Decrypting Dell vWorkspace .pit files

Mon, 08 Apr 2013 11:53:32 +0000

The Dell vWorkspace (previously Quest vWorkspace) Client can save a connection to a .pit file which is very similar to an .rdp file with one big difference: it is encrypted!

I am not sure why Dell/Quest have chosen to encrypt their files but a while ago I needed to know what was in a particular pit file so I could troubleshoot an issue.

I first created a test .pit file with the client (pntsc.exe version 7.6.305.791).

Decoding Citrix IMA Datastore Password

Tue, 29 May 2012 21:46:30 +0000

This morning Arjan Beijer sent me an interesting link to a youtube video about obtaining the Citrix IMA Datastore password using Windbg.

The video shows a method, discovered by Denis Gundarev to obtain the IMA Datastore password. Basically he uses DSMaint.exe and set’s a breakpoint on the call to CryptUnprotectData and then reads the password from memory.

I tried to call the CryptUnprotectData API with the data read from the registry directly but this failed with error NTE_BAD_KEY_STATE, this is defined in winerror.h and it means “Key not valid for use in specified state”.

Decrypt on Remko's Blog

Decrypting Dell vWorkspace .pit files

Decoding Citrix IMA Datastore Password