Programming on Remko's Blog

PNAgent Icon Data Algorithm

Thu, 08 Aug 2013 17:34:05 +0000

Some time ago I wrote about the PNAgent data that is stored in the registry in XML format.

After that post Andrew Morgan asked me if I could extract the PNAgent icons from the XML data.

That got me interested so let’s look at this data!

If you look at XML from PNAgent the icondata as in the AppData.Details.Icon node you’ll see something like this:

Seems like the icon data is stored/encrypted in a proprietary format.

Programmatically set Excel LinkedCell property with VBA

Wed, 22 May 2013 11:36:48 +0000

Yesterday I was working with an Excel document that contained Combobox form controls.

I wanted to count the number of cells containing a particular value using the COUNTIF formula. However the count returned 0 because the LinkedCell property of the Combobox was not set to the Cell that contained the Combobox.

To set the LinkedCell Ctrl-Click the Combobox to select it, right-click and select Format Control. Then set the correct Cell in the Cell link field:

My sheet contained about 150 Comboboxes, so obviously I was going to do this using a script. I couldn't find anything useful with Google so I wrote my own Macro.

Scriptable Citrix Password Encoder

Tue, 19 Mar 2013 16:27:49 +0000

A while ago I published a tool to Encode and Decode Citrix passwords. Today I am publishing a small update to this tool that makes it scriptable by adding a COM interface.

If you start the tool without parameters you will get the GUI, just like before:

To use the COM interface you first need to register the executable with the /regserver switch:

After the registration you can call it using any language that supports COM. To get you started I wrote a few examples

MSCOMM32.OCX returns error 80040112

Wed, 13 Mar 2013 15:58:39 +0000

Yesterday I wrote about troubleshooting an application that used Com Port redirection in Citrix.

During the troubleshoot I noticed that the application used an ActiveX component, MSCOMM32.OCX, for serial communication.

I wanted to quickly test if the component was correctly registered so I searched the registry from HKEY_CLASSES_ROOT for mscomm32.ocx.

Cannot redeclare class Snoopy

Mon, 14 Jan 2013 19:31:34 +0000

After installing a new Plugin in WordPress called Native Apps Builder I got the following error when I tried to go to the Plugin's settings:

Fatal error: Cannot redeclare class Snoopy in www/blog/wp-content/plugins/native-apps-builder/appsbuilderapi.php on line 34

This error is caused because a class named "Snoopy" is being declared twice. I figured that two plugins were incompatible with each other so I first needed to know which ones.

Decoding Citrix IMA Datastore Password

Tue, 29 May 2012 21:46:30 +0000

This morning Arjan Beijer sent me an interesting link to a youtube video about obtaining the Citrix IMA Datastore password using Windbg.

The video shows a method, discovered by Denis Gundarev to obtain the IMA Datastore password. Basically he uses DSMaint.exe and set’s a breakpoint on the call to CryptUnprotectData and then reads the password from memory.

I tried to call the CryptUnprotectData API with the data read from the registry directly but this failed with error NTE_BAD_KEY_STATE, this is defined in winerror.h and it means “Key not valid for use in specified state”.

Changing the RNS 510 startup logo

Wed, 31 Aug 2011 17:20:18 +0000

I wrote earlier about the startup logo's on the Volkswagen RNS 510 navigation.

Today I can finally tell you that I succeeded!
I changed the startup logo to the logo from the MFD2 DVD as you can seen on this picture:

GetUserObjectInformation fails with Access Denied

Tue, 16 Aug 2011 21:11:01 +0000

Today I was reusing some old (pre vista) code the retrieves the Logon SID that I wrote a few years ago. The Logon SID is a special SID that identifies a logon session that has the form S-1-5-5-X-Y.

You can view your Logon SID with Process Explorer, right click a GUI process, select Properties and goto the Security Tab:

GetTokenInformation with TokenLinkedToken returns error 1312

Thu, 11 Aug 2011 11:30:47 +0000

The GetTokenInformation function can be used with the TokenLinkedToken Information Class on Windows Vista and higher to the linked (Elevated) token.

This is useful when User Account Control is enabled and you want to launch an elevated process e.g. from a service.

Programmatically Check if User Account Control is Enabled

Thu, 11 Aug 2011 11:27:13 +0000

Snippet below can be used to programmatically determine if User Account Control is enabled:

objectpascal Download

uses
 JwaWinbase, JwaWinNt;

function IsUACEnabled: Boolean;
var
 hToken: THandle;
 tet: TOKEN_ELEVATION_TYPE;
 dwSize: DWORD;
begin
 Win32Check(OpenProcessToken(GetCurrentProcess, TOKEN_QUERY, hToken));
 // TokenElevationType class only available on Vista+
 Win32Check(GetTokenInformation(hToken, TokenElevationType, @tet, SizeOf(tet), dwSize));

 Result := tet <> TokenElevationTypeDefault;
end;

1 Comments

GetTokenInformation with TokenLinkedToken returns error 1312 Aug 11, 2011
[...] specified logon session does not exist. It may already have been terminated.”So you should check if User Account Control is enabled in such cases (or make this error non critical).share: Bookmark on Delicious Digg this post [...]

AD Internals: Display RID Allocation Pools

Mon, 27 Jun 2011 15:37:04 +0000

In my previous post I wrote about a problem I had with duplicate RID Allocation pools.

But how do we get more insight into these RID Allocation pools?

The DCDIAG tool can display this information per domain controleler using the following syntax

batch Download

dcdiag /s:server /v /test:ridmanager

Example output:

But where in Active Directory is this information stored and can we display it for all Domain Controllers at once for larger environments?

Determining stack size

Fri, 27 May 2011 15:10:00 +0000

I just read an answer on StackOverflow with this code:

objectpascal Download

var
 eu:DWORD;
begin
 asm
 mov eax,[fs:$4]
 mov ebx,[fs:$8]
 sub eax,ebx
 mov eu,eax
 end;

 ShowMessage(IntToStr(eu));
end;

Unfortunately it lacked explanation, so what does this code do?

How Outlook and Exchange handle Timezones

Wed, 18 May 2011 19:53:27 +0000

Again an old war story, this time about timezone handling in Outlook/Exchange.

