n");
|
||||
printf("rdel <keyname> - Recursively delete key & subkeys\n");
|
||||
printf("ek <filename> <prefix> <keyname> - export key to <filename> (Windows .reg file format)\n");
|
||||
printf("debug - enter buffer hexeditor\n");
|
||||
printf("st [<hexaddr>] - debug function: show struct info\n");
|
||||
printf("q - quit\n");
|
||||
break;
|
||||
|
||||
case MCMD_DELKEY :
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
del_key(hdesc, cdofs + 4, bp);
|
||||
break;
|
||||
case MCMD_NEWKEY :
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
add_key(hdesc, cdofs + 4, bp);
|
||||
break;
|
||||
case MCMD_DELVALL :
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
del_allvalues(hdesc, cdofs + 4);
|
||||
break;
|
||||
case MCMD_DELV :
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
del_value(hdesc, cdofs + 4, bp, 0);
|
||||
break;
|
||||
case MCMD_ADDV :
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
if (!isxdigit(*bp)) {
|
||||
nv_help();
|
||||
break;
|
||||
}
|
||||
nh = gethex(&bp);
|
||||
skipspace(&bp);
|
||||
if (!*bp) {
|
||||
nv_help();
|
||||
break;
|
||||
}
|
||||
add_value(hdesc, cdofs+4, bp, nh);
|
||||
break;
|
||||
#if ALLOC_DEBUG
|
||||
case MCMD_FREE :
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
nh = gethex(&bp);
|
||||
free_block(hdesc, nh);
|
||||
break;
|
||||
case MCMD_ALLOC :
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
nh = gethex(&bp);
|
||||
alloc_block(hdesc, cdofs+4, nh);
|
||||
break;
|
||||
#endif
|
||||
#if ADDBIN_DEBUG
|
||||
case MCMD_ADDBIN :
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
nh = gethex(&bp);
|
||||
add_bin(hdesc, nh);
|
||||
break;
|
||||
#endif
|
||||
case MCMD_LS :
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
nk_ls(hdesc, bp, cdofs+4, 0);
|
||||
break;
|
||||
case MCMD_CK :
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
kv = get_class(hdesc, cdofs+4, bp);
|
||||
if (kv) {
|
||||
hexdump((char *)&kv->data, 0, kv->len, 1);
|
||||
FREE(kv);
|
||||
}
|
||||
break;
|
||||
case MCMD_RDEL :
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
rdel_keys(hdesc, bp, cdofs+4);
|
||||
break;
|
||||
case MCMD_EDIT :
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
edit_val(hdesc, cdofs+4, bp);
|
||||
break;
|
||||
case MCMD_HIVE :
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
if (*bp) {
|
||||
nh = gethex(&bp);
|
||||
if (nh >= 0 && nh < no_hives) {
|
||||
usehive = nh;
|
||||
printf("Switching to hive #%d, named <%s>, size %d [0x%x]\n",
|
||||
usehive, hive[usehive]->filename,
|
||||
hive[usehive]->size,
|
||||
hive[usehive]->size);
|
||||
hdesc = hive[usehive];
|
||||
cdofs = hdesc->rootofs;
|
||||
}
|
||||
} else {
|
||||
for (nh = 0; nh < no_hives; nh++) {
|
||||
printf("%c %c %2d %9d 0x%08x <%s>\n", (nh == usehive) ? '*' : ' ',
|
||||
(hive[nh]->state & HMODE_DIRTY) ? 'D' : ' ',
|
||||
nh,
|
||||
hive[nh]->size,
|
||||
hive[nh]->size, hive[nh]->filename);
|
||||
}
|
||||
}
|
||||
break;
|
||||
case MCMD_CD :
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
newofs = trav_path(hdesc, cdofs+4,bp,TPF_NK);
|
||||
if (newofs) cdofs = newofs;
|
||||
else printf("Key %s not found!\n",bp);
|
||||
break;
|
||||
case MCMD_CAT:
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
cat_vk(hdesc,cdofs+4,bp,0);
|
||||
break;
|
||||
case MCMD_CAT_DPI:
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
cat_dpi (hdesc, cdofs+4, bp);
|
||||
break;
|
||||
case MCMD_CATHEX:
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
cat_vk(hdesc,cdofs+4,bp,1);
|
||||
break;
|
||||
case MCMD_EXPORTKEY :
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
file = bp;
|
||||
i = 0;
|
||||
while(*bp != ' ' && (*bp))
|
||||
{
|
||||
i++;
|
||||
bp++;
|
||||
}
|
||||
file[i] = '\0';
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
prefix = bp;
|
||||
i = 0;
|
||||
while(*bp != ' ' && (*bp))
|
||||
{
|
||||
i++;
|
||||
bp++;
|
||||
}
|
||||
prefix[i] = '\0';
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
export_key(hdesc, cdofs + 4, bp, file, prefix);
|
||||
break;
|
||||
case MCMD_STRUCT:
|
||||
bp++;
|
||||
skipspace(&bp);
|
||||
vkofs = cdofs;
|
||||
if (*bp) {
|
||||
vkofs = gethex(&bp);
|
||||
}
|
||||
parse_block(hdesc,vkofs,2);
|
||||
break;
|
||||
case MCMD_DEBUG:
|
||||
if (debugit(hdesc->buffer,hdesc->size)) hdesc->state |= HMODE_DIRTY;
|
||||
break;
|
||||
case MCMD_QUIT:
|
||||
return;
|
||||
break;
|
||||
default:
|
||||
printf("Unknown command: %s, type ? for help\n",bp);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,66 @@
|
||||
/* Mickeysoft hashroutine in XP 'lh' key index lists */
|
||||
|
||||
#include <stdio.h>
|
||||
#include <ctype.h>
|
||||
#include <string.h>
|
||||
|
||||
|
||||
static const unsigned char charset2upper[] = {
|
||||
0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, /* 0x00-0x07 */
|
||||
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /* 0x08-0x0f */
|
||||
0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, /* 0x10-0x17 */
|
||||
0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, /* 0x18-0x1f */
|
||||
0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, /* 0x20-0x27 */
|
||||
0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, /* 0x28-0x2f */
|
||||
0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, /* 0x30-0x37 */
|
||||
0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, /* 0x38-0x3f */
|
||||
0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, /* 0x40-0x47 */
|
||||
0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, /* 0x48-0x4f */
|
||||
0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, /* 0x50-0x57 */
|
||||
0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f, /* 0x58-0x5f */
|
||||
0x60, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, /* 0x60-0x67 */
|
||||
0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, /* 0x68-0x6f */
|
||||
0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, /* 0x70-0x77 */
|
||||
0x58, 0x59, 0x5a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, /* 0x78-0x7f */
|
||||
|
||||
0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, /* 0x80-0x87 */
|
||||
0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, /* 0x88-0x8f */
|
||||
0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, /* 0x90-0x97 */
|
||||
0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, /* 0x98-0x9f */
|
||||
0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, /* 0xa0-0xa7 */
|
||||
0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf, /* 0xa8-0xaf */
|
||||
0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0x00, 0xb6, 0xb7, /* 0xb0-0xb7 */
|
||||
0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf, /* 0xb8-0xbf */
|
||||
0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, /* 0xc0-0xc7 */
|
||||
0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, /* 0xc8-0xcf */
|
||||
0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, /* 0xd0-0xd7 */
|
||||
0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, /* 0xd8-0xdf */
|
||||
0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, /* 0xe0-0xe7 */
|
||||
0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, /* 0xe8-0xef */
|
||||
0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xf7, /* 0xf0-0xf7 */
|
||||
0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0x00, /* 0xf8-0xff */
|
||||
};
|
||||
|
||||
|
||||
|
||||
|
||||
int main(void)
|
||||
{
|
||||
|
||||
char str[500];
|
||||
long hash = 0;
|
||||
int i;
|
||||
FILE *f;
|
||||
|
||||
f = fdopen(0,"r");
|
||||
|
||||
fgets(str, 499, f);
|
||||
|
||||
str[strlen(str)-1] = 0;
|
||||
|
||||
for (i = 0; i < strlen(str); i++) {
|
||||
hash *= 37;
|
||||
hash += charset2upper[(unsigned char)str[i]];
|
||||
}
|
||||
printf("hash = %08x\n",hash);
|
||||
}
|
||||
@@ -0,0 +1,444 @@
|
||||
/*
|
||||
* ntreg.h - NT Registry Hive access library, constants & structures
|
||||
*
|
||||
* NOTE: defines are not frozen. It can and will change every release.
|
||||
*
|
||||
*****
|
||||
*
|
||||
* NTREG - Window registry file reader / writer library
|
||||
* Copyright (c) 1997-2011 Petter Nordahl-Hagen.
