All console applications are presented with their (self-contained) ANSI C source code and build without the MSVCRT runtime library.
Group Policy Scripts Client Registration
Process Launcher Privilege Twiddler
Really Known SIDs Enumerator Security Descriptor Definition Language Decoder
Security Descriptor Inspector 8.3 File and Directory Name Changer
Directory Change Notifier Debug String Monitor
Product Key Validator Shim Database Decoder
Registry Policy Reader Registry INF Dumper Offline Registry Reader
Portable Executable Version Information Reader Portable Executable Resource Enumerator Portable Executable Metadata Reader
Language Enumerator Locale Enumerator Network Enumerator
MSVC Helper Library MSVC Helper Library •
Note: only privileges already assigned to a user user account can be enabled!
Cmd.exe
with the privileges SeAuditPrivilege
,
SeBackupPrivilege
, SeDebugPrivilege
,
SeRestorePrivilege
, SeSecurityPrivilege
and SeTakeOwnershipPrivilege
enabled in the directory
C:\System Volume Information\
and list its contents.
Create the text file PROCESS.VBS
with the following
content in an arbitrary directory:
Rem Copyright © 1999-2023, Stefan Kanthak <stefan.kanthak@nexgo.de>
Rem * The software is provided "as is" without any warranty, neither express
Rem nor implied.
Rem * In no event will the author be held liable for any damage(s) arising
Rem from the use of the software.
Rem * Redistribution of the software is allowed only in unmodified form.
Rem * Permission is granted to use the software solely for personal private
Rem and non-commercial purposes.
Rem * An individuals use of the software in his or her capacity or function
Rem as an agent, (independent) contractor, employee, member or officer of
Rem a business, corporation or organization (commercial or non-commercial)
Rem does not qualify as personal private and non-commercial purpose.
Rem * Without written approval from the author the software must not be used
Rem for a business, for commercial, corporate, governmental, military or
Rem organizational purposes of any kind, or in a commercial, corporate,
Rem governmental, military or organizational environment of any kind.
Option Explicit
Const strCommandLine = "C:\Windows\System32\Cmd.exe /D /K DIR /A"
Const strCurrentDirectory = "C:\System Volume Information"
Dim arrEnvironment(10)
arrEnvironment(0) = "NoDefaultCurrentDirectoryInExePath=*"
With WScript.CreateObject("Scripting.FileSystemObject")
Const fsoWindowsFolder = 0
Const fsoSystemFolder = 1
Const fsoTemporaryFolder = 2
arrEnvironment(1) = "SYSTEMDRIVE=" & .GetSpecialFolder(fsoWindowsFolder).Drive
arrEnvironment(2) = "SYSTEMROOT=" & .GetSpecialFolder(fsoWindowsFolder).Path
arrEnvironment(3) = "PATH=" & .GetSpecialFolder(fsoSystemFolder).Path & ";" & .GetSpecialFolder(fsoWindowsFolder).Path
arrEnvironment(4) = "TEMP=" & .GetSpecialFolder(fsoTemporaryFolder).Path
arrEnvironment(5) = "LOCALAPPDATA=" & .GetSpecialFolder(fsoTemporaryFolder).ParentFolder.Path
arrEnvironment(6) = "USERPROFILE=" & .GetSpecialFolder(fsoTemporaryFolder).ParentFolder.ParentFolder.ParentFolder.Path
End With
With WScript.CreateObject("WScript.Network")
arrEnvironment(7) = "COMPUTERNAME=" & .ComputerName
arrEnvironment(8) = "USERDOMAIN=" & .UserDomain
arrEnvironment(9) = "USERNAME=" & .UserName
End With
With GetObject("WinMgmts:{impersonationLevel=Impersonate, (Audit, Backup, Debug, Restore, Security, TakeOwnership)}!\\.\Root\CIMv2")
Dim objProcessStartup
Set objProcessStartup = .Get("Win32_ProcessStartup").SpawnInstance_
With objProcessStartup
' .CreateFlags = 8 ' Detached_Process
.EnvironmentVariables = arrEnvironment
.ErrorMode = 2 ' Fail_Critical_Errors
.FillAttribute = 240 ' Black on White
.PriorityClass = 32 ' Normal
.ShowWindow = 1 ' SW_NORMAL
.Title = vbNullString
.WinstationDesktop = vbNullString
' .X = 0
.XCountChars = 80
' .XSize = 640
' .Y = 240
.YCountChars = 50
' .YSize = 480
End With
Dim intReturn, intProcessID
intReturn = .Get("Win32_Process").Create(strCommandLine, strCurrentDirectory, objProcessStartup, intProcessID)
If intReturn <> 0 Then
WScript.Echo "Error " & intReturn
Else
WScript.Echo "Process " & intProcessID & " created"
End If
End With
Execute the
VBScript
PROCESS.VBS
created in step 1. per double-click.
Note: PROCESS.VBS
must be run under a
user account which has the privileges to enable assigned, typically
any member of the
BUILTIN\Administrators
user group!
Note: startup and shutdown scripts
run under
the NT AUTHORITY\SYSTEM
alias
LocalSystem
account; logon and logoff scripts
run under the current user
account.
SCRIPTS.INF
and save it in an arbitrary directory, then right-click the
downloaded file to display its context menu and click Installto run it.
Note: on Windows Vista and newer
versions of Windows NT,
InfDefaultInstall.exe
,
the application registered for the Install
verb of
*.inf
files, requests administrative privileges and
access rights.
client programswhich can be selected by every user as the
default programfor their associated file types and URL protocols.
CLIENTS.INF
and save it in an arbitrary directory, then right-click the
downloaded file to display its context menu and click Installto run it.
Note: on Windows Vista and newer
versions of Windows NT,
InfDefaultInstall.exe
,
the application registered for the Install
verb of
*.inf
files, requests administrative privileges.
Application Compatibility Shim Database(
.sdb
) file and print its contents in
UTF-16LE
encoding on standard output(which must be redirected to a file or piped into an application that reads from
standard input, like Clip or More).
SdbCloseDatabase()
SdbGetBinaryTagData()
SdbGetFirstChild()
SdbGetNextChild()
SdbGetStringTagPtr()
SdbGetTagFromTagID()
SdbOpenDatabase()
SdbReadDWORDTag()
SdbReadQWORDTag()
SdbTagToString()
Understanding Shims
APPHELP.COM ‹input file name› >‹output file name› APPHELP.COM ‹input file name› | MORE.COM
Note: due to the design and implementation of
Windows’ (classic alias legacy) console, the
Win32 function
WriteConsole()
can only write to a console, not to a file nor a pipe, i.e.
redirection of standard error
is not supported!
The MSDN article Console Handles provides background information.
Create the text file APPHELP.C
with the following
content in an arbitrary, preferable empty directory:
// Copyright © 2004-2023, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#ifndef _DLL
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <shellapi.h>
typedef enum _PATH_TYPE
{
DOS_PATH,
NT_PATH
} PATH_TYPE;
#define PATCH_STOP 0UL
#define PATCH_REPLACE 2UL
#define PATCH_MATCH 4UL
typedef struct _PATCH_ACTION
{
DWORD Opcode;
DWORD ActionSize; // size of structure
DWORD PatternSize;
DWORD RVA;
DWORD Reserved;
WCHAR ModuleName[32];
BYTE Pattern[ANYSIZE_ARRAY];
} PATCH_ACTION, *LPPATCH_ACTION;
typedef LPVOID PDB;
typedef ULONGLONG QWORD;
typedef WORD TAG;
#define TAG_TYPE_NULL 0x1000 // no value associated with the TAG
#define TAG_TYPE_BYTE 0x2000 // BYTE value
#define TAG_TYPE_WORD 0x3000 // WORD value
#define TAG_TYPE_DWORD 0x4000 // DWORD value
#define TAG_TYPE_QWORD 0x5000 // ULONGLONG value
#define TAG_TYPE_STRINGREF 0x6000 // tokenized string value
#define TAG_TYPE_LIST 0x7000 // list of TAG values
#define TAG_TYPE_STRING 0x8000 // UNICODE string value
#define TAG_TYPE_BINARY 0x9000 // binary value
#define TAG_TYPE_MASK 0xF000
#define TAG_LINK_DATE (TAG_TYPE_DWORD | 0x001D) // link date attribute of a file
#define TAG_UPTO_LINK_DATE (TAG_TYPE_DWORD | 0x001E) // link date attribute of a file; matching is done up to and including this link date
#define TAG_APP_NAME_RC_ID (TAG_TYPE_DWORD | 0x0024) // application name resource identifier attribute for AppHelp entries
#define TAG_VENDOR_NAME_RC_ID (TAG_TYPE_DWORD | 0x0025) // vendor name resource identifier attribute for AppHelp entries
#define TAG_SUMMARY_MSG_RC_ID (TAG_TYPE_DWORD | 0x0026) // summary message resource identifier attribute for AppHelp entries
#define TAG_DESCRIPTION_RC_ID (TAG_TYPE_DWORD | 0x0028) // description resource identifier attribute for AppHelp entries
#define TAG_PARAMETER1_RC_ID (TAG_TYPE_DWORD | 0x0029) // parameter1 resource identifier attribute for AppHelp entries
#define TAG_TIME (TAG_TYPE_QWORD | 0x0001) // time attribute
#define TAG_BIN_FILE_VERSION (TAG_TYPE_QWORD | 0x0002) // bin file version attribute for file entries
#define TAG_BIN_PRODUCT_VERSION (TAG_TYPE_QWORD | 0x0003) // bin product version attribute for file entries
#define TAG_UPTO_BIN_PRODUCT_VERSION (TAG_TYPE_QWORD | 0x0006) // bin product version attribute of a file; matching is done up to and including this product version
#define TAG_UPTO_BIN_FILE_VERSION (TAG_TYPE_QWORD | 0x000D) // bin file version attribute of a file; matching is done up to and including this file version
#define TAG_PATCH_BITS (TAG_TYPE_BINARY | 0x0002) // patch file bits attribute
#define TAG_EXE_ID (TAG_TYPE_BINARY | 0x0004) // GUID attribute of an executable entry
#define TAG_MSI_PACKAGE_ID (TAG_TYPE_BINARY | 0x0006) // MSI package identifier attribute of an MSI package
#define TAG_DATABASE_ID (TAG_TYPE_BINARY | 0x0007) // GUID attribute of a database
#define TAG_CONTEXT_PLATFORM_ID (TAG_TYPE_BINARY | 0x0008)
#define TAG_CONTEXT_BRANCH_ID (TAG_TYPE_BINARY | 0x0009)
#define TAG_FIX_ID (TAG_TYPE_BINARY | 0x0010)
#define TAG_APP_ID (TAG_TYPE_BINARY | 0x0011)
typedef DWORD TAGID;
#define TAGID_NULL 0UL
#define TAGID_ROOT 0UL
__declspec(dllimport)
VOID WINAPI SdbCloseDatabase(PDB lpdb);
__declspec(dllimport)
LPVOID WINAPI SdbGetBinaryTagData(PDB lpdb,
TAGID tiWhich);
__declspec(dllimport)
BOOL WINAPI SdbGetDatabaseVersion(LPCWSTR lpwszFileName,
LPDWORD dwMajorversion,
LPDWORD dwMinorversion);
__declspec(dllimport)
TAGID WINAPI SdbGetFirstChild(PDB lpdb,
TAGID tiParent);
__declspec(dllimport)
TAGID WINAPI SdbGetNextChild(PDB lpdb,
TAGID tiParent,
TAGID tiPrevious);
__declspec(dllimport)
LPWSTR WINAPI SdbGetStringTagPtr(PDB lpdb,
TAGID tiWhich);
__declspec(dllimport)
DWORD WINAPI SdbGetTagDataSize(PDB lpdb,
TAGID tiWhich);
__declspec(dllimport)
TAG WINAPI SdbGetTagFromTagID(PDB lpdb,
TAGID tiWhich);
__declspec(dllimport)
BOOL WINAPI SdbGUIDToString(GUID *lpGuid,
LPWSTR lpwszGuidString);
__declspec(dllimport)
PDB WINAPI SdbOpenDatabase(LPCWSTR lpwszPath,
PATH_TYPE eType);
__declspec(dllimport)
DWORD WINAPI SdbReadDWORDTag(PDB lpdb,
TAGID tiWhich,
DWORD dwDefault);
__declspec(dllimport)
QWORD WINAPI SdbReadQWORDTag(PDB lpdb,
TAGID tiWhich,
QWORD qwDefault);
__declspec(dllimport)
WORD WINAPI SdbReadWORDTag(PDB lpdb,
TAGID tiWhich,
WORD wDefault);
__declspec(dllimport)
LPCWSTR WINAPI SdbTagToString(TAG tag);
__declspec(safebuffers)
BOOL PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
DWORD dwBuffer;
DWORD dwConsole;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
if (!WriteConsole(hConsole, szBuffer, dwBuffer, &dwConsole, NULL))
return FALSE;
return dwConsole == dwBuffer;
}
__declspec(safebuffers)
BOOL PrintFormat(HANDLE hFile, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
LPBYTE lpBuffer = (LPBYTE) szBuffer;
DWORD dwBuffer;
DWORD dwFile;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
dwBuffer *= sizeof(*szBuffer);
do
{
if (!WriteFile(hFile, lpBuffer, dwBuffer, &dwFile, (LPOVERLAPPED) NULL))
return FALSE;
lpBuffer += dwFile;
dwBuffer -= dwFile;
} while (dwBuffer > 0);
return TRUE;
}
#define PrintString(HANDLE, LITERAL) PrintDirect(HANDLE, LITERAL, sizeof(LITERAL) / sizeof(*LITERAL) - 1UL)
__inline
BOOL WINAPI PrintDirect(HANDLE hFile, LPCWSTR lpString, DWORD dwString)
{
DWORD dwFile;
dwString *= sizeof(*lpString);
do
{
if (!WriteFile(hFile, lpString, dwString, &dwFile, (LPOVERLAPPED) NULL))
return FALSE;
lpString = (LPCWSTR) ((LPBYTE) lpString + dwFile);
dwString -= dwFile;
} while (dwString > 0);
return TRUE;
}
const LPCWSTR szDayOfWeek[7] = {L"Sunday",
L"Monday",
L"Tuesday",
L"Wednesday",
L"Thursday",
L"Friday",
L"Saturday"};
__declspec(safebuffers)
VOID WINAPI Children(HANDLE hConsole, HANDLE hOutput, PDB lpdb, TAGID tiParent, DWORD dwLevel)
{
SYSTEMTIME st;
PATCH_ACTION *lpPatch;
BOOL bOutput = TRUE;
DWORD dw;
LPBYTE lpData;
WORD wData;
DWORD dwData;
QWORD qwData;
WCHAR szGUID[sizeof("{00000000-0000-0000-0000-000000000000}")];
TAG tChild;
TAGID tiChild = SdbGetFirstChild(lpdb, tiParent);
while (tiChild != TAGID_NULL)
{
tChild = SdbGetTagFromTagID(lpdb, tiChild);
bOutput &= PrintFormat(hOutput,
L"0x%08lX%ls0x%04hX = %ls",
tiChild,
L"\t\t\t\t\t\t\t\t\t\t" + 9 - dwLevel,
tChild,
SdbTagToString(tChild));
switch (tChild & TAG_TYPE_MASK)
{
case TAG_TYPE_NULL:
bOutput &= PrintString(hOutput, L"\r\n");
break;
case TAG_TYPE_WORD:
wData = SdbReadWORDTag(lpdb, tiChild, ~0U);
if (wData == ~0U)
bOutput &= PrintString(hOutput, L"\r\n");
else
bOutput &= PrintFormat(hOutput, L": 0x%04hX\r\n", wData);
break;
case TAG_TYPE_DWORD:
dwData = SdbReadDWORDTag(lpdb, tiChild, ~0UL);
if (dwData == ~0UL)
bOutput &= PrintString(hOutput, L"\r\n");
else
if ((tChild == TAG_LINK_DATE)
|| (tChild == TAG_UPTO_LINK_DATE))
{
qwData = __emulu(dwData, 10000000) // seconds since 1970-01-01 to
+ 116444736000000000; // 100 nano-seconds since 1601-01-01
if (!FileTimeToSystemTime((LPFILETIME) &qwData, &st))
PrintConsole(hConsole,
L"FileTimeToSystemTime() returned error %lu\n",
GetLastError());
else
bOutput &= PrintFormat(hOutput,
L": %ls, %04hu-%02hu-%02hu %02hu:%02hu:%02hu.%03hu UTC\r\n",
szDayOfWeek[st.wDayOfWeek],
st.wYear, st.wMonth, st.wDay, st.wHour,
st.wMinute, st.wSecond, st.wMilliseconds);
}
#if 0 // NOTE: Windows Vista or newer!