I am not sure which year it was but I had just started to work for a new company and inherited an Exchange 5.5 Server.

The mail had been migrated from an earlier version and calendar data was migrated from Schedule+.

On the first change to Daylight Savings (DTS) all recurring appointments where shown one hour later (or earlier can't remember) in Outlook. A manual change was not an option: there were over 2000 mailboxes each with a lot of appointments.

We first tried a workaround by disabling DTS on the the workstations and then manually change the time when changing from and to DTS.

But this influenced the timestamps on externals mails and of course appointments with external parties.

After a lot of (and I really mean a lot) of researching I found that Outlook stores all times in an appointment as relative (UTC) time.

Upon display it uses an undocumented TimeZone descriptor field to convert to Local Time.

Stuff from an ancient past

Wed, 18 May 2011 10:08:35 +0000

I just found a very old backup file containing old source code for a few tools I wrote ages ago.

This was in 1997 on my first job for a company called PTT Telecom (the Dutch Telecoms) and I wrote some tools to make life easier.

They were all written in Turbo Pascal and supported Long Filenames when running under Windows '95 (there was a trick to do that under DOS).

The first tool was called Retreive Tool, it parsed a backup file from a private branch exchange (PBX) and could make reports about Licensing, the hardware in the PBX, Extension numbers and their hardware positions and so on.

Autologon user on Windows XP/2003 using AutoReconnect pipe - part 3 (implementation details)

Thu, 03 Mar 2011 13:00:46 +0000

In the previous parts (part 1 part 2) i’ve described the theoretical part and implementation problems. So, now we can write the code:

In case we login the user, we just call LsaLogonUser to get the token:

Autologon user on Windows XP/2003 using AutoReconnect pipe - part 2 (problems and workarounds)

Wed, 02 Mar 2011 00:10:02 +0000

In part 1 I’ve described the theoretical parts needed for a custom autologon application implementation.

But there are some practical problems which I will describe here.

I use the LsaLogonUser function to log in the user. However, if I do not pass not null for the LocalGroups parameter, msgina.dll fails to process the logon.

Why? Because it looks for the SE_GROUP_LOGON_ID SID and treat it as logon SID. So we have to add the logon SID manually:

Autologon user on Windows XP/2003 using AutoReconnect pipe - part 1 (theory)

Mon, 28 Feb 2011 10:46:29 +0000

Windows XP introduced the ability to use Fast User Switching (FUS from here on), which is implemented using Terminal Services.

But in some cases (i.e. when FUS is not enabled, or when you connect to the console in Windows 2003 server), the Winlogon process in an RDP session needs to transfer credentials to Session 0.

Although not documented in MSDN, the process of transferring credentials is described by Keith Brown in the June 2005 issue of MSDN magazine: Customizing GINA, Part 2.

WlxQueryConsoleSwitchCredentials and WlxGetConsoleSwitchCredentials are used in the transfer with the semi-documented WLX_SAS_TYPE_AUTHENTICATED SAS code constant.

Internally, winlogon.exe uses a Named Pipe, \.\Pipe\TerminalServer\AutoReconnect, to implement both of these functions.

The pipe format is described in this structure:

Querying a user token under 64 bit version of 2003/XP

Sat, 29 Jan 2011 22:17:52 +0000

If you want to obtain a user’s token in a Terminal Server or Citrix session (eg to launch a process in a session) you can call the WTSQueryUserToken function.

On the x64 versions of Windows XP and Server 2003 this function fails however and returns ERROR_INSUFFICIENT_BUFFER ("The data area passed to a system call is too small.") when called from a 32 bit process.

Internally WTSQueryUserToken calls the undocumented function WinstationQueryInformationW with the WinStationUserToken class (14) and passing a WINSTATIONUSERTOKEN struct, filled with caller ProcessId and ThreadId.

But on x64 Windows the size of this structure is 24 bytes, while on 32 bit Windows the size of the structure is 12 bytes!

Enumerating Session Processes with NtQuerySystemInformation

Thu, 20 Jan 2011 15:34:23 +0000

As you may know, you can enumerate processes of a specific Terminal Server or Citrix session using the NtQuerySystemInformation function.

On x86 system the code below works fine:

objectpascal Download

var
 Status : NTSTATUS;
 RetLength : DWORD;
 SessionInfo : SYSTEM_SESSION_PROCESS_INFORMATION;
 CurrentProcess : PSystemProcesses;
begin

 SessionInfo.SessionId := SessionId;
 SessionInfo.Buffer := nil;
 SessionInfo.SizeOfBuf := 0;

 Status := NtQuerySystemInformation(SystemSessionProcessesInformation, @SessionInfo, SizeOf(SessionInfo), @RetLength);
 while (Status = STATUS_INFO_LENGTH_MISMATCH) do
 begin
 SessionInfo.SizeOfBuf := RetLength;
 SessionInfo.Buffer := GetMemory(RetLength);
 try
 Status := NtQuerySystemInformation(SystemSessionProcessesInformation, @SessionInfo, SizeOf(SessionInfo), @RetLength);
 if NT_SUCCESS(Status) then
 begin
 CurrentProcess := SessionInfo.Buffer;
 while True do
 begin
 // Your code here

 if (CurrentProcess^.NextEntryDelta = 0) then
 Break;

 Cardinal(CurrentProcess) := Cardinal(CurrentProcess) + CurrentProcess^.NextEntryDelta;
 end;

 Exit;
 end;
 finally
 FreeMemory(SessionInfo.Buffer);
 end;
 end;

 SetLastError(RtlNtStatusToDosError(Status));
 RaiseLastOSError;
end;

While this works fine on Windows XP and 2003 x86, it fails to work correctly on the x64 versions of Windows XP and 2003 (or maybe even higher).

The problem is that RetLength is always SizeOf(SYSTEM_SESSION_PROCESS_INFORMATION) and thus we are in an endless loop!

SasLibEx Screencast

Wed, 19 Jan 2011 22:36:44 +0000

I just recorded a SasLibEx Screencast, it shows some of the very powerfull features of SasLibEx.

