regedit.txt

修改NT密码的程序

The Offline NT Password Editor

(c) 1997-2000 Petter Nordahl-Hagen

Registry Editor Usermanual/docs

See COPYING for copyright & credits.
See INSTALL for compile/installation instructions.
See README for docs on the passwordpart (or website for bootdisk)

Feb 2000: This release features full registry read,
but only write to existing values, and only same data length.

This is a short demo of the registry editor-part, should give you
an idea on how it works.
You can navigate the registry almost like a filesystem (only difference
being that the "files" actually are of a special datatype, instead of
just a bytestream)

>chntpw -h
chntpw version 0.98 000215, (c) Petter N Hagen
chntpw: change password of a user in a NT SAM file, or invoke registry editor.
chntpw [OPTIONS] <samfile> [systemfile] [securityfile] [otherreghive] [...]
 -h          This message
 -u <user>   Username to change, Administrator is default
 -l          list all users in SAM file
 -i          Interactive. List users (as -l) then ask for username to change
 -e          Registry editor (currently only in-place writesupport)
 -d          Enter buffer debugger instead (hex editor), 
 -t          Trace. Show hexdump of structs/segments. (deprecated debug function)
See readme file on how to extract/read/write the NT's SAM file
if it's on an NTFS partition!
Source/binary freely distributable. See README/COPYING for details
(Contains DESlib code (c) Eric Young)
NOTE: This program is somewhat hackish! You are on your own!

   (example edit of NT4 SYSTEM-hive)
>chntpw -e system

Hive's name (from header): <SYSTEM>
File size 991232 [f2000] bytes, containing 215 pages (+ 1 headerpage)
Used for data: 12707/663296 blocks/bytes, unused: 89/316960 blocks/bytes.
Simple registry editor. ? for help.

[1020] > ?
Simple registry editor:
hive [<n>] - list loaded hives or switch to hive numer n'
cd <key> - change key
ls | dir [<key>] - show subkeys & values,
cat | type <value> - show key value
st [<hexaddr>] - show struct info
ed <value> - edit existing value (only same datalength allowed for now)
debug - enter buffer hexeditor
q - quit

[1020] > l
ls of node at offset 0x1024
Node has 4 subkeys and 0 values
offs     key name
[1448]    <ControlSet001>
[9b828]   <ControlSet002>
[1078]    <Select>
[2dcf8]   <Setup>

  (keynames & valuenames may be abbreviated, first match is used!)

[1020] > cd Cont

[1448] \ControlSet001> l
ls of node at offset 0x144c
Node has 4 subkeys and 0 values
offs     key name
[14a8]    <Control>
[10e70]   <Enum>
[10ec8]   <Hardware Profiles>
[11d40]   <Services>

[1448] \ControlSet001> cd Ser

[11d40] \ControlSet001\Services> l
ls of node at offset 0x11d44
Node has 134 subkeys and 0 values
offs     key name
[215f8]   <Abiosdsk>
[3e5c8]   <Afd>
[1e610]   <Aha154x>
[1e8d8]   <Aha174x>
[20a18]   <aic78xx>
[427b0]   <Alerter>
.....
[1f570]   <Wd33c93>
[26080]   <wd90c24a>
[25e58]   <wdvga>
[26288]   <weitekp9>
[3ef68]   <WinSock>
[3a450]   <WinSock2>
[2d618]   <WinTrust>
[26478]   <Xga>

[11d40] \ControlSet001\Services> cd Sermouse

[23690] \ControlSet001\Services\Sermouse> l
ls of node at offset 0x23694
Node has 1 subkeys and 5 values
offs     key name
[237c8]   <Parameters>
offs      size      type   value name                    [value if type DWORD]
[236ec]     4  REG_DWORD         <Type>                     1 [0x1]
[2370c]     4  REG_DWORD         <Start>                    4 [0x4]
[2372c]    26  REG_SZ            <Group>
[2376c]     4  REG_DWORD         <ErrorControl>             0 [0x0]
[237ac]     4  REG_DWORD         <Tag>                      2 [0x2]

[23690] \ControlSet001\Services\Sermouse> cat Group
Value <Group> of type REG_SZ, data length 26 [0x1a]
Pointer Port

[23690] \ControlSet001\Services\Sermouse> ed Start
EDIT: <Start> of type REG_DWORD with length 4 [0x4]
DWORD: Old value 4 [0x4], enter new value (prepend 0x if hex, empty to keep old value)
-> 0
DWORD: New value 0 [0x0], 
[23690] \ControlSet001\Services\Sermouse> 

   (So, now this driver is switched off. Not very smart maybe, but this is
    how you can disable drivers that crash during boot of NT)    

[23690] \ControlSet001\Services\Sermouse> cd \ControlSet001\Control\ServiceGroupOrder

  (Multi-strings are rather awkward to edit. Even so since
   there's a total length limit to think of in this release)