else if ((tChild == TAG_APP_NAME_RC_ID)
|| (tChild == TAG_VENDOR_NAME_RC_ID)
|| (tChild == TAG_SUMMARY_MSG_RC_ID)
|| (tChild == TAG_DESCRIPTION_RC_ID)
|| (tChild == TAG_PARAMETER1_RC_ID))
bOutput &= PrintFormat(hOutput, L": 0x%08lX\r\n", dwData);
#endif
else
bOutput &= PrintFormat(hOutput, L": 0x%08lX\r\n", dwData);
break;
case TAG_TYPE_QWORD:
qwData = SdbReadQWORDTag(lpdb, tiChild, ~0ULL);
if (qwData == ~0ULL)
bOutput &= PrintString(hOutput, L"\r\n");
else
if ((tChild == TAG_BIN_FILE_VERSION)
|| (tChild == TAG_BIN_PRODUCT_VERSION)
|| (tChild == TAG_UPTO_BIN_PRODUCT_VERSION)
|| (tChild == TAG_UPTO_BIN_FILE_VERSION))
bOutput &= PrintFormat(hOutput,
L": %hu.%hu.%hu.%hu\r\n",
(WORD) (qwData >> 48), (WORD) (qwData >> 32), (WORD) (qwData >> 16), (WORD) qwData);
else if (tChild != TAG_TIME)
bOutput &= PrintFormat(hOutput, L": 0x%016I64X\r\n", qwData);
else
if (!FileTimeToSystemTime((LPFILETIME) &qwData, &st))
PrintConsole(hConsole,
L"FileTimeToSystemTime() returned error %lu\n",
GetLastError());
else
bOutput &= PrintFormat(hOutput,
L": %ls, %04hu-%02hu-%02hu %02hu:%02hu:%02hu.%03hu UTC\r\n",
szDayOfWeek[st.wDayOfWeek],
st.wYear, st.wMonth, st.wDay, st.wHour,
st.wMinute, st.wSecond, st.wMilliseconds);
break;
case TAG_TYPE_STRING:
case TAG_TYPE_STRINGREF:
bOutput &= PrintFormat(hOutput,
L": %ls\r\n",
SdbGetStringTagPtr(lpdb, tiChild));
break;
case TAG_TYPE_BYTE:
case TAG_TYPE_BINARY:
lpData = SdbGetBinaryTagData(lpdb, tiChild);
dwData = SdbGetTagDataSize(lpdb, tiChild);
if ((dwData == sizeof(GUID))
&& ((tChild == TAG_EXE_ID)
|| (tChild == TAG_MSI_PACKAGE_ID)
|| (tChild == TAG_DATABASE_ID)
|| (tChild == TAG_CONTEXT_PLATFORM_ID)
|| (tChild == TAG_CONTEXT_BRANCH_ID)
|| (tChild == TAG_FIX_ID)
|| (tChild == TAG_APP_ID)))
if (!SdbGUIDToString((LPGUID) lpData, szGUID))
PrintConsole(hConsole,
L"SdbGUIDToString() returned FALSE!\n");
else
bOutput &= PrintFormat(hOutput, L": %ls\r\n", szGUID);
else if (tChild == TAG_PATCH_BITS)
{
bOutput &= PrintString(hOutput, L":\r\n");
while (dwData > 0)
{
lpPatch = (LPPATCH_ACTION) lpData;
if ((lpPatch->Opcode == PATCH_STOP)
&& (lpPatch->ActionSize == 0))
break;
dwData -= lpPatch->ActionSize;
lpData += lpPatch->ActionSize;
if ((lpPatch->Opcode != PATCH_REPLACE)
&& (lpPatch->Opcode != PATCH_MATCH))
continue;
bOutput &= PrintFormat(hOutput,
L"%ls Action = %lu (%ls)\r\n"
L"%ls Module = %.32ls\r\n"
L"%ls RVA = 0x%08lX\r\n"
L"%ls Length = %lu\r\n"
L"%ls Pattern = 0x",
L"\t\t\t\t\t\t\t\t\t\t" + 7 - dwLevel,
lpPatch->Opcode,
lpPatch->Opcode == PATCH_MATCH ? L"MATCH" : L"REPLACE",
L"\t\t\t\t\t\t\t\t\t\t" + 7 - dwLevel,
lpPatch->ModuleName,
L"\t\t\t\t\t\t\t\t\t\t" + 7 - dwLevel,
lpPatch->RVA,
L"\t\t\t\t\t\t\t\t\t\t" + 7 - dwLevel,
lpPatch->PatternSize,
L"\t\t\t\t\t\t\t\t\t\t" + 7 - dwLevel);
for (dw = 0; dw < lpPatch->PatternSize; dw++)
bOutput &= PrintFormat(hOutput, L"%02X", lpPatch->Pattern[dw]);
bOutput &= PrintFormat(hOutput,
L"\r\n"
L"%ls Unknown = 0x%08lX\r\n",
L"\t\t\t\t\t\t\t\t\t\t" + 7 - dwLevel,
lpPatch->Reserved);
}
#if 0
if (dwData != 8)
PrintConsole(hConsole,
L"Sequence of \'PATCH_ACTION\' structures not properly terminated!\n");
#endif
}
else
{
if (dwData > 0)
bOutput &= PrintString(hOutput, L": 0x");
for (dw = 0; dw < dwData; dw++)
bOutput &= PrintFormat(hOutput, L"%02X", lpData[dw]);
bOutput &= PrintString(hOutput, L"\r\n");
}
break;
case TAG_TYPE_LIST:
bOutput &= PrintString(hOutput, L"\r\n");
Children(hConsole, hOutput, lpdb, tiChild, dwLevel + 1);
break;
default:
bOutput &= PrintString(hOutput, L"\r\n");
PrintConsole(hConsole,
L"Undefined TAG_TYPE 0x%04hX for TAGID 0x%08lX\n",
tChild, tiChild);
}
tiChild = SdbGetNextChild(lpdb, tiParent, tiChild);
}
if (!bOutput)
PrintConsole(hConsole,
L"WriteFile() returned error %lu for level %lu\n",
GetLastError(), dwLevel);
}
__declspec(noreturn)
VOID WINAPI wmainCRTStartup(VOID)
{
PDB lpdb;
LPWSTR *lpArguments;
INT nArguments;
DWORD dwError = ERROR_BAD_ARGUMENTS;
DWORD dwMajor, dwMinor;
HANDLE hOutput;
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole == INVALID_HANDLE_VALUE)
dwError = GetLastError();
else
{
lpArguments = CommandLineToArgvW(GetCommandLine(), &nArguments);
if (lpArguments == NULL)
PrintConsole(hConsole,
L"CommandLineToArgv() returned error %lu\n",
dwError = GetLastError());
else
{
if (nArguments != 2)
PrintConsole(hConsole,
L"Bad arguments: a single file or path name of a shim database must be given!\n");
else
{
hOutput = GetStdHandle(STD_OUTPUT_HANDLE);
if (hOutput == INVALID_HANDLE_VALUE)
PrintConsole(hConsole,
L"GetStdHandle() returned error %lu\n",
dwError = GetLastError());
else
{
if (!FlushFileBuffers(hOutput))
PrintConsole(hConsole,
L"FlushFileBuffers() returned error %lu: standard output is not redirected to a file!\n",
dwError = GetLastError());
else
{
dwError = ERROR_SUCCESS;
if (SdbGetDatabaseVersion(lpArguments[1], &dwMajor, &dwMinor))
PrintConsole(hConsole,
L"Shim database version: %lu.%lu\n",
dwMajor, dwMinor);
lpdb = SdbOpenDatabase(lpArguments[1], DOS_PATH);
if (lpdb == NULL)
PrintConsole(hConsole,
L"SdbOpenDatabase() returned NULL for file \'%ls\'\n",
lpArguments[1]);
else
{
if (!PrintFormat(hOutput,
L"\xFEFF" // UTF-16LE BOM
L"Shim database file:\t%ls\r\n"
L"Shim database version:\t%lu.%lu\r\n"
L"\r\n"
L"TAGID\t\tTAG = TAGSTRING: TAGVALUE\r\n"
L"\r\n",
lpArguments[1],
dwMajor, dwMinor))
PrintConsole(hConsole,
L"WriteFile() returned error %lu\n",
dwError = GetLastError());
Children(hConsole, hOutput, lpdb, TAGID_ROOT, 0);
SdbCloseDatabase(lpdb);
}
}
if (!CloseHandle(hOutput))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
}
if (LocalFree(lpArguments) != NULL)
PrintConsole(hConsole,
L"LocalFree() returned error %lu\n",
GetLastError());
}
if (!CloseHandle(hConsole))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
ExitProcess(dwError);
}
#else // _DLL
__declspec(dllexport)
long SdbCloseDatabase(void *_1)
{ return 0; }
__declspec(dllexport)
long SdbGetBinaryTagData(void *_1, long _2)
{ return 0; }
__declspec(dllexport)
long SdbGetDatabaseVersion(void *_1, void *_2, void *_3)
{ return 0; }
__declspec(dllexport)
long SdbGetFirstChild(void *_1, long _2)
{ return 0; }
__declspec(dllexport)
long SdbGetNextChild(void *_1, long _2, long _3)
{ return 0; }
__declspec(dllexport)
long SdbGetStringTagPtr(void *_1, long _2)
{ return 0; }
__declspec(dllexport)
long SdbGetTagDataSize(void *_1, long _2)
{ return 0; }
__declspec(dllexport)
long SdbGetTagFromTagID(void *_1, long _2)
{ return 0; }
__declspec(dllexport)
long SdbGUIDToString(void *_1, void *_2)
{ return 0; }
__declspec(dllexport)
long SdbOpenDatabase(void *_1, long _2)
{ return 0; }
__declspec(dllexport)
long SdbReadDWORDTag(void *_1, long _2, long _3)
{ return 0; }
__declspec(dllexport)
long SdbReadQWORDTag(void *_1, long _2, long long _3)
{ return 0; }
__declspec(dllexport)
long SdbReadWORDTag(void *_1, long _2, short _3)
{ return 0; }
__declspec(dllexport)
long SdbTagToString(short _1)
{ return 0; }
#endif // _DLL
Run the following four command lines to compile the source file
APPHELP.C
created in step 1. a first time,
generate the import library APPHELP.LIB
from the
compiled object file APPHELP.OBJ
and cleanup
afterwards:
SET CL=/Gz /LD /MD /W4 /wd4100 /X /Zl SET LINK=/EXPORT:SdbCloseDatabase /EXPORT:SdbGetBinaryTagData /EXPORT:SdbGetDatabaseVersion /EXPORT:SdbGetFirstChild /EXPORT:SdbGetNextChild /EXPORT:SdbGetStringTagPtr /EXPORT:SdbGetTagDataSize /EXPORT:SdbGetTagFromTagID /EXPORT:SdbGUIDToString /EXPORT:SdbOpenDatabase /EXPORT:SdbReadDWORDTag /EXPORT:SdbReadQWORDTag /EXPORT:SdbReadWORDTag /EXPORT:SdbTagToString /NODEFAULTLIB /NOENTRY CL.EXE APPHELP.C ERASE APPHELP.DLL APPHELP.EXP APPHELP.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. APPHELP.C Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. … Creating library APPHELP.lib and object APPHELP.exp
Run the following four command lines to compile the source file
APPHELP.C
created in step 1. a second time, link
the compiled object file APPHELP.OBJ
with the import
library APPHELP.LIB
generated in step 2. and
cleanup afterwards:
SET CL=/GA /GF /GS /Gy /O1 /Oi /Os /Oy /W4 /Zl SET LINK=/DEFAULTLIB:APPHELP.LIB /DEFAULTLIB:KERNEL32.LIB /DEFAULTLIB:SHELL32.LIB /DEFAULTLIB:USER32.LIB /ENTRY:wmainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /OSVERSION:5.1 /RELEASE /SUBSYSTEM:CONSOLE /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /FeAPPHELP.COM APPHELP.C ERASE APPHELP.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. APPHELP.C APPHELP.C(221) : warning C4213: nonstandard extension used : cast on l-value APPHELP.C(273) : warning C4310: cast truncates constant value Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Create the text file APPHELP.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 33 2c 20 53 74 65 66 61 6e 20 4b 61 -2023, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 02 00 56 4f 49 44 00 00 00 00 PE..L...VOID....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 08 00 00 ......#.........
00 0c 00 00 00 00 00 00 95 15 00 00 00 10 00 00 ................
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
05 00 01 00 00 00 2f 03 05 00 01 00 00 00 00 00 ....../.........
00 30 00 00 00 02 00 00 b6 db 00 00 03 00 00 85 .0..............
00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
04 28 00 00 64 00 00 00 00 00 00 00 00 00 00 00 .(..d...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 20 00 00 78 00 00 00 ......... ..x...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
69 07 00 00 00 10 00 00 00 08 00 00 00 02 00 00 i...............
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 63 6f 6e 73 74 00 00 ec 0a 00 00 00 20 00 00 .const....... ..
00 0c 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 ....@..@........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
55 8b ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 U........V.E.P.u
0c 8d 85 f8 f7 ff ff 50 ff 15 70 20 40 00 8b f0 .......P..p @...
85 f6 75 04 33 c0 eb 23 6a 00 8d 45 fc 50 56 8d ..u.3..#j..E.PV.
85 f8 f7 ff ff 50 ff 75 08 ff 15 3c 20 40 00 85 .....P.u...< @..
c0 74 e1 33 c0 39 75 fc 0f 94 c0 5e c9 c3 55 8b .t.3.9u....^..U.
ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 0c 8d .......V.E.P.u..
b5 f8 f7 ff ff 8b c6 50 ff 15 70 20 40 00 85 c0 .......P..p @...
74 25 57 8d 3c 00 6a 00 8d 45 fc 50 57 56 ff 75 t%W.<.j..E.PWV.u
08 ff 15 40 20 40 00 85 c0 74 0f 03 75 fc 2b 7d ...@ @...t..u.+}
fc 75 e3 33 c0 40 5f 5e c9 c3 33 c0 eb f8 55 8b .u.3.@_^..3...U.
ec 56 8b 75 10 57 8b 7d 0c 03 f6 6a 00 8d 45 10 .V.u.W.}...j..E.
50 56 57 ff 75 08 ff 15 40 20 40 00 85 c0 74 11 PVW.u...@ @...t.
03 7d 10 2b 75 10 75 e3 33 c0 40 5f 5e 5d c2 0c .}.+u.u.3.@_^]..
00 33 c0 eb f6 55 8b ec 83 ec 7c ff 75 14 c7 45 .3...U....|.u..E
fc 01 00 00 00 ff 75 10 ff 15 28 20 40 00 89 45 ......u...( @..E
f8 85 c0 0f 84 98 04 00 00 8b 45 18 53 03 c0 c7 ..........E.S...
45 f4 d6 24 40 00 29 45 f4 56 57 ff 75 f8 ff 75 E..$@.)E.VW.u..u
10 ff 15 24 20 40 00 0f b7 f8 57 8b f7 ff 15 20 ...$ @....W....
20 40 00 8b 5d 0c 50 56 ff 75 f4 ff 75 f8 68 94 @..].PV.u..u.h.
24 40 00 53 e8 15 ff ff ff 21 45 fc 8b c6 25 00 $@.S.....!E...%.
f0 00 00 b9 00 50 00 00 83 c4 18 3b c1 0f 87 ac .....P.....;....
01 00 00 0f 84 11 01 00 00 3d 00 10 00 00 74 34 .........=....t4
3d 00 20 00 00 0f 84 e5 01 00 00 3d 00 30 00 00 =. ........=.0..
0f 84 cc 00 00 00 3d 00 40 00 00 0f 85 a6 01 00 ......=.@.......
00 6a ff ff 75 f8 ff 75 10 ff 15 1c 20 40 00 83 .j..u..u.... @..
f8 ff 75 12 6a 02 68 8c 24 40 00 53 e8 fd fe ff ..u.j.h.$@.S....
ff e9 a7 03 00 00 b9 1d 40 00 00 66 3b f9 74 11 ........@..f;.t.
41 66 3b f9 74 0b 50 68 74 24 40 00 e9 83 03 00 Af;.t.Pht$@.....
00 b9 80 96 98 00 f7 e1 05 00 80 3e d5 81 d2 de ...........>....
b1 9d 01 89 45 e4 89 55 e8 8d 45 d4 50 8d 45 e4 ....E..U..E.P.E.
50 ff 15 48 20 40 00 85 c0 75 16 ff 15 44 20 40 P..H @...u...D @
00 50 68 48 24 40 00 68 14 24 40 00 e9 3f 01 00 .PhH$@.h.$@..?..
00 0f b7 45 e2 50 0f b7 45 e0 50 0f b7 45 de 50 ...E.P..E.P..E.P
0f b7 45 dc 50 0f b7 45 da 50 0f b7 45 d6 50 0f ..E.P..E.P..E.P.
b7 45 d4 50 0f b7 45 d8 ff 34 85 c4 20 40 00 68 .E.P..E..4.. @.h
a0 23 40 00 53 e8 14 fe ff ff 83 c4 28 e9 0b 03 .#@.S.......(...
00 00 68 ff ff 00 00 ff 75 f8 ff 75 10 ff 15 18 ..h.....u..u....
20 40 00 0f b7 c0 83 f8 ff 0f 84 35 ff ff ff 50 @.........5...P
68 84 23 40 00 e9 da 02 00 00 6a ff 6a ff ff 75 h.#@......j.j..u
f8 ff 75 10 ff 15 14 20 40 00 8b c8 23 ca 89 45 ..u.... @...#..E
e4 89 55 e8 83 f9 ff 0f 84 07 ff ff ff b9 02 50 ..U............P
00 00 66 3b f9 74 3b 41 66 3b f9 74 35 b9 06 50 ..f;.t;Af;.t5..P
00 00 66 3b f9 74 2b 83 c1 07 66 3b f9 74 23 b9 ..f;.t+...f;.t#.
01 50 00 00 66 3b f9 0f 84 1c ff ff ff 52 50 68 .P..f;.......RPh
64 23 40 00 53 e8 84 fd ff ff 83 c4 10 e9 7b 02 d#@.S.........{.
00 00 0f b7 c8 51 8b ca 0f ac c8 10 0f b7 c0 50 .....Q.........P
0f b7 45 e8 50 c1 ea 10 52 68 3c 23 40 00 53 c1 ..E.P...Rh<#@.S.
e9 10 e8 57 fd ff ff 83 c4 18 e9 4e 02 00 00 3d ...W.......N...=
00 60 00 00 0f 84 28 02 00 00 3d 00 70 00 00 0f .`....(...=.p...
84 f7 01 00 00 3d 00 80 00 00 0f 84 12 02 00 00 .....=..........
3d 00 90 00 00 74 29 6a 02 68 8c 24 40 00 53 e8 =....t)j.h.$@.S.
6a fd ff ff ff 75 f8 21 45 fc 56 68 e0 22 40 00 j....u.!E.Vh."@.
ff 75 08 e8 b8 fc ff ff 83 c4 10 e9 00 02 00 00 .u..............
ff 75 f8 ff 75 10 ff 15 10 20 40 00 ff 75 f8 8b .u..u.... @..u..
d8 ff 75 10 ff 15 0c 20 40 00 8b f0 89 75 f0 83 ..u.... @....u..
fe 10 75 72 b8 04 90 00 00 66 3b f8 74 34 83 c0 ..ur.....f;.t4..
02 66 3b f8 74 2c b8 07 90 00 00 66 3b f8 74 22 .f;.t,.....f;.t"
40 66 3b f8 74 1c b8 09 90 00 00 66 3b f8 74 12 @f;.t......f;.t.
83 c0 07 66 3b f8 74 0a b8 11 90 00 00 66 3b f8 ...f;.t......f;.
75 34 8d 45 84 50 53 ff 15 08 20 40 00 85 c0 75 u4.E.PS... @...u
14 68 98 22 40 00 ff 75 08 e8 32 fc ff ff 59 59 .h."@..u..2...YY
e9 7b 01 00 00 8d 45 84 50 68 88 22 40 00 ff 75 .{....E.Ph."@..u
0c e9 5f 01 00 00 b8 02 90 00 00 66 3b f8 0f 85 .._........f;...
d0 00 00 00 6a 03 68 80 22 40 00 ff 75 0c e8 9b ....j.h."@..u...
fc ff ff 21 45 fc 85 f6 0f 84 42 01 00 00 83 3b ...!E.....B....;
00 8b f3 75 0a 83 7b 04 00 0f 84 31 01 00 00 8b ...u..{....1....
43 04 8b 0e 29 45 f0 03 d8 89 5d ec 83 f9 02 74 C...)E....]....t
05 83 f9 04 75 7f ba 74 22 40 00 83 f9 04 74 05 ....u..t"@....t.
ba 64 22 40 00 8b 45 18 03 c0 bf d2 24 40 00 2b .d"@..E.....$@.+
f8 57 ff 76 08 8d 46 14 57 ff 76 0c 57 50 57 52 .W.v..F.W.v.WPWR
51 57 68 90 21 40 00 ff 75 0c e8 df fb ff ff 21 QWh.!@..u......!
45 fc 33 db 83 c4 30 39 5e 08 76 1f 0f b6 44 1e E.3...09^.v...D.
54 50 68 84 21 40 00 ff 75 0c e8 bf fb ff ff 21 TPh.!@..u......!
45 fc 83 c4 0c 43 3b 5e 08 72 e1 ff 76 10 57 68 E....C;^.r..v.Wh
50 21 40 00 ff 75 0c e8 a2 fb ff ff 8b 5d ec 83 P!@..u.......]..
c4 10 21 45 fc 83 7d f0 00 0f 87 4f ff ff ff e9 ..!E..}....O....
8c 00 00 00 85 f6 74 12 6a 04 68 44 21 40 00 ff ......t.j.hD!@..
75 0c e8 c7 fb ff ff 21 45 fc 33 ff 85 f6 74 1d u......!E.3...t.
0f b6 04 1f 50 68 84 21 40 00 ff 75 0c e8 5c fb ....Ph.!@..u..\.
ff ff 21 45 fc 83 c4 0c 47 3b fe 72 e3 6a 02 68 ..!E....G;.r.j.h
8c 24 40 00 ff 75 0c e9 90 fc ff ff 6a 02 68 8c .$@..u......j.h.
24 40 00 53 e8 85 fb ff ff 21 45 fc 8b 45 18 40 $@.S.....!E..E.@
50 ff 75 f8 ff 75 10 53 ff 75 08 e8 a5 fb ff ff P.u..u.S.u......
eb 1e ff 75 f8 ff 75 10 ff 15 04 20 40 00 50 68 ...u..u.... @.Ph
88 22 40 00 53 e8 04 fb ff ff 83 c4 0c 21 45 fc ."@.S........!E.
ff 75 f8 ff 75 14 ff 75 10 ff 15 00 20 40 00 89 .u..u..u.... @..
45 f8 85 c0 0f 85 a1 fb ff ff 5f 5e 5b 39 45 fc E........._^[9E.
75 1f ff 75 18 ff 15 44 20 40 00 50 68 30 21 40 u..u...D @.Ph0!@
00 68 e0 20 40 00 ff 75 08 e8 72 fa ff ff 83 c4 .h. @..u..r.....
14 c9 c2 14 00 83 ec 18 55 57 6a f4 bd a0 00 00 ........UWj.....
00 ff 15 60 20 40 00 8b f8 83 ff ff 75 0d ff 15 ...` @......u...
44 20 40 00 8b e8 e9 a5 01 00 00 53 56 8d 44 24 D @........SV.D$
24 50 ff 15 5c 20 40 00 50 ff 15 68 20 40 00 8b $P..\ @.P..h @..