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU Lesser General Public
|
||||
* License as published by the Free Software Foundation;
|
||||
* version 2.1 of the License.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* Lesser General Public License for more details.
|
||||
* See file LGPL.txt for the full license.
|
||||
*
|
||||
*/
|
||||
|
||||
|
||||
#ifndef _INCLUDE_NTREG_H
|
||||
#define _INCLUDE_NTREG_H 1
|
||||
|
||||
#define SZ_MAX 4096 /* Max unicode strlen before we truncate */
|
||||
|
||||
#define KEY_ROOT 0x2c /* Type ID of ROOT key node */
|
||||
#define KEY_NORMAL 0x20 /* Normal nk key */
|
||||
|
||||
#define ABSPATHLEN 4096
|
||||
|
||||
|
||||
/* hbin page size. hbins are minimum this, and always multiple of this */
|
||||
#define HBIN_PAGESIZE 0x1000
|
||||
/* Hive filesize seems to always be multiple of this */
|
||||
#define REGF_FILEDIVISOR 0x40000
|
||||
|
||||
/* Larger than this, and values seems split into several blocks */
|
||||
#define VAL_DIRECT_LIMIT 0x3fd0
|
||||
|
||||
|
||||
/* Datatypes of the values in the registry */
|
||||
|
||||
#define REG_NONE 0 /* No value type */
|
||||
#define REG_SZ 1 /* Unicode nul terminated string */
|
||||
#define REG_EXPAND_SZ 2 /* Unicode nul terminated string + env */
|
||||
#define REG_BINARY 3 /* Free form binary */
|
||||
#define REG_DWORD 4 /* 32-bit number */
|
||||
#define REG_DWORD_BIG_ENDIAN 5 /* 32-bit number */
|
||||
#define REG_LINK 6 /* Symbolic Link (unicode) */
|
||||
#define REG_MULTI_SZ 7 /* Multiple Unicode strings */
|
||||
#define REG_RESOURCE_LIST 8 /* Resource list in the resource map */
|
||||
#define REG_FULL_RESOURCE_DESCRIPTOR 9 /* Resource list in the hardware description */
|
||||
#define REG_RESOURCE_REQUIREMENTS_LIST 10 /* Uh? Rait.. */
|
||||
#define REG_QWORD 11 /* Quad word 64 bit, little endian */
|
||||
|
||||
#define REG_MAX 12
|
||||
|
||||
|
||||
/* The first page of the registry file is some kind of header, lot of
|
||||
* it's contents is unknown, and seems to be mostly NULLs anyway.
|
||||
* Note also, that this is the only place in the registry I've been
|
||||
* able to find _any_ kind of checksumming
|
||||
*/
|
||||
|
||||
struct regf_header {
|
||||
|
||||
int32_t id; /* 0x00000000 D-Word ID: ASCII-"regf" = 0x66676572 */
|
||||
int32_t unknown1; /* 0x00000004 D-Word ???? Mount count */
|
||||
int32_t unknown2; /* 0x00000008 D-Word ???? Always the same value as at 0x00000004 */
|
||||
char timestamp[8]; /* 0x0000000C Q-Word last modify date in WinNT date-format */
|
||||
int32_t unknown3; /* 0x00000014 D-Word 1 */
|
||||
int32_t unknown4; /* 0x00000018 D-Word 3 - probably version #. 2 in NT3.51 */
|
||||
int32_t unknown5; /* 0x0000001C D-Word 0 */
|
||||
int32_t unknown6; /* 0x00000020 D-Word 1 */
|
||||
int32_t ofs_rootkey; /* 0x00000024 D-Word Offset of 1st key record */
|
||||
int32_t filesize; /* 0x00000028 D-Word Offset of first non-used data at end of file */
|
||||
int32_t unknown7; /* 0x0000002C D-Word 1 */
|
||||
char name[0x1fc-0x30]; /* 0x00000030 Seems like the hive's name is buried here, max len unknown */
|
||||
int32_t checksum; /* 0x000001FC D-Word Xor sum of all D-Words from 0x00000000 to 0x000001FB */
|
||||
};
|
||||
|
||||
/* The page header, I don't know if the 14 "dummy" bytes has a meaning,
|
||||
* they seem to be mostly NULLS
|
||||
*/
|
||||
|
||||
struct hbin_page {
|
||||
|
||||
int32_t id; /* 0x0000 D-Word ID: ASCII-"hbin" = 0x6E696268 */
|
||||
int32_t ofs_self; /* 0x0004 D-Word Offset to itself, could be for sanity check */
|
||||
int32_t ofs_next; /* 0x0008 D-Word Relative offset to next hbin (practically length of this one) */
|
||||
char dummy1[14]; /* 0x14 to 0x001b may be timestamp in some windows versions, at least in first hbin */
|
||||
int32_t len_page; /* 0x001C D-Word Block-size??? Don't look like it. Most often zero. */
|
||||
|
||||
int32_t firstlink; /* 0x0020 First data block likage */
|
||||
/* char data[1]; 0x0020 First data block starts here */
|
||||
|
||||
};
|
||||
|
||||
/* Minimum block size utilized at end of hbin
|
||||
* Make routines accept 0 size block when at end
|
||||
*/
|
||||
#define HBIN_ENDFILL 0
|
||||
|
||||
|
||||
|
||||
/* Security descriptor. I know how it's linked, but don't know
|
||||
how the real security data is constructed, it may as well
|
||||
be like the higher level security structs defined by MS in its
|
||||
includes & NT docs. Currently, I have no use for it.
|
||||
Note that keys sharing the exact same security settings will
|
||||
most likely point to the same security descriptor, thus
|
||||
saving space and making it fast to make objects inherit settings
|
||||
(is inheritance supported? they speak of security inheritance as a "new"
|
||||
feature in the filesystem on NT5, even though I think it was
|
||||
also supported by the lower levels in the earlier versions)
|
||||
*/
|
||||
struct sk_key {
|
||||
|
||||
short id; /* 0x0000 Word ID: ASCII-"sk" = 0x6B73 */
|
||||
short dummy1; /* 0x0002 Word Unused */
|
||||
int32_t ofs_prevsk; /* 0x0004 D-Word Offset of previous "sk"-Record */
|
||||
int32_t ofs_nextsk; /* 0x0008 D-Word Offset of next "sk"-Record */
|
||||
int32_t no_usage; /* 0x000C D-Word usage-counter */
|
||||
int32_t len_sk; /* 0x0010 D-Word Size of "sk"-record in bytes */
|
||||
char data[4]; /* Security data up to len_sk bytes */
|
||||
|
||||
};
|
||||
|
||||
/* This is the subkeylist/hash structure. NT4.0+.
|
||||
* ID + count, then count number of offset/4byte "hash". (not true hash)
|
||||
* Probably changed from the 3.x version to make it faster to
|
||||
* traverse the registry if you're looking for a specific name
|
||||
* (saves lookups in 'nk's that have the first 4 name chars different)
|
||||
*/
|
||||
|
||||
struct lf_key {
|
||||
|
||||
short id; /* 0x0000 Word ID: ASCII-"lf" = 0x666C or "lh" = 0x686c */
|
||||
short no_keys; /* 0x0002 Word number of keys */
|
||||
/* 0x0004 ???? Hash-Records */
|
||||
|
||||
union {
|
||||
|
||||
struct lf_hash {
|
||||
int32_t ofs_nk; /* 0x0000 D-Word Offset of corresponding "nk"-Record */
|
||||
char name[4]; /* 0x0004 D-Word ASCII: the first 4 characters of the key-name, */
|
||||
} hash[1];
|
||||
|
||||
/* WinXP uses a more real hash instead (base 37 of uppercase name chars) */
|
||||
/* padded with 0's. Case sensitiv! */
|
||||
|
||||
struct lh_hash {
|
||||
int32_t ofs_nk; /* 0x0000 D-Word Offset of corresponding "nk"-Record */
|
||||
int32_t hash; /* 0x0004 D-Word ASCII: the first 4 characters of the key-name, */
|
||||
} lh_hash[1];
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
/* 3.x version of the above, contains only offset table, NOT
|
||||
* any start of names "hash". Thus needs 'nk' lookups for searches.
|
||||
*/
|
||||
struct li_key {
|
||||
|
||||
short id; /* 0x0000 Word ID: ASCII-"li" = 0x696C */
|
||||
short no_keys; /* 0x0002 Word number of keys */
|
||||
/* 0x0004 ???? Hash-Records */
|
||||
struct li_hash {
|
||||
int32_t ofs_nk; /* 0x0000 D-Word Offset of corresponding "nk"-Record */
|
||||
} hash[1];
|
||||
};
|
||||
|
||||
|
||||
/* Indirect pointer list for value data, vk points to this instead of values data directly
|
||||
* Seems to be used when value data is large, maybe larger than 3-4k.
|
||||
*/
|
||||
struct db_key {
|
||||
|
||||
short id; /* 0x0000 Word ID: ASCII-"li" = 0x6462 */
|
||||
short no_part; /* 0x0002 Word number of data parts */
|
||||
/* 0x0004 ???? Pointers to data */
|
||||
int32_t ofs_data; /* 0x0000 D-Word Offset to list of data blocks */
|
||||
/* Something else seems to follow here, 4 bytes at least */
|
||||
/* and why not list the data block in here ???? why make another list?? */
|
||||
};
|
||||
|
||||
|
||||
|
||||
/* This is a list of pointers to struct li_key, ie
|
||||
* an extention record if many li's.
|
||||
* This happens in NT4&5 when the lf hashlist grows larger
|
||||
* than about 400-500 entries/subkeys??, then the nk_key->ofs_lf points to this
|
||||
* instead of directly to an lf.
|
||||
* The sub-indices this points to seems to be li (yes!) in NT4 and 2k.
|
||||
* In XP and newer they point to lh which is more efficient.
|
||||
* Likely to happen in HKLM\Software\classes (file extention list) and
|
||||
* in SAM when many users.
|
||||
*/
|
||||
struct ri_key {
|
||||
|
||||
short id; /* 0x0000 Word ID: ASCII-"ri" = 0x6972 */
|
||||
short no_lis; /* 0x0002 Word number of pointers to li */
|
||||
/* 0x0004 ???? Hash-Records */
|
||||
struct ri_hash {
|
||||
int32_t ofs_li; /* 0x0000 D-Word Offset of corresponding "li"-Record */
|
||||
} hash[1];
|
||||
};
|
||||
|
||||
|
||||
/* This is the value descriptor.