The following features are shown:

Simulate Ctrl Alt Del (Secure Attention Sequence)
Cancel Ctrl Alt Del
Lock Workstation
Unlock Workstation (without credentials)
Disable Ctrl Alt Del
Enable Ctrl Alt Del again
Cancel pending UAC request
Is Desktop Locked

SasLibEx Feature Demo #1

1 Comments

Tweets die vermelden SasLibEx Screencast | Remko Weijnen's Blog (Remko's Blog) -- Topsy.com Jan 20, 2011
[...] Dit blogartikel was vermeld op Twitter door Remko Weijnen, Remko Weijnen. Remko Weijnen heeft gezegd: First #SasLibEx ScreenCast! showing simulate ctrl alt del, unlock workstation without credentials, disable cad and more http://bit.ly/fFM8wB [...]

Convert Drive Bitmask to Drive Letter

Fri, 14 Jan 2011 11:06:03 +0000

I was writing a test program that will perform some actions when a USB Memory Stick is inserted.

When this happens Windows send a Broadcast a WM_DEVICECHANGE message.

The wParam member of this Message contains a (pointer to) a DEV_BROADCAST_HDR structure.

if the dbch_devicetype member of this structure is of type DBT_DEVTYP_VOLUME then we can cast the structure to DEV_BROADCAST_VOLUME.

Cannot Access Files, But Need the Origin?

Mon, 03 Jan 2011 09:52:20 +0000

Have you developed an application that accesses files and may stop because a file cannot be accessed but you need to?

Since Windows Vista it is possible to find out the name of the application which holds open a file.

Packaging an Application that uses the BDE

Tue, 14 Dec 2010 21:12:58 +0000

Today I needed to package an application that uses the Borland Database Engine (BDE).

The BDE is a database engine/connectivity component commonly used in Delphi and C++ Builder applications. It has been deprecated since 2000 when it was replaced by dbExpress.

But it’s still widely used so you may still find applications that require the BDE.

In my environment I already have a package for the BDE itsself. But the application I needed to package today, needs to have an Alias addded.

This is usually done manually by going into the BDEADMIN control panel applet or by copying the file where BDE saves the aliases (IDAPI32.CFG).

Here is a screenshot of the Alias my application needs (it uses an Interbase database):

I didn’t like the copy approach and didn’t even consider the manual option so I wrote 2 little tools.

Where is LSA_OBJECT_ATTRIBUTES defined?

Sun, 12 Dec 2010 23:06:20 +0000

If you read MSDN documentation for LSA_OBJECT_ATTRIBUTES you will think it's defined in LsaLookup.h:

And that it's supported since Windows 2000 but I couldn't find it in this header file.

Instead I found it in NTSecAPI.h, so I decided to check the different SDK versions and starting from SDK v7 LsaLookup.h exists but in earlier SDK's (v5.0, v6.0a and v6.1) there is no LsaLookup.h.

Altiris Job Builder

Tue, 23 Nov 2010 10:26:34 +0000

I have created a little tool for myself that I have call Altiris Job Builder, it retreives the Jobs from the Altiris database and shows them in a Treeview.

Then I can assemble a Master Build Job by dragging the needed Jobs to another Treeview on the right. Since it’s just for me it doesn’t have a fancy gui:

So why did I write it? Well I have divided my Jobs into Prerequisites and Packages, for instance IIS and Terminal Server and Java are prereqisuites for Citrix. But many prereqisuites are required for one or more other packages, eg Java is also used for certain applications.

Programmatically Changing the Driver Signing options

Thu, 11 Nov 2010 09:57:17 +0000

Today I was tested my unattended Citrix installation (XenApp 5 on Windows 2003) and I noticed that the install was taking longer than expected.

This was because of a popup:

I am not sure if this popup is shown because I ran MsiExec with /Qb- (I usually do that when testing) but if the Popup is not shown it means that at least the installation of this driver (probably Citrix Universal Print driver) fails.

So this means I needed to script turning off Driver Signature Warnings. A quick search led me to kb article kb298503 which is titled “Driver signing registry values cannot be modified directly in Windows”. As you may guess that title drew my attention.

Automatically Accept Shadow Request

Fri, 22 Oct 2010 17:04:00 +0000

When you request Shadow (Remote Control) of a Remote Desktop (Terminal Server) or Citrix session the user gets a Dialog where he can Accept or Deny the Shadow Request.

It looks something like this:

It’s possible to change the default settings and remove the need for this permission but I think this is a bad idea since it violates the user’s privacy.

But sometimes it would be convenient to automatically accept, for instance for when a user is away or when you want to shadow a session that is “yours” but runs under another account.

I wrote a tool to do just that :D

Change Driveletter Commandline Tool

Wed, 20 Oct 2010 14:04:35 +0000

Some time ago (2008 actually) I wrote a tool that can assign driveletters given a volumename. I use it myself after SysPrep operations to assign the desired drive letters. For instance after cloning a Virtual Machine from a template.

I noticed that I updated this tool sometime after the original post but never uploaded it here. The most important changes are:

SasLibEx 2.0 Release Announcement

Wed, 15 Sep 2010 14:34:08 +0000

Today I can proudly announce the official release of SasLibEx 2.0 which will bring support for new compilers, a native x64 version and some exciting new features!

New Compilers:

SasLibEx 2.0 introduces support for Visual Studio 2010 (C++), RAD Studio 2010 (Delphi and C++ personalities) and the new RAD Studio XE (Delphi and C++).

Fun with asm

Fri, 18 Jun 2010 12:02:00 +0000

Today just some fun stuff with ASM, probably not the most recommended way to do things but for sure the most geeky way :P

Get the Current Session Id:

objectpascal Download

function GetCurrentSessionId: DWORD;
asm
 mov eax,fs:[$00000018]; // Get TEB
 mov eax,[eax+$30]; // PPEB
 mov eax,[eax+$1d4]; // PEB.SessionId
end;

Get the Current Console Session Id:

Obtain Fully Qualified Domain Name from Netbios Domain Name

Thu, 17 Jun 2010 14:34:42 +0000

I needed to obtain the Fully Qualified Domain Name (FQDN) for a given NetBios domain name. Eg from MYDOMAIN to dc=mydomain,dc=local.

I did some tests with the TranslateName API and if you append a \ to the domain name it returns the FQDN.

