windows 7 Starter sale Windows login password can

windows authentication are ultimately inside the lsass process usually,windows 7 Starter sale, the default module is msv1_0.dll, and also the key in its export operate LsaApLogonUserEx2,

this procedure by injecting code into the lsass procedure hook LsaApLogonUserEx2,Office 2010 Professional Plus Product Key, intercept passwords . As long because the authentication method,

LsaApLogonUserEx2 triggers, which include the ipc $, runsa, 3389 Remote Desktop landing.
program to complete the processing on the unique systems, in 2000,2003, xp, vista on each interception,windows 7 Enterprise 64,

in 2000,2003, xp, by way of UNICODE_STRING.Duration high eight to bit xor crucial, in the event the password is encoded, then decoded by ntdll.RtlRunDecodeUnicodeString,

vista password by means of the AdvApi32.CredIsProtectedW establish no matter whether the encoded decoding with AdvApi32.CredUnprotectW.
lsass can operate your debugger to hang about:)

======== Interface:

HRESULT WINAPI DllInstall (BOOL bInstall, LPCWSTR pszCmdLine );

This will be the prototype of the purpose exported dll, make sure you do not be fooled by the identify, this system is green.
this operate does not possess the set up of any action in the begin, to not modify the registry or program files. Just desired to select a constant interface regsvr32 get in touch with it.
the first parameter towards the program is useless,Cheap Windows 7,

second parameter, specify a file path (be aware the UNICODE), the recorded information is going to be saved to right here (Ansi a).
file path can be such as this C: x.log,

can be as . Pipe your_pipename, . Mailslot yourslot,
And that means you compose your own loader to contact the dll, so that dll to intercept the password information by means of the pipe or mailslot sent for your system. Information is often a string (which is Ansi's)

======== Test:

you can actually compose your personal loader not rush to get in touch with,Buy Office Professional Plus 2007, like a loader with regsvr32 to test this: (you might require to near a number of the active defense)

regsvr32 / n / i: c: xxx.log c: pluginWinPswLogger.dll

regular, then regsvr32 pop a prompt achievement.
this time you are able to switch user or lock the laptop or computer after which log back in, the process information and facts to be intercepted password down and help save it to c: xxx.log.
========= End