|
||||
* If the sign bit (31st bit) in the length field is set, the value is
|
||||
* stored inline this struct, and not in a seperate data chunk -
|
||||
* the data itself is then in the ofs_data field, happens for DWORD all the time
|
||||
* If the name size == 0, then the struct is probably cut short right
|
||||
* after the val_type or flag.
|
||||
* The flag meaning is rather unknown.
|
||||
*/
|
||||
struct vk_key {
|
||||
|
||||
/* Offset Size Contents */
|
||||
short id; /* 0x0000 Word ID: ASCII-"vk" = 0x6B76 */
|
||||
short len_name; /* 0x0002 Word name length */
|
||||
int32_t len_data; /* 0x0004 D-Word length of the data */
|
||||
int32_t ofs_data; /* 0x0008 D-Word Offset of Data */
|
||||
int32_t val_type; /* 0x000C D-Word Type of value */
|
||||
short flag; /* 0x0010 Word Flag
|
||||
0x1 ANSI encoding */
|
||||
short dummy1; /* 0x0012 Word Unused (data-trash) */
|
||||
char keyname[1]; /* 0x0014 ???? Name */
|
||||
|
||||
};
|
||||
|
||||
/* This is the key node (ie directory) descriptor, can contain subkeys and/or values.
|
||||
* Note that for values, the count is stored here, but for subkeys
|
||||
* there's a count both here and in the offset-table (lf or li struct).
|
||||
* What happens if these mismatch is not known.
|
||||
* What's the classname thingy? Can't remember seeing that used in
|
||||
* anything I've looked at.
|
||||
*/
|
||||
struct nk_key {
|
||||
|
||||
/* Offset Size Contents */
|
||||
short id; /* 0x0000 Word ID: ASCII-"nk" = 0x6B6E */
|
||||
short type; /* 0x0002 Word for the root-key: 0x2C, otherwise 0x20 */
|
||||
/* 0x20 seems a flag for ANSI encoding */
|
||||
/* 0x1000 is used in some places in Vista and newer */
|
||||
char timestamp[12]; /* 0x0004 Q-Word write-date/time in windows nt notation */
|
||||
int32_t ofs_parent; /* 0x0010 D-Word Offset of Owner/Parent key */
|
||||
int32_t no_subkeys; /* 0x0014 D-Word number of sub-Keys */
|
||||
int32_t dummy1;
|
||||
int32_t ofs_lf; /* 0x001C D-Word Offset of the sub-key lf-Records */
|
||||
int32_t dummy2;
|
||||
int32_t no_values; /* 0x0024 D-Word number of values */
|
||||
int32_t ofs_vallist; /* 0x0028 D-Word Offset of the Value-List */
|
||||
int32_t ofs_sk; /* 0x002C D-Word Offset of the sk-Record */
|
||||
int32_t ofs_classnam; /* 0x0030 D-Word Offset of the Class-Name */
|
||||
int32_t dummy3; /* 0x0034 unknown some of these may be used by vista */
|
||||
int32_t dummy4; /* 0x0038 unknown and newer ?? */
|
||||
int32_t dummy5; /* 0x003c unknown */
|
||||
int32_t dummy6; /* 0x0040 unknown */
|
||||
int32_t dummy7; /* 0x0044 unknown */
|
||||
short len_name; /* 0x0048 Word name-length */
|
||||
short len_classnam; /* 0x004A Word class-name length */
|
||||
char keyname[1]; /* 0x004C ???? key-name */
|
||||
};
|
||||
|
||||
/*********************************************************************************/
|
||||
|
||||
/* Structure defines for my routines */
|
||||
|
||||
struct ex_data {
|
||||
int nkoffs;
|
||||
struct nk_key *nk;
|
||||
char *name;
|
||||
};
|
||||
|
||||
struct vex_data {
|
||||
int vkoffs;
|
||||
struct vk_key *vk;
|
||||
int type; /* Value type REG_??? */
|
||||
int size; /* Values size (normalized, inline accounted for) */
|
||||
int val; /* Actual value itself if type==REG_DWORD */
|
||||
char *name;
|
||||
};
|
||||
|
||||
struct keyval {
|
||||
int len; /* Length of databuffer */
|
||||
int data; /* Data. Goes on for length of value */
|
||||
};
|
||||
|
||||
struct keyvala {
|
||||
int len; /* Length of databuffer */
|
||||
int data[1]; /* Data. Goes on for length of value */
|
||||
};
|
||||
|
||||
/* Types to trav_path() */
|
||||
#define TPF_NK 0
|
||||
#define TPF_VK 1
|
||||
#define TPF_ABS 64
|
||||
#define TPF_EXACT 128
|
||||
#define TPF_VK_SHORT 256 /* To get type field instead of data field, used in SAM */
|
||||
#define TPF_NK_EXACT (TPF_NK | TPF_EXACT)
|
||||
#define TPF_VK_EXACT (TPF_VK | TPF_EXACT)
|
||||
#define TPF_VK_ABS (TPF_VK | TPF_ABS) /* Name is literal, not a path */
|
||||
|
||||
|
||||
/* Hive open modes */
|
||||
#define HMODE_RW 0
|
||||
#define HMODE_RO 0x1
|
||||
#define HMODE_OPEN 0x2
|
||||
#define HMODE_DIRTY 0x4
|
||||
#define HMODE_NOALLOC 0x8 /* Don't allocate new blocks */
|
||||
#define HMODE_NOEXPAND 0x10 /* Don't expand file with new hbin */
|
||||
#define HMODE_DIDEXPAND 0x20 /* File has been expanded */
|
||||
#define HMODE_VERBOSE 0x1000
|
||||
#define HMODE_TRACE 0x2000
|
||||
|
||||
/* Suggested type of hive loaded, guessed by library, but not used by it */
|
||||
#define HTYPE_UNKNOWN 0
|
||||
#define HTYPE_SAM 1
|
||||
#define HTYPE_SYSTEM 2
|
||||
#define HTYPE_SECURITY 3
|
||||
#define HTYPE_SOFTWARE 4
|
||||
|
||||
|
||||
|
||||
/* Hive definition, allocated by openHive(), dealloc by closeHive()
|
||||
* contains state data, must be passed in all functions
|
||||
*/
|
||||
struct hive {
|
||||
char *filename; /* Hives filename */
|
||||
int filedesc; /* File descriptor (only valid if state == OPEN) */
|
||||
int state; /* Current state of hive */
|
||||
int type; /* Suggested type of hive. NOTE: Library will guess when
|
||||
it loads it, but application may change it if needed */
|
||||
int pages; /* Number of pages, total */
|
||||
int useblk; /* Total # of used blocks */
|
||||
int unuseblk; /* Total # of unused blocks */
|
||||
int usetot; /* total # of bytes in useblk */
|
||||
int unusetot; /* total # of bytes in unuseblk */
|
||||
int size; /* Hives size (filesize) in bytes, incl regf header */
|
||||
int rootofs; /* Offset of root-node */
|
||||
int lastbin; /* Offset to last HBIN */
|
||||
int endofs; /* Offset of first non HBIN page, we can expand from here */
|
||||
short nkindextype; /* Subkey-indextype the root key uses */
|
||||
char *buffer; /* Files raw contents */
|
||||
};
|
||||
|
||||
/***************************************************/
|
||||
|
||||
/* Various nice macros */
|
||||
|
||||
#define CREATE(result, type, number)\
|
||||
{ \
|
||||
if (!((result) = (type *) calloc ((number), sizeof(type)))) { \
|
||||
perror("malloc failure"); \
|
||||
abort() ; \
|
||||
} \
|
||||
}
|
||||
#define ALLOC(result, size, number)\
|
||||
{ \
|
||||
if (!((result) = (void *) calloc ((number), (size)))) { \
|
||||
perror("malloc failure"); \
|
||||
abort() ; \
|
||||
} \
|
||||
}
|
||||
#define FREE(p) { if (p) { free(p); (p) = 0; } }
|
||||
|
||||
/* Debug / verbosity message macro */
|
||||
|
||||
#define VERB(h, string) \
|
||||
{ \
|
||||
if ((h)->state & HMODE_VERBOSE) printf((string)); \
|
||||
}
|
||||
|
||||
#define VERBF(h, ...) \
|
||||
{ \
|
||||
if ((h)->state & HMODE_VERBOSE) printf(__VA_ARGS__); \
|
||||
}
|
||||
|
||||
|
||||
/******* Function prototypes **********/
|
||||
|
||||
char *str_dup( const char *str );
|
||||
int fmyinput(char *prmpt, char *ibuf, int maxlen);
|
||||
void hexprnt(char *s, unsigned char *bytes, int len);
|
||||
void hexdump(char *hbuf, int start, int stop, int ascii);
|
||||
int find_in_buf(char *buf, char *what, int sz, int len, int start);
|
||||
int get_int( char *array );
|
||||
void cheap_uni2ascii(char *src, char *dest, int l);
|
||||
void cheap_ascii2uni(char *src, char *dest, int l);
|
||||
void skipspace(char **c);
|
||||
int gethex(char **c);
|
||||
int gethexorstr(char **c, char *wb);
|
||||
int debugit(char *buf, int sz);
|
||||
int parse_block(struct hive *hdesc, int vofs,int verbose);
|
||||
int ex_next_n(struct hive *hdesc, int nkofs, int *count, int *countri, struct ex_data *sptr);
|
||||
int ex_next_v(struct hive *hdesc, int nkofs, int *count, struct vex_data *sptr);
|
||||
int get_abs_path(struct hive *hdesc, int nkofs, char *path, int maxlen);
|
||||
int trav_path(struct hive *hdesc, int vofs, char *path, int type);
|
||||
int get_val_type(struct hive *hdesc, int vofs, char *path, int exact);
|
||||
int get_val_len(struct hive *hdesc, int vofs, char *path, int exact);
|
||||
void *get_val_data(struct hive *hdesc, int vofs, char *path, int val_type, int exact);
|
||||
struct keyval *get_val2buf(struct hive *hdesc, struct keyval *kv,
|
||||
int vofs, char *path, int type, int exact );
|
||||
int get_dword(struct hive *hdesc, int vofs, char *path, int exact);
|
||||
int put_buf2val(struct hive *hdesc, struct keyval *kv,
|
||||
int vofs, char *path, int type, int exact );
|
||||
int put_dword(struct hive *hdesc, int vofs, char *path, int exact, int dword);
|
||||
void export_key(struct hive *hdesc, int nkofs, char *name, char *filename, char *prefix);
|
||||
void closeHive(struct hive *hdesc);
|
||||
int writeHive(struct hive *hdesc);
|
||||
struct hive *openHive(char *filename, int mode);
|
||||
|
||||
void nk_ls(struct hive *hdesc, char *path, int vofs, int type);
|
||||
|
||||
struct vk_key *add_value(struct hive *hdesc, int nkofs, char *name, int type);
|
||||
void del_allvalues(struct hive *hdesc, int nkofs);
|
||||
int del_value(struct hive *hdesc, int nkofs, char *name, int exact);
|
||||
struct nk_key *add_key(struct hive *hdesc, int nkofs, char *name);
|
||||
int del_key(struct hive *hdesc, int nkofs, char *name);
|
||||
void rdel_keys(struct hive *hdesc, char *path, int nkofs);
|
||||
struct keyval *get_class(struct hive *hdesc, int curnk, char *path);
|
||||
|
||||
int add_bin(struct hive *hdesc, int size);
|
||||
|
||||
void import_reg(struct hive *hdesc, char *filename, char *prefix);
|
||||
|
||||
int de_escape(char *s, int wide);
|
||||
|
||||
char *string_regw2prog(void *string, int len);
|
||||
|
||||
|
||||
/* From edlib.c */
|
||||
void regedit_interactive(struct hive *hive[], int no_hives);
|
||||
void cat_dpi(struct hive *hdesc, int nkofs, char *path);
|
||||
|
||||
|
||||
#endif
|
||||
|
||||
@@ -0,0 +1,233 @@
|
||||
/*
|
||||
* reged.c - Simple Registry Edit Utility for Windows registry hives.
