Context Menu ... Directory Identifiers MSDM Product Key Reader WPBT Command Line Reader Environment Viewer Easter Date Calculator •
CONTEXT.REG
to display its context menu and click Mergeto import it into the registry of your user account.
REGEDIT4
; Copyright © 2004-2024, Stefan Kanthak <stefan.kanthak@nexgo.de>
[HKEY_CURRENT_USER\Software\Classes\*\Shell\Cmdline]
@="ProgId '*'"
[HKEY_CURRENT_USER\Software\Classes\*\Shell\Cmdline\Command]
@="C:\\Windows\\System32\\Cmd.exe /V:ON /K Echo Command Line: && Echo !CMDCMDLINE! && Echo. && Echo Arguments: && Echo *=%* && Echo 0=%0 && Echo 1=%1 && Echo 2=%2 && Echo D=%D && Echo H=%H && Echo I=%I && Echo L=%L && Echo S=%S && Echo V=%V && Echo W=%W"
[HKEY_CURRENT_USER\Software\Classes\.\Shell\Cmdline]
@="ProgId '.'"
[HKEY_CURRENT_USER\Software\Classes\.\Shell\Cmdline\Command]
@="C:\\Windows\\System32\\Cmd.exe /V:ON /K Echo Command Line: && Echo !CMDCMDLINE! && Echo. && Echo Arguments: && Echo *=%* && Echo 0=%0 && Echo 1=%1 && Echo 2=%2 && Echo D=%D && Echo H=%H && Echo I=%I && Echo L=%L && Echo S=%S && Echo V=%V && Echo W=%W"
[HKEY_CURRENT_USER\Software\Classes\DesktopBackground\Shell\Cmdline]
@="ProgId 'DesktopBackground'"
[HKEY_CURRENT_USER\Software\Classes\DesktopBackground\Shell\Cmdline\Command]
@="C:\\Windows\\System32\\Cmd.exe /V:ON /K Echo Command Line: && Echo !CMDCMDLINE! && Echo. && Echo Arguments: && Echo *=%* && Echo 0=%0 && Echo 1=%1 && Echo 2=%2 && Echo D=%D && Echo H=%H && Echo I=%I && Echo L=%L && Echo S=%S && Echo V=%V && Echo W=%W"
[HKEY_CURRENT_USER\Software\Classes\Directory\Background\Shell\Cmdline]
@="ProgId 'Directory\Background'"
[HKEY_CURRENT_USER\Software\Classes\Directory\Background\Shell\Cmdline\Command]
@="C:\\Windows\\System32\\Cmd.exe /V:ON /K Echo Command Line: && Echo !CMDCMDLINE! && Echo. && Echo Arguments: && Echo *=%* && Echo 0=%0 && Echo 1=%1 && Echo 2=%2 && Echo D=%D && Echo H=%H && Echo I=%I && Echo L=%L && Echo S=%S && Echo V=%V && Echo W=%W"
[HKEY_CURRENT_USER\Software\Classes\Directory\Shell\Cmdline]
@="ProgId 'Directory'"
[HKEY_CURRENT_USER\Software\Classes\Directory\Shell\Cmdline\Command]
@="C:\\Windows\\System32\\Cmd.exe /V:ON /K Echo Command Line: && Echo !CMDCMDLINE! && Echo. && Echo Arguments: && Echo *=%* && Echo 0=%0 && Echo 1=%1 && Echo 2=%2 && Echo D=%D && Echo H=%H && Echo I=%I && Echo L=%L && Echo S=%S && Echo V=%V && Echo W=%W"
[HKEY_CURRENT_USER\Software\Classes\Drive\Shell\Cmdline]
@="ProgId 'Drive'"
[HKEY_CURRENT_USER\Software\Classes\Drive\Shell\Cmdline\Command]
@="C:\\Windows\\System32\\Cmd.exe /V:ON /K Echo Command Line: && Echo !CMDCMDLINE! && Echo. && Echo Arguments: && Echo *=%* && Echo 0=%0 && Echo 1=%1 && Echo 2=%2 && Echo D=%D && Echo H=%H && Echo I=%I && Echo L=%L && Echo S=%S && Echo V=%V && Echo W=%W"
[HKEY_CURRENT_USER\Software\Classes\Folder\Shell\Cmdline]
@="ProgId 'Folder'"
[HKEY_CURRENT_USER\Software\Classes\Folder\Shell\Cmdline\Command]
@="C:\\Windows\\System32\\Cmd.exe /V:ON /K Echo Command Line: && Echo !CMDCMDLINE! && Echo. && Echo Arguments: && Echo *=%* && Echo 0=%0 && Echo 1=%1 && Echo 2=%2 && Echo D=%D && Echo H=%H && Echo I=%I && Echo L=%L && Echo S=%S && Echo V=%V && Echo W=%W"
[HKEY_CURRENT_USER\Software\Classes\NetServer\Shell\Cmdline]
@="ProgId 'NetServer'"
[HKEY_CURRENT_USER\Software\Classes\NetServer\Shell\Cmdline\Command]
@="C:\\Windows\\System32\\Cmd.exe /V:ON /K Echo Command Line: && Echo !CMDCMDLINE! && Echo. && Echo Arguments: && Echo *=%* && Echo 0=%0 && Echo 1=%1 && Echo 2=%2 && Echo D=%D && Echo H=%H && Echo I=%I && Echo L=%L && Echo S=%S && Echo V=%V && Echo W=%W"
; NOTE: key not evaluated!
[-HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\*\Shell\Cmdline]
[HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.\Shell\Cmdline]
@="ProgId 'SystemFileAssociations\\.'"
[HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.\Shell\Cmdline\Command]
@="C:\\Windows\\System32\\Cmd.exe /V:ON /K Echo Command Line: && Echo !CMDCMDLINE! && Echo. && Echo Arguments: && Echo *=%* && Echo 0=%0 && Echo 1=%1 && Echo 2=%2 && Echo D=%D && Echo H=%H && Echo I=%I && Echo L=%L && Echo S=%S && Echo V=%V && Echo W=%W"
[HKEY_CURRENT_USER\Software\Classes\Unknown\Shell\Cmdline]
@="ProgId 'Unknown'"
[HKEY_CURRENT_USER\Software\Classes\Unknown\Shell\Cmdline\Command]
@="C:\\Windows\\System32\\Cmd.exe /V:ON /K Echo Command Line: && Echo !CMDCMDLINE! && Echo. && Echo Arguments: && Echo *=%* && Echo 0=%0 && Echo 1=%1 && Echo 2=%2 && Echo D=%D && Echo H=%H && Echo I=%I && Echo L=%L && Echo S=%S && Echo V=%V && Echo W=%W"
DIRID.INF
and
LDID.INF
create the file
DIRID.INI
or
LDID.INI
respectively on the user’s desktop with all known
Dirids
and the pathnames they resolve to, then opens it in
Windows’™ text editor
NotePad.exe
.
DIRID.INF
or
LDID.INF
respectively to display its context menu and click Installto run it.