35 44 20 40 00 89 44 24 10 85 c0 75 14 ff d6 8b 5D @..D$...u....
e8 55 68 e0 27 40 00 bb 14 24 40 00 e9 46 01 00 .Uh.'@...$@..F..
00 83 7c 24 24 02 bb 14 24 40 00 74 12 68 48 27 ..|$$...$@.t.hH'
40 00 57 e8 f8 f9 ff ff 59 59 e9 12 01 00 00 6a @.W.....YY.....j
f5 ff 15 60 20 40 00 89 44 24 14 83 f8 ff 75 0f ...` @..D$....u.
ff d6 8b e8 55 68 2c 27 40 00 e9 e8 00 00 00 50 ....Uh,'@......P
ff 15 58 20 40 00 85 c0 75 11 ff d6 8b e8 55 68 ..X @...u.....Uh
08 27 40 00 68 78 26 40 00 eb 5b 8d 44 24 18 50 .'@.hx&@..[.D$.P
8d 44 24 20 50 8b 44 24 18 ff 70 04 33 ed ff 15 .D$ P.D$..p.3...
34 20 40 00 85 c0 74 16 ff 74 24 18 ff 74 24 20 4 @...t..t$..t$
68 38 26 40 00 57 e8 85 f9 ff ff 83 c4 10 8b 44 h8&@.W.........D
24 10 6a 00 ff 70 04 ff 15 30 20 40 00 89 44 24 $.j..p...0 @..D$
20 85 c0 8b 44 24 10 75 18 ff 70 04 68 18 26 40 ...D$.u..p.h.&@
00 68 d0 25 40 00 57 e8 54 f9 ff ff 83 c4 10 eb .h.%@.W.T.......
50 ff 74 24 18 ff 74 24 20 ff 70 04 68 08 25 40 P.t$..t$ .p.h.%@
00 ff 74 24 24 e8 84 f9 ff ff 83 c4 14 85 c0 75 ..t$$..........u
14 ff d6 8b e8 55 68 30 21 40 00 53 57 e8 1e f9 .....Uh0!@.SW...
ff ff 83 c4 10 6a 00 6a 00 ff 74 24 28 ff 74 24 .....j.j..t$(.t$
20 57 e8 de f9 ff ff ff 74 24 20 ff 15 2c 20 40 W......t$ .., @
00 ff 74 24 14 ff 15 54 20 40 00 85 c0 75 12 ff ..t$...T @...u..
d6 50 68 f0 24 40 00 53 57 e8 e2 f8 ff ff 83 c4 .Ph.$@.SW.......
10 ff 74 24 10 ff 15 50 20 40 00 85 c0 74 12 ff ..t$...P @...t..
d6 50 68 dc 24 40 00 53 57 e8 c2 f8 ff ff 83 c4 .Ph.$@.SW.......
10 57 ff 15 54 20 40 00 85 c0 75 12 ff d6 50 68 .W..T @...u...Ph
f0 24 40 00 53 57 e8 a5 f8 ff ff 83 c4 10 5e 5b .$@.SW........^[
55 ff 15 4c 20 40 00 5f 5d 00 00 00 00 00 00 00 U..L @._].......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
e0 28 00 00 f2 28 00 00 08 29 00 00 1a 29 00 00 .(...(...)...)..
2e 29 00 00 44 29 00 00 56 29 00 00 68 29 00 00 .)..D)..V)..h)..
7a 29 00 00 8c 29 00 00 a2 29 00 00 b6 29 00 00 z)...)...)...)..
ca 29 00 00 dc 29 00 00 00 00 00 00 00 2a 00 00 .)...).......*..
10 2a 00 00 1c 2a 00 00 2c 2a 00 00 44 2a 00 00 .*...*..,*..D*..
52 2a 00 00 5e 2a 00 00 6c 2a 00 00 80 2a 00 00 R*..^*..l*...*..
92 2a 00 00 00 00 00 00 b0 2a 00 00 00 00 00 00 .*.......*......
d2 2a 00 00 00 00 00 00 53 00 61 00 74 00 75 00 .*......S.a.t.u.
72 00 00 00 46 00 72 00 69 00 00 00 54 00 68 00 r...F.r.i...T.h.
75 00 72 00 73 00 00 00 57 00 65 00 64 00 6e 00 u.r.s...W.e.d.n.
65 00 73 00 00 00 00 00 54 00 75 00 65 00 73 00 e.s.....T.u.e.s.
00 00 00 00 4d 00 6f 00 6e 00 00 00 53 00 75 00 ....M.o.n...S.u.
6e 00 00 00 bc 20 40 00 b4 20 40 00 a8 20 40 00 n.... @.. @.. @.
98 20 40 00 8c 20 40 00 84 20 40 00 78 20 40 00 . @.. @.. @.x @.
25 00 6c 00 73 00 28 00 29 00 20 00 72 00 65 00 %.l.s.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 65 00 t.u.r.n.e.d. .e.
72 00 72 00 6f 00 72 00 20 00 25 00 6c 00 75 00 r.r.o.r. .%.l.u.
20 00 66 00 6f 00 72 00 20 00 6c 00 65 00 76 00 .f.o.r. .l.e.v.
65 00 6c 00 20 00 25 00 6c 00 75 00 0a 00 00 00 e.l. .%.l.u.....
57 00 72 00 69 00 74 00 65 00 46 00 69 00 6c 00 W.r.i.t.e.F.i.l.
65 00 00 00 3a 00 20 00 30 00 78 00 00 00 00 00 e...:. .0.x.....
0d 00 0a 00 25 00 6c 00 73 00 20 00 55 00 6e 00 ....%.l.s. .U.n.
6b 00 6e 00 6f 00 77 00 6e 00 20 00 3d 00 20 00 k.n.o.w.n. .=. .
30 00 78 00 25 00 30 00 38 00 6c 00 58 00 0d 00 0.x.%.0.8.l.X...
0a 00 00 00 25 00 30 00 32 00 58 00 00 00 00 00 ....%.0.2.X.....
25 00 6c 00 73 00 20 00 41 00 63 00 74 00 69 00 %.l.s. .A.c.t.i.
6f 00 6e 00 20 00 20 00 3d 00 20 00 25 00 6c 00 o.n. . .=. .%.l.
75 00 20 00 28 00 25 00 6c 00 73 00 29 00 0d 00 u. .(.%.l.s.)...
0a 00 25 00 6c 00 73 00 20 00 4d 00 6f 00 64 00 ..%.l.s. .M.o.d.
75 00 6c 00 65 00 20 00 20 00 3d 00 20 00 25 00 u.l.e. . .=. .%.
2e 00 33 00 32 00 6c 00 73 00 0d 00 0a 00 25 00 ..3.2.l.s.....%.
6c 00 73 00 20 00 52 00 56 00 41 00 20 00 20 00 l.s. .R.V.A. . .
20 00 20 00 20 00 3d 00 20 00 30 00 78 00 25 00 . . .=. .0.x.%.
30 00 38 00 6c 00 58 00 0d 00 0a 00 25 00 6c 00 0.8.l.X.....%.l.
73 00 20 00 4c 00 65 00 6e 00 67 00 74 00 68 00 s. .L.e.n.g.t.h.
20 00 20 00 3d 00 20 00 25 00 6c 00 75 00 0d 00 . .=. .%.l.u...
0a 00 25 00 6c 00 73 00 20 00 50 00 61 00 74 00 ..%.l.s. .P.a.t.
74 00 65 00 72 00 6e 00 20 00 3d 00 20 00 30 00 t.e.r.n. .=. .0.
78 00 00 00 52 00 45 00 50 00 4c 00 41 00 43 00 x...R.E.P.L.A.C.
45 00 00 00 4d 00 41 00 54 00 43 00 48 00 00 00 E...M.A.T.C.H...
3a 00 0d 00 0a 00 00 00 3a 00 20 00 25 00 6c 00 :.......:. .%.l.
73 00 0d 00 0a 00 00 00 53 00 64 00 62 00 47 00 s.......S.d.b.G.
55 00 49 00 44 00 54 00 6f 00 53 00 74 00 72 00 U.I.D.T.o.S.t.r.
69 00 6e 00 67 00 28 00 29 00 20 00 72 00 65 00 i.n.g.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 46 00 t.u.r.n.e.d. .F.
41 00 4c 00 53 00 45 00 21 00 0a 00 00 00 00 00 A.L.S.E.!.......
55 00 6e 00 64 00 65 00 66 00 69 00 6e 00 65 00 U.n.d.e.f.i.n.e.
64 00 20 00 54 00 41 00 47 00 5f 00 54 00 59 00 d. .T.A.G._.T.Y.
50 00 45 00 20 00 30 00 78 00 25 00 30 00 34 00 P.E. .0.x.%.0.4.
68 00 58 00 20 00 66 00 6f 00 72 00 20 00 54 00 h.X. .f.o.r. .T.
41 00 47 00 49 00 44 00 20 00 30 00 78 00 25 00 A.G.I.D. .0.x.%.
30 00 38 00 6c 00 58 00 0a 00 00 00 3a 00 20 00 0.8.l.X.....:. .
25 00 68 00 75 00 2e 00 25 00 68 00 75 00 2e 00 %.h.u...%.h.u...
25 00 68 00 75 00 2e 00 25 00 68 00 75 00 0d 00 %.h.u...%.h.u...
0a 00 00 00 3a 00 20 00 30 00 78 00 25 00 30 00 ....:. .0.x.%.0.
31 00 36 00 49 00 36 00 34 00 58 00 0d 00 0a 00 1.6.I.6.4.X.....
00 00 00 00 3a 00 20 00 30 00 78 00 25 00 30 00 ....:. .0.x.%.0.
34 00 68 00 58 00 0d 00 0a 00 00 00 00 00 00 00 4.h.X...........
3a 00 20 00 25 00 6c 00 73 00 64 00 61 00 79 00 :. .%.l.s.d.a.y.
2c 00 20 00 25 00 30 00 34 00 68 00 75 00 2d 00 ,. .%.0.4.h.u.-.
25 00 30 00 32 00 68 00 75 00 2d 00 25 00 30 00 %.0.2.h.u.-.%.0.
32 00 68 00 75 00 20 00 25 00 30 00 32 00 68 00 2.h.u. .%.0.2.h.
75 00 3a 00 25 00 30 00 32 00 68 00 75 00 3a 00 u.:.%.0.2.h.u.:.
25 00 30 00 32 00 68 00 75 00 2e 00 25 00 30 00 %.0.2.h.u...%.0.
33 00 68 00 75 00 20 00 55 00 54 00 43 00 0d 00 3.h.u. .U.T.C...
0a 00 00 00 25 00 6c 00 73 00 28 00 29 00 20 00 ....%.l.s.(.). .
72 00 65 00 74 00 75 00 72 00 6e 00 65 00 64 00 r.e.t.u.r.n.e.d.
20 00 65 00 72 00 72 00 6f 00 72 00 20 00 25 00 .e.r.r.o.r. .%.
6c 00 75 00 0a 00 00 00 46 00 69 00 6c 00 65 00 l.u.....F.i.l.e.
54 00 69 00 6d 00 65 00 54 00 6f 00 53 00 79 00 T.i.m.e.T.o.S.y.
73 00 74 00 65 00 6d 00 54 00 69 00 6d 00 65 00 s.t.e.m.T.i.m.e.
00 00 00 00 3a 00 20 00 30 00 78 00 25 00 30 00 ....:. .0.x.%.0.
38 00 6c 00 58 00 0d 00 0a 00 00 00 0d 00 0a 00 8.l.X...........
00 00 00 00 30 00 78 00 25 00 30 00 38 00 6c 00 ....0.x.%.0.8.l.
58 00 25 00 6c 00 73 00 30 00 78 00 25 00 30 00 X.%.l.s.0.x.%.0.
34 00 68 00 58 00 20 00 3d 00 20 00 25 00 6c 00 4.h.X. .=. .%.l.
73 00 00 00 09 00 09 00 09 00 09 00 09 00 09 00 s...............
09 00 09 00 09 00 09 00 00 00 00 00 4c 00 6f 00 ............L.o.
63 00 61 00 6c 00 46 00 72 00 65 00 65 00 00 00 c.a.l.F.r.e.e...
43 00 6c 00 6f 00 73 00 65 00 48 00 61 00 6e 00 C.l.o.s.e.H.a.n.
64 00 6c 00 65 00 00 00 ff fe 53 00 68 00 69 00 d.l.e.....S.h.i.
6d 00 20 00 64 00 61 00 74 00 61 00 62 00 61 00 m. .d.a.t.a.b.a.
73 00 65 00 20 00 66 00 69 00 6c 00 65 00 3a 00 s.e. .f.i.l.e.:.
09 00 25 00 6c 00 73 00 0d 00 0a 00 53 00 68 00 ..%.l.s.....S.h.
69 00 6d 00 20 00 64 00 61 00 74 00 61 00 62 00 i.m. .d.a.t.a.b.
61 00 73 00 65 00 20 00 76 00 65 00 72 00 73 00 a.s.e. .v.e.r.s.
69 00 6f 00 6e 00 3a 00 09 00 25 00 6c 00 75 00 i.o.n.:...%.l.u.
2e 00 25 00 6c 00 75 00 0d 00 0a 00 0d 00 0a 00 ..%.l.u.........
54 00 41 00 47 00 49 00 44 00 09 00 09 00 54 00 T.A.G.I.D.....T.
41 00 47 00 20 00 20 00 20 00 20 00 3d 00 20 00 A.G. . . . .=. .
54 00 41 00 47 00 53 00 54 00 52 00 49 00 4e 00 T.A.G.S.T.R.I.N.
47 00 3a 00 20 00 54 00 41 00 47 00 56 00 41 00 G.:. .T.A.G.V.A.
4c 00 55 00 45 00 0d 00 0a 00 0d 00 0a 00 00 00 L.U.E...........
25 00 6c 00 73 00 28 00 29 00 20 00 72 00 65 00 %.l.s.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 4e 00 t.u.r.n.e.d. .N.
55 00 4c 00 4c 00 20 00 66 00 6f 00 72 00 20 00 U.L.L. .f.o.r. .
66 00 69 00 6c 00 65 00 20 00 27 00 25 00 6c 00 f.i.l.e. .'.%.l.
73 00 27 00 0a 00 00 00 53 00 64 00 62 00 4f 00 s.'.....S.d.b.O.
70 00 65 00 6e 00 44 00 61 00 74 00 61 00 62 00 p.e.n.D.a.t.a.b.
61 00 73 00 65 00 00 00 53 00 68 00 69 00 6d 00 a.s.e...S.h.i.m.
20 00 64 00 61 00 74 00 61 00 62 00 61 00 73 00 .d.a.t.a.b.a.s.
65 00 20 00 76 00 65 00 72 00 73 00 69 00 6f 00 e. .v.e.r.s.i.o.
6e 00 3a 00 20 00 25 00 6c 00 75 00 2e 00 25 00 n.:. .%.l.u...%.
6c 00 75 00 0a 00 00 00 25 00 6c 00 73 00 28 00 l.u.....%.l.s.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 3a 00 20 00 73 00 74 00 .%.l.u.:. .s.t.
61 00 6e 00 64 00 61 00 72 00 64 00 20 00 6f 00 a.n.d.a.r.d. .o.
75 00 74 00 70 00 75 00 74 00 20 00 69 00 73 00 u.t.p.u.t. .i.s.
20 00 6e 00 6f 00 74 00 20 00 72 00 65 00 64 00 .n.o.t. .r.e.d.
69 00 72 00 65 00 63 00 74 00 65 00 64 00 20 00 i.r.e.c.t.e.d. .
74 00 6f 00 20 00 61 00 20 00 66 00 69 00 6c 00 t.o. .a. .f.i.l.
65 00 21 00 0a 00 00 00 46 00 6c 00 75 00 73 00 e.!.....F.l.u.s.
68 00 46 00 69 00 6c 00 65 00 42 00 75 00 66 00 h.F.i.l.e.B.u.f.
66 00 65 00 72 00 73 00 00 00 00 00 47 00 65 00 f.e.r.s.....G.e.
74 00 53 00 74 00 64 00 48 00 61 00 6e 00 64 00 t.S.t.d.H.a.n.d.
6c 00 65 00 00 00 00 00 4e 00 6f 00 20 00 61 00 l.e.....N.o. .a.
72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 3a 00 r.g.u.m.e.n.t.:.
20 00 61 00 20 00 73 00 69 00 6e 00 67 00 6c 00 .a. .s.i.n.g.l.
65 00 20 00 66 00 69 00 6c 00 65 00 20 00 6f 00 e. .f.i.l.e. .o.
72 00 20 00 70 00 61 00 74 00 68 00 20 00 6e 00 r. .p.a.t.h. .n.
61 00 6d 00 65 00 20 00 6f 00 66 00 20 00 61 00 a.m.e. .o.f. .a.
20 00 73 00 68 00 69 00 6d 00 20 00 64 00 61 00 .s.h.i.m. .d.a.
74 00 61 00 62 00 61 00 73 00 65 00 20 00 6d 00 t.a.b.a.s.e. .m.
75 00 73 00 74 00 20 00 62 00 65 00 20 00 67 00 u.s.t. .b.e. .g.
69 00 76 00 65 00 6e 00 21 00 0a 00 00 00 00 00 i.v.e.n.!.......
43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 4c 00 C.o.m.m.a.n.d.L.
69 00 6e 00 65 00 54 00 6f 00 41 00 72 00 67 00 i.n.e.T.o.A.r.g.
76 00 00 00 68 28 00 00 00 00 00 00 00 00 00 00 v...h(..........
f4 29 00 00 00 20 00 00 a4 28 00 00 00 00 00 00 .)... ...(......
00 00 00 00 a2 2a 00 00 3c 20 00 00 d0 28 00 00 .....*..< ...(..
00 00 00 00 00 00 00 00 c6 2a 00 00 68 20 00 00 .........*..h ..
d8 28 00 00 00 00 00 00 00 00 00 00 e0 2a 00 00 .(...........*..
70 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 p ..............
00 00 00 00 00 00 00 00 e0 28 00 00 f2 28 00 00 .........(...(..
08 29 00 00 1a 29 00 00 2e 29 00 00 44 29 00 00 .)...)...)..D)..
56 29 00 00 68 29 00 00 7a 29 00 00 8c 29 00 00 V)..h)..z)...)..
a2 29 00 00 b6 29 00 00 ca 29 00 00 dc 29 00 00 .)...)...)...)..
00 00 00 00 00 2a 00 00 10 2a 00 00 1c 2a 00 00 .....*...*...*..
2c 2a 00 00 44 2a 00 00 52 2a 00 00 5e 2a 00 00 ,*..D*..R*..^*..
6c 2a 00 00 80 2a 00 00 92 2a 00 00 00 00 00 00 l*...*...*......
b0 2a 00 00 00 00 00 00 d2 2a 00 00 00 00 00 00 .*.......*......
1b 00 53 64 62 47 65 74 4e 65 78 74 43 68 69 6c ..SdbGetNextChil
64 00 1f 00 53 64 62 47 65 74 53 74 72 69 6e 67 d...SdbGetString
54 61 67 50 74 72 00 00 12 00 53 64 62 47 55 49 TagPtr....SdbGUI
44 54 6f 53 74 72 69 6e 67 00 20 00 53 64 62 47 DToString. .SdbG
65 74 54 61 67 44 61 74 61 53 69 7a 65 00 14 00 etTagDataSize...