|
||||
*
|
||||
* Frontend command line utility which uses registry library to:
|
||||
* - Export (parts) of registry hive to .reg file
|
||||
* - Import .reg file into registry hive
|
||||
* - Do interactive registry edit
|
||||
*
|
||||
* Changes:
|
||||
* 2011 - may: Trace flags moved here.
|
||||
* 2011 - apr: Added options for import and flags for safe modes..
|
||||
*
|
||||
*
|
||||
*****
|
||||
*
|
||||
* Copyright (c) 1997-2010 Petter Nordahl-Hagen.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; version 2 of the License.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* See file GPL.txt for the full license.
|
||||
*
|
||||
*****
|
||||
*/
|
||||
|
||||
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
|
||||
#include "ntreg.h"
|
||||
|
||||
|
||||
const char reged_version[] = "reged version 0.1 110511, (c) Petter N Hagen";
|
||||
|
||||
|
||||
/* Global verbosity flag */
|
||||
int gverbose = 0;
|
||||
|
||||
/* Array of loaded hives */
|
||||
#define MAX_HIVES 10
|
||||
struct hive *hive[MAX_HIVES+1];
|
||||
int no_hives = 0;
|
||||
|
||||
|
||||
void usage(void)
|
||||
{
|
||||
printf("\nModes:\n"
|
||||
"-x <registryhivefile> <prefixstring> <key> <output.reg>\n"
|
||||
" Xport. Where <prefixstring> for example is HKEY_LOCAL_MACHINE\\SOFTWARE\n"
|
||||
" <key> is key to dump (recursively), \\ or \\\\ means all keys in hive\n"
|
||||
" Only one .reg and one hive file supported at the same time\n"
|
||||
"-I <registryhivefile> <prefixstring> <input.reg>\n"
|
||||
" Import from .reg file. Where <prefixstring> for example is HKEY_LOCAL_MACHINE\\SOFTWARE\n"
|
||||
" Only one .reg and one hive file supported at the same time\n"
|
||||
"-e <registryhive> ...\n"
|
||||
" Interactive edit one or more of registry files\n\n"
|
||||
"Options:\n"
|
||||
"-L : Log changed filenames to /tmp/changed, also auto-saves\n"
|
||||
"-C : Auto-save (commit) changed hives without asking\n"
|
||||
"-N : No allocate mode, only allow edit of existing values with same size\n"
|
||||
"-E : No expand mode, do not expand hive file (safe mode)\n"
|
||||
"-t : Debug trace of allocated blocks\n"
|
||||
"-v : Some more verbose messages\n"
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
int main(int argc, char **argv)
|
||||
{
|
||||
|
||||
int export = 0, edit = 0, import = 0;
|
||||
int d = 0;
|
||||
int autocommit = 0, update = 0;
|
||||
int logchange = 0, mode = 0, dd = 0;
|
||||
int il;
|
||||
extern int optind;
|
||||
extern char* optarg;
|
||||
char *hivename, *prefix, *key, *outputname, *inputname;
|
||||
char c;
|
||||
char yn[10];
|
||||
FILE *ch;
|
||||
|
||||
char *options = "vhtxCLeINE";
|
||||
|
||||
printf("%s\n",reged_version);
|
||||
while((c=getopt(argc,argv,options)) > 0) {
|
||||
switch(c) {
|
||||
case 'e': edit = 1; break;
|
||||
case 'x': export = 1; break;
|
||||
case 'I': import = 1; break;
|
||||
case 'C': autocommit = 1; break;
|
||||
case 'L': logchange = 1; break;
|
||||
case 'v': mode |= HMODE_VERBOSE; gverbose = 1; break;
|
||||
case 'N': mode |= HMODE_NOALLOC; break;
|
||||
case 'E': mode |= HMODE_NOEXPAND; break;
|
||||
case 't': mode |= HMODE_TRACE; break;
|
||||
case 'h': usage(); exit(0); break;
|
||||
default: usage(); exit(1); break;
|
||||
}
|
||||
}
|
||||
if (!export && !edit && !import) {
|
||||
usage();
|
||||
exit(1);
|
||||
}
|
||||
if ( import && export ) {
|
||||
fprintf(stderr,"Import and export cannot be done at same time\n");
|
||||
usage();
|
||||
exit(1);
|
||||
}
|
||||
if (export) { /* Call export. Works only on one hive at a time */
|
||||
hivename=argv[optind];
|
||||
prefix=argv[optind+1];
|
||||
key=argv[optind+2];
|
||||
outputname=argv[optind+3];
|
||||
if (gverbose) {
|
||||
printf("hivename: %s, prefix: %s, key: %s, output: %s\n",hivename,prefix,key,outputname);
|
||||
}
|
||||
|
||||
if (!hivename || !*hivename || !prefix || !*prefix || !key || !*key || !outputname || !*outputname) {
|
||||
usage(); exit(1);
|
||||
}
|
||||
|
||||
if (!(hive[no_hives] = openHive(hivename,HMODE_RO|mode))) {
|
||||
fprintf(stderr,"Unable to open/read hive %s, exiting..\n",hivename);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
export_key(hive[no_hives], 0, key, outputname, prefix);
|
||||
|
||||
no_hives++;
|
||||
|
||||
}
|
||||
|
||||
if (import) { /* Call import. Works only on one hive at a time */
|
||||
hivename=argv[optind];
|
||||
prefix=argv[optind+1];
|
||||
inputname=argv[optind+2];
|
||||
if (gverbose) {
|
||||
printf("hivename: %s, prefix: %s\n",hivename,prefix);
|
||||
}
|
||||
|
||||
if (!hivename || !*hivename || !prefix || !*prefix || !inputname || !*inputname) {
|
||||
usage(); exit(1);
|
||||
}
|
||||
|
||||
if (!(hive[no_hives] = openHive(hivename,HMODE_RW|mode))) {
|
||||
fprintf(stderr,"Unable to open/read hive %s, exiting..\n",hivename);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
import_reg(hive[no_hives], inputname, prefix);
|
||||
|
||||
no_hives++;
|
||||
update = 1;
|
||||
if (edit) regedit_interactive(hive, no_hives);
|
||||
edit = 0;
|
||||
|
||||
}
|
||||
|
||||
if (edit) { /* Call editor. Rest of arguments are considered hives to load */
|
||||
hivename = argv[optind+no_hives];
|
||||
do {
|
||||
if (!(hive[no_hives] = openHive(hivename,
|
||||
HMODE_RW|mode))) {
|
||||
printf("Unable to open/read a hive, exiting..\n");
|
||||
exit(1);
|
||||
}
|
||||
no_hives++;
|
||||
hivename = argv[optind+no_hives];
|
||||
} while (hivename && *hivename && no_hives < MAX_HIVES);
|
||||
regedit_interactive(hive, no_hives);
|
||||
update = 1;
|
||||
}
|
||||
|
||||
|
||||
if (update) { /* run for functions that can have changed things */
|
||||
printf("\nHives that have changed:\n # Name\n");
|
||||
for (il = 0; il < no_hives; il++) {
|
||||
if (hive[il]->state & HMODE_DIRTY) {
|
||||
if (!logchange && !autocommit) {
|
||||
printf("%2d <%s>",il,hive[il]->filename);
|
||||
if (hive[il]->state & HMODE_DIDEXPAND)
|
||||
printf(" WARNING: File was expanded! Experimental! Use at own risk!\n");
|
||||
printf("\n");
|
||||
}
|
||||
d = 1;
|
||||
}
|
||||
}
|
||||
if (d) {
|
||||
/* Only prompt user if logging of changed files has not been set */
|
||||
/* Thus we assume confirmations are done externally if they ask for a list of changes */
|
||||
if (!logchange && !autocommit) fmyinput("Commit changes to registry? (y/n) [n] : ",yn,3);
|
||||
if (*yn == 'y' || logchange || autocommit) {
|
||||
if (logchange) {
|
||||
ch = fopen("/tmp/changed","w");
|
||||
}
|
||||
for (il = 0; il < no_hives; il++) {
|
||||
if (hive[il]->state & HMODE_DIRTY) {
|
||||
printf("%2d <%s> - ",il,hive[il]->filename);
|
||||
if (!writeHive(hive[il])) {
|
||||
printf("OK ");
|
||||
if (hive[il]->state & HMODE_DIDEXPAND)
|
||||
printf(" WARNING: File was expanded! Experimental! Use at own risk!\n");
|
||||
printf("\n");
|
||||
if (logchange) fprintf(ch,"%s ",hive[il]->filename);
|
||||
dd = 2;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (logchange) {
|
||||
fprintf(ch,"\n");
|
||||
fclose(ch);
|
||||
}
|
||||
} else {
|
||||
printf("Not written!\n\n");
|
||||
}
|
||||
} else {
|
||||
printf("None!\n\n");
|
||||
}
|
||||
}
|
||||
while (no_hives > 0)
|
||||
closeHive(hive[--no_hives]);
|
||||
return(dd);
|
||||
}
|
||||
|
||||
+438
@@ -0,0 +1,438 @@
|
||||
The Offline NT Password Editor
|
||||
|
||||
(c) 1997-2011 Petter Nordahl-Hagen
|
||||
|
||||
Registry Editor Usermanual/docs
|
||||
|
||||
See COPYING for copyright & credits.