Zur Interpretation der Gaußschen Osterformel und ihrer Ausnahmeregeln
in Historia Mathematica, volume 24, issue 4, on pages 441-444:
Rem Copyleft © 1999-2024, Stefan Kanthak <stefan.kanthak@nexgo.de>
Y = Year(Now())
Rem Revision of Gauß' Formula
Rem Heiner Lichtenberg, Zur Interpretation der Gaußschen Osterformel und ihrer Ausnahmeregeln
Rem Historia Mathematica, Volume 24, Issue 4, November 1997, Pages 441-444
C = Y \ 100 ' Century
S = (C * 3 + 3) \ 4 ' Solar Equation
L = (C * 8 + 13) \ 25 ' Lunar Equation
M = S - L + 15
A = Y Mod 19 ' Golden Number - 1
D = (A * 19 + M) Mod 30 ' Epact
R = D \ 29 + (D \ 28 - D \ 29) * (A \ 11)
M = D - R + 21 ' Full Moon in March
S = 7 - (Y + Y \ 4 + 2 - S) Mod 7 ' First Sunday in March
E = M + 7 - (M - S) Mod 7
SetLocale("en-GB")
MsgBox "Ash Wednesday" & vbTab & DateSerial(Y, 3, E - 46) & vbNewLine _
& "Palm Sunday" & vbTab & DateSerial(Y, 3, E - 7) & vbNewLine _
& "Maundy Thursday" & vbTab & DateSerial(Y, 3, E - 3) & vbNewLine _
& "Good Friday" & vbTab & DateSerial(Y, 3, E - 2) & vbNewLine _
& "Easter Sunday" & vbTab & DateSerial(Y, 3, E) & vbNewLine _
& "Easter Monday" & vbTab & DateSerial(Y, 3, E + 1) & vbNewLine _
& "Ascension Day" & vbTab & DateSerial(Y, 3, E + 39) & vbNewLine _
& "Whit Sunday" & vbTab & DateSerial(Y, 3, E + 49) & vbNewLine _
& "Whit Monday" & vbTab & DateSerial(Y, 3, E + 50) & vbNewLine _
& "Trinity Sunday" & vbTab & DateSerial(Y, 3, E + 56) & vbNewLine _
& "Corpus Christi" & vbTab & DateSerial(Y, 3, E + 60), vbOKOnly, _
"Movable Christian Feast Days in " & Y
Rem Copyleft © 1999-2024, Stefan Kanthak <stefan.kanthak@nexgo.de>
Y = Year(Now())
Rem Anonymous' Formula
Rem Nature, Volume 13, Issue 338, April 20, 1876, Page 487
A = Y Mod 19
B = Y \ 100
C = Y Mod 100
D = B \ 4
E = B Mod 4
F = (B + 8) \ 25
G = (B - F + 1) \ 3
H = (A * 19 + B - D - G + 15) Mod 30
I = C \ 4
J = C Mod 4
K = (E * 2 + I * 2 - H - J + 32) Mod 7
L = (A + H * 11 + K * 22) \ 451
M = H + K - L * 7 + 114
N = M \ 31
O = M Mod 31
SetLocale("en-GB")
MsgBox "Ash Wednesday" & vbTab & DateSerial(Y, N, O - 45) & vbNewLine _
& "Palm Sunday" & vbTab & DateSerial(Y, N, O - 6) & vbNewLine _
& "Maundy Thursday" & vbTab & DateSerial(Y, N, O - 2) & vbNewLine _
& "Good Friday" & vbTab & DateSerial(Y, N, O - 1) & vbNewLine _
& "Easter Sunday" & vbTab & DateSerial(Y, N, O + 1) & vbNewLine _
& "Easter Monday" & vbTab & DateSerial(Y, N, O + 2) & vbNewLine _
& "Ascension Day" & vbTab & DateSerial(Y, N, O + 40) & vbNewLine _
& "Whit Sunday" & vbTab & DateSerial(Y, N, O + 50) & vbNewLine _
& "Whit Monday" & vbTab & DateSerial(Y, N, O + 51) & vbNewLine _
& "Trinity Sunday" & vbTab & DateSerial(Y, N, O + 57) & vbNewLine _
& "Corpus Christi" & vbTab & DateSerial(Y, N, O + 61), vbOKOnly, _
"Movable Christian Feast Days in " & Y
How ten divisions lead to Easterin New Scientist, volume 9, issue 228, on pages 828-829:
Rem Copyleft © 1999-2024, Stefan Kanthak <stefan.kanthak@nexgo.de>
Y = Year(Now())
Rem Thomas H. O'Beirne, How ten divisions lead to Easter
Rem New Scientist, Volume 9, Issue 228, March 30, 1961, Pages 828-829
A = Y Mod 19
B = Y \ 100
C = Y Mod 100
D = B \ 4
E = B Mod 4
G = (B * 8 + 13) \ 25
H = (A * 19 + B - D - G + 15) Mod 30
I = C \ 4
K = C Mod 4
L = (E * 2 + I * 2 - H - K + 32) Mod 7
M = (A + H * 11 + L * 19) \ 433
N = (H + L - M * 7 + 90) \ 25
P = (H + L - M * 7 + N * 33 + 19) Mod 32
SetLocale("en-GB")
MsgBox "Ash Wednesday" & vbTab & DateSerial(Y, N, P - 46) & vbNewLine _
& "Palm Sunday" & vbTab & DateSerial(Y, N, P - 7) & vbNewLine _
& "Maundy Thursday" & vbTab & DateSerial(Y, N, P - 3) & vbNewLine _
& "Good Friday" & vbTab & DateSerial(Y, N, P - 2) & vbNewLine _
& "Easter Sunday" & vbTab & DateSerial(Y, N, P) & vbNewLine _
& "Easter Monday" & vbTab & DateSerial(Y, N, P + 1) & vbNewLine _
& "Ascension Day" & vbTab & DateSerial(Y, N, P + 39) & vbNewLine _
& "Whit Sunday" & vbTab & DateSerial(Y, N, P + 49) & vbNewLine _
& "Whit Monday" & vbTab & DateSerial(Y, N, P + 50) & vbNewLine _
& "Trinity Sunday" & vbTab & DateSerial(Y, N, P + 56) & vbNewLine _
& "Corpus Christi" & vbTab & DateSerial(Y, N, P + 60), vbOKOnly, _
"Movable Christian Feast Days in " & Y
Rem Copyleft © 1999-2024, Stefan Kanthak <stefan.kanthak@nexgo.de>
Y = Year(Now())
Rem Ian Stewart, Easter Is a Quasicrystal
Rem Scientific American, Volume 284, Number 3, March 1, 2001, Pages 80-83
A = Y Mod 19 ' Golden Number - 1
B = Y \ 100
C = Y Mod 100
D = B \ 4
E = B Mod 4
G = (B * 8 + 13) \ 25
H = (A * 19 + B - D - G + 15) Mod 30
J = C \ 4
K = C Mod 4
M = (A + H * 11) \ 319
L = (E * 2 + J * 2 - K - H + M + 32) Mod 7
N = (H - M + L + 90) \ 25
P = (H - M + L + N + 19) Mod 32
SetLocale("en-GB")
MsgBox "Ash Wednesday" & vbTab & DateSerial(Y, N, P - 46) & vbNewLine _
& "Palm Sunday" & vbTab & DateSerial(Y, N, P - 7) & vbNewLine _
& "Maundy Thursday" & vbTab & DateSerial(Y, N, P - 3) & vbNewLine _
& "Good Friday" & vbTab & DateSerial(Y, N, P - 2) & vbNewLine _
& "Easter Sunday" & vbTab & DateSerial(Y, N, P) & vbNewLine _
& "Easter Monday" & vbTab & DateSerial(Y, N, P + 1) & vbNewLine _
& "Ascension Day" & vbTab & DateSerial(Y, N, P + 39) & vbNewLine _
& "Whit Sunday" & vbTab & DateSerial(Y, N, P + 49) & vbNewLine _
& "Whit Monday" & vbTab & DateSerial(Y, N, P + 50) & vbNewLine _
& "Trinity Sunday" & vbTab & DateSerial(Y, N, P + 56) & vbNewLine _
& "Corpus Christi" & vbTab & DateSerial(Y, N, P + 60), vbOKOnly, _
"Movable Christian Feast Days in " & Y
Étude sur la date de Pâques
in
Bulletin Astronomique, volume 12, on pages 391-410:
Rem Copyleft © 1999-2024, Stefan Kanthak <stefan.kanthak@nexgo.de>
Y = Year(Now())
Rem J.-M. Oudin, Étude sur la date de Pâques
Rem Bulletin Astronomique, Volume 12, 1940, Pages 391-410
C = Y \ 100 ' Century
G = Y Mod 19 ' Golden Number - 1
H = (C - C \ 4 - (C - (C - 17) \ 25) \ 3 + G * 19 + 15) Mod 30
I = H - (H \ 28) * (1 - (H \ 28) * (29 \ (H + 1)) * ((21 - G) \ 11))
J = (Y + Y \ 4 + I + 2 - C + C \ 4) Mod 7 ' Weekday of Paschal Full Moon
L = I - J
M = (L + 40) \ 44 + 3
D = L + 28 - (M \ 4) * 31
SetLocale("en-GB")
MsgBox "Ash Wednesday" & vbTab & DateSerial(Y, M, D - 46) & vbNewLine _
& "Palm Sunday" & vbTab & DateSerial(Y, M, D - 7) & vbNewLine _
& "Maundy Thursday" & vbTab & DateSerial(Y, M, D - 3) & vbNewLine _
& "Good Friday" & vbTab & DateSerial(Y, M, D - 2) & vbNewLine _
& "Easter Sunday" & vbTab & DateSerial(Y, M, D) & vbNewLine _
& "Easter Monday" & vbTab & DateSerial(Y, M, D + 1) & vbNewLine _
& "Ascension Day" & vbTab & DateSerial(Y, M, D + 39) & vbNewLine _
& "Whit Sunday" & vbTab & DateSerial(Y, M, D + 49) & vbNewLine _
& "Whit Monday" & vbTab & DateSerial(Y, M, D + 50) & vbNewLine _
& "Trinity Sunday" & vbTab & DateSerial(Y, M, D + 56) & vbNewLine _
& "Corpus Christi" & vbTab & DateSerial(Y, M, D + 60), vbOKOnly, _
"Movable Christian Feast Days in " & Y
GIMMICK.VBS
with one of the
VBScripts
presented above in an arbitrary directory, then execute it per
double-click.