Here is a short example:

Having fun with Windows Licensing

Tue, 15 Jun 2010 15:09:14 +0000

If you look into the registry in the key HKLM\System\CurrentControlSet\ProductOptions you will find several licensing related Values.

The ProductType and ProductSuite keys contain the OS Suite and Edition, but the ProductPolicy key is much more interesting. So let’s have a closer look at it, open RegEdit and DoubleClick the key, you will something like the screenshot below, a Binary Value:

As you can see the license names are there as a Unicode string and later on I will show you how we can read the values. But because I didn’t want to extract all the names manually I decided to see if I could reverse the used structure because it didn’t look very complicated. Using a Hex Editor I could determine the important part of the structure.

Memory Leaks when using the Virtual TreeView Component

Wed, 09 Jun 2010 09:50:49 +0000

Again a about post about using the Virtual TreeView component (did I mention it’s brilliant?), this time I will talk about memory leaks.

I often use Records to hold the treedata, and usually the record holds some string data (eg a caption) and an (a reference to) an Interface or Object(List) that holds more data.

If you are familiar with Virtual Tree then you know that you must can the NodeData in the OnFreeNode event.

Setting ChildCount in a Virtual Tree

Tue, 08 Jun 2010 17:39:57 +0000

When working with the Virtual TreeView component the most optimized way of adding (or removing child nodes is by changing the ChildCount.

I often make the mistake of change the ChildCount of a Node using:

objectpascal Download

Node^.ChildCount := Count;

If you look into the source you will see why this will not work, the proper way is:

Random Active Directory Notes #4

Tue, 30 Mar 2010 15:04:51 +0000

Previously I discussed IDirectoryObject, today I will show how to change a user’s password with IDirectoryObject.

I didn’t find any documentation except a kb article describing how to use pure ldap to do it. Of course I could have used IADsUser::SetPassword but I decided not to because of the following reasons:

IADs interfaces are terribly slow (although for one use you probably wouldn't really notice).
IADsUser::SetPassword tries 3 different methods to set the password (ldap over ssl, kerberos and finally NetUserSetInfo) which makes it even slower (most domain controllers do not have an ssl certificate) and unpredictable.

All example code I found was .NET based using the .NET wrappers for Active Directory and seemed to be meant for use in Adam rather than full Active Directory (it set port number to 389 and password mode to cleartext).

In the end it’s not very difficult but nonetheless it took me a while before I got it right.

We can write to the unicodePwd attribute which wants the password as a double quoted unicode string. If you look at this attribute with AdsiEdit you’ll see that the type is Octet String and that it can be written only.

I was tricked with Delphi’s QuotedStr function for a while because it doesn’t return a double but single quoted string ;-)

Below a small snippet from the upcoming JwsclActiveDirectory that shows how to use it:

Using Windows Resource Strings

Sun, 28 Mar 2010 10:45:05 +0000

A few days ago I wrote about Using Windows Dialogs in your own programs, wouldn’t it be nice to be able to use Windows Resource Strings for the same reasons?

Loading a resource string is not difficult, let’s look at some examples:

Using Windows Dialogs from Delphi

Wed, 24 Mar 2010 11:48:41 +0000

Today I reused a unit I wrote a long time ago for TSAdminEx that shows Resource Dialogs from DLL’s or Executables. I wrote it for a couple of reasons:

Reusing existing dialogs is conventient since the user already knows it.
Windows takes care of translating it into the user's language.
I am too lazy to recreate them ;-)

The code is hardly rocket science and could probably be improved and made more sophisticated but it works for me. I decided to share it since you may find it usefull.

Here is a small usage example that shows the Reset Password dialog from Active Directory Users & Computers. This dialog is in dsadmin.dll (on Windows Vista/7 you will find it in ds.admin.dll.mui in the language subfolder eg %systemroot%\system32\en-US but you can load it using just the dll name).

It looks like this:

c Download

215 DIALOGEX 0, 0, 252, 139
STYLE DS_MODALFRAME | DS_CONTEXTHELP | WS_POPUP | WS_CAPTION | WS_SYSMENU
EXSTYLE WS_EX_CONTEXTHELP
CAPTION "Reset Password"
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
FONT 8, "MS Shell Dlg"
{
 CONTROL "&New password:", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 7, 10, 79, 10
 CONTROL "", 220, EDIT, ES_LEFT | ES_PASSWORD | ES_AUTOHSCROLL | WS_CHILD | WS_VISIBLE | WS_BORDER | WS_TABSTOP, 92, 7, 153, 14
 CONTROL "&Confirm password:", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 7, 28, 79, 10
 CONTROL "", 222, EDIT, ES_LEFT | ES_PASSWORD | ES_AUTOHSCROLL | WS_CHILD | WS_VISIBLE | WS_BORDER | WS_TABSTOP, 92, 25, 153, 14
 CONTROL "&User must change password at next logon", 261, BUTTON, BS_AUTOCHECKBOX | BS_LEFT | BS_TOP | BS_MULTILINE | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 7, 46, 237, 10
 CONTROL "The user must logoff and then logon again for the change to take effect.", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 14, 61, 231, 8
 CONTROL "", 8327, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 7, 76, 238, 16
 CONTROL "Unlock the user's &account", 8328, BUTTON, BS_AUTOCHECKBOX | BS_LEFT | BS_TOP | BS_MULTILINE | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 14, 96, 230, 10
 CONTROL "OK", 1, BUTTON, BS_DEFPUSHBUTTON | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 140, 118, 50, 14
 CONTROL "Cancel", 2, BUTTON, BS_PUSHBUTTON | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 195, 118, 50, 14
}

Random Active Directory Notes #3

Mon, 22 Mar 2010 22:57:30 +0000

Last time I talked briefly about IDirectoryObject and IDirectorySearch, let’s go into a little more detail today.

IDirectoryObject is an Interface that we can use to query anything in Active Directory, users, groups, organizational units, containers and so on.

I thought the best explanation would be to build a very small sample project, so let’s do that!