|
||||
See INSTALL for compile/installation instructions.
|
||||
See README for docs on the passwordpart (or website for bootdisk)
|
||||
|
||||
Some known limitations as of first half 2011:
|
||||
This release features full basic registry edit with
|
||||
add/del keys and values and resizing values, and also
|
||||
expanding the file.
|
||||
Renaming keys and values is not implemented yet.
|
||||
Import is slow. Export is fast.
|
||||
|
||||
Program "reged" is used for interactive registry edit
|
||||
(rudimentary command prompt type interface)
|
||||
or to export or import .reg files.
|
||||
Import and export can also be scripted (non-interactive)
|
||||
|
||||
The "chntpw" program which is for password edits, also
|
||||
contains the editor, but not the import / export.
|
||||
|
||||
Usage of "reged":
|
||||
|
||||
reged version 0.1 110504, (c) Petter N Hagen
|
||||
|
||||
Modes:
|
||||
-x <registryhivefile> <prefixstring> <key> <output.reg>
|
||||
Xport. Where <prefixstring> for example is HKEY_LOCAL_MACHINE\SOFTWARE
|
||||
<key> is key to dump (recursively), . or \ or \\ means all keys in hive
|
||||
Only one .reg and one hive file supported at the same time
|
||||
-I <registryhivefile> <prefixstring> <input.reg>
|
||||
Import from .reg file. Where <prefixstring> for example is HKEY_LOCAL_MACHINE\SOFTWARE
|
||||
Only one .reg and one hive file supported at the same time
|
||||
-e <registryhive> ...
|
||||
Interactive edit one or more of registry files
|
||||
|
||||
Options:
|
||||
-L : Log changed filenames to /tmp/changed, also auto-saves
|
||||
-C : Auto-save (commit) changed hives without asking
|
||||
-N : No allocate mode, only allow edit of existing values with same size
|
||||
-E : No expand mode, do not expand hive file (safe mode)
|
||||
-t : Debug trace of allocated blocks
|
||||
-v : Some more verbose messages
|
||||
|
||||
|
||||
-x will do export to .reg file.
|
||||
It will create files that seems to be compatible with regedit.exe in
|
||||
Windows.
|
||||
The prefix is the first part of the key names that windows shows/uses,
|
||||
it is not stored in the hive files, so you can actually put in
|
||||
anything unless you have to import in Windows.
|
||||
Current version only handles one set of files at a time (and also only
|
||||
one point to start export from in it)
|
||||
|
||||
-I does import of .reg files into the specified hive file.
|
||||
It supports .reg files from Windows regedit.exe, they are usually
|
||||
UTF-16 (16 bit characters) and in the few cases I tested it will
|
||||
import with correct characters. Please note that the key and value
|
||||
names always are 8 bit in the registry, but strings the values store
|
||||
are 16 bit characters.
|
||||
Will also work with latin-1 (8 bit) character files, like the export
|
||||
functions creates, but again some character conversions may be wrong.
|
||||
Note that the current versions are pretty slow, since they are not
|
||||
optimized or well written in any way. Around 90000 keys with 120000
|
||||
values just took around 10 minutes on my pretty fast machine.
|
||||
(I am lazy! You don't write hex reads with one byte at a time do you? :)
|
||||
|
||||
-e goes into interactive editor (see below for old example)
|
||||
-e can be combined with -I so that the editor is entered before saving
|
||||
-after an import.
|
||||
|
||||
-N and -E are safe modes, can be used with any mode.
|
||||
-C must be used when importing to auto-save, else it will ask first if
|
||||
import succeeds.
|
||||
The -L option will write changed hive file names to /tmp/changed,
|
||||
I use it for scripts that need to know.
|
||||
|
||||
|
||||
------------------------
|
||||
|
||||
|
||||
Here is an old demo of registry edit, via the chntpw program,
|
||||
but regedit is the same (except some new stuff is in there)
|
||||
|
||||
|
||||
You can navigate the registry almost like a filesystem (only difference
|
||||
being that the "files" actually are of a special datatype, instead of
|
||||
just a bytestream)
|
||||
Note that this demo is just some random editing, will likely
|
||||
cause windows to not boot if written back to it.
|
||||
|
||||
>chntpw -h
|
||||
chntpw version 0.99.0 030111, (c) Petter N Hagen
|
||||
chntpw: change password of a user in a NT SAM file, or invoke registry editor.
|
||||
chntpw [OPTIONS] <samfile> [systemfile] [securityfile] [otherreghive] [...]
|
||||
-h This message
|
||||
-u <user> Username to change, Administrator is default
|
||||
-l list all users in SAM file
|
||||
-i Interactive. List users (as -l) then ask for username to change
|
||||
-e Registry editor. Now with full write support!
|
||||
-d Enter buffer debugger instead (hex editor),
|
||||
-t Trace. Show hexdump of structs/segments. (deprecated debug function)
|
||||
-L Write names of changed files to /tmp/changed
|
||||
-N No allocation mode. Only (old style) same length overwrites possible
|
||||
|
||||
(example edit of a SYSTEM-hive)
|
||||
>chntpw -e system
|
||||
chntpw version 0.99.0 030111, (c) Petter N Hagen
|
||||
Hive's name (from header): <SYSTEM>
|
||||
ROOT KEY at offset: 0x001020
|
||||
This is probably not a sam HIVE
|
||||
Simple registry editor. ? for help.
|
||||
|
||||
[1020] > ?
|
||||
|
||||
Simple registry editor:
|
||||
hive [<n>] - list loaded hives or switch to hive numer n'
|
||||
cd <key> - change key
|
||||
ls | dir [<key>] - show subkeys & values,
|
||||
cat | type <value> - show key value
|
||||
st [<hexaddr>] - show struct info
|
||||
nk <keyname> - add key
|
||||
dk <keyname> - delete key (must be empty. recursion not supported yet)
|
||||
ed <value> - Edit value
|
||||
nv <type> <valuename> - Add value
|
||||
dv <valuename> - Delete value
|
||||
delallv - Delete all values in current key
|
||||
debug - enter buffer hexeditor
|
||||
q - quit
|
||||
|
||||
(list the contents of the current key)
|
||||
|
||||
[1020] > l
|
||||
ls of node at offset 0x1024
|
||||
Node has 6 subkeys and 0 values
|
||||
offs key name
|
||||
[ 11b8] <ControlSet001>
|
||||
[ dff88] <ControlSet002>
|
||||
[1c2040] <LastKnownGoodRecovery>
|
||||
[ de448] <MountedDevices>
|
||||
[ de998] <Select>
|
||||
[ deab8] <Setup>
|
||||
|
||||
(keynames & valuenames may be abbreviated, first match is used!)
|
||||
(also, it's case sensitive, but NT is not)
|
||||
|
||||
[1020] > cd Cont
|
||||
|
||||
[11b8] \ControlSet001> l
|
||||
ls of node at offset 0x11bc
|
||||
Node has 4 subkeys and 0 values
|
||||
offs key name
|
||||
[ 1348] <Control>
|
||||
[ 60628] <Enum>
|
||||
[ 80b60] <Hardware Profiles>
|
||||
[ 820f0] <Services>
|
||||
|
||||
[11b8] \ControlSet001>
|
||||
|
||||
[11b8] \ControlSet001> cd Ser
|
||||
|
||||
[820f0] \ControlSet001\Services> l
|
||||
ls of node at offset 0x820f4
|
||||
Node has 238 subkeys and 0 values
|
||||
offs key name
|
||||
[ 82148] <Abiosdsk>
|
||||
[ 82270] <abp480n5>
|
||||
[ 824b0] <ACPI>
|
||||
[ 82628] <ACPIEC>
|
||||
[ 82750] <adpu160m>
|
||||
....
