Hacking/Cracking passwords on Windows XP, 2000, and NT

Have you every been handed a desktop machine or laptop, and been told..."The information you want is on this machine, but the only employee who knew the administrator password left the company and we don't know any way to get into it."

I have on many occasions. That's when this little utility comes in handy: Offline NT Password & Registry Editor

This works so well, it's hard to believe. Originally designed to run from a boot floppy, but also available as a boot CD image (which is good because long ago I gave up my last computer that had a floppy drive), just pop this disk into the machine, make sure in the BIOS you've enabled boot from CD (or floppy if that's what you are using), follow the prompts, most of the time accepting the default answers. And when you get to the end, you have the ability to enter a blank password for the Administrator account. Let it run, eject the disk, reboot the machine, and BAM! Now that machine is owned by you!

Although I haven't tested it on every Windows version, the makers claim support for Windows NT 3.51, 4.0, 2000, XP, and 2003 including Server versions and published service packs.

Very cool, very easy, and very fast. There are other apps out there that claim to do the same thing. Some probably do, others I believe mess up your registry and might even be Trojan horses. It's a little scary to download a disk image from an unknown website and let it boot up your computer and mess with low level registry security entries. So when you are looking for an app that will break that password but nervous about which one to choose, you can safely use this one as I've used it and am very impressed. Now download this app, and go get your hack on! ;-)

Uninstalling Oracle 10g Manually from Windows XP

Oracle's installation utility has a nasty habit of leaving a lot of items behind.  I wrote this up to document what I've found you need to do to uninstall Oracle 10g manually.  This is specific to 10g and Windows XP.  Removing 9i is very similar if I remember right, but who's using 9i anymore? ;-)

The first thing you should do, is go ahead and run the installation tool to do an uninstall.  It probably will leave some things behind, but it's worth running.  Then go through this list and remove anything it missed.  This list is detailed enough though, that I believe even if you did not run the uninstallation tool, this would fully uninstall Oracle.

The most commonly missed item is to make sure you remove everything from the GAC because the uninstaller doesn't appear to.  I get to that later, but if you wanted to know the largest source of uninstallation problems, it's libraries remaining in the GAC.

After running the supplied Oracle uninstallation utility (which may or may not do some or all of the following):

Stop any Oracle services that have been left running.
Start->Settings->Control Panel->Services
Look for any services with names starting with 'Oracle' and stop them.

Run regedit and delete the following keys (some may have slightly different names in your registry):
HKEY_CURRENT_USER\SOFTWARE\ORACLE
HKEY_LOCAL_MACHINE\SOFTWARE\ORACLE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\Oracle.oracle
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OracleDBConsole
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Oracle10g_home
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OraclService

Note that the services control panel will still show the old services until you reboot.

Delete the Oracle home directory
C:\Oracle

Delete the Oracle Program Files directory:
C:\Program Files\Oracle

Delete the Oracle Start Menu shortcuts directory:
C:\Documents and Settings\All Users\Start Menu\Programs\Oracle*
Where * indicates the name of your install.  Look for and remove all Oracle directories from that location.

Remove Oracle refereces from the path.  To edit your path go to:
Start->Settings->Control Panel->System->Advanced->Environment Variables
Edit both of the environment variables user PATH and system PATH.  Remove any Oracle references in them.

Remove Oracle.DataAccess and any Polic.Oracle files from the GAC which is at:
C:\Windows\assembly\

There, now your system is Oracle free.  If you are installing a new instance of Oracle (and not just an additional DB) I recommend you do this before any new Oracle installation.
Note: I used several other websites and searches as references when developing these steps, but I was unable to find any steps that covered all of the items for Oracle 10g so I assembled them here.

Installing Oracle 10g under Mac OS X

Ok, so you want to install Oracle 10g for free (under the developer license) to your Mac OS X 10.4 Tiger computer.

There's a couple things you should know. First, Oracle 10g is only officially supported under Mac OS X Server, but it seems to work fine under plan old Mac OS X (non-server).