Environment Viewer.exe
displays the environment blocks of the (current) process,
the (current) user and the system.
Every process has an environment block that contains a set of environment variables and their values. There are two types of environment variables: user environment variables (set for each user) and system environment variables (set for everyone).By default, a child process inherits the environment variables of its parent process. […]
[…] To programmatically add or modify system environment variables, add them to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment registry key, […]
Environment variables specify search paths for files, directories for temporary files, application-specific options, and other similar information. The system maintains an environment block for each user and one for the computer. The system environment block represents environment variables for all users of the particular computer. A user's environment block represents the environment variables the system maintains for that particular user, including the set of system environment variables.Both articles but fail to tell that two kinds of user environment variables exist, persistent and volatile, that volatile environment variables obscure persistent environment variables with the same name, how to add, modify or remove them, and where they are stored: persistent user environment variables are stored in the registry keyBy default, each process receives a copy of the environment block for its parent process. Typically, this is the environment block for the user who is logged on. […]
HKEY_CURRENT_USER\Environment
alias
HKEY_USERS\‹security identifier›\Environment
,
while volatile user environment variables are stored in the
(volatile) registry key
HKEY_CURRENT_USER\Volatile Environment
alias
HKEY_USERS\‹security identifier›\Volatile Environment
,
where they are created during user logon and discarded when the user
logs off.
The articles also fail to tell that not all system environment
variables are stored in the registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
:
the system environment variables ALLUSERSPROFILE
,
COMPUTERNAME
, PUBLIC
,
CommonProgramFiles
,
CommonProgramFiles(x86)
,
CommonProgramW6432
,
ProgramData
, ProgramFiles
,
ProgramFiles(x86)
, ProgramW6432
,
SystemDrive
and SystemRoot
are created
programmatically.
And they fail to tell that user environment variables obscure system environment variables of the same name – with but two notable exceptions:
LibPath
,
OS2LibPath
and Path
are assigned to the
respective process environment variable during user logon;
NT AUTHORITY\SYSTEM
alias
LocalSystem
get the system environment variables TEMP
and
TMP
instead of the respective user environment
variables!
Environment Viewer.exe
is a pure Win32
application, written in
ANSI C,
built with the Environment Viewer.exe
from the source
presented below.
Create the text file GIMMICK.C
with the following
content in an arbitrary, preferable empty directory:
// Copyright © 2004-2024, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <userenv.h>
__declspec(noreturn)
VOID CDECL wWinMainCRTStartup(VOID)
{
HANDLE hToken;
DWORD dwString;
LPWSTR lpString;
LPCWSTR lpBlock = GetEnvironmentStrings();
if (lpBlock != NULL)
{
for (lpString = lpBlock;
lpString[0] != L'\0';
lpString[dwString = wcslen(lpString)] = L'\n', lpString += dwString + 1)
continue;
MessageBoxEx(HWND_DESKTOP,
lpBlock,
L"Process Environment Block",
MB_OK,
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT));
FreeEnvironmentStrings(lpBlock);
}
if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken))
{
if (CreateEnvironmentBlock(&lpBlock, hToken, FALSE))
{
for (lpString = lpBlock;
lpString[0] != L'\0';
lpString[dwString = wcslen(lpString)] = L'\n', lpString += dwString + 1)
continue;
MessageBoxEx(HWND_DESKTOP,
lpBlock,
L"User Environment Block",
MB_OK,
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT));
DestroyEnvironmentBlock(lpBlock);
}
CloseHandle(hToken);
}
if (CreateEnvironmentBlock(&lpBlock, (HANDLE) NULL, FALSE))
{
for (lpString = lpBlock;
lpString[0] != L'\0';
lpString[dwString = wcslen(lpString)] = L'\n', lpString += dwString + 1)
continue;
MessageBoxEx(HWND_DESKTOP,
lpBlock,
L"System Environment Block",
MB_OK,
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT));
DestroyEnvironmentBlock(lpBlock);
}
ExitProcess(GetLastError());
}
Run the following four command lines to compile the source file
GIMMICK.C
created in step 1., link the compiled
object file GIMMICK.OBJ
and cleanup afterwards:
SET CL=/GA /GF /GS /Gy /O1 /Os /Oy /W4 /wd4090 /Zl SET LINK=/ENTRY:wWinMainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /NODEFAULTLIB /OSVERSION:5.0 /RELEASE /SUBSYSTEM:WINDOWS /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /Fe"Environment Viewer.exe" GIMMICK.C ADVAPI32.LIB KERNEL32.LIB USER32.LIB USERENV.LIB ERASE GIMMICK.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the MSDN article Use the Microsoft C++ toolset from the command line for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window.
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. GIMMICK.C Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Create the text file GIMMICK.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 34 2c 20 53 74 65 66 61 6e 20 4b 61 -2024, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 02 00 56 4f 49 44 00 00 00 00 PE..L...VOID....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 02 00 00 ......#.........
00 04 00 00 00 00 00 00 00 10 00 00 00 10 00 00 ................
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
04 00 00 00 00 00 2f 03 04 00 00 00 00 00 00 00 ....../.........
00 30 00 00 00 02 00 00 d6 b3 00 00 02 00 00 85 .0..............
00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
d0 20 00 00 64 00 00 00 00 00 00 00 00 00 00 00 . ..d...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 20 00 00 38 00 00 00 ......... ..8...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
74 01 00 00 00 10 00 00 00 02 00 00 00 02 00 00 t...............
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 63 6f 6e 73 74 00 00 6c 02 00 00 00 20 00 00 .const..l.... ..
