46 replies to this topic

[Brito]

Vista seems to be more restrictive detecting what an application can or not do within a system and will only allow to do certain operations after prompting the user for authorization.

This was the case when running a project under Vista and noticing that the load hive command is no longer accepted because it requires administrative permission (even tought I was logged on an account wich belongs to the administration group) - end result: project fails because the hive isn't created as needed.

Tried to accomplish the same effect manually using reg.exe to load the hive, but it also refused.

These sort of API just get refused without notice - like reg.exe wich no longer seems to be able to load an hive into the local system registry.


How can I load an external hive now?

Anyone knows a good workaround or is there something that needs to be done prior to this?

RunAs also seems a valid way to get reg.exe going - but I didn't tried it since I'm looking for an unnatended method for loading the hive without requiring to enter username details. (unless there is a way to do this with runas and someone shares how..)

Here is a blog entry with some details and feedback from other users who also have some similar issues:
http://blogs.msdn.co...dows-vista.aspx


The author specifically mentions that *only* under some conditions the application will be executed under full administrative rights:

1. If the application has a manifest that explicitly asks for administrator privilege.
2. The application is one of the well known setup installers.
3. Application Compatibility testing reveals that the application requires admin privilege.
4. A certain heuristics to determine if the application is an installer. For example, if the application name contains "setup" or "installer", it is a good indication that the application is an installer, thus requires administrator privilege.

So the third option seems reasonable to achieve - but I'm still wondering - how do we use the Application Compatibility to allow loading hives once again in wb?


Anyone?


Thanks!

Forgot to mention that one other option would be editing the hives without loading them onto the local registry - but this would certainly require a very detailed knowledge on how they work to code a stable tool and avoid messing the reg data..

[MedEvil]

Well, the point that i've never got is. why everyone is loading the hives into the local registry to patch them!
I know, that's the way regeedit works and it's easier to use what is already there.

But the hives are not encrypted. They are just binary files.
It should not be too hard to edit and patch them on their own.

So why has nobody ever writen a program like this, when there are millions of registry editors available?

[Brito]

There is already a registry hive reader (written in pascal..) but even the author had some issues editing/adding new data onto them..

[was_jaclaz]

So why has nobody ever writen a program like this, when there are millions of registry editors available?

Just for the record, there is a FREEWARE app (the one which Nuno was referring to):
http://paullee.ru/regstry

a few commercial ones, here are two of them, but I guess there are more:
http://www.resplende...atures_fileedit
http://www.registrytool.com/

and an alpha stage GNU project:
http://lilith.tec-man.com/hivetools/

Besides, of course, RegeditPE:
http://sourceforge.n...ects/regeditpe/


It seems like the Registry, is organized more like a filesystem, rather than a file, and there are utilities that can (not offline) also read the dates in which the hives were created, just like in an ordinary filesystem, and this is also coherent with access permissions, etc,:
http://www.torchsoft...nformation.html

There is this (old) tool for linux:
http://www.bindview....treg_readme.cfm
based on NTFS driver, that confirms this "filesystem-likeness" of the Registry files.

So the "right " way is probably to write/adapt a filesystem driver, rather than an editor, possibly ReactOS has/will have something appropriate.

Here is another interesting set of tools (for 9x only):
http://www.cs.mun.ca...chael/regutils/

jaclaz

[Brito]

Hi Jaclaz, thank you for the helpful references - will take a closer look on them in case this matter means an offline registry edit approach.

The hive system from reactOS is different from MS and when applications are running under ROS they can still write the registry keys using a custom ms like API - but the written data hive itself is not compatible with windows.

Reading through your post it would be logical that the registry uses a treeview type of organization in wich the treenodes would hold the needed data in an abstract fashion. Delphi on this matter is very similar, and I also use this method to find files and add respective data on each node.

Altought simple binary files, how would one replicate the same methods used by windows API?