There's a great blog here about how to install it under 10.3:
Installing Oracle Database 10g on Mac OS X

and another blog here that covers fixes/changes needed to install it under 10.4 Tiger:
Set up Oracle 10g on Tiger

Spaces in hard drive names...unfortunately it turns out Oracle simply doesn't support spaces in its path, which it will tell you about much later in the install. That means you cannot install this on to a hard drive with a space in its name. So while they claim to support Java/Unix/Mac OS X which all support spaces in the names of files and directories, they choose not to allow that. Strange.

Oracle, if you want I'd be willing to help with your native Mac OS X development of Oracle software and installation tools. Are you listening? ;-)

Fetch Art 1.2 for Mac OS X 10.4 Tiger Released by yours truly

Just a quick note, that I've taken over development of the excellent Fetch Art application by Yoel Inbar. I finally got a version working 100% with Mac OS X 10.4.

It's available on my website here: http://www.aric.org/fetchart/

In Mac OS X 10.4 Tiger, AppleScript reports versions differently

Previously, when checking for what version of AppleScript Studio you were running under, you would need to follow these articles
Specifying Minimum Requirements for an Application and Version Constant

That state that you should check for your version with a line like this:

if (AppleScript's version as string) ≥ "1.8.2" then

Where 1.9.2 corresponds to AppleScript Studio 1.1 or later. The reason the versions are different (i.e. AppleScript reports 1.8.2 but AppleScript Studio is 1.1) is because 1.8.2 represents the version of AppleScript which came out much before AppleScript Studio came out.

Anyway, in Tiger, now it reports the version of AppleScript Studio, so that line should really read.

if (AppleScript's version as string) ≥ "1.1" then

Just a minor change that appears to have broken a lot of AppleScripts.

After updating to Mac OS X 10.4 Tiger, Project Builder doesn't work

Ok, so now that I've updated to Tiger, I've found whenever I try to open any project file (.pbproj) in Project Builder, I get an error like this:
Reason: *** -[PBXToolbar _notificationPostingEnabled]: selector not recognized [self = 0x4cf6880].

This happens even to the sample projects installed with Tiger.

I found the solution is simply to load them into XCode instead. It will ask you if it's ok to convert the project first, but every project I have done this with compiles fine in XCode. Apple is phasing out Project Builder for XCode. So, just re-associate your .pbproj files to XCode using the Get Info window.

Updating the iPod’s Firmware Requires Power Adapter for USB users

As an owner of an iPod for about two years now (first a 40GB 3rd generation, and now a 60GB iPod Photo), and having performed many software/firmware upgrades on my iPod in the past, I was stunned after upgrading my iPod Photo the other day, that after the upgrade, it insisted on being plugged into the wall in order to complete the update. I had never seen that before. What was different? I was using USB instead of FireWire.

Apparently during the writing of the new update to the firmware the iPod requires more power than USB can offer. My guess is some computers could power it fine over USB, but the USB standard is lax about power requirements, and some computers offer less power than others across their USB bus.

While the instructions after the firmware updater are run, and the graphic that appears on the iPod imply you MUST use the wall power adapter, I’ve found that connecting the iPod to my car cigarette lighter adapter, and to my computers 6 pin FireWire port also allowed it to flash its firmware successfully. So apparently it is only 4pin FireWire and USB connections that require an alternate power source.

This was a problem for me, however, as I normally carry my iPod around without the power adapter, or FireWire cable when I’m traveling, as my home laptop is a PowerBook, but my work/travel laptop is a Windows machine that I connect to via USB. Luckily I was able to connect it to someone’s car charger while I was traveling to complete the update, however, I think Apple should put a large orange sticker on the USB cable included with the iPod warning users that you could be stuck with a non-working iPod if you travel with only the USB cable and NOT the power adapter, and choose to do a software update. They should at least, when running the updater software, warn the user they will need a power adapter to complete the firmware update. They allow you to run the update enough off of USB to disable your iPod, but not restore it.

Anyway, here is the graphic on the iPod screen you will be presented with when you do a firmware update, and do not have a power adapter:


The safest thing to do, I guess, is never do a firmware update when traveling without your power adapter.