00 04 00 00 00 04 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 ....@..@........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
83 ec 08 56 57 ff 15 1c 20 40 00 8b 3d 24 20 40 ...VW... @..=$ @
00 89 44 24 08 85 c0 74 51 66 83 38 00 8b c8 74 ..D$...tQf.8...t
2d 8b c1 8d 70 02 66 8b 10 83 c0 02 66 85 d2 75 -...p.f.....f..u
f5 2b c6 d1 f8 ba 0a 00 00 00 66 89 14 41 66 83 .+........f..Af.
7c 41 02 00 8d 4c 41 02 75 d7 8b 44 24 08 68 00 |A...LA.u..D$.h.
04 00 00 6a 00 68 9c 20 40 00 50 6a 00 ff d7 8b ...j.h. @.Pj....
44 24 08 50 ff 15 18 20 40 00 8d 4c 24 0c 51 6a D$.P... @..L$.Qj
08 ff 15 14 20 40 00 50 ff 15 00 20 40 00 85 c0 .... @.P... @...
74 72 8b 54 24 0c 6a 00 52 8d 44 24 10 50 e8 db tr.T$.j.R.D$.P..
00 00 00 85 c0 74 52 8b 4c 24 08 66 83 39 00 74 .....tR.L$.f.9.t
2d 8b c1 8d 70 02 66 8b 10 83 c0 02 66 85 d2 75 -...p.f.....f..u
f5 2b c6 d1 f8 ba 0a 00 00 00 66 89 14 41 66 83 .+........f..Af.
7c 41 02 00 8d 4c 41 02 75 d7 8b 4c 24 08 68 00 |A...LA.u..L$.h.
04 00 00 6a 00 68 6c 20 40 00 51 6a 00 ff d7 8b ...j.hl @.Qj....
44 24 08 50 e8 7f 00 00 00 8b 4c 24 0c 51 ff 15 D$.P......L$.Q..
10 20 40 00 6a 00 6a 00 8d 54 24 10 52 e8 6c 00 . @.j.j..T$.R.l.
00 00 85 c0 74 52 8b 4c 24 08 66 83 39 00 74 2d ....tR.L$.f.9.t-
8b c1 8d 70 02 66 8b 10 83 c0 02 66 85 d2 75 f5 ...p.f.....f..u.
2b c6 d1 f8 ba 0a 00 00 00 66 89 14 41 66 83 7c +........f..Af.|
41 02 00 8d 4c 41 02 75 d7 8b 4c 24 08 68 00 04 A...LA.u..L$.h..
00 00 6a 00 68 38 20 40 00 51 6a 00 ff d7 8b 44 ..j.h8 @.Qj....D
24 08 50 e8 10 00 00 00 ff 15 0c 20 40 00 50 ff $.P........ @.P.
15 08 20 40 00 5f 5e cc ff 25 30 20 40 00 ff 25 .. @._^..%0 @..%
2c 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 , @.............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
6c 21 00 00 00 00 00 00 8e 21 00 00 9c 21 00 00 l!.......!...!..
ac 21 00 00 ba 21 00 00 ce 21 00 00 e8 21 00 00 .!...!...!...!..
00 00 00 00 10 22 00 00 00 00 00 00 46 22 00 00 ....."......F"..
2c 22 00 00 00 00 00 00 53 00 79 00 73 00 74 00 ,"......S.y.s.t.
65 00 6d 00 20 00 45 00 6e 00 76 00 69 00 72 00 e.m. .E.n.v.i.r.
6f 00 6e 00 6d 00 65 00 6e 00 74 00 20 00 42 00 o.n.m.e.n.t. .B.
6c 00 6f 00 63 00 6b 00 00 00 00 00 55 00 73 00 l.o.c.k.....U.s.
65 00 72 00 20 00 45 00 6e 00 76 00 69 00 72 00 e.r. .E.n.v.i.r.
6f 00 6e 00 6d 00 65 00 6e 00 74 00 20 00 42 00 o.n.m.e.n.t. .B.
6c 00 6f 00 63 00 6b 00 00 00 00 00 50 00 72 00 l.o.c.k.....P.r.
6f 00 63 00 65 00 73 00 73 00 20 00 45 00 6e 00 o.c.e.s.s. .E.n.
76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 v.i.r.o.n.m.e.n.
74 00 20 00 42 00 6c 00 6f 00 63 00 6b 00 00 00 t. .B.l.o.c.k...
34 21 00 00 00 00 00 00 00 00 00 00 80 21 00 00 4!...........!..
00 20 00 00 3c 21 00 00 00 00 00 00 00 00 00 00 . ..<!..........
02 22 00 00 08 20 00 00 58 21 00 00 00 00 00 00 ."... ..X!......
00 00 00 00 20 22 00 00 24 20 00 00 60 21 00 00 .... "..$ ..`!..
00 00 00 00 00 00 00 00 60 22 00 00 2c 20 00 00 ........`".., ..
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 6c 21 00 00 00 00 00 00 8e 21 00 00 ....l!.......!..
9c 21 00 00 ac 21 00 00 ba 21 00 00 ce 21 00 00 .!...!...!...!..
e8 21 00 00 00 00 00 00 10 22 00 00 00 00 00 00 .!......."......
46 22 00 00 2c 22 00 00 00 00 00 00 f7 01 4f 70 F"..,"........Op
65 6e 50 72 6f 63 65 73 73 54 6f 6b 65 6e 00 00 enProcessToken..
41 44 56 41 50 49 33 32 2e 64 6c 6c 00 00 19 01 ADVAPI32.dll....
45 78 69 74 50 72 6f 63 65 73 73 00 02 02 47 65 ExitProcess...Ge
74 4c 61 73 74 45 72 72 6f 72 00 00 52 00 43 6c tLastError..R.Cl
6f 73 65 48 61 6e 64 6c 65 00 c0 01 47 65 74 43 oseHandle...GetC
75 72 72 65 6e 74 50 72 6f 63 65 73 73 00 61 01 urrentProcess.a.
46 72 65 65 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 FreeEnvironmentS
74 72 69 6e 67 73 57 00 da 01 47 65 74 45 6e 76 tringsW...GetEnv
69 72 6f 6e 6d 65 6e 74 53 74 72 69 6e 67 73 57 ironmentStringsW
00 00 4b 45 52 4e 45 4c 33 32 2e 64 6c 6c 00 00 ..KERNEL32.dll..
10 02 4d 65 73 73 61 67 65 42 6f 78 45 78 57 00 ..MessageBoxExW.
55 53 45 52 33 32 2e 64 6c 6c 00 00 04 00 44 65 USER32.dll....De
73 74 72 6f 79 45 6e 76 69 72 6f 6e 6d 65 6e 74 stroyEnvironment
42 6c 6f 63 6b 00 00 00 43 72 65 61 74 65 45 6e Block...CreateEn
76 69 72 6f 6e 6d 65 6e 74 42 6c 6f 63 6b 00 00 vironmentBlock..
55 53 45 52 45 4e 56 2e 64 6c 6c 00 00 00 00 00 USERENV.dll.....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file GIMMICK.TXT
created in
step 3. to recreate the Windows application
Environment Viewer.exe
:
CERTUTIL.EXE /DecodeHex /V GIMMICK.TXT "Environment Viewer.exe"
Input Length = 8704 Output Length = 2048 CertUtil: -decodehex command completed successfully.