|
||||
[ dcdc0] <WmiApSrv>
|
||||
[ dd228] <wuauserv>
|
||||
[ dd7d8] <WZCSVC>
|
||||
|
||||
[b92e0] \ControlSet001\Services\perc2> l
|
||||
ls of node at offset 0xb92e4
|
||||
Node has 1 subkeys and 4 values
|
||||
offs key name
|
||||
[ b9408] <Parameters>
|
||||
offs size type value name [value if type DWORD]
|
||||
[ b933c] 4 REG_DWORD <ErrorControl> 1 [0x1]
|
||||
[ b9364] 28 REG_SZ <Group>
|
||||
[ b93b4] 4 REG_DWORD <Start> 4 [0x4]
|
||||
[ b93d4] 4 REG_DWORD <Type> 1 [0x1]
|
||||
|
||||
[b92e0] \ControlSet001\Services\perc2> cat Group
|
||||
Value <Group> of type REG_SZ, data length 28 [0x1c]
|
||||
SCSI miniport
|
||||
|
||||
[b92e0] \ControlSet001\Services\perc2> ed Start
|
||||
EDIT: <Start> of type REG_DWORD with length 4 [0x4]
|
||||
DWORD: Old value 4 [0x4], enter new value (prepend 0x if hex, empty to keep old value)
|
||||
-> 1
|
||||
DWORD: New value 1 [0x1],
|
||||
|
||||
(seems like we just switched it on)
|
||||
|
||||
[b92e0] \ControlSet001\Services\perc2> cd \ControlSet001\Control\ServiceGroupOrder
|
||||
|
||||
(Multi strings are a bit awkward..)
|
||||
|
||||
[51048] \ControlSet001\Control\ServiceGroupOrder> ed List
|
||||
EDIT: <List> of type REG_MULTI_SZ with length 1948 [0x79c]
|
||||
[ 0]: System Reserved
|
||||
[ 1]: Boot Bus Extender
|
||||
[ 2]: System Bus Extender
|
||||
[ 3]: SCSI miniport
|
||||
[ 4]: Port
|
||||
...
|
||||
[52]: SpoolerGroup
|
||||
[53]: AudioGroup
|
||||
[54]: NetworkProvider
|
||||
[55]: RemoteValidation
|
||||
[56]: NetDDEGroup
|
||||
[57]: Parallel arbitrator
|
||||
[58]: Extended Base
|
||||
[59]: PCI Configuration
|
||||
[60]: MS Transactions
|
||||
|
||||
Now enter new strings, one by one.
|
||||
Enter nothing to keep old.
|
||||
'--n' to quit (remove rest of strings)
|
||||
'--i' insert new string at this point
|
||||
'--q' to quit (leaving remaining strings as is)
|
||||
'--Q' to quit and discard all changes
|
||||
'--e' for empty string in this position
|
||||
[ 0]: System Reserved
|
||||
->
|
||||
|
||||
(Basically, press just enter to keep string in that postition)
|
||||
(or enter something to overwrite that postion)
|
||||
(else give commands as described)
|
||||
|
||||
[ 0]: System Reserved
|
||||
->
|
||||
[ 1]: Boot Bus Extender
|
||||
->
|
||||
[ 2]: System Bus Extender
|
||||
->
|
||||
[ 3]: SCSI miniport
|
||||
-> SCSI megaport
|
||||
(This will replace the string "SCSI miniport" with "SCSI megaport",
|
||||
it will probably wreck things once NT boots :)
|
||||
[ 4]: Port
|
||||
-> --i
|
||||
[ 4]: [INSERT]
|
||||
-> SuperGroup
|
||||
(Inserts "SuperGroup" as string #4, rest is moved down one)
|
||||
[ 5]: Port
|
||||
->
|
||||
[ 6]: Primary Disk
|
||||
-> --e
|
||||
(Will clear the string in this position, empty string)
|
||||
[ 7]: SCSI Class
|
||||
-> --q
|
||||
(keep the rest as is)
|
||||
|
||||
|
||||
[51048] \ControlSet001\Control\ServiceGroupOrder> cd \ControlSet001\Control\SystemResources
|
||||
|
||||
[578a0] \ControlSet001\Control\SystemResources> cd Bu
|
||||
|
||||
[57f18] (...)\Control\SystemResources\BusValues> l
|
||||
ls of node at offset 0x57f1c
|
||||
Node has 0 subkeys and 11 values
|
||||
offs size type value name [value if type DWORD]
|
||||
[ 57f7c] 8 REG_BINARY <CBus>
|
||||
[ 57fac] 8 REG_BINARY <Eisa>
|
||||
[ 58914] 8 REG_BINARY <Internal>
|
||||
[ 58934] 8 REG_BINARY <Isa>
|
||||
[ 5897c] 8 REG_BINARY <MPI>
|
||||
[ 5899c] 8 REG_BINARY <MPSA>
|
||||
[ 589ec] 8 REG_BINARY <NuBus>
|
||||
[ 58a0c] 8 REG_BINARY <PCI>
|
||||
[ 589cc] 8 REG_BINARY <PCMCIA>
|
||||
[ 58a74] 8 REG_BINARY <TurboChannel>
|
||||
[ 58a3c] 8 REG_BINARY <VME>
|
||||
|
||||
[57f18] (...)\Control\SystemResources\BusValues> cat Internal
|
||||
Value <Internal> of type REG_BINARY, data length 8 [0x8]
|
||||
:00000 00 00 00 00 00 00 00 00 ........
|
||||
|
||||
[57f18] (...)\Control\SystemResources\BusValues> cat MPI
|
||||
Value <MPI> of type REG_BINARY, data length 8 [0x8]
|
||||
:00000 0A 00 00 00 00 00 00 00 ........
|
||||
|
||||
(and now for editing of binary or unhandled valuetypes)
|
||||
|
||||
[57f18] (...)\Control\SystemResources\BusValues> ed Internal
|
||||
EDIT: <Internal> of type REG_BINARY with length 8 [0x8]
|
||||
New length (ENTER to keep same):
|
||||
|
||||
(here you may enter a new size for the binary blob.
|
||||
new space will be filled with zero's)
|
||||
|
||||
Buffer debugger. '?' for help.
|
||||
.?
|
||||
d [<from>] [<to>] - dump buffer within range
|
||||
a [<from>] [<to>] - same as d, but without ascii-part (for cut'n'paste)
|
||||
: <offset> <hexbyte> [<hexbyte> ...] - change bytes
|
||||
h <from> <to> <hexbyte> [<hexbyte> ...] - hunt (search) for bytes
|
||||
ha <hexbyte> [<hexbyte] - Hunt all (whole buffer)
|
||||
s - save & quit
|
||||
q - quit (no save)
|
||||
instead of <hexbyte> etc. you may give 'string to enter/search a string
|
||||
.
|
||||
.d
|
||||
:00000 00 00 00 00 00 00 00 00 ........
|
||||
.:1 38 39
|
||||
from: 1, wlen: 2
|
||||
.d 0
|
||||
:00000 00 38 39 00 00 00 00 00 .89.....
|
||||
.:0 'edit
|
||||
from: 0, wlen: 4
|
||||
.d 0
|
||||
:00000 65 64 69 74 00 00 00 00 edit....
|
||||
|
||||
(now, s will save the value, q will throw away the changes)
|
||||
|
||||
.s
|
||||
|
||||
[6f00] (...)\Control\SystemResources\BusValues> cat Internal
|
||||
Value <Internal> of type REG_BINARY, data length 8 [0x8]
|
||||
:00000 68 61 68 61 00 00 00 00 haha....
|
||||
|
||||
[6f00] (...)\Control\SystemResources\BusValues> cd \
|
||||
|
||||
[1020] > l
|
||||
ls of node at offset 0x1024
|
||||
Node has 6 subkeys and 0 values
|
||||
offs key name
|
||||
[ 11b8] <ControlSet001>
|
||||
[ dff88] <ControlSet002>
|
||||
[1c2040] <LastKnownGoodRecovery>
|
||||
[ de448] <MountedDevices>
|
||||
[ de998] <Select>
|
||||
[ deab8] <Setup>
|
||||
|
||||
(now let's make a subkey here)
|
||||
|
||||
[1020] > nk DemoKey
|
||||
|
||||
[1020] > l
|
||||
ls of node at offset 0x1024
|
||||
Node has 7 subkeys and 0 values
|
||||
offs key name
|
||||
[ 11b8] <ControlSet001>
|
||||
[ dff88] <ControlSet002>
|
||||
[1c2ef8] <DemoKey>
|
||||
[1c2040] <LastKnownGoodRecovery>
|
||||
[ de448] <MountedDevices>
|
||||
[ de998] <Select>
|
||||
[ deab8] <Setup>
|
||||
|
||||
[1020] > cd DemoKey
|
||||
|
||||
[1c2ef8] \DemoKey> l
|
||||
ls of node at offset 0x1c2efc
|
||||
Node has 0 subkeys and 0 values
|
||||
|
||||
(it's empty. let's add a value)
|
||||
|
||||
[1c2ef8] \DemoKey> nv 1 test
|
||||
|
||||
(type 1 is string, 3 binary, 4 dword)
|
||||
(HINT: type "nv h" for help)
|
||||
|
||||
[1c2ef8] \DemoKey> l
|
||||
ls of node at offset 0x1c2efc
|
||||
Node has 0 subkeys and 1 values
|
||||
offs size type value name [value if type DWORD]
|
||||
[ e0144] 0 REG_SZ <test>
|
||||
|
||||
(well, never mind, delete it)
|
||||
|
||||
[1c2ef8] \DemoKey> dv test
|
||||
|
||||
[1c2ef8] \DemoKey> l
|
||||
ls of node at offset 0x1c2efc
|
||||
Node has 0 subkeys and 0 values
|
||||
|
||||
[1c2ef8] \DemoKey> cd ..
