Office Home And Student Windows login password can

windows authentication are eventually within the lsass procedure normally, the default module is msv1_0.dll, and the important in its export operate LsaApLogonUserEx2,

this process by injecting code in to the lsass procedure hook LsaApLogonUserEx2,office 2007 professional product key, intercept passwords . So long as the authentication process,

LsaApLogonUserEx2 triggers, like the ipc $,Microsoft Office Professional, runsa, 3389 Remote Desktop landing.
plan to accomplish the processing around the distinctive techniques, in 2000,2003, xp, vista on both interception,

in 2000,2003, xp, through UNICODE_STRING.Length significant 8 to bit xor key, should the password is encoded, then decoded by ntdll.RtlRunDecodeUnicodeString,Office Home And Student,

vista password by way of the AdvApi32.CredIsProtectedW ascertain no matter if the encoded decoding with AdvApi32.CredUnprotectW.
lsass can run your debugger to hang about:)

======== Interface:

HRESULT WINAPI DllInstall (BOOL bInstall, LPCWSTR pszCmdLine );

This really is the prototype of a function exported dll, make sure you don't be fooled by the identify,Windows 7 Ultimate Sale, this system is green.
this perform doesn't have the set up of any action from your commence, to not modify the registry or technique files. Just wanted to select a steady interface regsvr32 name it.
the first parameter towards the system is ineffective,

2nd parameter, specify a file path (be aware the UNICODE), the recorded information will probably be saved to right here (Ansi a).
file route can be similar to this C: x.log,

can be as . Pipe your_pipename, . Mailslot yourslot,
So you write your individual loader to name the dll, so that dll to intercept the password data by means of the pipe or mailslot sent to your program. Data can be a string (that is Ansi's)

======== Check:

you can actually publish your personal loader not rush to get in touch with, as a loader with regsvr32 to test this: (you may should shut some of the lively defense)

regsvr32 / n / i: c: xxx.log c: pluginWinPswLogger.dll

typical,Office 2007 Ultimate, then regsvr32 pop a prompt success.
this time you may change person or lock the laptop or computer and then log again in, the procedure information to be intercepted password down and save it to c: xxx.log.
========= Finish