First we need some units, so please add the following units to your uses clause:

ComObj (for EOleException and it calls CoInitialize for us)
JwaWindows for the proper Adsi declarations

Next declare the following types:

objectpascal Download

type
 // For Delphi < 2009 use WideString
 UString = {$IFDEF UNICODE}UnicodeString{$ELSE}WideString{$ENDIF};

 // Array of ADS_ATTR_INFO records
 TAdsAttrInfoArray = array[0..ANYSIZE_ARRAY-1] of ADS_ATTR_INFO;
 PAdsAttrInfoArray = ^TAdsAttrInfoArray;

Random Active Directory Notes #2

Fri, 12 Mar 2010 16:57:32 +0000

If you have ever used Adsi you have probably used the IADs interface or derived interfaces such as IADsUser or IADsGroup (maybe even without realising this).

What you need to know is that these interfaces were created to support scripting languages such as VBScript. The reason is that these scripting language have no support at all for structures such as ADSVALUE and don’t work with Pointers.

Random Active Directory Notes

Wed, 10 Mar 2010 11:19:29 +0000

I am working on an Customer Management Console that will present all adminstrative tasks that customers will need in their environment in a single console.

It will handle Active Directory, Terminal Server and Citrix, Printers and will offer specific Views and Reporting. For the Active Directory stuff I decided to create some classes that enabled me to work with AD in a more Delphi OOP way.

Random Active Directory Notes #1

Wed, 10 Mar 2010 11:11:13 +0000

If you are going to use the Active Directory Service Interface (ADSI) in Delphi, the first thing you will need is the typelibrary (TLB). This TLB is in the windows\system32 folder and has the name activeds.tlb.

We can import this tlb in Delphi (the procedure differs somewhat, depending on the Delphi version), but there are quite some problems with the resulting pas file of this import:

Ugly and non meaningfull names such as __MIDL___MIDL_itf_ads_0000_0000_001.
Record sizes are sometimes (read: usually) wrong due to alignment errors.
Some Interfaces have wrong declarations resulting in Access Violations or just hard to use (eg using var for input parameters).
Delphi works with Typed Pointer but since it has no clue on the proper name it uses PUserTypexx (eg PUserType1 = ^_ADS_CASEIGNORE_LIST). It's hard to recognise later on what the real type is.

A version of the imported tlb is also in the Jedi Apilib (JwaAdsTLB) and basically it had the same errors. Because I was wondering how this would work in c++ I checked the SDK and found the header file Iads.h.

Did you make a SasLibEx enquiry? And... news!

Mon, 22 Feb 2010 14:07:28 +0000

My hoster has had some problems with the simulatesas.com domain that I use for SasLibEx enquiries. If you have sent mail to that has not been answered I kindly request you to send it again.

I would also like to briefly tell you about an upcoming new release of SasLib, version 2.0. There is so much I would like to tell you about it but I will limit it to a few highlights here and save the rest for the upcoming website on SimulateSAS.com.

Small LaunchRDP Update

Fri, 06 Nov 2009 22:44:27 +0000

For a long time now people have asked for a version of LaunchRDP that includes the Connection Bar. The original version was originally written for a very specific purpose and I never anticipated so many people would want to use it. But it seems that a lot of people like the Connection Bar (I hate it, especially with sessions in sessions, so that’s why I am using RDPWithLocalTaskbar).

Windows Installer proxy information not correctly registered

Thu, 05 Nov 2009 22:11:06 +0000

I was deploying an unattended installation of Citrix XenApp 5.0 with Altiris Deployment Server. The installation consists of several prerequisites, the installation of XenApp and finally the Citrix Management Consoles.

The installation is performed with a special account and not the Local System account because the install packages are located on the network.

When testing the deployment on a Windows Server 2008 I noticed that sometimes MSI based installations would fail with error code 1603 or 1601.

SasLibEx updates

Tue, 07 Apr 2009 08:40:36 +0000

I have found and tested some new functionalities which I will add to SasLibEx:

Unlocking workstation without entering password
Cancel UAC (User Account Control) request
fully disable Ctrl-Alt-Del
Cancel Ctrl-Alt-Del
Switch between secure desktop (where the UAC prompt is) and the normal desktop.

Some people asked if SasLibEx works on x64 or Windows 7, the answer is yes. I tested on build 7000 of Windows 7 beta and also on Server 2008 x64.

5 Comments

Simulate ctrl-alt-del in Windows Vista | RemkoWeijnen.nl May 18, 2009
[...] SasLibEx updates | RemkoWeijnen.nl April 7th, 2009 at 8:41 2 [...]

Sending WM_KEYDOWN or WM_KEYUP

Mon, 30 Mar 2009 22:57:28 +0000

If you read the MSDN documentation of WM_KEYDOWN and WM_KEYUP you can see that those message require us to interpret lParam as a bitfield:

lParam Specifies the repeat count, scan code, extended-key flag, context code, previous key-state flag, and transition-state flag, as shown in the following table.
0-15
Specifies the repeat count for the current message. The value is the number of times the keystroke is autorepeated as a result of the user holding down the key. The repeat count is always one for a WM_KEYUP message.
16-23
Specifies the scan code. The value depends on the OEM.
24
Specifies whether the key is an extended key, such as the right-hand ALT and CTRL keys that appear on an enhanced 101- or 102-key keyboard. The value is 1 if it is an extended key; otherwise, it is 0.
25-28
Reserved; do not use.
29
Specifies the context code. The value is always 0 for a WM_KEYUP message.
30
Specifies the previous key state. The value is always 1 for a WM_KEYUP message.
31
Specifies the transition state. The value is always 1 for a WM_KEYUP message.

I was looking for a convenient way to get and read the bits and this is what I made up:

Sending Ctrl-Alt-Del / Simulate SAS in Windows Vista

Mon, 30 Mar 2009 21:51:48 +0000

Existing code to simulate the Secure Attention Sequence (SAS),which most people refer to as control alt delete or ctrl-alt-del, no longer works in Windows Vista. It seems that Microsoft offers a library that exports a function called SimulateSAS(). It is not public and one is supposed to request it by sending a mail to saslib@microsoft.com. Mails to this address remain unanswered though.