Create the text file GIMMICK.C
with the following
content in an arbitrary, preferable empty directory:
// Copyright © 2004-2024, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <userenv.h>
__declspec(noreturn)
VOID CDECL wmainCRTStartup(VOID)
{
DWORD dwString;
LPWSTR lpString;
LPCWSTR lpBlock;
HANDLE hToken;
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole != INVALID_HANDLE_VALUE)
{
if (CreateEnvironmentBlock(&lpBlock, (HANDLE) NULL, FALSE))
{
WriteConsole(hConsole,
L"\nSystem Environment Block:\n\n",
sizeof("\nSystem Environment Block:\n\n") - 1,
&dwString,
NULL);
for (lpString = lpBlock;
lpString[0] != L'\0';
lpString[dwString = wcslen(lpString)] = L'\n', lpString += dwString + 1)
continue;
WriteConsole(hConsole, lpBlock, lpString - lpBlock, &dwString, NULL);
DestroyEnvironmentBlock(lpBlock);
}
if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken))
{
if (CreateEnvironmentBlock(&lpBlock, hToken, FALSE))
{
WriteConsole(hConsole,
L"\nUser Environment Block:\n\n",
sizeof("\nUser Environment Block:\n\n") - 1,
&dwString,
NULL);
for (lpString = lpBlock;
lpString[0] != L'\0';
lpString[dwString = wcslen(lpString)] = L'\n', lpString += dwString + 1)
continue;
WriteConsole(hConsole, lpBlock, lpString - lpBlock, &dwString, NULL);
DestroyEnvironmentBlock(lpBlock);
}
CloseHandle(hToken);
}
lpBlock = GetEnvironmentStrings();
if (lpBlock != NULL)
{
WriteConsole(hConsole,
L"\nProcess Environment Block:\n\n",
sizeof("\nProcess Environment Block:\n\n") - 1,
&dwString,
NULL);
for (lpString = lpBlock;
lpString[0] != L'\0';
lpString[dwString = wcslen(lpString)] = L'\n', lpString += dwString + 1)
continue;
WriteConsole(hConsole, lpBlock, lpString - lpBlock, &dwString, NULL);
FreeEnvironmentStrings(lpBlock);
}
CloseHandle(hConsole);
}
ExitProcess(GetLastError());
}
Run the following four command lines to compile the source file
GIMMICK.C
created in step 5., link the compiled
object file GIMMICK.OBJ
and cleanup afterwards:
SET CL=/GA /GF /GS /Gy /O1 /Os /Oy /W4 /wd4090 /Zl SET LINK=/ENTRY:wmainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /NODEFAULTLIB /OSVERSION:5.0 /RELEASE /SUBSYSTEM:CONSOLE /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /Fe"Environment Viewer.com" GIMMICK.C ADVAPI32.LIB KERNEL32.LIB USERENV.LIB ERASE GIMMICK.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the MSDN article Use the Microsoft C++ toolset from the command line for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window.
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. GIMMICK.C Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Create the text file GIMMICK.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 34 2c 20 53 74 65 66 61 6e 20 4b 61 -2024, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 02 00 56 4f 49 44 00 00 00 00 PE..L...VOID....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 02 00 00 ......#.........
00 04 00 00 00 00 00 00 00 10 00 00 00 10 00 00 ................
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
04 00 00 00 00 00 2f 03 04 00 00 00 00 00 00 00 ....../.........
00 30 00 00 00 02 00 00 dc b7 00 00 03 00 00 85 .0..............
00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
e8 20 00 00 50 00 00 00 00 00 00 00 00 00 00 00 . ..P...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 20 00 00 38 00 00 00 ......... ..8...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
9e 01 00 00 00 10 00 00 00 02 00 00 00 02 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 63 6f 6e 73 74 00 00 74 02 00 00 00 20 00 00 .const..t.... ..
00 04 00 00 00 04 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 ....@..@........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
55 8b ec 83 ec 10 53 56 57 6a f4 ff 15 24 20 40 U.....SVWj...$ @
00 89 45 f4 83 f8 ff 0f 84 67 01 00 00 33 ff 57 ..E......g...3.W
57 8d 45 fc 50 e8 6e 01 00 00 8b 35 20 20 40 00 W.E.P.n....5 @.
85 c0 74 5b 57 8d 45 f8 50 6a 1c 68 ac 20 40 00 ..t[W.E.Pj.h. @.
ff 75 f4 ff d6 8b 45 fc eb 25 8b c8 8d 59 02 66 .u....E..%...Y.f
8b 11 83 c1 02 66 3b d7 75 f5 2b cb d1 f9 6a 0a .....f;.u.+...j.
89 4d f8 5a 66 89 14 48 8b 4d f8 8d 44 48 02 66 .M.Zf..H.M..DH.f
39 38 75 d6 2b 45 fc 57 8d 4d f8 51 d1 f8 50 ff 98u.+E.W.M.Q..P.
75 fc ff 75 f4 ff d6 ff 75 fc e8 03 01 00 00 8d u..u....u.......
45 f0 50 6a 08 ff 15 1c 20 40 00 50 ff 15 00 20 E.Pj.... @.P...
40 00 85 c0 74 75 57 ff 75 f0 8d 45 fc 50 e8 e5 @...tuW.u..E.P..
00 00 00 85 c0 74 5b 57 8d 45 f8 50 6a 1a 68 74 .....t[W.E.Pj.ht
20 40 00 ff 75 f4 ff d6 8b 45 fc eb 25 8b c8 8d @..u....E..%...
59 02 66 8b 11 83 c1 02 66 3b d7 75 f5 2b cb d1 Y.f.....f;.u.+..
f9 6a 0a 89 4d f8 5a 66 89 14 48 8b 4d f8 8d 44 .j..M.Zf..H.M..D
48 02 66 39 38 75 d6 2b 45 fc 57 8d 4d f8 51 d1 H.f98u.+E.W.M.Q.
f8 50 ff 75 fc ff 75 f4 ff d6 ff 75 fc e8 80 00 .P.u..u....u....
00 00 ff 75 f0 ff 15 18 20 40 00 ff 15 14 20 40 ...u.... @.... @
00 89 45 fc 3b c7 74 5c 57 8d 45 f8 50 6a 1d 68 ..E.;.t\W.E.Pj.h
38 20 40 00 ff 75 f4 ff d6 8b 45 fc eb 25 8b c8 8 @..u....E..%..
8d 59 02 66 8b 11 83 c1 02 66 3b d7 75 f5 2b cb .Y.f.....f;.u.+.
d1 f9 6a 0a 89 4d f8 5a 66 89 14 48 8b 4d f8 8d ..j..M.Zf..H.M..
44 48 02 66 39 38 75 d6 2b 45 fc 57 8d 4d f8 51 DH.f98u.+E.W.M.Q
d1 f8 50 ff 75 fc ff 75 f4 ff d6 ff 75 fc ff 15 ..P.u..u....u...
10 20 40 00 ff 15 0c 20 40 00 50 ff 15 08 20 40 . @.... @.P... @
00 cc ff 25 30 20 40 00 ff 25 2c 20 40 00 00 00 ...%0 @..%, @...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
70 21 00 00 00 00 00 00 92 21 00 00 a0 21 00 00 p!.......!...!..
b0 21 00 00 ca 21 00 00 e4 21 00 00 f2 21 00 00 .!...!...!...!..
06 22 00 00 16 22 00 00 00 00 00 00 4e 22 00 00 ."..."......N"..
34 22 00 00 00 00 00 00 0a 00 50 00 72 00 6f 00 4"........P.r.o.
63 00 65 00 73 00 73 00 20 00 45 00 6e 00 76 00 c.e.s.s. .E.n.v.
69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 i.r.o.n.m.e.n.t.
20 00 42 00 6c 00 6f 00 63 00 6b 00 3a 00 0a 00 .B.l.o.c.k.:...
0a 00 00 00 0a 00 55 00 73 00 65 00 72 00 20 00 ......U.s.e.r. .
45 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 E.n.v.i.r.o.n.m.