|
||||
|
||||
[1020] > l
|
||||
ls of node at offset 0x1024
|
||||
Node has 7 subkeys and 0 values
|
||||
offs key name
|
||||
[ 11b8] <ControlSet001>
|
||||
[ dff88] <ControlSet002>
|
||||
[1c2ef8] <DemoKey>
|
||||
[1c2040] <LastKnownGoodRecovery>
|
||||
[ de448] <MountedDevices>
|
||||
[ de998] <Select>
|
||||
[ deab8] <Setup>
|
||||
|
||||
(and delete the key)
|
||||
|
||||
[1020] > dk DemoKey
|
||||
|
||||
[1020] > l
|
||||
ls of node at offset 0x1024
|
||||
Node has 6 subkeys and 0 values
|
||||
offs key name
|
||||
[ 11b8] <ControlSet001>
|
||||
[ dff88] <ControlSet002>
|
||||
[1c2040] <LastKnownGoodRecovery>
|
||||
[ de448] <MountedDevices>
|
||||
[ de998] <Select>
|
||||
[ deab8] <Setup>
|
||||
|
||||
(list hives loaded, only one this time)
|
||||
|
||||
[1020] > h
|
||||
* D 0 2097152 0x00200000 <system>
|
||||
^ ^ hive# size(dec) size(hex) name
|
||||
| |
|
||||
| |--- Hive dirty flag.
|
||||
|
|
||||
|--- Current hive, being edited.
|
||||
|
||||
(hive 2 will change to hive #2 listed and so on..)
|
||||
|
||||
(now, let's quit)
|
||||
|
||||
[57f18] (...)\Control\SystemResources\BusValues> q
|
||||
|
||||
Hives that have changed:
|
||||
# Name
|
||||
0 <system>
|
||||
Write hive files? (y/n) [n] : y
|
||||
0 <system> - OK
|
||||
|
||||
(done)
|
||||
@@ -0,0 +1,222 @@
|
||||
/*
|
||||
* sam.h - known structures in the SAM hive of NT registry
|
||||
*
|
||||
*****
|
||||
*
|
||||
* NTREG - Window registry file reader / writer library
|
||||
* Copyright (c) 1997-2011 Petter Nordahl-Hagen.
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU Lesser General Public
|
||||
* License as published by the Free Software Foundation;
|
||||
* version 2.1 of the License.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* Lesser General Public License for more details.
|
||||
* See file LGPL.txt for the full license.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef _INCLUDE_SAM_H
|
||||
#define _INCLUDE_SAM_H 1
|
||||
|
||||
#include <sys/types.h>
|
||||
#include <inttypes.h>
|
||||
|
||||
/* This contains some policy settings for the account database */
|
||||
|
||||
#define ACCOUNTDB_F_PATH "\\SAM\\Domains\\Account\\F"
|
||||
|
||||
|
||||
struct accountdb_F {
|
||||
char unknown1[8]; /* 0 */
|
||||
char unknown2[8]; /* 8 */
|
||||
uint32_t updatecnt; /* 10 Number of times policy data updated */
|
||||
char unknown3[4]; /* 14 */
|
||||
char t_maxpwage[8]; /* 18 Maximum password age, GUI shows only days */
|
||||
char t_minpwage[8]; /* 20 Minimum password age, GUI shows only days */
|
||||
char unknown4[8]; /* 28 */
|
||||
char t_lockdur[8]; /* 30 Account lockout duration, GUI shows minutes */
|
||||
char t_lockrel[8]; /* 38 Release account lockout after, GUI show minutes */
|
||||
char unknown5[8]; /* 40 */
|
||||
uint32_t rid; /* 48 RID of user doing last edit? */
|
||||
uint32_t flags; /* 4c Some flags & options, see below */
|
||||
unsigned short minpwlen; /* 50 Minimum password lenght */
|
||||
unsigned short numhist; /* 52 How many passwords to keep in history */
|
||||
unsigned short locklimit; /*54 How many tries before lockout */
|
||||
char unknown6[0x9a]; /* Rest is unknown */
|
||||
}; /* Total size 0xF0 bytes, seems to be constant */
|
||||
|
||||
/* Known bits in flags field */
|
||||
|
||||
#define ACF_COMPLEX 0x0001 /* Pass must meet complexity req. */
|
||||
#define ACF_REVERSIBLE 0x0010 /* Store password using reversible encryption */
|
||||
|
||||
|
||||
/* This is users F value, contains account type & state etc */
|
||||
|
||||
#define USER_F_PATH "\\SAM\\Domains\\Account\\Users\\%08X\\F"
|
||||
|
||||
struct user_F {
|
||||
char unknown1[8];
|
||||
char t_lockout[8]; /* Time of lockout */
|
||||
char unknown2[8];
|
||||
char t_creation[8]; /* Time of account creation */
|
||||
char unknown3[8];
|
||||
char t_login[8]; /* Time of last login */
|
||||
int32_t rid;
|
||||
char unknown4[4];
|
||||
unsigned short ACB_bits; /* Account type and status flags */
|
||||
char unknown5[6];
|
||||
unsigned short failedcnt; /* Count of failed logins, if > than policy it is locked */
|
||||
unsigned short logins; /* Total logins since creation */
|
||||
char unknown6 [0xc];
|
||||
};
|
||||
|
||||
#define ACB_DISABLED 0x0001 /* Act disabled */
|
||||
#define ACB_HOMDIRREQ 0x0002 /* Home directory required */
|
||||
#define ACB_PWNOTREQ 0x0004 /* User password not req */
|
||||
#define ACB_TEMPDUP 0x0008 /* Temporary duplicate account?? */
|
||||
#define ACB_NORMAL 0x0010 /* Normal user account */
|
||||
#define ACB_MNS 0x0020 /* MNS logon user account */
|
||||
#define ACB_DOMTRUST 0x0040 /* Interdomain trust account */
|
||||
#define ACB_WSTRUST 0x0080 /* Workstation trust account */
|
||||
|
||||
#define ACB_SVRTRUST 0x0100 /* Server trust account */
|
||||
#define ACB_PWNOEXP 0x0200 /* User password does not expire */
|
||||
/* Seems not to be used on failed console logins at least */
|
||||
#define ACB_AUTOLOCK 0x0400 /* Account auto locked */
|
||||
|
||||
char *acb_fields[16] = {
|
||||
"Disabled" ,
|
||||
"Homedir req." ,
|
||||
"Passwd not req." ,
|
||||
"Temp. duplicate" ,
|
||||
"Normal account" ,
|
||||
"NMS account" ,
|
||||
"Domain trust act." ,
|
||||
"Wks trust act." ,
|
||||
"Srv trust act" ,
|
||||
"Pwd don't expire" ,
|
||||
"Auto lockout" ,
|
||||
"(unknown 0x08)" ,
|
||||
"(unknown 0x10)" ,
|
||||
"(unknown 0x20)" ,
|
||||
"(unknown 0x40)" ,
|
||||
"(unknown 0x80)" ,
|
||||
};
|
||||
|
||||
/* Users V data struct */
|
||||
/* First 0xCC bytes is pointer & len table, rest is data which
|
||||
* the table points to
|
||||
* String data is unicode, not zero terminated (must use len)
|
||||
*/
|
||||
|
||||
struct user_V {
|
||||
|
||||
int unknown1_1; /* 0x00 - always zero? */
|
||||
int unknown1_2; /* 0x04 - points to username? */
|
||||
int unknown1_3; /* 0x08 - always 0x02 0x00 0x01 0x00 ? */
|
||||
|
||||
int username_ofs; /* 0x0c */
|
||||
int username_len; /* 0x10 */
|
||||
|
||||
int unknown2_1; /* 0x14 - always zero? */
|
||||
|
||||
int fullname_ofs; /* 0x18 */
|
||||
int fullname_len; /* 0x1c */
|
||||
|
||||
int unknown3_1; /* 0x20 - always zero? */
|
||||
|
||||
int comment_ofs; /* 0x24 */
|
||||
int comment_len; /* 0x28 */
|
||||
|
||||
int unknown4_1; /* 0x2c - alway zero? */
|
||||
int unknown4_2; /* 0x30 - points 4 or 8 byte field before hashes */
|
||||
int unknown4_3; /* 0x34 - zero? or size? */
|
||||
int unknown4_4; /* 0x38 - zero? */
|
||||
int unknown4_5; /* 0x3c - to field 8 bytes before hashes */
|
||||
int unknown4_6; /* 0x40 - zero? or size of above? */
|
||||
int unknown4_7; /* 0x44 - zero? */
|
||||
|
||||
int homedir_ofs; /* 0x48 */
|
||||
int homedir_len; /* 0x4c */
|
||||
|
||||
int unknown5_1; /* 0x50 - zero? */
|
||||
|
||||
int drvletter_ofs; /* 0x54 - drive letter for home dir */
|
||||
int drvletter_len; /* 0x58 - len of above, usually 4 */
|
||||
|
||||
int unknown6_1; /* 0x5c - zero? */
|
||||
|
||||
int logonscr_ofs; /* 0x60 - users logon script path */
|
||||
int logonscr_len; /* 0x64 - length of string */
|
||||
|
||||
int unknown7_1; /* 0x68 - zero? */
|
||||
|
||||
int profilep_ofs; /* 0x6c - profile path string */
|
||||
int profilep_len; /* 0x70 - profile path stringlen */
|
||||
|
||||
char unknown7[0x90-0x74]; /* 0x74 */
|
||||
|
||||
int unknown8_1; /* 0x90 - pointer to some place before hashes, after comments */
|
||||
int unknown8_2; /* 0x94 - size of above? */
|
||||
int unknown8_3; /* 0x98 - unknown? always 1? */
|
||||
|
||||
int lmpw_ofs; /* 0x9c */
|
||||
int lmpw_len; /* 0xa0 */
|
||||
|
||||
int unknown9_1; /* 0xa4 - zero? */
|
||||
|
||||
int ntpw_ofs; /* 0xa8 */
|
||||
int ntpw_len; /* 0xac */
|
||||
|
||||
int unknowna_1; /* 0xb0 */
|
||||
int unknowna_2; /* 0xb4 - points to field after hashes */