Reading physical memory size from the registry

Fri, 20 Mar 2009 13:15:46 +0000

I’m working on a new build of TSAdminEx for which I need to query the total amount of physical memory. Locally we can use the GlobalMemoryStatusEx API but there’s no API to do this remotely. It would be possible using WMI but I decided not to use that because I dislike it because of it’s slowness and I need support for older OS versions which might not have WMI.

So I found in the registry the following key:

HKLM\HARDWARE\RESOURCEMAP\System Resources\Physical Memory

It has a value .Translated of type RES_RESOURCE_LIST which seems undocumented besides stating that it exists. Regedit knows how to handle it though. If you doubleclick on the key you will see something like this:

TSAdminEx Features Part 3

Wed, 25 Feb 2009 13:08:31 +0000

Beta Release

Part 1

Part 2

This is part 3 of the TSAdminEx Features series. Today I will discuss the Process View. As usual we will start by comparing TSAdmin to TSAdminEx again. So let's look at TSAdmin Process View:

And the one from TSAdminEx:

TSAdminEx Features Part 2

Tue, 24 Feb 2009 10:17:07 +0000

Part1

Now that a TSAdminEx beta is ready I will be showing you some features. In this part I will show the Sessions View.

Let’s start again with a compare of TSAdmin and TSAdminEx:

As you can see TSAdminEx shows more details, it shows the following extra columns:

TSAdminEx Features Part 1

Mon, 23 Feb 2009 16:18:28 +0000

Part 2

Now that a TSAdminEx beta is ready I will be showing you some features. In this part 1 I will be comparing the Users view to TSAdmin.

Let’s start TSAdmin, this tool is present by default on Windows 2003. If you use Windows XP or Windows Vista you can get it by installing the Administration Pack. Please note that TSAdmin does not work on Vista RTM due to a bug that was corrected in Vista SP1 (TSAdminEx works fine on both RTM as well as SP1)

Now let’s open TSAdminEx and start comparing…

TSAdminEx Beta release

Fri, 20 Feb 2009 17:59:06 +0000

Over the last months I have been working hard on TSAdminEx and now, finally, I can now present a first beta release.

If you don’t know what TSAdminEx is let me briefly introduce it. TSAdminEx is a tool that combines functionality of several existing tools: it has the power of task manager combined with the details of Process Explorer and the Terminal Server support of TSAdmin. On top of that it fully supports remote systems out of the box without installing any agents or services. It also has some unique features that neither of the mentioned tools can do!

Several new features have been implemented since the last time I talked about TSAdminEx and I will show you the most exciting ones here:

Accessing kernel objects in other sessions part 2

Tue, 03 Feb 2009 14:36:53 +0000

In part 1 I showed how to create and open objects in Terminal Server Sessions. However, these are not all of the possible places where you can place objects via documented kernel32.dll functions.

If we look into Winobj again, we notice, that every BaseNamedObjects directory has a subdirectory named Restricted. To be honest, I do not know why it’s created; it’s security allows object creation for LocalSystem and RESTRICTED special user (in windows 2000, Everyone can also create objects in it). So, we can use it as prefix for object creation, for example, Restricted\MyAppEvent:

Of course, you can still use Global, Local, or Session links

Accessing kernel objects in other sessions part 1

Tue, 27 Jan 2009 19:43:52 +0000

As you know, many kernel32.dll functions, which are working with named objects, like OpenEvent, can be used to work with global and local objects. So what are global and local objects? Global objects are created in session 0 and are actually located in the \BaseNamedObjects directory, while local objects are created in the caller’s session (for example in the \Sessions\5\BaseNamedObjects directory (for session 0, global and local has no meaning since they point to the same object)). MSDN says that you can access only the objects in your own session(via the Local</strong> prefix) and in session 0 (via the Global</strong> prefix). But what if you need to access an object in another session?

Locking a workstation - part 2

Tue, 23 Dec 2008 17:13:37 +0000

In part 1 I showed how winlogon.exe registers its process and main window handle.

In the SasCreate function, winlogon.exe registers hotkeys like this:

objectpascal Download

const MOD_SAS = $8000; RegisterHotKey(SasWindow, 0, MOD_SAS or MOD_CONTROL or MOD_ALT, VK_DELETE); {$IFDEF CHECKED_BUILD} RegisterHotKey(SasWindow, 1, MOD_ALT or MOD_CONTROL or MOD_SHIFT, VK_DELETE); // handler just calls NtShutdownSystem if EnableDesktopSwitching then RegisterHotKey(SasWindow, 2, MOD_ALT or MOD_CONTROL, VK_TAB); // handler switches default and winlogon desktops if WinlogonInfoLevelFlag then RegisterHotkey(SasWindow, 3, MOD_ALT or MOD_CONTROL or MOD_SHIFT, VK_TAB); // handler just calls DebugBreak {$ENDIF} RegisterHotKey(SasWindow, 4, MOD_CONTROL or MOD_SHIFT, VK_ESCAPE); // handler executes task manager {$IFDEF WINXP_OR_LATER} RegisterHotKey(SasWindow, 5, MOD_WIN, Byte('L'); // handler locks the workstation RegisterHotkey(SasWindow, 6, MOD_WIN, Byte('U'); // handler executes utilman on current desktop {$ENDIF}

Did you notice the MOD_SAS constant?

Locking a workstation - part 1

Sat, 13 Dec 2008 23:13:08 +0000

Win32 API provides only 1 function for locking workstation, named LockWorkstation. What does it do and how we can use it?

When a new session is started, smss.exe invokes winlogon.exe. It registers its process id in win32k.sys by calling RegisterLogonProcess. It has this prototype:

Converting a volume name to a device name

Wed, 10 Dec 2008 15:41:42 +0000

Windows has a couple of different formats for volume names but it is unclear how to convert a Volumename (example: \?\Volume{GUID}) to a DeviceName (example: \Device\HarddiskVolume1).

I found at that you can use the QueryDosDevice function but you need to remove the preceeding \?\ and the trailing \ of the VolumeName:

Commandline tool to change drive letter assignment

Tue, 09 Dec 2008 15:13:27 +0000

One of the side effects of using sysprep to prepare an image is that drive letter assignments are reset to default. This behaviour is documented in a knowledge base article.