65 00 6e 00 74 00 20 00 42 00 6c 00 6f 00 63 00 e.n.t. .B.l.o.c.
6b 00 3a 00 0a 00 0a 00 00 00 00 00 0a 00 53 00 k.:...........S.
79 00 73 00 74 00 65 00 6d 00 20 00 45 00 6e 00 y.s.t.e.m. .E.n.
76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 v.i.r.o.n.m.e.n.
74 00 20 00 42 00 6c 00 6f 00 63 00 6b 00 3a 00 t. .B.l.o.c.k.:.
0a 00 0a 00 00 00 00 00 38 21 00 00 00 00 00 00 ........8!......
00 00 00 00 84 21 00 00 00 20 00 00 40 21 00 00 .....!... ..@!..
00 00 00 00 00 00 00 00 26 22 00 00 08 20 00 00 ........&"... ..
64 21 00 00 00 00 00 00 00 00 00 00 68 22 00 00 d!..........h"..
2c 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , ..............
00 00 00 00 00 00 00 00 70 21 00 00 00 00 00 00 ........p!......
92 21 00 00 a0 21 00 00 b0 21 00 00 ca 21 00 00 .!...!...!...!..
e4 21 00 00 f2 21 00 00 06 22 00 00 16 22 00 00 .!...!..."..."..
00 00 00 00 4e 22 00 00 34 22 00 00 00 00 00 00 ....N"..4"......
f7 01 4f 70 65 6e 50 72 6f 63 65 73 73 54 6f 6b ..OpenProcessTok
65 6e 00 00 41 44 56 41 50 49 33 32 2e 64 6c 6c en..ADVAPI32.dll
00 00 19 01 45 78 69 74 50 72 6f 63 65 73 73 00 ....ExitProcess.
02 02 47 65 74 4c 61 73 74 45 72 72 6f 72 00 00 ..GetLastError..
61 01 46 72 65 65 45 6e 76 69 72 6f 6e 6d 65 6e a.FreeEnvironmen
74 53 74 72 69 6e 67 73 57 00 da 01 47 65 74 45 tStringsW...GetE
6e 76 69 72 6f 6e 6d 65 6e 74 53 74 72 69 6e 67 nvironmentString
73 57 00 00 52 00 43 6c 6f 73 65 48 61 6e 64 6c sW..R.CloseHandl
65 00 c0 01 47 65 74 43 75 72 72 65 6e 74 50 72 e...GetCurrentPr
6f 63 65 73 73 00 24 05 57 72 69 74 65 43 6f 6e ocess.$.WriteCon
73 6f 6c 65 57 00 64 02 47 65 74 53 74 64 48 61 soleW.d.GetStdHa
6e 64 6c 65 00 00 4b 45 52 4e 45 4c 33 32 2e 64 ndle..KERNEL32.d
6c 6c 00 00 04 00 44 65 73 74 72 6f 79 45 6e 76 ll....DestroyEnv
69 72 6f 6e 6d 65 6e 74 42 6c 6f 63 6b 00 00 00 ironmentBlock...
43 72 65 61 74 65 45 6e 76 69 72 6f 6e 6d 65 6e CreateEnvironmen
74 42 6c 6f 63 6b 00 00 55 53 45 52 45 4e 56 2e tBlock..USERENV.
64 6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 dll.............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file GIMMICK.TXT
created in
step 7. to recreate the console application
Environment Viewer.com
:
CERTUTIL.EXE /DecodeHex /V GIMMICK.TXT "Environment Viewer.com"
Input Length = 8704 Output Length = 2048 CertUtil: -decodehex command completed successfully.
MSDM Product Key Reader.exe
displays the device-specific individual product keyembedded by (big) OEMs in the MSDM table of the ACPI BIOS.
product keyis used for automatic selection of the product edition and the activation of Windows 8 and Windows 8.1 during their installation, and can since version
1511alias
Threshold 2be used for (manual) product activation of Windows 10 too.
white paperavailable from Microsoft Software Licensing Tables (SLIC and MSDM) on MSDN.
MSDM Product Key Reader.exe
is a pure Win32 application, written in
ANSI C,
built with the MSDM Product Key Reader.exe
from the source presented below.
Create the text file MSDM.C
with the following content
in an arbitrary, preferable empty directory:
// Copyright © 2012-2024, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define STRICT
#undef UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
typedef struct _msdm // 'Microsoft Data Management' table
{
DWORD Signature; // "MSDM" = 0x4D44534D = 'MDSM'
DWORD Length; // size of entire MSDM table: 0x00000055
BYTE Revision;
BYTE Checksum; // checksum of entire MSDM table
CHAR OEMId[6]; // OEM identification
CHAR OEMTableId[8];
DWORD OEMRevision;
CHAR CreatorId[4]; // creator identification
DWORD CreatorRevision;
DWORD Version; // 0x00000001
DWORD Reserved; // 0x00000000
DWORD DataType; // 0x00000001
DWORD DataReserved; // 0x00000000
DWORD DataLength; // 0x0000001D
CHAR Data[29]; // product key: "23467-89BCD-FGHJK-MNPQR-TVWXY"
} MSDM;
__declspec(noreturn)
__declspec(safebuffers)
VOID CDECL WinMainCRTStartup(VOID)
{
MSDM msdm;
UINT size = GetSystemFirmwareTable('ACPI', 'MDSM', &msdm, sizeof(msdm));
DWORD length;
BYTE checksum;
if (size == 0)
MessageBoxEx(HWND_DESKTOP,
"No \'MSDM\' table found!",
"\'MSDM\' Product Key Reader",
MB_OK | MB_ICONQUESTION,
MAKELANGID(LANG_ENGLISH, SUBLANG_NEUTRAL));
else if (size > sizeof(msdm))
MessageBoxEx(HWND_DESKTOP,
"Error reading \'MSDM\' table!",
"\'MSDM\' Product Key Reader",
MB_OK | MB_ICONERROR,
MAKELANGID(LANG_ENGLISH, SUBLANG_NEUTRAL));
else
{
for (length = msdm.Length, checksum = 0;
length > 0;
checksum += ((BYTE *) &msdm)[--length])
continue;
if ((checksum != 0)
|| (msdm.Version != 1)
|| (msdm.Reserved != 0)
|| (msdm.DataType != 1)
|| (msdm.DataReserved != 0)
|| (msdm.DataLength != sizeof(msdm.Data)))
MessageBoxEx(HWND_DESKTOP,
"Invalid or unknown \'MSDM\' table found!",
"\'MSDM\' Product Key Reader",
MB_OK | MB_ICONWARNING,
MAKELANGID(LANG_ENGLISH, SUBLANG_NEUTRAL));
else
{
msdm.Data[sizeof(msdm.Data)] = '\0';
MessageBoxEx(HWND_DESKTOP,
msdm.Data,
"\'MSDM\' Product Key Reader",
MB_OK | MB_ICONINFORMATION,
MAKELANGID(LANG_ENGLISH, SUBLANG_NEUTRAL));
}
}
ExitProcess(GetLastError());
}
GetSystemFirmwareTable()
Run the following four command lines to compile the source file
MSDM.C
created in step 1., link the compiled
object file MSDM.OBJ
and cleanup afterwards:
SET CL=/GA /GF /GS /Gy /O1 /Os /Oy /W4 /Zl SET LINK=/ENTRY:WinMainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /NODEFAULTLIB /OSVERSION:5.2 /RELEASE /SUBSYSTEM:WINDOWS /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /Fe"MSDM Product Key Reader.exe" MSDM.C KERNEL32.LIB USER32.LIB ERASE MSDM.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the MSDN article Use the Microsoft C++ toolset from the command line for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window.