53 64 62 47 65 74 42 69 6e 61 72 79 54 61 67 44 SdbGetBinaryTagD
61 74 61 00 2f 00 53 64 62 52 65 61 64 51 57 4f ata./.SdbReadQWO
52 44 54 61 67 00 31 00 53 64 62 52 65 61 64 57 RDTag.1.SdbReadW
4f 52 44 54 61 67 00 00 2e 00 53 64 62 52 65 61 ORDTag....SdbRea
64 44 57 4f 52 44 54 61 67 00 3a 00 53 64 62 54 dDWORDTag.:.SdbT
61 67 54 6f 53 74 72 69 6e 67 00 00 21 00 53 64 agToString..!.Sd
62 47 65 74 54 61 67 46 72 6f 6d 54 61 67 49 44 bGetTagFromTagID
00 00 18 00 53 64 62 47 65 74 46 69 72 73 74 43 ....SdbGetFirstC
68 69 6c 64 00 00 05 00 53 64 62 43 6c 6f 73 65 hild....SdbClose
44 61 74 61 62 61 73 65 00 00 2a 00 53 64 62 4f Database..*.SdbO
70 65 6e 44 61 74 61 62 61 73 65 00 16 00 53 64 penDatabase...Sd
62 47 65 74 44 61 74 61 62 61 73 65 56 65 72 73 bGetDatabaseVers
69 6f 6e 00 41 50 50 48 45 4c 50 2e 64 6c 6c 00 ion.APPHELP.dll.
24 05 57 72 69 74 65 43 6f 6e 73 6f 6c 65 57 00 $.WriteConsoleW.
25 05 57 72 69 74 65 46 69 6c 65 00 02 02 47 65 %.WriteFile...Ge
74 4c 61 73 74 45 72 72 6f 72 00 00 25 01 46 69 tLastError..%.Fi
6c 65 54 69 6d 65 54 6f 53 79 73 74 65 6d 54 69 leTimeToSystemTi
6d 65 00 00 19 01 45 78 69 74 50 72 6f 63 65 73 me....ExitProces
73 00 48 03 4c 6f 63 61 6c 46 72 65 65 00 52 00 s.H.LocalFree.R.
43 6c 6f 73 65 48 61 6e 64 6c 65 00 57 01 46 6c CloseHandle.W.Fl
75 73 68 46 69 6c 65 42 75 66 66 65 72 73 00 00 ushFileBuffers..
87 01 47 65 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 ..GetCommandLine
57 00 64 02 47 65 74 53 74 64 48 61 6e 64 6c 65 W.d.GetStdHandle
00 00 4b 45 52 4e 45 4c 33 32 2e 64 6c 6c 00 00 ..KERNEL32.dll..
06 00 43 6f 6d 6d 61 6e 64 4c 69 6e 65 54 6f 41 ..CommandLineToA
72 67 76 57 00 00 53 48 45 4c 4c 33 32 2e 64 6c rgvW..SHELL32.dl
6c 00 35 03 77 76 73 70 72 69 6e 74 66 57 00 00 l.5.wvsprintfW..
55 53 45 52 33 32 2e 64 6c 6c 00 00 00 00 00 00 USER32.dll......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file APPHELP.TXT
created in
step 4. to recreate the console application
Shim Database Decoder:
CERTUTIL.EXE /DecodeHex /V APPHELP.TXT APPHELP.COM
Input Length = 23936 Output Length = 5632 CertUtil: -decodehex command completed successfully.
debug stringswritten from all processes running in the current (user) session with the Win32 function
OutputDebugString()
.
debug stringswritten with the Win32 function
OutputDebugString()
are catched and typically displayed by the debugger.
In Win32 processes that are not run under a debugger,
the Win32 function
OutputDebugString()
checks whether the shared memory section DBWIN_BUFFER
as well as the events DBWIN_BUFFER_READY
and
DBWIN_DATA_READY
exist; if yes, it waits until the
event DBWIN_BUFFER_READY
is signaled, writes the
process identification and its argument into the shared memory
section DBWIN_BUFFER
, signals the event
DBWIN_DATA_READY
and returns to its caller.
DBWINNER.COM
Note: due to the design and implementation of
Windows’ (classic alias legacy) console, the
Win32 function
WriteConsole()
can only write to a console, not to a file nor a pipe, i.e.
redirection of standard error
or standard output
is
not supported!
The MSDN article Console Handles provides background information.
Create the text file DBWINNER.C
with the following
content in an arbitrary, preferable empty directory:
// Copyright © 2004-2023, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
const LPCSTR szCtrlType[] = {"Ctrl-C",
"Ctrl-Break",
"Ctrl-Close",
NULL,
NULL,
"Ctrl-Logoff",
"Ctrl-Shutdown"};
BOOL WINAPI CtrlHandler(DWORD dwCtrlType)
{
switch (dwCtrlType)
{
case CTRL_C_EVENT:
case CTRL_BREAK_EVENT:
case CTRL_CLOSE_EVENT:
case CTRL_LOGOFF_EVENT:
case CTRL_SHUTDOWN_EVENT:
OutputDebugStringA(szCtrlType[dwCtrlType]);
return TRUE;
default:
return FALSE;
}
}
__declspec(safebuffers)
BOOL PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
DWORD dwBuffer;
DWORD dwConsole;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
if (!WriteConsole(hConsole, szBuffer, dwBuffer, &dwConsole, NULL))
return FALSE;
return dwConsole == dwBuffer;
}
typedef struct _dbwin_buffer
{
DWORD dwProcessId;
CHAR szString[4096 - sizeof(DWORD)];
} DBWIN_BUFFER;
__declspec(noreturn)
VOID WINAPI wmainCRTStartup(VOID)
{
DBWIN_BUFFER *lpDBWin;
HANDLE hDBWin;
HANDLE hDBWinBuffer;
HANDLE hDBWinData;
DWORD dwDBWinData;
DWORD dwString;
DWORD dwError = ERROR_SUCCESS;
DWORD dwProcessId = 0;
DWORD dwCurrentProcessId = GetCurrentProcessId();
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole == INVALID_HANDLE_VALUE)
dwError = GetLastError();
else
{
hDBWin = CreateFileMapping(INVALID_HANDLE_VALUE,
(LPSECURITY_ATTRIBUTES) NULL,
PAGE_READWRITE,
0,
sizeof(DBWIN_BUFFER),
L"DBWIN_BUFFER");
dwError = GetLastError();
if (hDBWin == NULL)
PrintConsole(hConsole,
L"CreateFileMapping() returned error %lu\n",
dwError);
else
{
if (dwError == ERROR_ALREADY_EXISTS)
PrintConsole(hConsole,
L"Shared section \'DBWIN_BUFFER\' already created by another process!\n");
else
{
hDBWinBuffer = CreateEvent((LPSECURITY_ATTRIBUTES) NULL,
FALSE,
FALSE,
L"DBWIN_BUFFER_READY");
dwError = GetLastError();
if (hDBWinBuffer == NULL)
PrintConsole(hConsole,
L"CreateEvent() returned error %lu\n",
dwError);
else
{
if (dwError == ERROR_ALREADY_EXISTS)
PrintConsole(hConsole,
L"Event \'DBWIN_BUFFER_READY\' already created by another process!\n");
else
{
hDBWinData = CreateEvent((LPSECURITY_ATTRIBUTES) NULL,
FALSE,
FALSE,
L"DBWIN_DATA_READY");
dwError = GetLastError();
if (hDBWinData == NULL)
PrintConsole(hConsole,
L"CreateEvent() returned error %lu\n",
dwError);
else
{
if (dwError == ERROR_ALREADY_EXISTS)
PrintConsole(hConsole,
L"Event \'DBWIN_DATA_READY\' already created by another process!\n");
else
{
lpDBWin = MapViewOfFile(hDBWin,
SECTION_MAP_READ | SECTION_MAP_WRITE,
0, 0, 0);
if (lpDBWin == NULL)
PrintConsole(hConsole,
L"MapViewOfFile() returned error %lu\n",
dwError = GetLastError());
else
{
if (!SetConsoleCtrlHandler(CtrlHandler, TRUE))
PrintConsole(hConsole,
L"SetConsoleCtrlHandler() returned error %lu\n",
dwError = GetLastError());
PrintConsole(hConsole,
L"Press \'Ctrl-C\' or \'Ctrl-Break\' to terminate!\n"
L"\n"
L"Process\tDebug String\n");
do
{
dwDBWinData = SignalObjectAndWait(hDBWinBuffer,
hDBWinData,
INFINITE,
FALSE);
if (dwDBWinData != WAIT_OBJECT_0)
break;
dwString = strlen(lpDBWin->szString);
while ((dwString-- > 0)
&& ((lpDBWin->szString[dwString] == ' ')
|| (lpDBWin->szString[dwString] == '\a')
|| (lpDBWin->szString[dwString] == '\b')
|| (lpDBWin->szString[dwString] == '\f')
|| (lpDBWin->szString[dwString] == '\n')
|| (lpDBWin->szString[dwString] == '\r')
|| (lpDBWin->szString[dwString] == '\t')
|| (lpDBWin->szString[dwString] == '\v')))
/* lpDBWin->szString[dwString] = '\0' */;
lpDBWin->szString[++dwString] = '\0';
if (lpDBWin->dwProcessId != dwProcessId)
PrintConsole(hConsole,
L"\n"
L"%7lu\t%hs\n",
dwProcessId = lpDBWin->dwProcessId,
lpDBWin->szString);
else
PrintConsole(hConsole,
L"\t%hs\n",
lpDBWin->szString);
} while (dwProcessId != dwCurrentProcessId);
if (dwDBWinData == WAIT_FAILED)
PrintConsole(hConsole,
L"SignalObjectAndWait() returned error %lu\n",
dwError = GetLastError());
if (!SetConsoleCtrlHandler(CtrlHandler, FALSE))
PrintConsole(hConsole,
L"SetConsoleCtrlHandler() returned error %lu\n",
GetLastError());
if (!UnmapViewOfFile(lpDBWin))
PrintConsole(hConsole,
L"UnmapViewOfFile() returned error %lu\n",
GetLastError());
}
}
if (!CloseHandle(hDBWinData))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
}
if (!CloseHandle(hDBWinBuffer))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
}
if (!CloseHandle(hDBWin))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
if (!CloseHandle(hConsole))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
ExitProcess(dwError);
}
Run the following four command lines to compile the source file
DBWINNER.C
created in step 1., link the compiled
object file DBWINNER.OBJ
and cleanup afterwards:
SET CL=/GA /GF /GS /Gy /O1 /Oi /Os /Oy /W4 /Zl SET LINK=/DEFAULTLIB:KERNEL32.LIB /DEFAULTLIB:USER32.LIB /ENTRY:wmainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /OSVERSION:5.0 /RELEASE /SUBSYSTEM:CONSOLE /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /FeDBWINNER.COM DBWINNER.C ERASE DBWINNER.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. DBWINNER.C Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Create the text file DBWINNER.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 33 2c 20 53 74 65 66 61 6e 20 4b 61 -2023, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 02 00 56 4f 49 44 00 00 00 00 PE..L...VOID....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 04 00 00 ......#.........
00 06 00 00 00 00 00 00 78 10 00 00 00 10 00 00 ........x.......
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
05 00 00 00 00 00 2f 03 05 00 00 00 00 00 00 00 ....../.........
00 30 00 00 00 02 00 00 3c 77 00 00 03 00 00 85 .0......<w......
00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
a8 23 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 .#..<...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 20 00 00 40 00 00 00 ......... ..@...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
7f 03 00 00 00 10 00 00 00 04 00 00 00 02 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 63 6f 6e 73 74 00 00 3a 05 00 00 00 20 00 00 .const..:.... ..
00 06 00 00 00 06 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 ....@..@........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8b 44 24 04 83 f8 02 76 0a 83 f8 04 76 17 83 f8 .D$....v....v...
06 77 12 ff 34 85 7c 20 40 00 ff 15 00 20 40 00 .w..4.| @.... @.
33 c0 40 eb 02 33 c0 c2 04 00 55 8b ec 81 ec 08 3.@..3....U.....
08 00 00 56 8d 45 10 50 ff 75 0c 8d 85 f8 f7 ff ...V.E.P.u......
ff 50 ff 15 38 20 40 00 8b f0 85 f6 75 04 33 c0 .P..8 @.....u.3.
eb 23 6a 00 8d 45 fc 50 56 8d 85 f8 f7 ff ff 50 .#j..E.PV......P
ff 75 08 ff 15 04 20 40 00 85 c0 74 e1 33 c0 39 .u.... @...t.3.9
75 fc 0f 94 c0 5e c9 c3 83 ec 1c 55 57 33 ff 89 u....^.....UW3..
7c 24 0c ff 15 30 20 40 00 6a f4 89 44 24 24 ff |$...0 @.j..D$$.
15 2c 20 40 00 8b e8 83 fd ff 75 0f ff 15 28 20 ., @......u...(
40 00 89 44 24 08 e9 c8 02 00 00 53 56 bb 8c 23 @..D$......SV..#
40 00 53 68 00 10 00 00 57 6a 04 57 6a ff ff 15 @.Sh....Wj.Wj...
24 20 40 00 8b 35 28 20 40 00 89 44 24 20 ff d6 $ @..5( @..D$ ..
39 7c 24 20 89 44 24 10 bf 58 23 40 00 75 0b 50 9|$ .D$..X#@.u.P
68 34 23 40 00 e9 60 02 00 00 3d b7 00 00 00 75 h4#@..`...=....u
14 53 68 c0 22 40 00 55 e8 2d ff ff ff 83 c4 0c .Sh."@.U.-......
e9 2f 02 00 00 8b 1d 20 20 40 00 68 94 22 40 00 ./..... @.h."@.
33 c0 50 50 50 ff d3 89 44 24 1c ff d6 33 c9 89 3.PPP...D$...3..
44 24 10 39 4c 24 1c 75 0b 50 68 7c 22 40 00 e9 D$.9L$.u.Ph|"@..
f6 01 00 00 3d b7 00 00 00 75 18 68 94 22 40 00 ....=....u.h."@.
68 18 22 40 00 55 e8 df fe ff ff 83 c4 0c e9 c1 h."@.U..........
01 00 00 68 f4 21 40 00 51 51 51 ff d3 89 44 24 ...h.!@.QQQ...D$
18 ff d6 33 c9 89 44 24 10 39 4c 24 18 75 0b 50 ...3..D$.9L$.u.P
68 7c 22 40 00 e9 90 01 00 00 3d b7 00 00 00 75 h|"@......=....u
18 68 f4 21 40 00 68 18 22 40 00 55 e8 99 fe ff .h.!@.h."@.U....
ff 83 c4 0c e9 5b 01 00 00 51 51 51 6a 06 ff 74 .....[...QQQj..t
24 30 ff 15 1c 20 40 00 8b d8 89 5c 24 24 85 db $0... @....\$$..
75 11 ff d6 50 89 44 24 14 68 d8 21 40 00 e9 27 u...P.D$.h.!@..'
01 00 00 6a 01 68 00 10 40 00 ff 15 18 20 40 00 ...j.h..@.... @.
85 c0 75 16 ff d6 50 68 ac 21 40 00 57 55 89 44 ..u...Ph.!@.WU.D
24 20 e8 43 fe ff ff 83 c4 10 68 20 21 40 00 55 $ .C......h !@.U
e8 35 fe ff ff 59 59 6a 00 6a ff ff 74 24 20 ff .5...YYj.j..t$ .
74 24 28 ff 15 14 20 40 00 85 c0 0f 85 88 00 00 t$(... @........
00 8d 53 04 8b c2 8d 48 01 8a 18 40 84 db 75 f9 ..S....H...@..u.
2b c1 8b c8 48 85 c9 74 2b 8a 0c 02 80 f9 20 74 +...H..t+..... t
f1 80 f9 07 74 ec 80 f9 08 74 e7 80 f9 0c 74 e2 ....t....t....t.
80 f9 0a 74 dd 80 f9 0d 74 d8 80 f9 09 74 d3 80 ...t....t....t..
f9 0b 74 ce 8b 5c 24 24 c6 44 18 05 00 8b 03 52 ..t..\$$.D.....R
3b 44 24 18 74 15 50 68 04 21 40 00 55 89 44 24 ;D$.t.Ph.!@.U.D$
24 e8 b4 fd ff ff 83 c4 10 eb 0e 68 f8 20 40 00 $..........h. @.
55 e8 a4 fd ff ff 83 c4 0c 8b 44 24 14 3b 44 24 U.........D$.;D$
28 0f 85 60 ff ff ff eb 1b 83 f8 ff 75 16 ff d6 (..`........u...
50 68 d0 20 40 00 57 55 89 44 24 20 e8 79 fd ff Ph. @.WU.D$ .y..
ff 83 c4 10 6a 00 68 00 10 40 00 ff 15 18 20 40 ....j.h..@.... @
00 85 c0 75 12 ff d6 50 68 ac 21 40 00 57 55 e8 ...u...Ph.!@.WU.
56 fd ff ff 83 c4 10 53 ff 15 10 20 40 00 85 c0 V......S... @...
75 12 ff d6 50 68 b0 20 40 00 57 55 e8 39 fd ff u...Ph. @.WU.9..
ff 83 c4 10 ff 74 24 18 ff 15 0c 20 40 00 85 c0 .....t$.... @...
75 12 ff d6 50 68 98 20 40 00 57 55 e8 19 fd ff u...Ph. @.WU....
ff 83 c4 10 ff 74 24 1c ff 15 0c 20 40 00 85 c0 .....t$.... @...
75 12 ff d6 50 68 98 20 40 00 57 55 e8 f9 fc ff u...Ph. @.WU....
ff 83 c4 10 ff 74 24 20 ff 15 0c 20 40 00 85 c0 .....t$ ... @...
75 12 ff d6 50 68 98 20 40 00 57 55 e8 d9 fc ff u...Ph. @.WU....
ff 83 c4 10 55 ff 15 0c 20 40 00 85 c0 75 12 ff ....U... @...u..
d6 50 68 98 20 40 00 57 55 e8 bc fc ff ff 83 c4 .Ph. @.WU.......
10 5e 5b ff 74 24 08 ff 15 08 20 40 00 5f 5d 00 .^[.t$.... @._].
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
24 24 00 00 3a 24 00 00 4a 24 00 00 58 24 00 00 $$..:$..J$..X$..
66 24 00 00 78 24 00 00 8e 24 00 00 a6 24 00 00 f$..x$...$...$..
b6 24 00 00 c6 24 00 00 dc 24 00 00 ec 24 00 00 .$...$...$...$..
fc 24 00 00 00 00 00 00 20 25 00 00 00 00 00 00 .$...... %......
43 74 72 6c 2d 53 68 75 74 64 6f 77 6e 00 00 00 Ctrl-Shutdown...
43 74 72 6c 2d 4c 6f 67 6f 66 66 00 43 74 72 6c Ctrl-Logoff.Ctrl
2d 43 6c 6f 73 65 00 00 43 74 72 6c 2d 42 72 65 -Close..Ctrl-Bre
61 6b 00 00 43 74 72 6c 2d 43 00 00 74 20 40 00 ak..Ctrl-C..t @.
68 20 40 00 5c 20 40 00 00 00 00 00 00 00 00 00 h @.\ @.........
50 20 40 00 40 20 40 00 43 00 6c 00 6f 00 73 00 P @.@ @.C.l.o.s.
65 00 48 00 61 00 6e 00 64 00 6c 00 65 00 00 00 e.H.a.n.d.l.e...
55 00 6e 00 6d 00 61 00 70 00 56 00 69 00 65 00 U.n.m.a.p.V.i.e.
77 00 4f 00 66 00 46 00 69 00 6c 00 65 00 00 00 w.O.f.F.i.l.e...
53 00 69 00 67 00 6e 00 61 00 6c 00 4f 00 62 00 S.i.g.n.a.l.O.b.
6a 00 65 00 63 00 74 00 41 00 6e 00 64 00 57 00 j.e.c.t.A.n.d.W.
61 00 69 00 74 00 00 00 09 00 25 00 68 00 73 00 a.i.t.....%.h.s.
0a 00 00 00 0a 00 25 00 37 00 6c 00 75 00 09 00 ......%.7.l.u...
25 00 68 00 73 00 0a 00 00 00 00 00 00 00 00 00 %.h.s...........
50 00 72 00 65 00 73 00 73 00 20 00 27 00 43 00 P.r.e.s.s. .'.C.
74 00 72 00 6c 00 2d 00 43 00 27 00 20 00 6f 00 t.r.l.-.C.'. .o.
72 00 20 00 27 00 43 00 74 00 72 00 6c 00 2d 00 r. .'.C.t.r.l.-.
42 00 72 00 65 00 61 00 6b 00 27 00 20 00 74 00 B.r.e.a.k.'. .t.
