Description: The windows Password intercept, access to the plaintext password. Processing program on a different system in 2000, 2003, xp, vista can intercept, 2000,2003, xp UNICODE_STRING.Length high eight take xor key if the password is encoded by the ntdll.RtlRunDecodeUnicodeString decoding, vista, to judge by AdvApi32.CredIsProtectedW and password whether encoding, decoding AdvApi32.CredUnprotectW.
To Search:
File list (Check if you may need any files):
WinPswLogger3\readme.txt
.............\WinPswLogger\debugoutput.cpp
.............\............\debugoutput.h
.............\............\detour.cpp
.............\............\detour.h
.............\............\dllmain.cpp
.............\............\dllmain.def
.............\............\hookWinlogon.cpp
.............\............\hookWinlogon.h
.............\............\hookwinlogonShellcode.cpp
.............\............\hookwinlogonShellcode.h
.............\............\plugin.dsp
.............\............\plugin.dsw
.............\............\pluginWinPswLogger2.dll
.............\............\pluginWinPswLogger3.dll
.............\............\process.cpp
.............\............\process.h
.............\............\StdAfx.cpp
.............\............\StdAfx.h
.............\WinPswLogger
WinPswLogger3
Download