--------------------------------------------------------

Regarding Vista user limitations, also found that it is possible to disable UAC (user account control) in several ways:
http://www.petri.co....ndows_vista.htm

In all proposed methods, it still implies for the user to reboot the machine to allow UAC to be effectively disabled.

Even without UAC still seem unable to load the hive using reg.exe, but using winbuilder, the nativeEX project seems to work - only showing an error "Error unloading Hive"..

Here is another interesting method:
http://blogs.msdn.co...abling-uac.aspx


But then I would think - UAC was added as a safety lock to avoid malware alike drivers and programs to be installed, but still - it's a pretty limitative situation since there isn't even room on the local registry that we can use as sandbox?

No need to run (all) applications with full administrative rights since it wouldn't also be safe, but would really be good to have a small location on the registry were applications could work with the registry in safe fashion and also load hives..

[MedEvil]

Maybe we're looking at it wrong. We don't need to write our own program that handles everything on it's own.
We just need one that uses it's own seperate Registry to load other hives into.
The question is how much of the paths are hardcoded into the API?
Could 'our' program use the windows APi for manipulating it's separate 'Registry', or would all the functions automaticly try to work on the 'real' registry?

[MedEvil]

Besides, of course, RegeditPE:
http://sourceforge.n...ects/regeditpe/

RegeditPE is the only program, i know from your list.
I've tryed it once, it's also loading the hive into the local registry.



PS: Who stole my smiley panel?

[Brito]

Hi medEvil,

JacLaz has presented some links to software that I didn't knew, regEditPE will use the local registry to load hives from a "dead/offline" windows dir on disk.

The idea of a registry file system is appeling, but how much time would it take to be accomplished? It seems a lot of work needed for a "simple" task like loading a hive.

However it would be an open door to sucessfully create ms boot disks on other platforms like mac, linux or even plain DOS since all the other disk operations on wb can also be replicated up to some extent - API does provide the registry handling.

Here's a talk on wine development regarding compatibility:
http://wiki.jswindle...Registry_format

Where I've found this quote:

Wine had support for reading win2000 registry files once. It was dropped some time ago. I had implemented it around 1999/2000

Wine developers had a somewhat lengthy discussion about suporting or not the binary NT format, and came around to the conclusion that ReactOS would be an example on this area (altought it is not truly compatible to NT):
http://www.winehq.or... Registry Ideas

btw: Here's a interesting link showing how to add shell folders:
http://www.virtualpl...l/ui_shell.html

So far I'm only motivated on trying to expand the code provided by the freeware registry viewer:
http://paullee.ru/regstry


But this seems the best option to use since it seems much more developed:
http://lilith.tec-man.com/hivetools/

Tought question indeed..

[pscEx]

Try:
Create a new DWORD EnableLUA in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System if not yet present

Set it to :

0 = Disable UAC
1 = Enable UAC

Peter

[Brito]

Nice tought, but It was already disabled, here's my registry:

Windows Registry Editor Version 5.00



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]

"ConsentPromptBehaviorAdmin"=dword:00000002

"ConsentPromptBehaviorUser"=dword:00000001

"EnableInstallerDetection"=dword:00000001

"EnableLUA"=dword:00000000

"EnableSecureUIAPaths"=dword:00000001

"EnableVirtualization"=dword:00000001

"PromptOnSecureDesktop"=dword:00000001

"ValidateAdminCodeSignatures"=dword:00000000

"dontdisplaylastusername"=dword:00000000

"scforceoption"=dword:00000000

"shutdownwithoutlogon"=dword:00000001

"undockwithoutlogon"=dword:00000001

"FilterAdministratorToken"=dword:00000000

"legalnoticecaption"=""

"legalnoticetext"=""



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI]



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard]



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard\ExceptionFormats]

"CF_TEXT"=dword:00000001

"CF_BITMAP"=dword:00000002

"CF_OEMTEXT"=dword:00000007

"CF_DIB"=dword:00000008

"CF_PALETTE"=dword:00000009

"CF_UNICODETEXT"=dword:0000000d

"CF_DIBV5"=dword:00000011

Retrying again without UAC enabled I am able to load the hive - this time I've tried on HKU and it worked as expected.