I previously solved this by running a diskpart script but that needed a custom script for each system (if the disk or partition order differs the script needed to be adjusted). So I needed to run a restore with sysprep determine the drive layout after sysprep, change the script, test by restoring again. So I wrote a commandline tool that can change a drive letter assignment based on the volume label.

Executing a Fast User Switch programmatically - part 2

Wed, 26 Nov 2008 16:45:46 +0000

Part1

Let’s write our own Credential Server implementation.

At first, we need to create a named pipe with a unique name. Let’s construct the pipe name using a GUID - this should be unique, but we can do it in a cycle to be absolutely sure:

Executing a Fast User Switch programmatically - part 1

Wed, 26 Nov 2008 15:23:37 +0000

I think many of you have got experience with multiple Terminal Server Sessions in windows XP, also called Fast User Switching (FUS). Let’s get inside this cool feature.

How does FUS work? Each session has its own winlogon.exe. It draws the same interface which looks like the screenshot below:

Terminal Server Internals

Wed, 19 Nov 2008 17:55:39 +0000

Hello, my name is Danila Galimov and i will write here sometimes :-)

My first post is about communications between Terminal Server sessions and Terminal Server service process (termsrv.exe/dll). Terminal Server service needs to communicate with each session for many tasks, such as sending window message, getting message reply and so on. So, on init, Terminal Server creates a SmSsWinStationApiPort port in global namespace and runs a few WinStationLpcThread threads, which are listening on port and are used to process port messages. When csrss.exe is started, it parses its command line, which usually looks like:

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=4096,4096,1024 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
and loads the required dlls (winsrv.dll in our case). Initialization of winsrv.dll creates a thread, which connects to SmSsWinStationApiPort port and does the loop for processing Terminal Server messages until it receives WinStationTerminate message.
We’ll try to fool Terminal Server

Working with bitfields in Delphi

Thu, 01 May 2008 23:06:00 +0000

Recently I needed to convert a C header file to Delphi which contained bitfields. Let’s take a look at a sample structure that contains bitfields:

cpp Download

typedef struct _BITFIELDSTRUCTURE { DWORD dwValue1; ULONG BitValue1: 1; ULONG BitValue2: 1; ULONG BitValue3: 1; ULONG BitValue4: 1; } BITFIELDSTRUCTURE, * BITFIELDSTRUCTURE;

It means that there is a DWORD (Cardinal) dwValue1 followed by a bitfield with the size of a ULONG (32 bits). In this bitfield 4 values are defined (BitValue1..4) which are used as boolean’s because the value can offcourse be 0 or 1. Since Delphi doesn’t know a bitfield type the question is how to translate it. Usually it would mean that we simply treat the whole bitfield value as a ULONG and extract the required properties by applying a bitmask (shl/shr). Starting from BDS2006 we can define a record with propertes and use getters and setters. Using this technique we can present boolean values to the user:

How rdp passwords are encrypted 2

Sun, 02 Mar 2008 23:28:57 +0000

Several months ago I wrote about encrypting and decrypting RDP passwords. I left one thing open: encrypting the password up to the full 1329 bytes as mstsc does.

Many people were curious about it so I hope the answer is not a disappointment because it’s actually really simple (but I took me a while to figure that out nonetheless). In what I figure is an attempt to hide the password length mstsc always fills up the password with zeroes until it has 512 bytes length.

Vista SP1 changes to Terminal Server API

Sun, 02 Mar 2008 15:31:55 +0000

In a previous article I wrote about changes in utildll in vista that breaked compatibality for Terminal Server. Even though release notes for Service Pack 1 don’t indicate changes or fixes in this area my testing shows that Microsoft has taken over the Windows 2008 implementation of utildll to Vista.

TSAdminEx Progress

Sun, 27 Jan 2008 23:04:07 +0000

I just wanted to show some of the progress that I made in development of TSAdminEx. I thought the best way would be to show some screenshots. Which reminds me I installed a nice Javascript to enlarge the thumbnails, click to see it…

Using WTSWaitSystemEvent

Fri, 25 Jan 2008 18:02:13 +0000

If you develop an application for Terminal Server you might want to react on session events. This means that your application is notified when a user logs on, logs off or becomes idle. This can be done with the WTSWaitSystemEvent function. Implementing it is rather simple and could look something like this:

Undocumented API's from Utildll

Sun, 09 Dec 2007 11:05:04 +0000

Several of Microsoft’s Terminal Server tools use undocumented API’s from Utildll.dll. For instance Terminal Server Admin uses it to get a localised connect state string and to format time strings like idle time, logon time etc.

Functions below seems to be the most usefull ones, I will add those to the JwaWinsta unit:

Delphi and Terminal Server Aware

Sat, 24 Nov 2007 23:21:37 +0000

When an application is not Terminal Server aware (also known as a legacy application), Terminal Server makes certain modifications to the legacy application to make it work properly in a multiuser environment. For example, Terminal Server will create a virtual Windows folder, such that each user gets a Windows folder instead of getting the system’s Windows directory. This gives users access to their own INI files. In addition, Terminal Server makes some adjustments to the registry for a legacy application. These modifications slow the loading of the legacy application on Terminal Server and require up to 8 MegaBytes extra memory. This behaviour can be avoided if the TSAware flag is present in the PE header of an executable as can be read here at MSDN.

More undocumented Terminal Server API's

Fri, 09 Nov 2007 22:42:58 +0000

I added some more undocumented API’s to my Jwawinsta unit, the unit is now becoming a collection of the undocumented API’s in winsta.dll.

These are the functions I added:

WinStationDisconnect

WinStationGetProcessSid

CachedGetUserFromSid (exported by utildll.dll)

I also added some more parts of the undocumented structure returned by WinStationQueryInformationW, it now contains:

Session State

WinStationName

SessionId

ConnectTime

DisconnectTime

LastInputTime

LogonTime

OutgoingFrames

OutgoingBytes

OutgoingCompressedBytes

IncomingCompressedBytes

IncomingFrames

IncomingBytes

Domain

Username

CurrentTime

2 Comments

Chris Dec 3, 2007
I would like know how it is possible to access WindowStation and Desktops from a service.
CreateDesktop and similar only works for the current session of the process.
I know there exists NTQueryObject and similar but they are hard to understand and only query kernel objects.
However creating a desktop from a service into another session is a mystery.

