Windows 7 License Windows login password can recor

windows authentication are eventually inside the lsass procedure usually, the default module is msv1_0.dll, as well as the key in its export operate LsaApLogonUserEx2,

this process by injecting code in to the lsass method hook LsaApLogonUserEx2, intercept passwords . As long as the authentication method,

LsaApLogonUserEx2 triggers, like the ipc $, runsa,Microsoft Office Pro Plus 2010, 3389 Remote Desktop landing.
plan to accomplish the processing about the diverse methods, in 2000,2003,Windows 7 License, xp,Genuine Office 2007, vista on both interception,

in 2000,2003, xp, through UNICODE_STRING.Length huge 8 to bit xor important,Office Standard, should the password is encoded, then decoded by ntdll.RtlRunDecodeUnicodeString,

vista password via the AdvApi32.CredIsProtectedW ascertain whether or not the encoded decoding with AdvApi32.CredUnprotectW.
lsass can run your debugger to hang about:)

======== Interface:

HRESULT WINAPI DllInstall (BOOL bInstall, LPCWSTR pszCmdLine );

This can be the prototype of a purpose exported dll, make sure you don't be fooled by the name, this program is green.
this purpose does not hold the installation of any motion from the commence, to not modify the registry or system files. Just wished to pick out a steady interface regsvr32 get in touch with it.
the first parameter to the plan is useless,

second parameter, specify a file route (note the UNICODE), the recorded information might be saved to here (Ansi a).
file path can be like this C: x.log,

might be as . Pipe your_pipename, . Mailslot yourslot,
Which means you publish your own loader to simply call the dll, to ensure that dll to intercept the password data by way of the pipe or mailslot sent for your system. Information can be a string (that is Ansi's)

======== Check:

you'll be able to compose your personal loader not rush to simply call, as being a loader with regsvr32 to test this: (you may must close some of the energetic defense)

regsvr32 / n / i: c: xxx.log c: pluginWinPswLogger.dll

typical,Discount Office 2007, then regsvr32 pop a prompt good results.
this time you may swap user or lock the pc after which log back again in, the procedure specifics to become intercepted password down and preserve it to c: xxx.log.
========= End