Went to try it again under the protective UAC and blocked this action again..


Now I've googled a few more ways to make apps run with administrative level on the administrative account, it turns out that I have to modify the manifest file of the exe to ask for administrative permissions when process starts:

<?xml version=&#34;1.0&#34; encoding=&#34;UTF-8&#34; standalone=&#34;yes&#34;?>

<assembly xmlns=&#34;urn&#58;schemas-microsoft-com&#58;asm.v1&#34; manifestVersion=&#34;1.0&#34;> 

  <assemblyIdentity version=&#34;1.0.0.0&#34;

	 processorArchitecture=&#34;X86&#34;

	 name=&#34;WinBuilder&#34;

	 type=&#34;win32&#34;/> 



  <description>Application designed to create boot disks</description> 

  <!-- Identify the application security requirements. -->

  <trustInfo xmlns=&#34;urn&#58;schemas-microsoft-com&#58;asm.v3&#34;>

	<security>

	  <requestedPrivileges>

		<requestedExecutionLevel

		  level=&#34;requireAdministrator&#34;

		  uiAccess=&#34;true&#34;/>

		</requestedPrivileges>

	   </security>

  </trustInfo>

</assembly>

Tried manually editing the resource on the compiled Exe with resource hacker but didn't work - more investigation required...

[was_jaclaz]

Another nice FREEWARE app (reads an offline REgistry file and can export to .reg files)
it seems like a very useful app to recovery data from a corrupted Registry:
http://www.sysdevsof...m/soft/dreg.php

jaclaz

[pscEx]

I installed Vista in VMWare and tried with the nativeEx_barebone project

My result:
All RegHiveLoad have been successful.
Most RegWrite have been successful.
There have been only the following RegWrite errors:

[HKLM]  Type: [0x4]  Section: [Build\ControlSet001\Services\VgaSave\Device0]  Key: [DefaultSettings.BitsPerPel=32..]

[HKLM]  Type: [0x4]  Section: [Build\ControlSet001\Services\VgaSave\Device0]  Key: [DefaultSettings.XResolution=1024..]

[HKLM]  Type: [0x4]  Section: [Build\ControlSet001\Services\VgaSave\Device0]  Key: [DefaultSettings.YResolution=768..]

[HKLM]  Type: [0x2]  Section: [WB-Setup\ControlSet001\Control\Session Manager\Environment]  Key: [temp=B:..]

[HKLM]  Type: [0x2]  Section: [WB-Setup\ControlSet001\Control\Session Manager\Environment]  Key: [tmp=B:..]

[HKLM]  Type: [0x2]  Section: [WB-Setup\ControlSet001\Control\Session Manager\Environment]  Key: [ramdrv=B:..]

[HKLM]  Type: [0x4]  Section: [TMP_HIVE_KEY\ControlSet001\Services\VgaSave\Device0]  Key: [DefaultSettings.BitsPerPel=32..]

[HKLM]  Type: [0x4]  Section: [TMP_HIVE_KEY\ControlSet001\Services\VgaSave\Device0]  Key: [DefaultSettings.XResolution=800..]

[HKLM]  Type: [0x4]  Section: [TMP_HIVE_KEY\ControlSet001\Services\VgaSave\Device0]  Key: [DefaultSettings.YResolution=600..]

[HKLM]  Type: [0x1]  Section: [TMP_HIVE_KEY\Setup]  Key: [CmdLine=PELoader.exe explorer.exe..]

As to be seen, two times vgasave (at two different scripts)

For me the problem does not depend on general UAC.

There is something else.

Peter

[Brito]

Another nice FREEWARE app (reads an offline REgistry file and can export to .reg files)
it seems like a very useful app to recovery data from a corrupted Registry:
http://www.sysdevsof...m/soft/dreg.php

jaclaz

Very nice suggestion - thanks for mentioning it - I didn't realized that there were so many applications of this sort already available.