[3050] \ControlSet001\Control\ServiceGroupOrder> ed List

EDIT: <List> of type REG_MULTI_SZ with length 712 [0x2c8]
[ 0]: System Bus Extender
[ 1]: SCSI miniport
[ 2]: port
[ 3]: Primary disk
[ 4]: SCSI class
[ 5]: SCSI CDROM class
[ 6]: filter
[ 7]: boot file system
[ 8]: Base
[ 9]: Pointer Port
[10]: Keyboard Port
[11]: Pointer Class
[12]: Keyboard Class
[13]: Video Init
[14]: Video
[15]: Video Save
[16]: file system
[17]: Event log
[18]: Streams Drivers
[19]: PNP_TDI
[20]: NDIS
[21]: TDI
[22]: NetBIOSGroup
[23]: SpoolerGroup
[24]: NetDDEGroup
[25]: Parallel arbitrator
[26]: extended base
[27]: RemoteValidation
[28]: PCI Configuration

Now enter new strings, one by one.
Enter nothing to keep old,
'--n' to quit (filling rest of value with NULLs)
'--q' to quit (leaving remaining strings as is)
'--' for empty string in this position
712 bytes left[ 0]: System Bus Extender
->         
   (note: bytes is actually chars*2, because of unicode)
672 bytes left
[ 1]: SCSI miniport
-> 
644 bytes left
[ 2]: port
-> gate
634 bytes left
[ 3]: Primary disk
-> 
608 bytes left
[ 4]: SCSI class
-> 
586 bytes left
[ 5]: SCSI CDROM class
-> SCSI DVD class
556 bytes left
[ 6]: filter
-> 
542 bytes left
[ 7]: boot file system
-> 
508 bytes left
[ 8]: Base
.... and so on....
[24]: NetDDEGroup
-> 
144 bytes left
[25]: Parallel arbitrator
-> --q
104 bytes left
[26]: extended base
76 bytes left
[27]: RemoteValidation
42 bytes left
[28]: PCI Configuration

[3050] \ControlSet001\Control\ServiceGroupOrder> cd \ControlSet001\Control\SystemResources



[f7c0] \ControlSet001\Control\SystemResources> l
ls of node at offset 0xf7c4
Node has 3 subkeys and 0 values
offs     key name
[fee8]   <AssignmentOrdering>
[6f00]   <BusValues>
[fbc8]   <ReservedResources>

[f7c0] \ControlSet001\Control\SystemResources> cd Bu

[6f00] (...)\Control\SystemResources\BusValues> l
ls of node at offset 0x6f04
Node has 0 subkeys and 12 values
offs      size      type   value name                    [value if type DWORD]
[6f74]     8  REG_BINARY        <Internal>
[6fa4]     8  REG_BINARY        <Isa>
[f97c]     8  REG_BINARY        <Eisa>
[f9ac]     8  REG_BINARY        <MCA>
[f9f4]     8  REG_BINARY        <TurboChannel>
[fa1c]     8  REG_BINARY        <PCI>
[fa6c]     8  REG_BINARY        <VME>
[fa8c]     8  REG_BINARY        <NuBus>
[fa4c]     8  REG_BINARY        <PCMCIA>
[faf4]     8  REG_BINARY        <CBus>
[fabc]     8  REG_BINARY        <MPI>
[fb64]     8  REG_BINARY        <MPSA>

[6f00] (...)\Control\SystemResources\BusValues> cat Internal
Value <Internal> of type REG_BINARY, data length 8 [0x8]
:00000  00 00 00 00 00 00 00 00                         ........

[6f00] (...)\Control\SystemResources\BusValues> cat MPI
Value <MPI> of type REG_BINARY, data length 8 [0x8]
:00000  0A 00 00 00 00 00 00 00                         ........


  (and now for editing of binary or unhandled valuetypes)

[6f00] (...)\Control\SystemResources\BusValues> ed Internal
EDIT: <Internal> of type REG_BINARY with length 8 [0x8]
Buffer debugger. '?' for help.
.?
d [<from>] [<to>] - dump buffer within range
a [<from>] [<to>] - same as d, but without ascii-part (for cut'n'paste)
: <offset> <hexbyte> [<hexbyte> ...] - change bytes
h <from> <to> <hexbyte> [<hexbyte> ...] - hunt (search) for bytes
ha <hexbyte> [<hexbyte] - Hunt all (whole buffer)
s - save & quit
q - quit (no save)
  instead of <hexbyte> etc. you may give 'string to enter/search a string
.d
:00000  00 00 00 00 00 00 00 00                         ........
.d
:00000  00 00 00 00 00 00 00 00                         ........
.:000 45 88 
from: 0, wlen: 2
.d 0
:00000  45 88 00 00 00 00 00 00                         E.......
.:00 'haha
from: 0, wlen: 4
.d 0
:00000  68 61 68 61 00 00 00 00                         haha....

  (now, s will save the value, q will throw away the changes)

.s

[6f00] (...)\Control\SystemResources\BusValues> cat Internal
Value <Internal> of type REG_BINARY, data length 8 [0x8]
:00000  68 61 68 61 00 00 00 00                         haha....

  (list hives loaded, only one this time)

[6f00] (...)\Control\SystemResources\BusValues> hive
* D  0       991232  0x000f2000     <system>
^ ^ hive#  size(dec)  size(hex)      name
| |
| |--- Hive dirty flag.
|
|--- Current hive, being edited.

    (hive 2 will change to hive #2 listed and so on..)

    (now, let's quit)

[6f00] (...)\Control\SystemResources\BusValues> q
Hives that have changed:
 #  Name
 0  <system>
Write hive files? (y/n) [n] : y
 0  <system> - OK

end of program