6f 00 20 00 74 00 65 00 72 00 6d 00 69 00 6e 00 o. .t.e.r.m.i.n.
61 00 74 00 65 00 21 00 0a 00 0a 00 50 00 72 00 a.t.e.!.....P.r.
6f 00 63 00 65 00 73 00 73 00 09 00 44 00 65 00 o.c.e.s.s...D.e.
62 00 75 00 67 00 20 00 4d 00 65 00 73 00 73 00 b.u.g. .M.e.s.s.
61 00 67 00 65 00 0a 00 00 00 00 00 53 00 65 00 a.g.e.......S.e.
74 00 43 00 6f 00 6e 00 73 00 6f 00 6c 00 65 00 t.C.o.n.s.o.l.e.
43 00 74 00 72 00 6c 00 48 00 61 00 6e 00 64 00 C.t.r.l.H.a.n.d.
6c 00 65 00 72 00 00 00 4d 00 61 00 70 00 56 00 l.e.r...M.a.p.V.
69 00 65 00 77 00 4f 00 66 00 46 00 69 00 6c 00 i.e.w.O.f.F.i.l.
65 00 00 00 44 00 42 00 57 00 49 00 4e 00 5f 00 e...D.B.W.I.N._.
44 00 41 00 54 00 41 00 5f 00 52 00 45 00 41 00 D.A.T.A._.R.E.A.
44 00 59 00 00 00 00 00 45 00 76 00 65 00 6e 00 D.Y.....E.v.e.n.
74 00 20 00 27 00 25 00 6c 00 73 00 27 00 20 00 t. .'.%.l.s.'. .
61 00 6c 00 72 00 65 00 61 00 64 00 79 00 20 00 a.l.r.e.a.d.y. .
63 00 72 00 65 00 61 00 74 00 65 00 64 00 20 00 c.r.e.a.t.e.d. .
62 00 79 00 20 00 61 00 6e 00 6f 00 74 00 68 00 b.y. .a.n.o.t.h.
65 00 72 00 20 00 70 00 72 00 6f 00 63 00 65 00 e.r. .p.r.o.c.e.
73 00 73 00 21 00 0a 00 00 00 00 00 43 00 72 00 s.s.!.......C.r.
65 00 61 00 74 00 65 00 45 00 76 00 65 00 6e 00 e.a.t.e.E.v.e.n.
74 00 00 00 44 00 42 00 57 00 49 00 4e 00 5f 00 t...D.B.W.I.N._.
42 00 55 00 46 00 46 00 45 00 52 00 5f 00 52 00 B.U.F.F.E.R._.R.
45 00 41 00 44 00 59 00 00 00 00 00 00 00 00 00 E.A.D.Y.........
53 00 68 00 61 00 72 00 65 00 64 00 20 00 73 00 S.h.a.r.e.d. .s.
65 00 63 00 74 00 69 00 6f 00 6e 00 20 00 27 00 e.c.t.i.o.n. .'.
25 00 6c 00 73 00 27 00 20 00 61 00 6c 00 72 00 %.l.s.'. .a.l.r.
65 00 61 00 64 00 79 00 20 00 63 00 72 00 65 00 e.a.d.y. .c.r.e.
61 00 74 00 65 00 64 00 20 00 62 00 79 00 20 00 a.t.e.d. .b.y. .
61 00 6e 00 6f 00 74 00 68 00 65 00 72 00 20 00 a.n.o.t.h.e.r. .
70 00 72 00 6f 00 63 00 65 00 73 00 73 00 21 00 p.r.o.c.e.s.s.!.
0a 00 00 00 43 00 72 00 65 00 61 00 74 00 65 00 ....C.r.e.a.t.e.
46 00 69 00 6c 00 65 00 4d 00 61 00 70 00 70 00 F.i.l.e.M.a.p.p.
69 00 6e 00 67 00 00 00 25 00 6c 00 73 00 28 00 i.n.g...%.l.s.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 0a 00 00 00 44 00 42 00 .%.l.u.....D.B.
57 00 49 00 4e 00 5f 00 42 00 55 00 46 00 46 00 W.I.N._.B.U.F.F.
45 00 52 00 00 00 00 00 e4 23 00 00 00 00 00 00 E.R......#......
00 00 00 00 12 25 00 00 00 20 00 00 1c 24 00 00 .....%... ...$..
00 00 00 00 00 00 00 00 2e 25 00 00 38 20 00 00 .........%..8 ..
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 24 24 00 00 3a 24 00 00 4a 24 00 00 ....$$..:$..J$..
58 24 00 00 66 24 00 00 78 24 00 00 8e 24 00 00 X$..f$..x$...$..
a6 24 00 00 b6 24 00 00 c6 24 00 00 dc 24 00 00 .$...$...$...$..
ec 24 00 00 fc 24 00 00 00 00 00 00 20 25 00 00 .$...$...... %..
00 00 00 00 89 03 4f 75 74 70 75 74 44 65 62 75 ......OutputDebu
67 53 74 72 69 6e 67 41 00 00 24 05 57 72 69 74 gStringA..$.Writ
65 43 6f 6e 73 6f 6c 65 57 00 19 01 45 78 69 74 eConsoleW...Exit
50 72 6f 63 65 73 73 00 52 00 43 6c 6f 73 65 48 Process.R.CloseH
61 6e 64 6c 65 00 d6 04 55 6e 6d 61 70 56 69 65 andle...UnmapVie
77 4f 66 46 69 6c 65 00 b0 04 53 69 67 6e 61 6c wOfFile...Signal
4f 62 6a 65 63 74 41 6e 64 57 61 69 74 00 2d 04 ObjectAndWait.-.
53 65 74 43 6f 6e 73 6f 6c 65 43 74 72 6c 48 61 SetConsoleCtrlHa
6e 64 6c 65 72 00 57 03 4d 61 70 56 69 65 77 4f ndler.W.MapViewO
66 46 69 6c 65 00 85 00 43 72 65 61 74 65 45 76 fFile...CreateEv
65 6e 74 57 00 00 8c 00 43 72 65 61 74 65 46 69 entW....CreateFi
6c 65 4d 61 70 70 69 6e 67 57 00 00 02 02 47 65 leMappingW....Ge
74 4c 61 73 74 45 72 72 6f 72 00 00 64 02 47 65 tLastError..d.Ge
74 53 74 64 48 61 6e 64 6c 65 00 00 c1 01 47 65 tStdHandle....Ge
74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 49 tCurrentProcessI
64 00 4b 45 52 4e 45 4c 33 32 2e 64 6c 6c 00 00 d.KERNEL32.dll..
35 03 77 76 73 70 72 69 6e 74 66 57 00 00 55 53 5.wvsprintfW..US
45 52 33 32 2e 64 6c 6c 00 00 00 00 00 00 00 00 ER32.dll........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file DBWINNER.TXT
created in
step 3. to recreate the console application
Debug String Monitor:
CERTUTIL.EXE /DecodeHex /V DBWINNER.TXT DBWINNER.COM
Input Length = 13056 Output Length = 3072 CertUtil: -decodehex command completed successfully.
MAKESORTLCID
LANGIDFROMLCID
SORTIDFROMLCID
PRIMARYLANGID
SUBLANGID
MAKELANGID
VerLanguageName()
LANGUAGE.COM
Note: due to the design and implementation of
Windows’ (classic alias legacy) console, the
Win32 function
WriteConsole()
can only write to a console, not to a file nor a pipe, i.e.
redirection of standard error
or standard output
is
not supported!
The MSDN article Console Handles provides background information.
Create the text file LANGUAGE.C
with the following
content in an arbitrary, preferable empty directory:
// Copyright © 2004-2023, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
__declspec(safebuffers)
BOOL PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
DWORD dwBuffer;
DWORD dwConsole;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
if (!WriteConsole(hConsole, szBuffer, dwBuffer, &dwConsole, NULL))
return FALSE;
return dwConsole == dwBuffer;
}
__declspec(noreturn)
VOID WINAPI wmainCRTStartup(VOID)
{
DWORD dwError = ERROR_SUCCESS;
DWORD dwPrimaryLanguage;
DWORD dwLanguage;
WCHAR szLanguage[123];
WCHAR szNeutral[123];
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole == INVALID_HANDLE_VALUE)
dwError = GetLastError();
else
{
if (VerLanguageName(0,
szNeutral,
sizeof(szNeutral) / sizeof(*szNeutral)) == 0)
PrintConsole(hConsole,
L"VerLanguageName() returned error %lu for LCID 0x%04lX\n",
dwError = GetLastError(), 0);
else
{
PrintConsole(hConsole,
L"\n0x%04lX = %ls\n",
0, szNeutral);
for (dwPrimaryLanguage = 0; dwPrimaryLanguage < 0x0200; dwPrimaryLanguage++)
for (dwLanguage = dwPrimaryLanguage; dwLanguage < 0x8000; dwLanguage += 0x0400)
if (VerLanguageName(dwLanguage,
szLanguage,
sizeof(szLanguage) / sizeof(*szLanguage)) == 0)
PrintConsole(hConsole,
L"VerLanguageName() returned error %lu for LCID 0x%04lX\n",
dwError = GetLastError(), dwLanguage);
else
if (wcscmp(szLanguage, szNeutral) != 0)
PrintConsole(hConsole,
L"\n0x%04lX = %ls\n" + (dwLanguage != dwPrimaryLanguage),
dwLanguage, szLanguage);
else
if ((dwLanguage != 0)
&& (dwLanguage == dwPrimaryLanguage))
break;
}
if (!CloseHandle(hConsole))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
ExitProcess(dwError);
}
Run the following four command lines to compile the source file
LANGUAGE.C
created in step 1., link the compiled
object file LANGUAGE.OBJ
and cleanup afterwards:
SET CL=/GA /GF /GS /Gy /O1 /Oi /Os /Oy /W4 /Zl SET LINK=/DEFAULTLIB:KERNEL32.LIB /DEFAULTLIB:USER32.LIB /ENTRY:wmainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /OSVERSION:5.0 /RELEASE /SUBSYSTEM:CONSOLE /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /FeLANGUAGE.COM LANGUAGE.C ERASE LANGUAGE.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. LANGUAGE.C Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Create the text file LANGUAGE.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 33 2c 20 53 74 65 66 61 6e 20 4b 61 -2023, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 02 00 56 4f 49 44 00 00 00 00 PE..L...VOID....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 02 00 00 ......#.........
00 02 00 00 00 00 00 00 4e 10 00 00 00 10 00 00 ........N.......
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
05 00 00 00 00 00 2f 03 05 00 00 00 00 00 00 00 ....../.........
00 30 00 00 00 02 00 00 7a 12 00 00 03 00 00 85 .0......z.......
00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
00 21 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 .!..<...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 20 00 00 24 00 00 00 ......... ..$...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
b4 01 00 00 00 10 00 00 00 02 00 00 00 02 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 63 6f 6e 73 74 00 00 e8 01 00 00 00 20 00 00 .const....... ..
00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 ....@..@........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
55 8b ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 U........V.E.P.u
0c 8d 85 f8 f7 ff ff 50 ff 15 1c 20 40 00 8b f0 .......P... @...
85 f6 75 04 33 c0 eb 23 6a 00 8d 45 fc 50 56 8d ..u.3..#j..E.PV.
85 f8 f7 ff ff 50 ff 75 08 ff 15 00 20 40 00 85 .....P.u.... @..
c0 74 e1 33 c0 39 75 fc 0f 94 c0 5e c9 c3 55 8b .t.3.9u....^..U.
ec 81 ec c8 03 00 00 53 56 57 33 f6 6a f4 89 75 .......SVW3.j..u
f8 ff 15 14 20 40 00 8b f8 83 ff ff 75 0e ff 15 .... @......u...
10 20 40 00 89 45 f8 e9 27 01 00 00 68 f0 00 00 . @..E..'...h...
00 8d 85 18 fe ff ff 50 56 e8 20 01 00 00 85 c0 .......PV. .....
75 1e ff 15 10 20 40 00 56 50 68 90 20 40 00 57 u.... @.VPh. @.W
89 45 f8 e8 58 ff ff ff 83 c4 10 e9 d3 00 00 00 .E..X...........
8d 85 18 fe ff ff 50 56 68 6c 20 40 00 57 e8 3d ......PVhl @.W.=
ff ff ff 83 c4 10 89 75 fc bb 00 80 00 00 8b 75 .......u.......u
fc e9 95 00 00 00 68 f0 00 00 00 8d 85 38 fc ff ......h......8..
ff 50 56 e8 c6 00 00 00 85 c0 75 12 ff 15 10 20 .PV.......u....
40 00 56 50 89 45 f8 68 90 20 40 00 eb 53 8d 8d @.VP.E.h. @..S..
18 fe ff ff 8d 85 38 fc ff ff 66 8b 10 66 3b 11 ......8...f..f;.
75 1e 66 85 d2 74 15 66 8b 50 02 66 3b 51 02 75 u.f..t.f.P.f;Q.u
0f 83 c0 04 83 c1 04 66 85 d2 75 de 33 c0 eb 05 .......f..u.3...
1b c0 83 d8 ff 85 c0 74 23 8d 85 38 fc ff ff 50 .......t#..8...P
33 c0 3b 75 fc 56 0f 95 c0 8d 04 45 6c 20 40 00 3.;u.V.....El @.
50 57 e8 a9 fe ff ff 83 c4 10 eb 09 85 f6 74 05 PW............t.
3b 75 fc 74 0e 81 c6 00 04 00 00 3b f3 0f 82 63 ;u.t.......;...c
ff ff ff ff 45 fc 81 7d fc 00 02 00 00 0f 82 4b ....E..}.......K
ff ff ff 57 ff 15 08 20 40 00 85 c0 75 15 ff 15 ...W... @...u...
10 20 40 00 50 68 28 20 40 00 57 e8 60 fe ff ff . @.Ph( @.W.`...
83 c4 0c ff 75 f8 ff 15 04 20 40 00 cc cc ff 25 ....u.... @....%
0c 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 . @.............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
60 21 00 00 70 21 00 00 7e 21 00 00 8c 21 00 00 `!..p!..~!...!..
a0 21 00 00 b0 21 00 00 00 00 00 00 ce 21 00 00 .!...!.......!..
00 00 00 00 00 00 00 00 43 00 6c 00 6f 00 73 00 ........C.l.o.s.
65 00 48 00 61 00 6e 00 64 00 6c 00 65 00 28 00 e.H.a.n.d.l.e.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 0a 00 00 00 0a 00 30 00 .%.l.u.......0.
78 00 25 00 30 00 34 00 6c 00 58 00 20 00 3d 00 x.%.0.4.l.X. .=.
20 00 25 00 6c 00 73 00 0a 00 00 00 00 00 00 00 .%.l.s.........
56 00 65 00 72 00 4c 00 61 00 6e 00 67 00 75 00 V.e.r.L.a.n.g.u.
61 00 67 00 65 00 4e 00 61 00 6d 00 65 00 28 00 a.g.e.N.a.m.e.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 20 00 66 00 6f 00 72 00 .%.l.u. .f.o.r.
20 00 4c 00 43 00 49 00 44 00 20 00 30 00 78 00 .L.C.I.D. .0.x.
25 00 30 00 34 00 6c 00 58 00 0a 00 00 00 00 00 %.0.4.l.X.......
3c 21 00 00 00 00 00 00 00 00 00 00 c0 21 00 00 <!...........!..
00 20 00 00 58 21 00 00 00 00 00 00 00 00 00 00 . ..X!..........
dc 21 00 00 1c 20 00 00 00 00 00 00 00 00 00 00 .!... ..........
00 00 00 00 00 00 00 00 00 00 00 00 60 21 00 00 ............`!..
70 21 00 00 7e 21 00 00 8c 21 00 00 a0 21 00 00 p!..~!...!...!..
b0 21 00 00 00 00 00 00 ce 21 00 00 00 00 00 00 .!.......!......
24 05 57 72 69 74 65 43 6f 6e 73 6f 6c 65 57 00 $.WriteConsoleW.
19 01 45 78 69 74 50 72 6f 63 65 73 73 00 52 00 ..ExitProcess.R.
43 6c 6f 73 65 48 61 6e 64 6c 65 00 e3 04 56 65 CloseHandle...Ve
72 4c 61 6e 67 75 61 67 65 4e 61 6d 65 57 00 00 rLanguageNameW..
02 02 47 65 74 4c 61 73 74 45 72 72 6f 72 00 00 ..GetLastError..
64 02 47 65 74 53 74 64 48 61 6e 64 6c 65 00 00 d.GetStdHandle..
4b 45 52 4e 45 4c 33 32 2e 64 6c 6c 00 00 35 03 KERNEL32.dll..5.
77 76 73 70 72 69 6e 74 66 57 00 00 55 53 45 52 wvsprintfW..USER
33 32 2e 64 6c 6c 00 00 00 00 00 00 00 00 00 00 32.dll..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file LANGUAGE.TXT
created in
step 3. to recreate the console application
Language Enumerator:
CERTUTIL.EXE /DecodeHex /V LANGUAGE.TXT LANGUAGE.COM
Input Length = 6528 Output Length = 1536 CertUtil: -decodehex command completed successfully.
MAKELCID
GetLocaleInfo()
GetLocaleInfo()
LOCALE.COM
Note: due to the design and implementation of
Windows’ (classic alias legacy) console, the
Win32 function
WriteConsole()
can only write to a console, not to a file nor a pipe, i.e.
redirection of standard error
or standard output
is
not supported!
The MSDN article Console Handles provides background information.
Create the text file LOCALE.C
with the following
content in an arbitrary, preferable empty directory:
// Copyright © 2004-2023, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
__declspec(safebuffers)
BOOL PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
DWORD dwBuffer;
DWORD dwConsole;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
if (!WriteConsole(hConsole, szBuffer, dwBuffer, &dwConsole, NULL))
return FALSE;
return dwConsole == dwBuffer;
}
__declspec(noreturn)
VOID WINAPI wmainCRTStartup(VOID)
{
DWORD dwError = ERROR_SUCCESS;
DWORD dwPrimaryLanguage;
DWORD dwLanguage;
BOOL bLanguage;
WCHAR szLanguage[123];
WCHAR szEnglishLanguage[123];
WCHAR szEnglishCountry[123];
#ifdef NATIVE
WCHAR szNativeLanguage[80];
WCHAR szNativeCountry[80];
#endif
WCHAR szISO639[9];
WCHAR szISO3166[9];
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole == INVALID_HANDLE_VALUE)
dwError = GetLastError();
else
{
for (dwPrimaryLanguage = 0; ++dwPrimaryLanguage < 0x0200;)
{
bLanguage = FALSE;
for (dwLanguage = dwPrimaryLanguage; dwLanguage += 0x0400, dwLanguage < 0x8000;)
if (GetLocaleInfo(dwLanguage,
LOCALE_SLANGUAGE,
szLanguage,
sizeof(szLanguage) / sizeof(*szLanguage)) == 0)
{
dwError = GetLastError();
if (dwError == ERROR_INVALID_PARAMETER)
dwError = ERROR_SUCCESS;
else
PrintConsole(hConsole,
L"GetLocaleInfo() returned error %lu for LCID 0x%04lX\n",
dwError, dwLanguage);
}
else
{
if (GetLocaleInfo(dwLanguage,
LOCALE_SISO639LANGNAME,
szISO639,
sizeof(szISO3166) / sizeof(*szISO3166)) == 0)
PrintConsole(hConsole,
L"GetLocaleInfo() returned error %lu for LCID 0x%04lX\n",
dwError = GetLastError(), dwLanguage);
if (GetLocaleInfo(dwLanguage,
LOCALE_SISO3166CTRYNAME,
szISO3166,
sizeof(szISO3166) / sizeof(*szISO3166)) == 0)
PrintConsole(hConsole,
L"GetLocaleInfo() returned error %lu for LCID 0x%04lX\n",
dwError = GetLastError(), dwLanguage);
if (GetLocaleInfo(dwLanguage,
LOCALE_SENGLANGUAGE,
szEnglishLanguage,
sizeof(szEnglishLanguage) / sizeof(*szEnglishLanguage)) == 0)
PrintConsole(hConsole,
L"GetLocaleInfo() returned error %lu for LCID 0x%04lX\n",
dwError = GetLastError(), dwLanguage);
if (GetLocaleInfo(dwLanguage,
LOCALE_SENGCOUNTRY,
szEnglishCountry,
sizeof(szEnglishCountry) / sizeof(*szEnglishCountry)) == 0)
PrintConsole(hConsole,
L"GetLocaleInfo() returned error %lu for LCID 0x%04lX\n",
dwError = GetLastError(), dwLanguage);
#ifdef NATIVE
if (GetLocaleInfo(dwLanguage,
LOCALE_SNATIVELANGNAME,
szNativeLanguage,
sizeof(szNativeLanguage) / sizeof(*szNativeLanguage)) == 0)
PrintConsole(hConsole,
L"GetLocaleInfo() returned error %lu for LCID 0x%04lX\n",
dwError = GetLastError(), dwLanguage);
if (GetLocaleInfo(dwLanguage,
LOCALE_SNATIVECTRYNAME,
szNativeCountry,
sizeof(szNativeCountry) / sizeof(*szNativeCountry)) == 0)
PrintConsole(hConsole,
L"GetLocaleInfo() returned error %lu for LCID 0x%04lX\n",
dwError = GetLastError(), dwLanguage);
PrintConsole(hConsole,
L"\n0x%04lX = %ls // %ls-%ls;%ls (%ls), %ls (%ls)\n" + bLanguage,
dwLanguage,
szLanguage,
szISO639,
szISO3166,
szEnglishLanguage,
szEnglishCountry,
szNativeLanguage,
szNativeCountry);
#else
PrintConsole(hConsole,
L"\n0x%04lX = %ls // %ls-%ls;%ls (%ls)\n" + bLanguage,
dwLanguage,
szLanguage,
szISO639,
szISO3166,
szEnglishLanguage,
szEnglishCountry);
#endif
bLanguage = TRUE;
}
}
if (!CloseHandle(hConsole))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
ExitProcess(dwError);
}
Run the following four command lines to compile the source file
LOCALE.C
created in step 1., link the compiled
object file LOCALE.OBJ
and cleanup afterwards:
SET CL=/DNATIVE /GA /GF /GS /Gy /O1 /Oi /Os /Oy /W4 /Zl SET LINK=/DEFAULTLIB:KERNEL32.LIB /DEFAULTLIB:USER32.LIB /ENTRY:wmainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /OSVERSION:5.0 /RELEASE /SUBSYSTEM:CONSOLE /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /FeLOCALE.COM LOCALE.C ERASE LOCALE.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. LOCALE.C Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Create the text file LOCALE.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 33 2c 20 53 74 65 66 61 6e 20 4b 61 -2023, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 02 00 56 4f 49 44 00 00 00 00 PE..L...VOID....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 04 00 00 ......#.........