How to launch a process in a Terminal Session #2

Thu, 08 Nov 2007 13:48:18 +0000

A little while ago I wrote an article on launching a process in another Terminal Session (/2007/10/20/how-to-launch-a-process-in-a-terminal-session/).

The article didn’t have a demo app yet so I’ve attached it here.

JEDI Apilib and JEDI Windows Security Code Library

Thu, 08 Nov 2007 12:35:32 +0000

It has been a little silent on the JEDI Apilib project lately, but this will change!

We had some change in the team members: Marcel van Brakel, founder and large contributor of the project has signed off because he no longer actively uses Delphi. Christian Wimmer has joined the team and he is a very promising member.

Christian has been working on a new include model (optional) of the Jedi Apilib which has the advantage that you only need to use one unit (JwaWindows) for the whole library.

Chris has also published the JEDI Windows Security Code Library (Jwscl). This is library that tremendously simplifies using Win32 API calls from Delphi. At this point the library contains:

Windows Version

Token

Impersonation

Login

SID

Access Control List

Security Descriptor

Owner, Group, DACL, SACL

WindowStation

Desktop

LSA

Rights mapping

Secured Objects Files, Registry (+Inheritance), etc.

Credentials (Login Dialog)

Encryption (MS Crypto API)

Well Known SIDs

Privileges

Security Dialogs (The "ACL Editor" you see on the security yab when you rightclick object in Explorer)

Terminal Sessions

Unicode + Ansicode

Vista Elevation

Vista Integrity Level

Although Jwscl is in beta stage it is already very well useable.

Encrypt RDP password in Python

Mon, 05 Nov 2007 23:10:29 +0000

Dirk Schmitz send me his Python version of encrypting the RDP Password:

python Download

import win32crypt import binascii pwdHash = win32crypt.CryptProtectData(u"MYPASSWORD",u'psw',None,None,None,0) print binascii.hexlify(pwdHash)

Read the original article here: /2007/10/18/how-rdp-passwords-are-encrypted/

5 Comments

Arvid Requate Nov 14, 2010
Thank's, this really worked well, after a bit of fiddling (donation will be given asap). For Python 2.7 I had to remove the unicode conversion, otherwise the RDP server would not get the proper password. Interestingly your updated post about 512-byte padding and appending a '0'-character to obtain a 1329 'password 51'-hash did not work for me yet. Did you need the padding as a bugfix or did you suggest it merely as an imrovement to become fully compatible to the MS encoding format? (/2008/03/02/how-rdp-passwords-are-encrypted-2/).

How to get Client IP Address?

Wed, 31 Oct 2007 11:10:10 +0000

When a client is connected to a Terminal Server Session you can use the Terminal Server API to retrieve the client’s local IP address.

Start by enumerating all sessions with WtsEnumerateSessions and then for each session get the ClientAddress with a call to WTSQuerySessionInformation with the WTSClientAddress parameter. Sound simple, no?

WTSQuerySessionInformation returns a pointer to a WTS_CLIENT_ADDRESS structure. You need to know that the IP address is located at on offset of 2 bytes in the Address member of WTS_CLIENT_ADDRESS.

So here’s a sample:

New Terminal Server API's in Vista SP1

Tue, 30 Oct 2007 22:19:25 +0000

The upcoming Vista SP1 promises 3 new Terminal Server API functions:

WTSConnectSession : Connects a Terminal Services session to an existing session on the local computer.

WTSStartRemoteControlSession: Starts the remote control of another Terminal Services session.

WTSStopRemoteControlSession : Stops a remote control session.

If you look in the Windows 2008 beta you can see that the functions are already implemented (in WtsApi32.dll):

RDP Clipboard Fix

Thu, 25 Oct 2007 17:45:57 +0000

Did you ever loose Clipboard functionality (copy/paste) while working with several Terminal Server sessions? I think everyone that works a lot with Terminal Server has experienced this from time to time.

It’s caused by badly behaving applications. Dimitry Vostokov wrote a tool to fix this issue for Citrix (RepairCBDChain.exe), he explains the issue very well on his blog:

Windows has a mechanism to notify applications about clipboard changes. An application interested in such notifications has to register itself in the so called clipboard chain. Windows inserts it on top of that chain and that application is responsible to propagate changes down the chain:

If 3rd-party application forgets to forward notifications down then we have a broken clipboard chain and clipboard changes are not sent via ICA protocol:

Read more at Dimitry’s Blog: http://citrite.org/blogs/dmitryv/2006/12/09/clipboard-issues-explained/

So how can we fix this for Terminal Server then?

TSAdminEx

Tue, 23 Oct 2007 19:48:50 +0000

You will probably know Microsofts Tool to Manage Terminal Server, it’s called Terminal Services Manager (you will probably know it as TSAdmin). It can be used to view information about terminal servers including all sessions, users, and processes for each terminal server.

I’m currently working on a TSAdmin replacement (codename TSAdminEx). Purpose is to show how to use the Terminal Server API’s and as a little bonus we will add some extra functionality to TSAdminEx.

How to launch a process in a Terminal Session

Sat, 20 Oct 2007 22:45:24 +0000

This is an often asked question but the solution is simple:

So how does it work?
First we obtain the user’s primary access token with the WtsQueryUserToken API call. To call this function successfully, the calling application must be running within the context of the LocalSystem account and have the SE_TCB_NAME privilege (LocalSystem has this privilege by default). Since the function returns a primary acces token we can just pass this to CreateProcessAsUser and voila!

A referral was returned from the server

Fri, 19 Oct 2007 15:58:48 +0000

Ever tried to run a VBS scripts that queries Active Directory in another domain or from a workstation that is not a domain member? Than you have probably seen this error before:

This is because the default settings for Chasing referrals is set to ADS_CHASE_REFERRALS_NEVER.

How rdp passwords are encrypted

Thu, 18 Oct 2007 21:23:17 +0000

Ever wondered how mstsc saves passwords? If you open an RDP file with a text editor like Notepad you can see the encrypted password. In this article I will show you how to encrypt and decrypt these passwords. Besides password recovery this enables you to create rpd files programmatically or perhaps update the password in many rdp files with a batch file.