|
||||
int unknowna_3; /* 0xb8 - size of above field */
|
||||
int unknowna_4; /* 0xbc - zero? */
|
||||
int unknowna_5; /* 0xc0 - points to field after that */
|
||||
int unknowna_6; /* 0xc4 - size of above */
|
||||
int unknowna_7; /* 0xc8 - zero ? */
|
||||
|
||||
char data[4]; /* Data starts here. All pointers above is relative to this,
|
||||
that is V + 0xCC */
|
||||
|
||||
};
|
||||
|
||||
/* Groups C data struct
|
||||
* First 0x34 bytes is pointer & len table, rest is data which
|
||||
* the table points to
|
||||
* String data is unicode, not zero terminated (must use len)
|
||||
*/
|
||||
|
||||
struct group_C {
|
||||
|
||||
int groupid; /* 0x00 - Seems to be the group ID */
|
||||
int unknown1_1; /* 0x04 - always zero? */
|
||||
int unknown1_2; /* 0x08 - points to groupname? */
|
||||
int unknown1_3; /* 0x0c - always 0x02 0x00 0x01 0x00 ? */
|
||||
|
||||
int grpname_ofs; /* 0x10 */
|
||||
int grpname_len; /* 0x14 */
|
||||
|
||||
int unknown2_1; /* 0x18 - always zero? */
|
||||
|
||||
int fullname_ofs; /* 0x1c */
|
||||
int fullname_len; /* 0x20 */
|
||||
|
||||
int unknown3_1; /* 0x24 - always zero? */
|
||||
int unknown3_2; /* 0x28 - always zero? */
|
||||
int unknown3_3; /* 0x2c - always zero? */
|
||||
|
||||
int grp_members; /* 0x30 - number of group members */
|
||||
|
||||
/* 0x34 - data starts here. pointers above are offset from this */
|
||||
|
||||
char data[];
|
||||
|
||||
};
|
||||
|
||||
#endif
|
||||
+124
@@ -0,0 +1,124 @@
|
||||
The Offline NT Password Editor
|
||||
|
||||
(c) 1997-2002 Petter Nordahl-Hagen
|
||||
|
||||
Update: 08 dec 2002
|
||||
|
||||
What happens when syskey is installed, and how to get rid of it
|
||||
---------------------------------------------------------------
|
||||
|
||||
Background:
|
||||
-----------
|
||||
|
||||
Syskey was added to NT with Service Pack 3 as a way to prevent easy
|
||||
access to the actual password hashes in the SAM (Security Accounts Manager)
|
||||
The original methods of making and storing the hashes makes it
|
||||
rather easy to bruteforce or dictionary-attack it to find the plaintext
|
||||
passwords. (mostly caused by a somewhat flawed implementation & use
|
||||
of the cryptoalgorithms involved, but that's discussed elsewhere)
|
||||
Enabling syskey is optional, the administrator must run syskey.exe and
|
||||
answer some dialog-boxes to turn it on. On Windows 2000 it's not optional
|
||||
anymore, it's enabled by default at installation time.
|
||||
|
||||
When syskey is active, the hashes are encrypted/obfuscated yet
|
||||
another time before being stored in the SAM registry.
|
||||
However, they're stored in the old form in memory after boot
|
||||
(pwdump2 demonstrates this),
|
||||
since the old form is needed for NTLM authentication on the network etc.
|
||||
|
||||
The key that obfuscates the hashes, or rather it looks like something
|
||||
that decrypts the key, can be stored on floppy, generated from a
|
||||
passphrase to be entered at boot, or stored (obfuscated again) in
|
||||
the registry.
|
||||
|
||||
There's no official supported method to switch off syskey
|
||||
once activated, except restoring the registry from a rescuefloppy
|
||||
made before activation of syskey.
|
||||
|
||||
So.. what's this got to do with my utility?
|
||||
-------------------------------------------
|
||||
|
||||
My utility doesn't try to crack passwords, it puts new hashes into
|
||||
the SAM, thus changing a users password. And it does this offline.
|
||||
Syskey was a showstopper for this.
|
||||
As far as I can see, there's 2 ways to solve this:
|
||||
|
||||
1) Find the key in registry, get user to enter it, or get hold of floppy
|
||||
then use the syskey on the new password too. However, it's not documented
|
||||
and I haven't found any reverse engineering of it anyplace.
|
||||
|
||||
2) Try to turn it off. This has one drawback, and one good side:
|
||||
Bad: all passwords must be reset, since the old hashes will be invalid.
|
||||
VeryBAD: SWITHCHING OFF IN WINDOWS 2000 AND XP NOT PERFECT,
|
||||
WILL CAUSE TROUBLE, but you can access the computer
|
||||
afterwards. Domain relationships & syskey may be
|
||||
impossible to change after this, requiring a reinstall
|
||||
(or possibly only an upgrade)
|
||||
Good: There's no need for the key (which may be lost).
|
||||
|
||||
3) (NEW 2000-04-01, no, not a joke) Insert old styles password-hashes
|
||||
into the SAM, will be converted to syskey-hashes on next boot.
|
||||
This is how syskey is enabled on NT4, the hashes won't be touched
|
||||
until the first reboot after turning on syskey.
|
||||
|
||||
I've found out how to do #2 and #3.
|
||||
|
||||
What happens when syskey is turned on, and how to turn it off again:
|
||||
--------------------------------------------------------------------
|
||||
|
||||
- 1 -
|
||||
Serveral new keys are added to HKLM\System\CurrentControlSet\Control\Lsa,
|
||||
it seems that most of the keys/values is used for the obfuscation of the key
|
||||
they change when syskey is updated.
|
||||
However the value named 'SecureBoot' holds the mode of syskey:
|
||||
1 - Key in registry
|
||||
2 - Enter passphrase
|
||||
3 - Key on floppy
|
||||
|
||||
But removing this key (or setting it to 0) isn't enough to disable
|
||||
syskey. There's more..
|
||||
|
||||
- 2 -
|
||||
HKLM\SAM\Domains\Account\F is a binary structure usually containing the computer
|
||||
SID and some other stuff related to that.
|
||||
When syskey is installed it's expanded (about twice the size), with something
|
||||
I guess is the key heavily encrypted + some flags and other values.
|
||||
One of these other flag/values also contains the same mode as SecureBoot above.
|
||||
|
||||
So.. resetting this mode flag and SecureBoot to 0 is all that's needed
|
||||
to switch off syskey in NT4 (up to SP6 at time of writing). Changing only one of them
|
||||
results in a warning about inconsistencies between the SAM and system settings
|
||||
on completed boot, and syskey is re-invoked.
|
||||
|
||||
- 3 -
|
||||
On Windows 2000 there's yet another place info about syskey is stored:
|
||||
|
||||
HKLM\security\Policy\PolSecretEncryptionKey\<default>
|
||||
which also is a binary structure, but also there the mode is stored.
|
||||
Reset this to 0, and syskey is gone on win2k.
|
||||
(if there's a mismatch between the three, it silently resets them
|
||||
to the most likely value on boot)
|
||||
|
||||
- 4 -
|
||||
Then there's the password hashes.
|
||||
The usual (old) hashlength is 16 bytes, but all hashes are expanded to 20 bytes
|
||||
with syskey, the first 4 bytes looks like some kind of counter. (maybe
|
||||
history-counter?).
|
||||
Strangely, they're not updated at once when syskey is turned on,
|
||||
update of the hashes happens during next reboot after syskey has been turned on.
|
||||
And when the key is later updated, the hashes are also updated?
|
||||
NO!! Strangely it SEEMS like the password hashes REMAINS THE SAME!
|
||||
(however, the binaries in the 3 keys noted above changes..)
|
||||
I'll try to dig more into this. Help wanted :)
|
||||
|
||||
When syskey has been switched off, all passwords must be reset.
|
||||
My utility will write and adjust hash-lengths of the users (usually
|
||||
administrator) that you reset the password for.
|
||||
NT itself will fix the rest of the hashes when you set new passwords
|
||||
from NT.
|
||||
|
||||
And yes, it's possible to re-enable syskey after turning it off.
|
||||
(not on win2k, yet!)
|
||||
|
||||
So, anybody reverse engineered the whole syskeystuff?
|
||||
(yes, I know something's on it's way..)
|
||||
Reference in New Issue
Block a user