I found some discussions about this here as well: iPodlounge

Bug in Word 2003 Multiple Image Picture File Import with AutoCaption and a VB Script I Wrote to Import and Caption Multiple Image Files Correctly

Until Microsoft Word XP there was a huge oversight in image import, that I would call a bug, but most would probably just consider a design flaw. In versions of Word prior to XP and 2003 (up to and including 2000) the insert picture command only allowed inserting one image at a time. So, for example, if you went into Insert->Picture->From File… and tried to select more than one image in the file selection dialog, you were out of luck. Thankfully that feature was introduced in Word XP and continues in Microsoft Word 2003. (Incidentally, Microsoft Word 2004 for Mac still does not allow the selection of more than one image at a time under that same menu option, which I consider a serious flaw. This is one example of where the Windows version of Word is superior to the Mac OS X version. And in Word 2004 for Mac, dragging and dropping multiple image files onto a Word document, only results in one of the images being inserted, which I do consider a bug as that is not how any other Mac application behaves.)

Ok, so I needed to put together a report containing several hundred UML diagrams. The diagrams had already been exported in .WMF format, which Word can read, and since I was using Word 2003, I was able to select all of them for import at the same time. I thought my problems had been solved.

However, I also needed Word to AutoCaption (and number) the images, just with a simple caption, like “Figure 10” under each one. So I turned on AutoCaption for importing images (you do this by selecting Insert->Caption… and then clicking AutoCaption in the dialog and then selecting the type of files you want captions to be added to on import.)

Perfect. I had AutoCaption setup to put the word “Figure” and an auto incrementing number after that on every image I imported. I selected my several hundred image files, and told Word to import them. That’s when we found a pretty major bug in Word 2003.

To demonstrate this bug, let’s simplify the task a bit. Let’s say I have three images of cats I want to import and AutoCaption. While I expected, when I imported them to look like this:


Instead, it came out looking like this:


That’s a pretty serious bug as no one would ever want that behavior, and it seems pretty obvious that no one ever tested multiple image file import with AutoCaption on before shipping Word 2003. Since it has been out for over two years now, I don’t have high hopes of it getting fixed anytime soon.

So how did I solve this problem? I wrote a VB script that does the import and captioning for you. I’ve included the source here. Hopefully it will help anyone else who comes across this bug.

Here is the script:

Sub InsertImagesWithCaptions()

Dim fso, d1, file, fileName
Set fso = CreateObject("Scripting.FileSystemObject")
fileName = "C:\Documents and Settings\aric\My Documents\My Pictures\Cats"
Set d1 = fso.GetFolder(fileName)
For Each file In d1.Files
    Selection.ParagraphFormat.Alignment = wdAlignParagraphCenter
    Selection.TypeParagraph
    Selection.InlineShapes.AddPicture fileName:= _
        file, LinkToFile:=False, SaveWithDocument:=True
    Selection.TypeParagraph
    Selection.InsertCaption Label:="Figure", TitleAutoText:="", Title:="", _
        Position:=wdCaptionPositionBelow, ExcludeLabel:=0
    Selection.ParagraphFormat.Alignment = wdAlignParagraphCenter
    Selection.TypeParagraph
Next
End Sub

You'll have to customize the fileName path to point to the directory containing the images you want to import, but that's a lot simpler that manually importing them and captioning them.

BTW apparently even though Word 2004 for Mac supports VB macros, it doesn’t understand CreateObject. If anyone knows how to get a directory like this in VB in Word 2004 for Mac OS X, let me know, and I’ll post a Mac version of this script as well.

Multiple Conflicting FireWire Enclosures from the Same Manufacturers

I currently use a Titanium PowerBook as my primary computer. However, I’m also a power user and a laptop has a limited amount of upgradeability. That means I have a lot of external devices connected to my laptop using FireWire. FireWire supports 63 devices which is great for someone like me and I’m nowhere close to 63. I have three external hard drives (two 250GB 3.5” and one bus powered 30GB 2.5”), two external DVD burners (a Pioneer 109, and a Pioneer 104), one external CD-RW burner (a Plextor W4824A), and an iPod as well as a 6 port FireWire hub. That’s only 8 devices. Not very close to the limit of 63, however, when I added my latest DVD burner (the Pioneer 109), I had a lot of problems. I eventually solved them, and I’m writing down my experiences so hopefully someone can learn from my pain.