00 04 00 00 00 00 00 00 4e 10 00 00 00 10 00 00 ........N.......
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
05 00 00 00 00 00 2f 03 05 00 00 00 00 00 00 00 ....../.........
00 30 00 00 00 02 00 00 df 26 00 00 03 00 00 85 .0.......&......
00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
3c 21 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 <!..<...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 20 00 00 24 00 00 00 ......... ..$...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
6a 02 00 00 00 10 00 00 00 04 00 00 00 02 00 00 j...............
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 63 6f 6e 73 74 00 00 22 02 00 00 00 20 00 00 .const..".... ..
00 04 00 00 00 06 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 ....@..@........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
55 8b ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 U........V.E.P.u
0c 8d 85 f8 f7 ff ff 50 ff 15 1c 20 40 00 8b f0 .......P... @...
85 f6 75 04 33 c0 eb 23 6a 00 8d 45 fc 50 56 8d ..u.3..#j..E.PV.
85 f8 f7 ff ff 50 ff 75 08 ff 15 00 20 40 00 85 .....P.u.... @..
c0 74 e1 33 c0 39 75 fc 0f 94 c0 5e c9 c3 55 8b .t.3.9u....^..U.
ec 81 ec dc 05 00 00 83 65 f8 00 53 56 57 6a f4 ........e..SVWj.
ff 15 14 20 40 00 89 45 fc 83 f8 ff 75 0e ff 15 ... @..E....u...
10 20 40 00 89 45 f8 e9 e4 01 00 00 8b 3d 10 20 . @..E.......=.
40 00 c7 45 f4 01 04 00 00 c7 45 ec ff 01 00 00 @..E......E.....
be d0 20 40 00 83 65 f0 00 8b 5d f4 e9 87 01 00 .. @..e...].....
00 68 f0 00 00 00 8d 85 24 fa ff ff 50 6a 02 53 .h......$...Pj.S
ff 15 0c 20 40 00 85 c0 75 26 ff d7 89 45 f8 83 ... @...u&...E..
f8 57 74 13 53 50 56 ff 75 fc e8 31 ff ff ff 83 .Wt.SPV.u..1....
c4 10 e9 4b 01 00 00 83 65 f8 00 e9 42 01 00 00 ...K....e...B...
6a 09 8d 45 c4 50 6a 59 53 ff 15 0c 20 40 00 85 j..E.PjYS... @..
c0 75 13 ff d7 53 50 56 ff 75 fc 89 45 f8 e8 fd .u...SPV.u..E...
fe ff ff 83 c4 10 6a 09 8d 45 d8 50 6a 5a 53 ff ......j..E.PjZS.
15 0c 20 40 00 85 c0 75 13 ff d7 53 50 56 ff 75 .. @...u...SPV.u
fc 89 45 f8 e8 d7 fe ff ff 83 c4 10 68 f0 00 00 ..E.........h...
00 8d 85 04 fc ff ff 50 68 01 10 00 00 53 ff 15 .......Ph....S..
0c 20 40 00 85 c0 75 13 ff d7 53 50 56 ff 75 fc . @...u...SPV.u.
89 45 f8 e8 a8 fe ff ff 83 c4 10 6a 50 8d 85 84 .E.........jP...
fe ff ff 50 68 02 10 00 00 53 ff 15 0c 20 40 00 ...Ph....S... @.
85 c0 75 13 ff d7 53 50 56 ff 75 fc 89 45 f8 e8 ..u...SPV.u..E..
7c fe ff ff 83 c4 10 6a 50 8d 85 24 ff ff ff 50 |......jP..$...P
6a 04 53 ff 15 0c 20 40 00 85 c0 75 13 ff d7 53 j.S... @...u...S
50 56 ff 75 fc 89 45 f8 e8 53 fe ff ff 83 c4 10 PV.u..E..S......
6a 50 8d 85 e4 fd ff ff 50 6a 08 53 ff 15 0c 20 jP......Pj.S...
40 00 85 c0 75 13 ff d7 53 50 56 ff 75 fc 89 45 @...u...SPV.u..E
f8 e8 2a fe ff ff 83 c4 10 8d 85 e4 fd ff ff 50 ..*............P
8d 85 24 ff ff ff 50 8d 85 84 fe ff ff 50 8d 85 ..$...P......P..
04 fc ff ff 50 8d 45 d8 50 8d 45 c4 50 8d 85 24 ....P.E.P.E.P..$
fa ff ff 50 8b 45 f0 53 8d 04 45 70 20 40 00 50 ...P.E.S..Ep @.P
ff 75 fc e8 e8 fd ff ff 83 c4 28 c7 45 f0 01 00 .u........(.E...
00 00 81 c3 00 04 00 00 81 fb 00 80 00 00 0f 82 ................
6d fe ff ff ff 45 f4 ff 4d ec 0f 85 55 fe ff ff m....E..M...U...
ff 75 fc ff 15 08 20 40 00 85 c0 75 13 ff d7 50 .u.... @...u...P
68 28 20 40 00 ff 75 fc e8 a3 fd ff ff 83 c4 0c h( @..u.........
ff 75 f8 ff 15 04 20 40 00 cc 00 00 00 00 00 00 .u.... @........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
9c 21 00 00 ac 21 00 00 ba 21 00 00 c8 21 00 00 .!...!...!...!..
da 21 00 00 ea 21 00 00 00 00 00 00 08 22 00 00 .!...!......."..
00 00 00 00 00 00 00 00 43 00 6c 00 6f 00 73 00 ........C.l.o.s.
65 00 48 00 61 00 6e 00 64 00 6c 00 65 00 28 00 e.H.a.n.d.l.e.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 0a 00 00 00 00 00 00 00 .%.l.u.........
0a 00 30 00 78 00 25 00 30 00 34 00 6c 00 58 00 ..0.x.%.0.4.l.X.
20 00 3d 00 20 00 25 00 6c 00 73 00 20 00 2f 00 .=. .%.l.s. ./.
2f 00 20 00 25 00 6c 00 73 00 2d 00 25 00 6c 00 /. .%.l.s.-.%.l.
73 00 3b 00 25 00 6c 00 73 00 20 00 28 00 25 00 s.;.%.l.s. .(.%.
6c 00 73 00 29 00 2c 00 20 00 25 00 6c 00 73 00 l.s.).,. .%.l.s.
20 00 28 00 25 00 6c 00 73 00 29 00 0a 00 00 00 .(.%.l.s.).....
47 00 65 00 74 00 4c 00 6f 00 63 00 61 00 6c 00 G.e.t.L.o.c.a.l.
65 00 49 00 6e 00 66 00 6f 00 28 00 29 00 20 00 e.I.n.f.o.(.). .
72 00 65 00 74 00 75 00 72 00 6e 00 65 00 64 00 r.e.t.u.r.n.e.d.
20 00 65 00 72 00 72 00 6f 00 72 00 20 00 25 00 .e.r.r.o.r. .%.
6c 00 75 00 20 00 66 00 6f 00 72 00 20 00 4c 00 l.u. .f.o.r. .L.
43 00 49 00 44 00 20 00 30 00 78 00 25 00 30 00 C.I.D. .0.x.%.0.
34 00 6c 00 58 00 0a 00 00 00 00 00 78 21 00 00 4.l.X.......x!..
00 00 00 00 00 00 00 00 fa 21 00 00 00 20 00 00 .........!... ..
94 21 00 00 00 00 00 00 00 00 00 00 16 22 00 00 .!..........."..
1c 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 . ..............
00 00 00 00 00 00 00 00 9c 21 00 00 ac 21 00 00 .........!...!..
ba 21 00 00 c8 21 00 00 da 21 00 00 ea 21 00 00 .!...!...!...!..
00 00 00 00 08 22 00 00 00 00 00 00 24 05 57 72 ....."......$.Wr
69 74 65 43 6f 6e 73 6f 6c 65 57 00 19 01 45 78 iteConsoleW...Ex
69 74 50 72 6f 63 65 73 73 00 52 00 43 6c 6f 73 itProcess.R.Clos
65 48 61 6e 64 6c 65 00 06 02 47 65 74 4c 6f 63 eHandle...GetLoc
61 6c 65 49 6e 66 6f 57 00 00 02 02 47 65 74 4c aleInfoW....GetL
61 73 74 45 72 72 6f 72 00 00 64 02 47 65 74 53 astError..d.GetS
74 64 48 61 6e 64 6c 65 00 00 4b 45 52 4e 45 4c tdHandle..KERNEL
33 32 2e 64 6c 6c 00 00 35 03 77 76 73 70 72 69 32.dll..5.wvspri
6e 74 66 57 00 00 55 53 45 52 33 32 2e 64 6c 6c ntfW..USER32.dll
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file LOCALE.TXT
created in
step 3. to recreate the console application
Locale Enumerator:
CERTUTIL.EXE /DecodeHex /V LOCALE.TXT LOCALE.COM
Input Length = 10880 Output Length = 2560 CertUtil: -decodehex command completed successfully.
WNetOpenEnum()
WNetEnumResource()
WNetCloseEnum()
NETRESOURCE structure
NETWORK.COM
Note: due to the design and implementation of
Windows’ (classic alias legacy) console, the
Win32 function
WriteConsole()
can only write to a console, not to a file nor a pipe, i.e.
redirection of standard error
or standard output
is
not supported!
The MSDN article Console Handles provides background information.
Create the text file NETWORK.C
with the following
content in an arbitrary, preferable empty directory:
// Copyright © 2004-2023, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <winnetwk.h>
__declspec(safebuffers)
BOOL PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
DWORD dwBuffer;
DWORD dwConsole;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
if (!WriteConsole(hConsole, szBuffer, dwBuffer, &dwConsole, NULL))
return FALSE;
return dwConsole == dwBuffer;
}
const LPCWSTR szDisplayType[] = {L"Generic",
L"Domain",
L"Server",
L"Share",
L"File",
L"Group",
L"Network",
L"Root",
L"Administrative Share",
L"Directory",
L"Tree",
L"NDS Container"};
__declspec(safebuffers)
VOID Network(HANDLE hConsole, LPNETRESOURCE lpNR, DWORD dwLevel)
{
NETRESOURCE nr[80];
HANDLE hNetwork;
DWORD dwCount;
DWORD dwSize;
DWORD dwError = WNetOpenEnum(RESOURCE_GLOBALNET,
RESOURCETYPE_ANY,
#if 0
RESOURCEUSAGE_ALL,
#else
0,
#endif
lpNR,
&hNetwork);
if (dwError != ERROR_SUCCESS)
PrintConsole(hConsole,
L"WNetOpenEnum() returned error %lu\n",
dwError);
else
{
for (;;)
{
dwCount = 1;
dwSize = sizeof(nr);
dwError = WNetEnumResource(hNetwork,
&dwCount,
nr,
&dwSize);
if (dwError != ERROR_SUCCESS)
break;
PrintConsole(hConsole,
L"\n"
L"%lsScope:\t\t%lu\n"
L"%lsType:\t\t%lu\n"
L"%lsDisplay Type:\t%lu = %ls\n"
L"%lsUsage:\t\t0x%08lX\n"
L"%lsLocal Name:\t%ls\n"
L"%lsRemote Name:\t%ls\n"
L"%lsComment:\t%ls\n"
L"%lsProvider:\t%ls\n",
L"\t\t\t" + 3 + dwLevel, nr->dwScope,
L"\t\t\t" + 3 + dwLevel, nr->dwType,
L"\t\t\t" + 3 + dwLevel, nr->dwDisplayType,
nr->dwDisplayType < sizeof(szDisplayType) / sizeof(*szDisplayType) ? szDisplayType[nr->dwDisplayType] : L"Unknown",
L"\t\t\t" + 3 + dwLevel, nr->dwUsage,
L"\t\t\t" + 3 + dwLevel, nr->lpLocalName,
L"\t\t\t" + 3 + dwLevel, nr->lpRemoteName,
L"\t\t\t" + 3 + dwLevel, nr->lpComment,
L"\t\t\t" + 3 + dwLevel, nr->lpProvider);
if (nr->dwUsage & RESOURCEUSAGE_CONTAINER)
Network(hConsole, nr, dwLevel - 1);
}
if (dwError != ERROR_NO_MORE_ITEMS)
PrintConsole(hConsole,
L"WNetEnumResource() returned error %lu\n",
dwError);
dwError = WNetCloseEnum(hNetwork);
if (dwError != ERROR_SUCCESS)
PrintConsole(hConsole,
L"WNetCloseEnum() returned error %lu\n",
dwError);
}
}
__declspec(noreturn)
VOID WINAPI wmainCRTStartup(VOID)
{
DWORD dwError = ERROR_SUCCESS;
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole == INVALID_HANDLE_VALUE)
dwError = GetLastError();
else
{
Network(hConsole, (LPNETRESOURCE) NULL, 0);
if (!CloseHandle(hConsole))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
ExitProcess(dwError);
}
Run the following four command lines to compile the source file
NETWORK.C
created in step 1., link the compiled
object file NETWORK.OBJ
and cleanup afterwards:
SET CL=/GA /GF /GS /Gy /O1 /Oi /Os /Oy /W4 /Zl SET LINK=/DEFAULTLIB:KERNEL32.LIB /DEFAULTLIB:MPR.LIB /DEFAULTLIB:USER32.LIB /ENTRY:wmainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /OSVERSION:5.0 /RELEASE /SUBSYSTEM:CONSOLE /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /FeNETWORK.COM NETWORK.C ERASE NETWORK.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. NETWORK.C Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Create the text file NETWORK.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 33 2c 20 53 74 65 66 61 6e 20 4b 61 -2023, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 02 00 56 4f 49 44 00 00 00 00 PE..L...VOID....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 02 00 00 ......#.........
00 06 00 00 00 00 00 00 8f 11 00 00 00 10 00 00 ................
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
05 00 00 00 00 00 2f 03 05 00 00 00 00 00 00 00 ....../.........
00 30 00 00 00 02 00 00 d2 a0 00 00 03 00 00 85 .0..............
00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
a4 23 00 00 50 00 00 00 00 00 00 00 00 00 00 00 .#..P...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 20 00 00 30 00 00 00 ......... ..0...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
f2 01 00 00 00 10 00 00 00 02 00 00 00 02 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 63 6f 6e 73 74 00 00 d4 04 00 00 00 20 00 00 .const....... ..
00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 ....@..@........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
55 8b ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 U........V.E.P.u
0c 8d 85 f8 f7 ff ff 50 ff 15 28 20 40 00 8b f0 .......P..( @...
85 f6 75 04 33 c0 eb 23 6a 00 8d 45 fc 50 56 8d ..u.3..#j..E.PV.
85 f8 f7 ff ff 50 ff 75 08 ff 15 10 20 40 00 85 .....P.u.... @..
c0 74 e1 33 c0 39 75 fc 0f 94 c0 5e c9 c3 55 8b .t.3.9u....^..U.
ec 81 ec 0c 0a 00 00 8d 45 f8 50 ff 75 0c 6a 00 ........E.P.u.j.
6a 00 6a 02 e8 83 01 00 00 85 c0 74 0b 50 68 18 j.j........t.Ph.
23 40 00 e9 0a 01 00 00 53 8d 45 f4 50 8d 85 f4 #@......S.E.P...
f5 ff ff 50 8d 45 fc 50 ff 75 f8 33 db 43 89 5d ...P.E.P.u.3.C.]
fc c7 45 f4 00 0a 00 00 e8 49 01 00 00 85 c0 0f ..E......I......
85 b2 00 00 00 56 8b 75 10 8d 34 75 12 23 40 00 .....V.u..4u.#@.
8b 8d fc f5 ff ff 83 f9 0c 73 09 8b 04 8d 08 21 .........s.....!
40 00 eb 05 b8 fc 22 40 00 ff b5 10 f6 ff ff 56 @....."@.......V
ff b5 0c f6 ff ff 56 ff b5 08 f6 ff ff 56 ff b5 ......V......V..
04 f6 ff ff 56 ff b5 00 f6 ff ff 56 50 51 56 ff ....V......VPQV.
b5 f8 f5 ff ff 56 ff b5 f4 f5 ff ff 56 68 d0 21 .....V......Vh.!
40 00 ff 75 08 e8 f6 fe ff ff 83 c4 4c f6 85 00 @..u........L...
f6 ff ff 02 74 17 8b 45 10 48 50 8d 85 f4 f5 ff ....t..E.HP.....
ff 50 ff 75 08 e8 24 ff ff ff 83 c4 0c 8d 45 f4 .P.u..$.......E.
50 8d 85 f4 f5 ff ff 50 8d 45 fc 50 ff 75 f8 89 P......P.E.P.u..
5d fc c7 45 f4 00 0a 00 00 e8 98 00 00 00 85 c0 ]..E............
0f 84 5a ff ff ff 5e 5b 3d 03 01 00 00 74 11 50 ..Z...^[=....t.P
68 80 21 40 00 ff 75 08 e8 93 fe ff ff 83 c4 0c h.!@..u.........
ff 75 f8 e8 68 00 00 00 85 c0 74 11 50 68 38 21 .u..h.....t.Ph8!
40 00 ff 75 08 e8 76 fe ff ff 83 c4 0c c9 c3 56 @..u..v........V
57 6a f4 33 ff ff 15 0c 20 40 00 8b f0 83 fe ff Wj.3.... @......
75 0a ff 15 08 20 40 00 8b f8 eb 2b 57 57 56 e8 u.... @....+WWV.
9a fe ff ff 83 c4 0c 56 ff 15 04 20 40 00 85 c0 .......V... @...