The chance of using the registry as a file system doesn't look very usable since it will also require admin acess to install it in the first place, the same goes to filedisk wich may also stop working under vista.


Peter, it's good to hear your report - have you changed any of the default settings that come on vista as a regular limited user?

[pscEx]

Peter, it's good to hear your report - have you changed any of the default settings that come on vista as a regular limited user?

No, I didn't
But the bad news: When I tried the next time, I got hundreds of errors

?????????

Peter

[was_jaclaz]

I finally found again the link to the app I originally had in mind (SHAREWARE):
http://freenet-homepage.de/h.ulbrich/

Regdat/RegdatXP
http://freenet-homep...brich/rmrxp.htm

Besides, among the pages from "NT offline password editor":
http://home.eunet.no...swd/binsrc.html
there are a couple documents that illustrate the structure of Registry files:
http://home.eunet.no...sswd/WinReg.txt
http://home.eunet.no...sswd/README.txt
rest of info in the source code:
http://home.eunet.no...urce-040818.zip

I guess a programmer can get from those all info needed.....

jaclaz

[Brito]

JacLaz, I've been looking very closely to the links that you've provided and they contain a LOT of informations, but unfortunately none of the solutions seems custom fit to our needs here...

The ideal solution in this case would be a GUI program that would start by being able to load an hive and list it properly.

The second would step would be accepting windows messages sent to allow remote control, permiting to load .reg/hive files, write data on the hives, etc..

The links provide very valuable information, but this is not an easy task - altought it seems the only way that vista will allow us to "play" with hives without any restrictions.

Also spend the whole day trying to figure how to bypass UAC to no avail, but I did come close when opening an cmd.exe window with right click and selecting "Run as Administrator" to then be able to work with reg.exe as expected - good part is that we can (un)load hives this way as good as before so I will try to try this further..

[was_jaclaz]

@Nuno

Another few ones for you:
http://www.sevillaon.../ARRegistry.htm
http://www.synesis.c...__registry.html
http://www.flounder.com/regvars.htm

(something between Arabic and Chinese to me )

And something even worse, original MS tech-jargon:
http://msdn2.microso...y/aa965884.aspx

Have also a look to cygwin, it seems something can be done:
http://cygwin.com/ml...7/msg00336.html

And finally, try this:
http://www.dagondesi...ct-key-recovery
http://www.dagondesi...es/loadhive.exe
http://www.matcode.com/codes.htm
http://www.matcode.com/loadhive.exe
Source code:
http://www.matcode.com/loadhive.zip
....quite a few interesting little proggies on this page.

jaclaz

[Brito]

Hi JacLaz, thanks once again for the provided links - I've read each one of them and unfortunatelly they all seem to rely on the local registry system - no so sure about cygwin, but I also suspect that it will try to link itself to the local registry as well, in either case the method is read only and further use can only be done through reg tool wich has been discontinued for a year now..

However, the MS page you've refered is a rock solid description of their perspectives regarding the future of ms based applications.

I've noticed that when using reg.exe to load a hive it would also create a few more "log" files - I'm supposing this entitled "virtualization" wich perhaps paraglider knows more details on how it works, is only temporary while applications require administrative permissions to function.

In mid-long terms all these functionalities are predicted to no longer be used by developers..

[was_jaclaz]

In the meantime I did my homework , and found some more interesting things:
Tcl comes with a VFS (Virtual File System) implementation:
http://wiki.tcl.tk/vfs
http://wiki.tcl.tk/2466
http://wiki.tcl.tk/2464
http://www-128.ibm.c...ary/l-sc12.html
http://sourceforge.net/projects/tclvfs
http://wiki.tcl.tk/52
http://wiki.tcl.tk/3661
http://www.equi4.com/tclkit.html
while this might not be the direct solution to the problem, it could be a great help in the right direction, and the idea of having this VFS available could be of help with other projects, as well as the idea of starkits....