---

In short…
It turns out, that FireWire devices have unique IDs similar to the MAC address on Ethernet devices. Some manufacturers use the same ID on all of their devices, which causes problems if you connect two devices from the same manufacturer to your computer. My guess is the FireWire people told the manufacturers they needed to supply unique IDs, however, somewhere along the line, that information didn’t make it to the assembly line personnel.

I’ve seen this problem with enclosures from Plumax and Acomdata and I’m sure many other manufacturers out there are doing this as well. I can also say for certain that the Mercury Elite Pro 3.5” enclosures do not suffer from this problem, as I’ve been using two identical ones for a while without fail. In fact, these are my favorite FireWire 3.5” enclosures, and I highly recommend them. You can get them here:
Other World Computing

---

I’ll describe how I fixed the problem below by manually changing the FireWire ID. I spent most of the time trying to isolate the problem, and then reading detailed specifications about the Oxford FireWire bridge chipsets (thanks to Oxford making their information available for download in PDF format!). But I’m getting ahead of myself.

First of all, this applies to enclosures that use the Oxford FireWire chipsets. I believe it applies to 911, 911+, 912, and 922 chipsets. Although I specifically was working with 911+ and 912. If you have an enclosure that uses a different chipset, such as Prolific, I don’t know how to help you. I’ve worked with enough enclosures to know that when you are shopping, you want to make sure you get one that has an Oxford chipset in it. All other brands have received reports of bugs and data corruption issues, that I ignored, until I lost data that I was able to trace back to a problem with the Prolific chipset. Since then, I will only buy Oxford (I should write another entry just covering that experience!) There are probably ways to do this for the other chipsets, I just don’t know what it is. I believe Prolific, and Initio are the other FireWire chipsets. Not sure of any other brands.

Second, flashing or modifying firmware can toast your enclosure. For some reason while following the instructions that worked previously and using the same flash software, I erased a 911+ chipset, and was never able to upload a new firmware to it, rendering the enclosure unusable. If anyone knows how to revive a 911+ that claims it’s ready to be flashed, but just seems to ignore the flash, contact me. So standard disclaimer…you do this at your own risk.

This should apply to Windows as well as Mac or Linux and other supported Unix computers. The flash software I’m going to discuss is Java based, so it’s cross platform. How Oxford got a Java app to access FireWire hardware is beyond me, unless they are imbedding some OS specific binaries in there. If someone from Oxford Semiconductors wants to contact me, I’d love to chat!

---

Ok, so let’s assume, you’ve purchased two new identical model enclosures for those two new drives you just got. And you’ve found, like I did, that whenever both of them were connected and powered on, your computer had a terrible time talking to them. Some of the symptoms were:
Incomplete directory listings
Long pauses when accessing either drive
One drive never mounting/showing up on the desktop
And occasionally, when I told one drive (a DVD drive) to eject, it would eject the other drive. It was at that point I realized that the computer wasn’t able to tell the drives apart.

Basically there are two reasons to muck with your firmware. You can upgrade to the latest version (which was my goal at first, although that didn’t solve my problems) and you can also edit some of the “advanced settings” of the drives, which are stored in the flash memory as well. It’s worth noting, that you can update the settings in flash memory without actually flashing a new firmware, which makes changing the settings a bit less risky than uploading new firmware.

Now that you’ve identified the problematic enclosures, and verified that they are running Oxford chipsets, it’s time to start getting some software that lets us mess around with the internals. I found the software by searching in many places, and was able to verify the latest version, at this time 1.64, was here:
Cool Drives FireWire Info
Specifically, the 1.64 Java updater/uploader/cloner apps for Mac OS X:
uploader_164.zip
Since it’s Java you would think that would work on Windows too, however they list a separate Windows version here:
windows_uploader.zip

Ok, if you want to get some more recent firmware you can get it from links I supply below. When I download the flash apps, they didn’t usually include the firmware files, although they had directories where you could put your own.