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. MSDM.C Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Create the text file MSDM.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 34 2c 20 53 74 65 66 61 6e 20 4b 61 -2024, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 02 00 4d 53 44 4d 00 00 00 00 PE..L...MSDM....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 02 00 00 ......#.........
00 02 00 00 00 00 00 00 00 10 00 00 00 10 00 00 ................
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
05 00 02 00 00 00 2f 03 05 00 02 00 00 00 00 00 ....../.........
00 30 00 00 00 02 00 00 bd 1b 00 00 02 00 00 85 .0..............
00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
90 20 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 . ..<...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 20 00 00 18 00 00 00 ......... ......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
bf 00 00 00 00 10 00 00 00 02 00 00 00 02 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 63 6f 6e 73 74 00 00 46 01 00 00 00 20 00 00 .const..F.... ..
00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 ....@..@........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
55 8b ec 83 ec 58 53 56 8b 35 04 20 40 00 57 6a U....XSV.5. @.Wj
58 6a 00 bb 4d 53 44 4d 53 bf 49 50 43 41 57 ff Xj..MSDMS.IPCAW.
d6 85 c0 75 12 6a 09 6a 20 68 74 20 40 00 68 5c ...u.j.j ht @.h\
20 40 00 6a 00 eb 74 6a 58 8d 45 a8 50 53 57 ff @.j..tjX.E.PSW.
d6 83 f8 58 76 10 6a 09 6a 10 68 74 20 40 00 68 ...Xv.j.j.ht @.h
40 20 40 00 eb dd 8b 4d ac 33 d2 32 c0 3b ca 76 @ @....M.3.2.;.v
0d 02 44 0d a7 49 3b ca 77 f7 84 c0 75 2e 83 7d ..D..I;.w...u..}
cc 01 75 28 39 55 d0 75 23 83 7d d4 01 75 1d 39 ..u(9U.u#.}..u.9
55 d8 75 18 83 7d dc 1d 75 12 6a 09 6a 40 68 74 U.u..}..u.j.j@ht
20 40 00 8d 45 e0 88 55 fd 50 eb 0e 6a 09 6a 30 @..E..U.P..j.j0
68 74 20 40 00 68 18 20 40 00 52 ff 15 10 20 40 ht @.h. @.R... @
00 ff 15 00 20 40 00 50 ff 15 08 20 40 00 cc 00 .... @.P... @...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
f2 20 00 00 02 21 00 00 e4 20 00 00 00 00 00 00 . ...!... ......
2a 21 00 00 00 00 00 00 49 6e 76 61 6c 69 64 20 *!......Invalid
6f 72 20 75 6e 6b 6e 6f 77 6e 20 27 4d 53 44 4d or unknown 'MSDM
27 20 74 61 62 6c 65 20 66 6f 75 6e 64 21 00 00 ' table found!..
45 72 72 6f 72 20 72 65 61 64 69 6e 67 20 27 4d Error reading 'M
53 44 4d 27 20 74 61 62 6c 65 21 00 4e 6f 20 27 SDM' table!.No '
4d 53 44 4d 27 20 74 61 62 6c 65 20 66 6f 75 6e MSDM' table foun
64 21 00 00 27 4d 53 44 4d 27 20 50 72 6f 64 75 d!..'MSDM' Produ
63 74 20 4b 65 79 20 52 65 61 64 65 72 00 00 00 ct Key Reader...
cc 20 00 00 00 00 00 00 00 00 00 00 1c 21 00 00 . ...........!..
00 20 00 00 dc 20 00 00 00 00 00 00 00 00 00 00 . ... ..........
3a 21 00 00 10 20 00 00 00 00 00 00 00 00 00 00 :!... ..........
00 00 00 00 00 00 00 00 00 00 00 00 f2 20 00 00 ............. ..
02 21 00 00 e4 20 00 00 00 00 00 00 2a 21 00 00 .!... ......*!..
00 00 00 00 19 01 45 78 69 74 50 72 6f 63 65 73 ......ExitProces
73 00 02 02 47 65 74 4c 61 73 74 45 72 72 6f 72 s...GetLastError
00 00 72 02 47 65 74 53 79 73 74 65 6d 46 69 72 ..r.GetSystemFir
6d 77 61 72 65 54 61 62 6c 65 00 00 4b 45 52 4e mwareTable..KERN
45 4c 33 32 2e 64 6c 6c 00 00 0f 02 4d 65 73 73 EL32.dll....Mess
61 67 65 42 6f 78 45 78 41 00 55 53 45 52 33 32 ageBoxExA.USER32
2e 64 6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 .dll............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file MSDM.TXT
created in
step 3. to recreate the application
MSDM Product Key Reader.exe
:
CERTUTIL.EXE /DecodeHex /V MSDM.TXT "MSDM Product Key Reader.exe"
Input Length = 6528 Output Length = 1536 CertUtil: -decodehex command completed successfully.
WPBT Command Line Reader.exe
displays the command line embedded in the
WPDT table
of the
ACPI
BIOS.
white paperavailable from Windows Hardware Dev Center Archive Windows Hardware Dev Center Archive on MSDN. ACPI system description tables
WPBT Command Line Reader.exe
is a pure Win32 application, written in
ANSI C,
built with the WPBT Command Line Reader.exe
from the source presented below.
Create the text file WPBT.C
with the following content
in an arbitrary, preferable empty directory:
// Copyright © 2017-2024, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
typedef struct _wpbt // Windows Platform Binary Table
{
DWORD Signature; // "WPBT" = 0x54445057 = 'TBPW'
DWORD Length; // size of entire WPBT
BYTE Revision;
BYTE Checksum; // checksum of entire WPBT
CHAR OEMId[6]; // OEM identification
CHAR OEMTableId[8];
DWORD OEMRevision;
CHAR CreatorId[4]; // creator identification
DWORD CreatorRevision;
DWORD HandoffMemorySize;
DWORD64 HandoffMemoryLocation;
BYTE ContentLayout;
BYTE ContentType;
WORD CommandLineLength;
WCHAR CommandLine[32768];
} WPBT;
__declspec(noreturn)
__declspec(safebuffers)
VOID CDECL wWinMainCRTStartup(VOID)
{
WPBT wpbt;
UINT size = GetSystemFirmwareTable('ACPI', 'TBPW', &wpbt, sizeof(wpbt));
DWORD length;
BYTE checksum;
if (size == 0)
MessageBoxEx(HWND_DESKTOP,
L"No \'WPBT\' found!",
L"\'WPBT\' Command Line Reader",
MB_OK | MB_ICONQUESTION,
MAKELANGID(LANG_ENGLISH, SUBLANG_NEUTRAL));
else if (size > sizeof(wpbt))
MessageBoxEx(HWND_DESKTOP,
L"Error reading \'WPBT\'!",
L"\'WPBT\' Command Line Reader",
MB_OK | MB_ICONERROR,
MAKELANGID(LANG_ENGLISH, SUBLANG_NEUTRAL));
else
{
for (length = wpbt.Length, checksum = 0;
length > 0;
checksum += ((BYTE *) &wpbt)[--length])
continue;
if ((checksum != 0)
|| (wpbt.Signature != 'TBPW')
|| (wpbt.Length < sizeof(wpbt) - sizeof(wpbt.CommandLine))
|| (wpbt.ContentLayout != 0x01)
|| (wpbt.ContentType != 0x01))
MessageBoxEx(HWND_DESKTOP,
L"Invalid or unknown \'WPBT\' found!",
L"\'WPBT\' Command Line Reader",
MB_OK | MB_ICONWARNING,
MAKELANGID(LANG_ENGLISH, SUBLANG_NEUTRAL));
else
{
wpbt.CommandLine[wpbt.CommandLineLength / sizeof(*wpbt.CommandLine)] = L'\0';
MessageBoxEx(HWND_DESKTOP,
wpbt.CommandLine,
L"\'WPBT\' Command Line Reader",
MB_OK | MB_ICONINFORMATION,
MAKELANGID(LANG_ENGLISH, SUBLANG_NEUTRAL));
}
}
ExitProcess(GetLastError());
}
GetSystemFirmwareTable()
Run the command line matching the (32-bit or 64-bit) execution
environment to create the import library WPBT.LIB
for the compiler helper routine
_chkstk()
:
LINK.EXE /LIB /DEF /EXPORT:chkstk /MACHINE:AMD64 /NAME:NTDLL /NODEFAULTLIB /OUT:WPBT.LIB
LINK.EXE /LIB /DEF /EXPORT:_chkstk /MACHINE:I386 /NAME:NTDLL /NODEFAULTLIB /OUT:WPBT.LIB
Microsoft (R) Library Manager Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. Creating library WPBT.LIB and object WPBT.exp
Run the following four command lines to compile the source file
WPBT.C
created in step 1., link the compiled
object file WPBT.OBJ
and cleanup afterwards:
SET CL=/GA /GF /GS /Gs69632 /Gy /O1 /Os /Oy /W4 /Zl SET LINK=/ENTRY:wWinMainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /NODEFAULTLIB /OSVERSION:5.2 /RELEASE /STACK:1048576,65536 /SUBSYSTEM:WINDOWS /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /Fe"WPBT Command Line Reader.exe" WPBT.C KERNEL32.LIB USER32.LIB ERASE WPBT.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the MSDN article Use the Microsoft C++ toolset from the command line for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window.