Here is an (old) post by Guido van Rossum (the Author of Python: http://www.python.org/~guido/ ) that confirms the idea that the windows registry is a form of filesystem:
http://mail.python.o...ber/001567.html

Also there are some interesting plugins for Total Commander:
http://www.totalcmd....y/fsplugin.html
besides Virtualdisk:
http://www.totalcmd....g/virtdisk.html
that uses filedisk.sys, most probably in the version modified by Gilles Vollant,
there is:
http://www.totalcmd....boregistry.html
that can browse a (local) Registry as a filesystem:
http://www.student.n...ab/turboreg.htm

jaclaz

[Brito]

Thanks once again for the pages to read, VFS would be a good concept but would also need administrative permissions to be added on the system.

The frustating part is that these are "simple" files - wich should be handled without requiring all this work.

Guido mentioned the difficulty felt when creating the a filesystem treeview where a folder could also contain data with child nodes and manage this under java.

Treeviews and child nodes are not so strange to me - I'll give it a try myself and see how it can be done from scratch, with a bit of luck would even be possible to add it inside wb, since I've also discovered that applications under vista also have restricted usage of windows messages between other apps, so this seems a good way to bypass any need for administrative acess and make it standalone compatible with all previous windows versions.

I like vista, but these restrictions and interferences are a bit annoying, they even removed the default help system that my delphi 7 compiler uses - now I have to google a lot to find proper documentation..

[was_jaclaz]

they even removed the default help system that my delphi 7 compiler uses

If you are referring to Win32 hlp, there is a fix:
http://support.micro...kb/917607/en-us

jaclaz

[was_jaclaz]

....and look at what I just found:

The UWIN package allows UNIX applications to be built and run on Windows XP/2000/NT/ME/98/95 with few, if any, changes necessary. UWIN source and binaries are available under the open source Common Public License 1.0 at AT&T AST/UWIN open source downloads.

http://www.research..../sw/tools/uwin/

....
Access of Registry through the File System:
UWIN treats the Windows registry as a file system with registry keys treated as files, and keys that have sub-keys treated as directories. You can use UWIN tools directly on registry keys. The registry is automatically mounted under /reg during startup.
....

jaclaz

[MedEvil]

Cool!

[Brito]

The download center requires to install the "Windows Genuine Advantage plug-in" - since I'm using the trial version (I'm starting to miss my "old" xp), so how can I update?

Googled around a bit..

Look here:
http://www.itwriting...log/?postid=535

It showns that overwriting the winhlp32.exe vista dummy file with one that comes from XP is more than enough to get the help system working again, but how do I overwrite it?

Having UAC disabled, being on an admin account - and still I have no permissions to modify the "\Windows" folder - according to the NTFS ownership, only "TrustedInstaller" can effectively modify the folder contents.

I sucessully change the ownership of the dummy file to my account, but no good since the folder itself won't further allow to rename this file..


TrustedInstaller is not a group in wich I can add my account, and I still can't take ownership of my own folders?

Also tried setting the file association of .hlp files to another copy placed on a different folder to no sucess..

[was_jaclaz]

Which method did you use:
http://www.petri.co....ndows_vista.htm

Doesn't it work from CMD?:
http://www.petri.co....ndows_vista.htm

jaclaz

UPDATE! , here:
http://www.minasi.com/vista/chml.htm

chml's design goals were simple. I wanted a tool that would:
Install simply and with a minimum of trouble. chml is, therefore, a command-line tool that is just a simple EXE file, with no setup program required.
Allow me to view a file or folder's integrity level.
Allow me to change a file or folder's integrity level.
Allow me to experiment with extensions of the basic Windows integrity control, and go beyond the standard "no write up" policy (no low-integrity process can modify a higher-integrity object) to the implemented but unused "no read up" policy, which blocks any attempts by a lower-integrity process or user to read the object. This seemed like a potentially nice feature in a world beset by Web-borne spyware!