75 15 ff 15 08 20 40 00 50 68 60 23 40 00 56 e8 u.... @.Ph`#@.V.
2c fe ff ff 83 c4 0c 57 ff 15 00 20 40 00 5f 5e ,......W... @._^
ff 25 18 20 40 00 ff 25 1c 20 40 00 ff 25 20 20 .%. @..%. @..%
40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @...............
34 24 00 00 42 24 00 00 50 24 00 00 60 24 00 00 4$..B$..P$..`$..
24 24 00 00 00 00 00 00 7e 24 00 00 8e 24 00 00 $$......~$...$..
a2 24 00 00 00 00 00 00 ba 24 00 00 00 00 00 00 .$.......$......
4e 00 44 00 53 00 20 00 43 00 6f 00 6e 00 74 00 N.D.S. .C.o.n.t.
61 00 69 00 6e 00 65 00 72 00 00 00 54 00 72 00 a.i.n.e.r...T.r.
65 00 65 00 00 00 00 00 44 00 69 00 72 00 65 00 e.e.....D.i.r.e.
63 00 74 00 6f 00 72 00 79 00 00 00 41 00 64 00 c.t.o.r.y...A.d.
6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 61 00 m.i.n.i.s.t.r.a.
74 00 69 00 76 00 65 00 20 00 53 00 68 00 61 00 t.i.v.e. .S.h.a.
72 00 65 00 00 00 00 00 52 00 6f 00 6f 00 74 00 r.e.....R.o.o.t.
00 00 00 00 4e 00 65 00 74 00 77 00 6f 00 72 00 ....N.e.t.w.o.r.
6b 00 00 00 47 00 72 00 6f 00 75 00 70 00 00 00 k...G.r.o.u.p...
46 00 69 00 6c 00 65 00 00 00 00 00 53 00 68 00 F.i.l.e.....S.h.
61 00 72 00 65 00 00 00 53 00 65 00 72 00 76 00 a.r.e...S.e.r.v.
65 00 72 00 00 00 00 00 44 00 6f 00 6d 00 61 00 e.r.....D.o.m.a.
69 00 6e 00 00 00 00 00 47 00 65 00 6e 00 65 00 i.n.....G.e.n.e.
72 00 69 00 63 00 00 00 f8 20 40 00 e8 20 40 00 r.i.c.... @.. @.
d8 20 40 00 cc 20 40 00 c0 20 40 00 b4 20 40 00 . @.. @.. @.. @.
a4 20 40 00 98 20 40 00 6c 20 40 00 58 20 40 00 . @.. @.l @.X @.
4c 20 40 00 30 20 40 00 57 00 4e 00 65 00 74 00 L @.0 @.W.N.e.t.
43 00 6c 00 6f 00 73 00 65 00 45 00 6e 00 75 00 C.l.o.s.e.E.n.u.
6d 00 28 00 29 00 20 00 72 00 65 00 74 00 75 00 m.(.). .r.e.t.u.
72 00 6e 00 65 00 64 00 20 00 65 00 72 00 72 00 r.n.e.d. .e.r.r.
6f 00 72 00 20 00 25 00 6c 00 75 00 0a 00 00 00 o.r. .%.l.u.....
57 00 4e 00 65 00 74 00 45 00 6e 00 75 00 6d 00 W.N.e.t.E.n.u.m.
52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 R.e.s.o.u.r.c.e.
28 00 29 00 20 00 72 00 65 00 74 00 75 00 72 00 (.). .r.e.t.u.r.
6e 00 65 00 64 00 20 00 65 00 72 00 72 00 6f 00 n.e.d. .e.r.r.o.
72 00 20 00 25 00 6c 00 75 00 0a 00 00 00 00 00 r. .%.l.u.......
0a 00 25 00 6c 00 73 00 53 00 63 00 6f 00 70 00 ..%.l.s.S.c.o.p.
65 00 3a 00 09 00 09 00 25 00 6c 00 75 00 0a 00 e.:.....%.l.u...
25 00 6c 00 73 00 54 00 79 00 70 00 65 00 3a 00 %.l.s.T.y.p.e.:.
09 00 09 00 25 00 6c 00 75 00 0a 00 25 00 6c 00 ....%.l.u...%.l.
73 00 44 00 69 00 73 00 70 00 6c 00 61 00 79 00 s.D.i.s.p.l.a.y.
20 00 54 00 79 00 70 00 65 00 3a 00 09 00 25 00 .T.y.p.e.:...%.
6c 00 75 00 20 00 3d 00 20 00 25 00 6c 00 73 00 l.u. .=. .%.l.s.
0a 00 25 00 6c 00 73 00 55 00 73 00 61 00 67 00 ..%.l.s.U.s.a.g.
65 00 3a 00 09 00 09 00 30 00 78 00 25 00 30 00 e.:.....0.x.%.0.
38 00 6c 00 58 00 0a 00 25 00 6c 00 73 00 4c 00 8.l.X...%.l.s.L.
6f 00 63 00 61 00 6c 00 20 00 4e 00 61 00 6d 00 o.c.a.l. .N.a.m.
65 00 3a 00 09 00 25 00 6c 00 73 00 0a 00 25 00 e.:...%.l.s...%.
6c 00 73 00 52 00 65 00 6d 00 6f 00 74 00 65 00 l.s.R.e.m.o.t.e.
20 00 4e 00 61 00 6d 00 65 00 3a 00 09 00 25 00 .N.a.m.e.:...%.
6c 00 73 00 0a 00 25 00 6c 00 73 00 43 00 6f 00 l.s...%.l.s.C.o.
6d 00 6d 00 65 00 6e 00 74 00 3a 00 09 00 25 00 m.m.e.n.t.:...%.
6c 00 73 00 0a 00 25 00 6c 00 73 00 50 00 72 00 l.s...%.l.s.P.r.
6f 00 76 00 69 00 64 00 65 00 72 00 3a 00 09 00 o.v.i.d.e.r.:...
25 00 6c 00 73 00 0a 00 00 00 00 00 55 00 6e 00 %.l.s.......U.n.
6b 00 6e 00 6f 00 77 00 6e 00 00 00 09 00 09 00 k.n.o.w.n.......
09 00 00 00 00 00 00 00 57 00 4e 00 65 00 74 00 ........W.N.e.t.
4f 00 70 00 65 00 6e 00 45 00 6e 00 75 00 6d 00 O.p.e.n.E.n.u.m.
28 00 29 00 20 00 72 00 65 00 74 00 75 00 72 00 (.). .r.e.t.u.r.
6e 00 65 00 64 00 20 00 65 00 72 00 72 00 6f 00 n.e.d. .e.r.r.o.
72 00 20 00 25 00 6c 00 75 00 0a 00 00 00 00 00 r. .%.l.u.......
43 00 6c 00 6f 00 73 00 65 00 48 00 61 00 6e 00 C.l.o.s.e.H.a.n.
64 00 6c 00 65 00 28 00 29 00 20 00 72 00 65 00 d.l.e.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 65 00 t.u.r.n.e.d. .e.
72 00 72 00 6f 00 72 00 20 00 25 00 6c 00 75 00 r.r.o.r. .%.l.u.
0a 00 00 00 f4 23 00 00 00 00 00 00 00 00 00 00 .....#..........
70 24 00 00 00 20 00 00 0c 24 00 00 00 00 00 00 p$... ...$......
00 00 00 00 b2 24 00 00 18 20 00 00 1c 24 00 00 .....$... ...$..
00 00 00 00 00 00 00 00 c8 24 00 00 28 20 00 00 .........$..( ..
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 34 24 00 00 42 24 00 00 50 24 00 00 ....4$..B$..P$..
60 24 00 00 24 24 00 00 00 00 00 00 7e 24 00 00 `$..$$......~$..
8e 24 00 00 a2 24 00 00 00 00 00 00 ba 24 00 00 .$...$.......$..
00 00 00 00 24 05 57 72 69 74 65 43 6f 6e 73 6f ....$.WriteConso
6c 65 57 00 19 01 45 78 69 74 50 72 6f 63 65 73 leW...ExitProces
73 00 52 00 43 6c 6f 73 65 48 61 6e 64 6c 65 00 s.R.CloseHandle.
02 02 47 65 74 4c 61 73 74 45 72 72 6f 72 00 00 ..GetLastError..
64 02 47 65 74 53 74 64 48 61 6e 64 6c 65 00 00 d.GetStdHandle..
4b 45 52 4e 45 4c 33 32 2e 64 6c 6c 00 00 10 00 KERNEL32.dll....
57 4e 65 74 43 6c 6f 73 65 45 6e 75 6d 00 1c 00 WNetCloseEnum...
57 4e 65 74 45 6e 75 6d 52 65 73 6f 75 72 63 65 WNetEnumResource
57 00 3d 00 57 4e 65 74 4f 70 65 6e 45 6e 75 6d W.=.WNetOpenEnum
57 00 4d 50 52 2e 64 6c 6c 00 35 03 77 76 73 70 W.MPR.dll.5.wvsp
72 69 6e 74 66 57 00 00 55 53 45 52 33 32 2e 64 rintfW..USER32.d
6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ll..............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file NETWORK.TXT
created in
step 3. to recreate the console application
Network Enumerator:
CERTUTIL.EXE /DecodeHex /V NETWORK.TXT NETWORK.COM
Input Length = 10880 Output Length = 2560 CertUtil: -decodehex command completed successfully.
NOTIFIER.COM ‹directory name› …
Note: due to the design and implementation of
Windows’ (classic alias legacy) console, the
Win32 function
WriteConsole()
can only write to a console, not to a file nor a pipe, i.e.
redirection of standard error
or standard output
is
not supported!
The MSDN article Console Handles provides background information.
Create the text file NOTIFIER.C
with the following
content in an arbitrary, preferable empty directory:
// Copyright © 2004-2023, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <shellapi.h>
#define FILE_NOTIFY_CHANGE_UNDOCUMENTED 0x00000E80UL
#define FILE_NOTIFY_CHANGE_ANY 0x00000FFFUL
#define FILE_NOTIFY_CHANGE_INVALID 0xFFFFF000UL
__declspec(safebuffers)
BOOL PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
DWORD dwBuffer;
DWORD dwConsole;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
if (!WriteConsole(hConsole, szBuffer, dwBuffer, &dwConsole, NULL))
return FALSE;
return dwConsole == dwBuffer;
}
HANDLE hThreads[MAXIMUM_WAIT_OBJECTS];
DWORD dwThreads = 0;
const LPCWSTR szCtrlType[] = {L"C",
L"Break",
L"Close",
NULL,
NULL,
L"Logoff",
L"Shutdown"};
BOOL WINAPI CtrlHandler(DWORD dwCtrlType)
{
DWORD dwThread = dwThreads;
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
switch (dwCtrlType)
{
case CTRL_C_EVENT:
case CTRL_BREAK_EVENT:
case CTRL_CLOSE_EVENT:
case CTRL_LOGOFF_EVENT:
case CTRL_SHUTDOWN_EVENT:
PrintConsole(hConsole,
L"Ctrl-%ls\n",
szCtrlType[dwCtrlType]);
while (dwThread-- > 0)
if (!CancelSynchronousIo(hThreads[dwThread]))
PrintConsole(hConsole,
L"CancelSynchronousIo() returned error %lu for thread 0x%p\n",
GetLastError(), hThreads[dwThread]);
return TRUE;
default:
return FALSE;
}
}
const LPCWSTR lpAction[] = {NULL,
L"Added",
L"Removed",
L"Modified",
L"Renamed from",
L"Renamed to"};
__declspec(safebuffers)
DWORD WINAPI ThreadProc(LPCWSTR lpArgument)
{
FILE_NOTIFY_INFORMATION *lpEntry;
#if 0
BY_HANDLE_FILE_INFORMATION bhfi;
#else
FILE_ATTRIBUTE_TAG_INFO fati;
#endif
HANDLE hArgument;
WCHAR szArgument[MAX_PATH];
DWORD dwArgument;
DWORD dwError = ERROR_SUCCESS;
DWORD dwEntry;
DWORD dwBuffer[65536 / sizeof(DWORD)];
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole == INVALID_HANDLE_VALUE)
dwError = GetLastError();
else
{
hArgument = CreateFile(lpArgument,
FILE_LIST_DIRECTORY,
FILE_SHARE_DELETE | FILE_SHARE_READ | FILE_SHARE_WRITE,
(LPSECURITY_ATTRIBUTES) NULL,
OPEN_EXISTING,
FILE_FLAG_BACKUP_SEMANTICS,
(HANDLE) NULL);
if (hArgument == INVALID_HANDLE_VALUE)
PrintConsole(hConsole,
L"CreateFile() returned error %lu for argument \'%ls\'\n",
dwError = GetLastError(), lpArgument);
else
{
#if 0
if (!GetFileInformationByHandle(hArgument,
&bhfi))
PrintConsole(hConsole,
L"GetFileInformationByHandle() returned error %lu for argument \'%ls\'\n",
dwError = GetLastError(), lpArgument);
else
if (((bhfi.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) != FILE_ATTRIBUTE_DIRECTORY)
|| ((bhfi.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) == FILE_ATTRIBUTE_REPARSE_POINT))
#else
if (!GetFileInformationByHandleEx(hArgument,
FileAttributeTagInfo,
&fati,
sizeof(fati)))
PrintConsole(hConsole,
L"GetFileInformationByHandleEx() returned error %lu for argument \'%ls\'\n",
dwError = GetLastError(), lpArgument);
else
if (((fati.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != FILE_ATTRIBUTE_DIRECTORY)
|| ((fati.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) == FILE_ATTRIBUTE_REPARSE_POINT))
#endif
PrintConsole(hConsole,
L"Argument \'%ls\' is not a directory!\n",
lpArgument);
else
{
dwArgument = GetFinalPathNameByHandle(hArgument,
szArgument,
sizeof(szArgument) / sizeof(*szArgument),
FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
if (dwArgument == 0)
PrintConsole(hConsole,
L"GetFinalPathNameByHandle() returned error %lu for argument \'%ls\'\n",
dwError = GetLastError(), lpArgument);
else
{
while (ReadDirectoryChangesW(hArgument,
dwBuffer,
sizeof(dwBuffer),
TRUE,
#ifdef FILE_NOTIFY_CHANGE_ALL
FILE_NOTIFY_CHANGE_ALL,
#else
FILE_NOTIFY_CHANGE_ATTRIBUTES | FILE_NOTIFY_CHANGE_CREATION | FILE_NOTIFY_CHANGE_DIR_NAME | FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_LAST_ACCESS | FILE_NOTIFY_CHANGE_LAST_WRITE | FILE_NOTIFY_CHANGE_SECURITY | FILE_NOTIFY_CHANGE_SIZE,
#endif
&dwEntry,
(LPOVERLAPPED) NULL,
(LPOVERLAPPED_COMPLETION_ROUTINE) NULL))
for (lpEntry = (PFILE_NOTIFY_INFORMATION) dwBuffer;
dwEntry != 0;
lpEntry = (PFILE_NOTIFY_INFORMATION) ((LPBYTE) lpEntry + dwEntry))
{
dwEntry = lpEntry->NextEntryOffset;
lpEntry->FileName[lpEntry->FileNameLength / sizeof(lpEntry->FileName[0])] = L'\0';
PrintConsole(hConsole,
L"%ls %ls\\%ls\n",
lpAction[lpEntry->Action], szArgument + 4, lpEntry->FileName);
}
PrintConsole(hConsole,
L"ReadDirectoryChanges() returned error %lu for directory \'%ls\'\n",
dwError = GetLastError(), szArgument + 4);
}
}
if (!CloseHandle(hArgument))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
}
return dwError;
}
__declspec(noreturn)
VOID WINAPI wmainCRTStartup(VOID)
{
LPWSTR *lpArguments;
INT nArguments;
INT nArgument = 1;
DWORD dwError = ERROR_BAD_ARGUMENTS;
DWORD dwThreadId;
HANDLE hThread;
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole == INVALID_HANDLE_VALUE)
dwError = GetLastError();
else
{
lpArguments = CommandLineToArgvW(GetCommandLine(), &nArguments);
if (lpArguments == NULL)
PrintConsole(hConsole,
L"CommandLineToArgv() returned error %lu\n",
dwError = GetLastError());
else
{
if (nArguments < 2)
PrintConsole(hConsole,
L"Too few arguments: at least one directory name must be given!\n");
else if (nArguments > sizeof(hThreads) / sizeof(*hThreads) + 1)
PrintConsole(hConsole,
L"Too many arguments: at most %lu directory names may be given!\n",
sizeof(hThreads) / sizeof(*hThreads));
else
{
do
{
hThread = CreateThread((LPSECURITY_ATTRIBUTES) NULL,
(SIZE_T) 65536,
ThreadProc,
lpArguments[nArgument],
0,
&dwThreadId);
if (hThread == NULL)
PrintConsole(hConsole,
L"CreateThread() returned error %lu\n",
dwError = GetLastError());
else
{
hThreads[dwThreads++] = hThread;
PrintConsole(hConsole,
L"Thread %lu created for argument \'%ls\'\n",
dwThreadId, lpArguments[nArgument]);
}
} while (++nArgument < nArguments);
if (dwThreads > 0)
{
if (!SetConsoleCtrlHandler(CtrlHandler, TRUE))
PrintConsole(hConsole,
L"SetConsoleCtrlHandler() returned error %lu\n",
dwError = GetLastError());
PrintConsole(hConsole,
L"Press \'Ctrl-C\' or \'Ctrl-Break\' to terminate!\n"
L"\n");
if (WaitForMultipleObjects(dwThreads,
hThreads,
TRUE,
INFINITE) == WAIT_FAILED)
PrintConsole(hConsole,
L"WaitForMultipleObjects() returned error %lu\n",
dwError = GetLastError());
else
do
if (!CloseHandle(hThreads[--dwThreads]))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
while (dwThreads > 0);
if (!SetConsoleCtrlHandler(CtrlHandler, FALSE))
PrintConsole(hConsole,
L"SetConsoleCtrlHandler() returned error %lu\n",
GetLastError());
}
}
if (LocalFree(lpArguments) != NULL)
PrintConsole(hConsole,
L"LocalFree() returned error %lu\n",
GetLastError());
}
if (!CloseHandle(hConsole))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
ExitProcess(dwError);
}
ReadDirectoryChangesW()
Run the following four command lines to compile the source file
NOTIFIER.C
created in step 1., link the compiled
object file NOTIFIER.OBJ
and cleanup afterwards:
SET CL=/GA /GF /GS /Gs69632 /Gy /O1 /Oi /Os /Oy /W4 /Zl SET LINK=/DEFAULTLIB:KERNEL32.LIB /DEFAULTLIB:SHELL32.LIB /DEFAULTLIB:USER32.LIB /ENTRY:wmainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /OSVERSION:6.0 /RELEASE /SUBSYSTEM:CONSOLE /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /FeNOTIFIER.COM NOTIFIER.C ERASE NOTIFIER.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. NOTIFIER.C Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Create the text file NOTIFIER.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 33 2c 20 53 74 65 66 61 6e 20 4b 61 -2023, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 03 00 56 4f 49 44 00 00 00 00 PE..L...VOID....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 06 00 00 ......#.........
00 0c 00 00 00 00 00 00 a4 12 00 00 00 10 00 00 ................
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
06 00 00 00 00 00 2f 03 06 00 00 00 00 00 00 00 ....../.........
00 40 00 00 00 02 00 00 60 29 00 00 03 00 00 85 .@......`)......
00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
44 36 00 00 50 00 00 00 00 00 00 00 00 00 00 00 D6..P...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 30 00 00 50 00 00 00 .........0..P...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
c7 04 00 00 00 10 00 00 00 06 00 00 00 02 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 64 61 74 61 00 00 00 20 01 00 00 00 20 00 00 .data... .... ..
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 40 00 00 c0 2e 63 6f 6e 73 74 00 00 ....@....const..
52 08 00 00 00 30 00 00 00 0a 00 00 00 08 00 00 R....0..........
00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 ............@..@
55 8b ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 U........V.E.P.u
0c 8d 85 f8 f7 ff ff 50 ff 15 48 30 40 00 8b f0 .......P..H0@...
85 f6 75 04 33 c0 eb 23 6a 00 8d 45 fc 50 56 8d ..u.3..#j..E.PV.