Anyway, they recommend that you disconnect all other FireWire devices except the one you want to work with. I just powered them down, so the only things that were active were my FireWire hub and the drive I wanted to mess with.

Then I launched the uploadergui.jar file.


Right away this found my Oxford based drive, and brought up the firmware information on it. It looked like this:


I then clicked the Modify Configuration button. If that button is grayed out, make sure you launched uploadergui.jar and NOT updatergui.jar. You should see something like this after clicking the Modify Configuration button:


Note the all important Chip ID Hi and Chip ID Lo fields. The reason I even thought to start messing with them, is because the other app that came with the uploader is called the clonergui.jar. It’s designed to take the already flashed firmware from one device and propagate it to other identical devices. It stresses that every time it uploads a clone, that it will increment the chip id by 1 for every device it flashes. Unfortunately, it didn’t make it clear to me if it only changed the Chip ID Hi or Lo or both fields. I’m guessing it simply added 1 to the hex value in the Chip ID Lo field. To be safe, I modified the values in both fields, just changing a number in each position and incrementing it by a value of one. So for example, I think Chip ID Hi, was 02, so I changed it to 03. If someone wants to clarify the usage of the Hi and Lo values, feel free to contact me. Anyway, after changing both values, I simply clicked the Upload Changes button. After that, everything started working. Obviously I only had to change that value for one of the drives, and could keep the other drive at its factory default.

While this sounds pretty simple now, it took me a lot of research to find all this information. None of it was sitting in one place. Hopefully this entry will help someone else out in the same situation. And maybe more importantly, Plumax will start making their Chip IDs unique.

Links that helped me solve the puzzle:

Thank you for the latest 1.64 updater utility.
Cool Drives

Latest firmware files, and some good info.
FireWire Depot

Thanks for making the awesome Oxford FireWire chipsets.
Oxford Semiconductor

Detailed guide on using the flash uploaded app.
Uploader Guide in PDF

I think this is the same guide as I listed before with some other chipset documents.
More docs at Oxford

Firmware 1.02 for 912 chipset:
912_v1_02.bin

Firmware 4.00 for the 911 chipset (I believe this includes the 911+ chipset):
911_v4_00.bin

Firmware 1.07 for the 922 chipset:
922_v1_07.bin.zip

Borland Together Software Bugs and Fixes

Ok, I've ran into a lot of issues with Borland's Together Architect and Control Center 6.1 software. (Architect 6.2 is the successor of Control Center 6.1, however, I've been using both, as there are some incompatibilities between them.)

Did your model stop working?
I ended up with a model, that once it was open, hardly any menus in Together would work. The menus would appear, but selecting an item, had no affect. For example, selecting Project->Properties, never displayed the property dialog. The behavior occurred right after adding some Favorites. If you get into a situation where no menu or buttons actually have any affect (even selecting Exit doesn't close the application) try opening your .tws file in a text editor and removing the favorites entries. They should look something like this:

favorites.root.0 = <oiref:cpp#Class#ClassName1:cpp>
favorites.root.1 = <oiref:cpp#Class#ClassName2:cpp>

I simply deleted all the lines in that file with favorites entries, and reloaded the project, and now Together started working again. This was in version 6.1.

Incompatibilities Between Together
Architect 6.2, and Together Control Center 6.1
Together Architect defaults to using the old (non XML) model
format to maintain backwards compatibility with previous
versions.  That's great, in theory, however I've come across some
problems.  I'll try to list them here as I discover and verify
them:

1. Sequence diagrams created in 6.2 are not seen/ignored by 6.1


2. I've seen instances where Favorites added in 6.1 are not seen
   when loaded into 6.2 although this doesn't always occur.

That's it for now.  I'll keep coming back and updating this list
as I find issues.