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. WPBT.C Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Create the text file WPBT.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 34 2c 20 53 74 65 66 61 6e 20 4b 61 -2024, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 02 00 57 50 42 54 00 00 00 00 PE..L...WPBT....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 02 00 00 ......#.........
00 02 00 00 00 00 00 00 00 10 00 00 00 10 00 00 ................
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
05 00 02 00 00 00 2f 03 05 00 02 00 00 00 00 00 ....../.........
00 30 00 00 00 02 00 00 89 ed 00 00 02 00 00 85 .0..............
00 00 10 00 00 00 01 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
e4 20 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 . ..<...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 20 00 00 18 00 00 00 ......... ......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
c2 00 00 00 00 10 00 00 00 02 00 00 00 02 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 63 6f 6e 73 74 00 00 9a 01 00 00 00 20 00 00 .const....... ..
00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 ....@..@........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
81 ec 34 00 01 00 68 34 00 01 00 8d 44 24 04 50 ..4...h4....D$.P
68 57 50 42 54 68 49 50 43 41 ff 15 04 20 40 00 hWPBThIPCA... @.
85 c0 75 10 6a 09 6a 20 68 ac 20 40 00 68 88 20 ..u.j.j h. @.h.
40 00 eb 78 3d 34 00 01 00 76 10 6a 09 6a 10 68 @..x=4...v.j.j.h
ac 20 40 00 68 5c 20 40 00 eb 61 8b 54 24 04 32 . @.h\ @..a.T$.2
c9 8b c2 85 d2 74 0d 02 4c 04 ff 48 85 c0 75 f7 .....t..L..H..u.
84 c9 75 3a 81 3c 24 57 50 42 54 75 31 83 fa 34 ..u:.<$WPBTu1..4
72 2c 80 7c 24 30 01 75 25 80 7c 24 31 01 75 1e r,.|$0.u%.|$1.u.
0f b7 4c 24 32 6a 09 6a 40 d1 e9 33 d2 68 ac 20 ..L$2j.j@..3.h.
40 00 8d 44 24 40 66 89 54 4c 40 50 eb 0e 6a 09 @..D$@f.TL@P..j.
6a 30 68 ac 20 40 00 68 18 20 40 00 6a 00 ff 15 j0h. @.h. @.j...
10 20 40 00 ff 15 00 20 40 00 50 ff 15 08 20 40 . @.... @.P... @
00 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
46 21 00 00 56 21 00 00 38 21 00 00 00 00 00 00 F!..V!..8!......
7e 21 00 00 00 00 00 00 49 00 6e 00 76 00 61 00 ~!......I.n.v.a.
6c 00 69 00 64 00 20 00 6f 00 72 00 20 00 75 00 l.i.d. .o.r. .u.
6e 00 6b 00 6e 00 6f 00 77 00 6e 00 20 00 27 00 n.k.n.o.w.n. .'.
57 00 50 00 42 00 54 00 27 00 20 00 66 00 6f 00 W.P.B.T.'. .f.o.
75 00 6e 00 64 00 21 00 00 00 00 00 45 00 72 00 u.n.d.!.....E.r.
72 00 6f 00 72 00 20 00 72 00 65 00 61 00 64 00 r.o.r. .r.e.a.d.
69 00 6e 00 67 00 20 00 27 00 57 00 50 00 42 00 i.n.g. .'.W.P.B.
54 00 27 00 21 00 00 00 4e 00 6f 00 20 00 27 00 T.'.!...N.o. .'.
57 00 50 00 42 00 54 00 27 00 20 00 66 00 6f 00 W.P.B.T.'. .f.o.
75 00 6e 00 64 00 21 00 00 00 00 00 27 00 57 00 u.n.d.!.....'.W.
50 00 42 00 54 00 27 00 20 00 43 00 6f 00 6d 00 P.B.T.'. .C.o.m.
6d 00 61 00 6e 00 64 00 20 00 4c 00 69 00 6e 00 m.a.n.d. .L.i.n.
65 00 20 00 52 00 65 00 61 00 64 00 65 00 72 00 e. .R.e.a.d.e.r.
00 00 00 00 20 21 00 00 00 00 00 00 00 00 00 00 .... !..........
70 21 00 00 00 20 00 00 30 21 00 00 00 00 00 00 p!... ..0!......
00 00 00 00 8e 21 00 00 10 20 00 00 00 00 00 00 .....!... ......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
46 21 00 00 56 21 00 00 38 21 00 00 00 00 00 00 F!..V!..8!......
7e 21 00 00 00 00 00 00 19 01 45 78 69 74 50 72 ~!........ExitPr
6f 63 65 73 73 00 02 02 47 65 74 4c 61 73 74 45 ocess...GetLastE
72 72 6f 72 00 00 72 02 47 65 74 53 79 73 74 65 rror..r.GetSyste
6d 46 69 72 6d 77 61 72 65 54 61 62 6c 65 00 00 mFirmwareTable..
4b 45 52 4e 45 4c 33 32 2e 64 6c 6c 00 00 10 02 KERNEL32.dll....
4d 65 73 73 61 67 65 42 6f 78 45 78 57 00 55 53 MessageBoxExW.US
45 52 33 32 2e 64 6c 6c 00 00 00 00 00 00 00 00 ER32.dll........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file WPBT.TXT
created in
step 4. to recreate the application
WPBT Command Line Reader.exe
:
CERTUTIL.EXE /DecodeHex /V WPBT.TXT "WPBT Command Line Reader.exe"
Input Length = 6528 Output Length = 1536 CertUtil: -decodehex command completed successfully.
Use the X.509 certificate to send S/MIME encrypted mail.
Note: email in weird format and without a proper sender name is likely to be discarded!
I dislike
HTML (and even
weirder formats too) in email, I prefer to receive plain text.
I also expect to see your full (real) name as sender, not your
nickname.
I abhor top posts and expect inline quotes in replies.
as iswithout any warranty, neither express nor implied.
cookiesin the web browser.
The web service is operated and provided by
Telekom Deutschland GmbH The web service provider stores a session cookie
in the web
browser and records every visit of this web site with the following
data in an access log on their server(s):