85 f8 f7 ff ff 50 ff 75 08 ff 15 00 30 40 00 85 .....P.u....0@..
c0 74 e1 33 c0 39 75 fc 0f 94 c0 5e c9 c3 53 57 .t.3.9u....^..SW
8b 3d 00 20 40 00 6a f4 ff 15 0c 30 40 00 8b d8 .=. @.j....0@...
8b 44 24 0c 83 f8 02 76 0a 83 f8 04 76 59 83 f8 .D$....v....vY..
06 77 54 ff 34 85 f4 30 40 00 68 a4 31 40 00 53 .wT.4..0@.h.1@.S
e8 7b ff ff ff 83 c4 0c 85 ff 74 36 56 4f 8d 34 .{........t6VO.4
bd 20 20 40 00 ff 36 ff 15 08 30 40 00 85 c0 75 . @..6...0@...u
1c ff 36 ff 15 04 30 40 00 50 68 7c 31 40 00 68 ..6...0@.Ph|1@.h
28 31 40 00 53 e8 46 ff ff ff 83 c4 14 85 ff 75 (1@.S.F........u
cc 5e 33 c0 40 eb 02 33 c0 5f 5b c2 04 00 55 8b .^3.@..3._[...U.
ec 81 ec 18 02 01 00 56 57 6a f4 33 ff ff 15 0c .......VWj.3....
30 40 00 8b f0 89 75 f8 83 fe ff 75 0d ff 15 04 0@....u....u....
30 40 00 8b f8 e9 a2 01 00 00 53 8b 5d 08 57 68 0@........S.].Wh
00 00 00 02 6a 03 57 6a 07 6a 01 53 ff 15 20 30 ....j.Wj.j.S.. 0
40 00 89 45 08 83 f8 ff 75 22 ff 15 04 30 40 00 @..E....u"...0@.
53 8b f8 57 68 c4 33 40 00 68 68 33 40 00 56 e8 S..Wh.3@.hh3@.V.
cc fe ff ff 83 c4 14 e9 5f 01 00 00 6a 08 8d 4d ........_...j..M
f0 51 6a 09 50 ff 15 1c 30 40 00 85 c0 75 11 ff .Qj.P...0@...u..
15 04 30 40 00 53 8b f8 57 68 28 33 40 00 eb 40 ..0@.S..Wh(3@..@
f6 45 f0 10 0f 84 fb 00 00 00 f7 45 f0 00 04 00 .E.........E....
00 0f 85 ee 00 00 00 57 68 04 01 00 00 8d 85 e8 .......Wh.......
fd ff ff 50 ff 75 08 ff 15 18 30 40 00 85 c0 75 ...P.u....0@...u
22 ff 15 04 30 40 00 53 8b f8 57 68 f4 32 40 00 "...0@.S..Wh.2@.
68 68 33 40 00 56 e8 55 fe ff ff 83 c4 14 e9 c1 hh3@.V.U........
00 00 00 57 57 8b 3d 14 30 40 00 8d 45 fc 50 68 ...WW.=.0@..E.Ph
ff 0f 00 00 6a 01 bb 00 00 01 00 53 8d 85 e8 fd ....j......S....
fe ff 50 ff 75 08 ff d7 85 c0 74 6a 8d b5 e8 fd ..P.u.....tj....
fe ff eb 39 8b 06 89 45 fc 8b 46 08 d1 e8 33 c9 ...9...E..F...3.
66 89 4c 46 0c 8d 46 0c 50 8d 85 f0 fd ff ff 50 f.LF..F.P......P
8b 46 04 ff 34 85 10 31 40 00 68 d8 32 40 00 ff .F..4..1@.h.2@..
75 f8 e8 e9 fd ff ff 83 c4 14 03 75 fc 83 7d fc u..........u..}.
00 75 c1 6a 00 6a 00 8d 45 fc 50 68 ff 0f 00 00 .u.j.j..E.Ph....
6a 01 53 8d 85 e8 fd fe ff 50 ff 75 08 ff d7 85 j.S......P.u....
c0 75 99 8b 75 f8 ff 15 04 30 40 00 8b f8 8d 85 .u..u....0@.....
f0 fd ff ff 50 57 68 ac 32 40 00 68 50 32 40 00 ....PWh.2@.hP2@.
e9 40 ff ff ff 53 68 08 32 40 00 56 e8 8f fd ff .@...Sh.2@.V....
ff 83 c4 0c ff 75 08 ff 15 10 30 40 00 85 c0 75 .....u....0@...u
1a ff 15 04 30 40 00 50 68 ec 31 40 00 68 b8 31 ....0@.Ph.1@.h.1
40 00 56 e8 68 fd ff ff 83 c4 10 5b 8b c7 5f 5e @.V.h......[.._^
c9 c2 04 00 83 ec 14 53 55 6a f4 c7 44 24 0c 01 .......SUj..D$..
00 00 00 bd a0 00 00 00 ff 15 0c 30 40 00 8b d8 ...........0@...
83 fb ff 75 0d ff 15 04 30 40 00 8b e8 e9 ec 01 ...u....0@......
00 00 56 57 8d 44 24 14 50 ff 15 38 30 40 00 50 ..VW.D$.P..80@.P
ff 15 40 30 40 00 8b 35 04 30 40 00 89 44 24 18 ..@0@..5.0@..D$.
85 c0 75 14 ff d6 8b e8 55 68 20 36 40 00 bf b8 ..u.....Uh 6@...
31 40 00 e9 8d 01 00 00 83 7c 24 14 02 bf b8 31 1@.......|$....1
40 00 7d 12 68 a0 35 40 00 53 e8 e1 fc ff ff 59 @.}.h.5@.S.....Y
59 e9 59 01 00 00 83 7c 24 14 41 76 15 6a 40 68 Y.Y....|$.Av.j@h
20 35 40 00 53 e8 c6 fc ff ff 83 c4 0c e9 3d 01 5@.S.........=.
00 00 8b 4c 24 18 8b 44 24 10 8d 04 81 8d 4c 24 ...L$..D$.....L$
20 51 6a 00 ff 30 89 44 24 28 68 ce 10 40 00 68 Qj..0.D$(h..@.h
00 00 01 00 6a 00 ff 15 34 30 40 00 85 c0 75 0d ....j...40@...u.
ff d6 8b e8 55 68 00 35 40 00 57 eb 22 8b 0d 00 ....Uh.5@.W."...
20 40 00 ff 05 00 20 40 00 89 04 8d 20 20 40 00 @.... @.... @.
8b 44 24 1c ff 30 ff 74 24 24 68 b0 34 40 00 53 .D$..0.t$$h.4@.S
e8 5b fc ff ff 83 c4 10 ff 44 24 10 8b 44 24 10 .[.......D$..D$.
3b 44 24 14 7c 8c 83 3d 00 20 40 00 00 0f 86 bc ;D$.|..=. @.....
00 00 00 6a 01 68 4e 10 40 00 ff 15 30 30 40 00 ...j.hN.@...00@.
85 c0 75 14 ff d6 8b e8 55 68 80 34 40 00 57 53 ..u.....Uh.4@.WS
e8 1b fc ff ff 83 c4 10 68 20 34 40 00 53 e8 0d ........h 4@.S..
fc ff ff 59 59 6a ff 6a 01 68 20 20 40 00 ff 35 ...YYj.j.h @..5
00 20 40 00 ff 15 2c 30 40 00 83 f8 ff 75 16 ff . @...,0@....u..
d6 8b e8 55 68 f0 33 40 00 57 53 e8 e0 fb ff ff ...Uh.3@.WS.....
83 c4 10 eb 37 ff 0d 00 20 40 00 a1 00 20 40 00 ....7... @... @.
ff 34 85 20 20 40 00 ff 15 10 30 40 00 85 c0 75 .4. @....0@...u
12 ff d6 50 68 ec 31 40 00 57 53 e8 b0 fb ff ff ...Ph.1@.WS.....
83 c4 10 83 3d 00 20 40 00 00 77 c9 6a 00 68 4e ....=. @..w.j.hN
10 40 00 ff 15 30 30 40 00 85 c0 75 12 ff d6 50 .@...00@...u...P
68 80 34 40 00 57 53 e8 84 fb ff ff 83 c4 10 ff h.4@.WS.........
74 24 18 ff 15 28 30 40 00 85 c0 74 12 ff d6 50 t$...(0@...t...P
68 dc 33 40 00 57 53 e8 64 fb ff ff 83 c4 10 53 h.3@.WS.d......S
ff 15 10 30 40 00 85 c0 75 12 ff d6 50 68 ec 31 ...0@...u...Ph.1
40 00 57 53 e8 47 fb ff ff 83 c4 10 5f 5e 55 ff @.WS.G......_^U.
15 24 30 40 00 5d 5b 00 00 00 00 00 00 00 00 00 .$0@.][.........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
e4 36 00 00 f4 36 00 00 04 37 00 00 1a 37 00 00 .6...6...7...7..
2a 37 00 00 38 37 00 00 50 37 00 00 6c 37 00 00 *7..87..P7..l7..
8c 37 00 00 9a 37 00 00 a8 37 00 00 b4 37 00 00 .7...7...7...7..
ce 37 00 00 e6 37 00 00 f6 37 00 00 00 00 00 00 .7...7...7......
16 38 00 00 00 00 00 00 38 38 00 00 00 00 00 00 .8......88......
52 00 65 00 6e 00 61 00 6d 00 65 00 64 00 20 00 R.e.n.a.m.e.d. .
74 00 6f 00 00 00 00 00 52 00 65 00 6e 00 61 00 t.o.....R.e.n.a.
6d 00 65 00 64 00 20 00 66 00 72 00 6f 00 6d 00 m.e.d. .f.r.o.m.
00 00 00 00 4d 00 6f 00 64 00 69 00 66 00 69 00 ....M.o.d.i.f.i.
65 00 64 00 00 00 00 00 52 00 65 00 6d 00 6f 00 e.d.....R.e.m.o.
76 00 65 00 64 00 00 00 41 00 64 00 64 00 65 00 v.e.d...A.d.d.e.
64 00 00 00 53 00 68 00 75 00 74 00 64 00 6f 00 d...S.h.u.t.d.o.
77 00 6e 00 00 00 00 00 4c 00 6f 00 67 00 6f 00 w.n.....L.o.g.o.
66 00 66 00 00 00 00 00 43 00 6c 00 6f 00 73 00 f.f.....C.l.o.s.
65 00 00 00 42 00 72 00 65 00 61 00 6b 00 00 00 e...B.r.e.a.k...
43 00 00 00 f0 30 40 00 e4 30 40 00 d8 30 40 00 C....0@..0@..0@.
00 00 00 00 00 00 00 00 c8 30 40 00 b4 30 40 00 .........0@..0@.
00 00 00 00 a8 30 40 00 98 30 40 00 84 30 40 00 .....0@..0@..0@.
68 30 40 00 50 30 40 00 25 00 6c 00 73 00 28 00 h0@.P0@.%.l.s.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 20 00 66 00 6f 00 72 00 .%.l.u. .f.o.r.
20 00 74 00 68 00 72 00 65 00 61 00 64 00 20 00 .t.h.r.e.a.d. .
30 00 78 00 25 00 70 00 0a 00 00 00 43 00 61 00 0.x.%.p.....C.a.
6e 00 63 00 65 00 6c 00 53 00 79 00 6e 00 63 00 n.c.e.l.S.y.n.c.
68 00 72 00 6f 00 6e 00 6f 00 75 00 73 00 49 00 h.r.o.n.o.u.s.I.
6f 00 00 00 43 00 74 00 72 00 6c 00 2d 00 25 00 o...C.t.r.l.-.%.
6c 00 73 00 0a 00 00 00 25 00 6c 00 73 00 28 00 l.s.....%.l.s.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 0a 00 00 00 43 00 6c 00 .%.l.u.....C.l.
6f 00 73 00 65 00 48 00 61 00 6e 00 64 00 6c 00 o.s.e.H.a.n.d.l.
65 00 00 00 00 00 00 00 41 00 72 00 67 00 75 00 e.......A.r.g.u.
6d 00 65 00 6e 00 74 00 20 00 27 00 25 00 6c 00 m.e.n.t. .'.%.l.
73 00 27 00 20 00 69 00 73 00 20 00 6e 00 6f 00 s.'. .i.s. .n.o.
74 00 20 00 61 00 20 00 64 00 69 00 72 00 65 00 t. .a. .d.i.r.e.
63 00 74 00 6f 00 72 00 79 00 21 00 0a 00 00 00 c.t.o.r.y.!.....
25 00 6c 00 73 00 28 00 29 00 20 00 72 00 65 00 %.l.s.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 65 00 t.u.r.n.e.d. .e.
72 00 72 00 6f 00 72 00 20 00 25 00 6c 00 75 00 r.r.o.r. .%.l.u.
20 00 66 00 6f 00 72 00 20 00 64 00 69 00 72 00 .f.o.r. .d.i.r.
65 00 63 00 74 00 6f 00 72 00 79 00 20 00 27 00 e.c.t.o.r.y. .'.
25 00 6c 00 73 00 27 00 0a 00 00 00 52 00 65 00 %.l.s.'.....R.e.
61 00 64 00 44 00 69 00 72 00 65 00 63 00 74 00 a.d.D.i.r.e.c.t.
6f 00 72 00 79 00 43 00 68 00 61 00 6e 00 67 00 o.r.y.C.h.a.n.g.
65 00 73 00 00 00 00 00 25 00 6c 00 73 00 20 00 e.s.....%.l.s. .
25 00 6c 00 73 00 5c 00 25 00 6c 00 73 00 0a 00 %.l.s.\.%.l.s...
00 00 00 00 47 00 65 00 74 00 46 00 69 00 6e 00 ....G.e.t.F.i.n.
61 00 6c 00 50 00 61 00 74 00 68 00 4e 00 61 00 a.l.P.a.t.h.N.a.
6d 00 65 00 42 00 79 00 48 00 61 00 6e 00 64 00 m.e.B.y.H.a.n.d.
6c 00 65 00 00 00 00 00 47 00 65 00 74 00 46 00 l.e.....G.e.t.F.
69 00 6c 00 65 00 49 00 6e 00 66 00 6f 00 72 00 i.l.e.I.n.f.o.r.
6d 00 61 00 74 00 69 00 6f 00 6e 00 42 00 79 00 m.a.t.i.o.n.B.y.
48 00 61 00 6e 00 64 00 6c 00 65 00 45 00 78 00 H.a.n.d.l.e.E.x.
00 00 00 00 00 00 00 00 25 00 6c 00 73 00 28 00 ........%.l.s.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 20 00 66 00 6f 00 72 00 .%.l.u. .f.o.r.
20 00 61 00 72 00 67 00 75 00 6d 00 65 00 6e 00 .a.r.g.u.m.e.n.
74 00 20 00 27 00 25 00 6c 00 73 00 27 00 0a 00 t. .'.%.l.s.'...
00 00 00 00 43 00 72 00 65 00 61 00 74 00 65 00 ....C.r.e.a.t.e.
46 00 69 00 6c 00 65 00 00 00 00 00 4c 00 6f 00 F.i.l.e.....L.o.
63 00 61 00 6c 00 46 00 72 00 65 00 65 00 00 00 c.a.l.F.r.e.e...
57 00 61 00 69 00 74 00 46 00 6f 00 72 00 4d 00 W.a.i.t.F.o.r.M.
75 00 6c 00 74 00 69 00 70 00 6c 00 65 00 4f 00 u.l.t.i.p.l.e.O.
62 00 6a 00 65 00 63 00 74 00 73 00 00 00 00 00 b.j.e.c.t.s.....
50 00 72 00 65 00 73 00 73 00 20 00 27 00 43 00 P.r.e.s.s. .'.C.
74 00 72 00 6c 00 2d 00 43 00 27 00 20 00 6f 00 t.r.l.-.C.'. .o.
72 00 20 00 27 00 43 00 74 00 72 00 6c 00 2d 00 r. .'.C.t.r.l.-.
42 00 72 00 65 00 61 00 6b 00 27 00 20 00 74 00 B.r.e.a.k.'. .t.
6f 00 20 00 74 00 65 00 72 00 6d 00 69 00 6e 00 o. .t.e.r.m.i.n.
61 00 74 00 65 00 21 00 0a 00 0a 00 00 00 00 00 a.t.e.!.........
53 00 65 00 74 00 43 00 6f 00 6e 00 73 00 6f 00 S.e.t.C.o.n.s.o.
6c 00 65 00 43 00 74 00 72 00 6c 00 48 00 61 00 l.e.C.t.r.l.H.a.
6e 00 64 00 6c 00 65 00 72 00 00 00 00 00 00 00 n.d.l.e.r.......
54 00 68 00 72 00 65 00 61 00 64 00 20 00 25 00 T.h.r.e.a.d. .%.
6c 00 75 00 20 00 63 00 72 00 65 00 61 00 74 00 l.u. .c.r.e.a.t.
65 00 64 00 20 00 66 00 6f 00 72 00 20 00 61 00 e.d. .f.o.r. .a.
72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 20 00 r.g.u.m.e.n.t. .
27 00 25 00 6c 00 73 00 27 00 0a 00 00 00 00 00 '.%.l.s.'.......
43 00 72 00 65 00 61 00 74 00 65 00 54 00 68 00 C.r.e.a.t.e.T.h.
72 00 65 00 61 00 64 00 00 00 00 00 00 00 00 00 r.e.a.d.........
54 00 6f 00 6f 00 20 00 6d 00 61 00 6e 00 79 00 T.o.o. .m.a.n.y.
20 00 61 00 72 00 67 00 75 00 6d 00 65 00 6e 00 .a.r.g.u.m.e.n.
74 00 73 00 3a 00 20 00 61 00 74 00 20 00 6d 00 t.s.:. .a.t. .m.
6f 00 73 00 74 00 20 00 25 00 6c 00 75 00 20 00 o.s.t. .%.l.u. .
64 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 d.i.r.e.c.t.o.r.
79 00 20 00 6e 00 61 00 6d 00 65 00 73 00 20 00 y. .n.a.m.e.s. .
6d 00 61 00 79 00 20 00 62 00 65 00 20 00 67 00 m.a.y. .b.e. .g.
69 00 76 00 65 00 6e 00 21 00 0a 00 00 00 00 00 i.v.e.n.!.......
54 00 6f 00 6f 00 20 00 66 00 65 00 77 00 20 00 T.o.o. .f.e.w. .
61 00 72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 a.r.g.u.m.e.n.t.
73 00 3a 00 20 00 61 00 74 00 20 00 6c 00 65 00 s.:. .a.t. .l.e.
61 00 73 00 74 00 20 00 6f 00 6e 00 65 00 20 00 a.s.t. .o.n.e. .
64 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 d.i.r.e.c.t.o.r.
79 00 20 00 6e 00 61 00 6d 00 65 00 20 00 6d 00 y. .n.a.m.e. .m.
75 00 73 00 74 00 20 00 62 00 65 00 20 00 67 00 u.s.t. .b.e. .g.
69 00 76 00 65 00 6e 00 21 00 0a 00 00 00 00 00 i.v.e.n.!.......
43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 4c 00 C.o.m.m.a.n.d.L.
69 00 6e 00 65 00 54 00 6f 00 41 00 72 00 67 00 i.n.e.T.o.A.r.g.
76 00 00 00 94 36 00 00 00 00 00 00 00 00 00 00 v....6..........
08 38 00 00 00 30 00 00 d4 36 00 00 00 00 00 00 .8...0...6......
00 00 00 00 2c 38 00 00 40 30 00 00 dc 36 00 00 ....,8..@0...6..
00 00 00 00 00 00 00 00 46 38 00 00 48 30 00 00 ........F8..H0..
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 e4 36 00 00 f4 36 00 00 04 37 00 00 .....6...6...7..
1a 37 00 00 2a 37 00 00 38 37 00 00 50 37 00 00 .7..*7..87..P7..
6c 37 00 00 8c 37 00 00 9a 37 00 00 a8 37 00 00 l7...7...7...7..
b4 37 00 00 ce 37 00 00 e6 37 00 00 f6 37 00 00 .7...7...7...7..
00 00 00 00 16 38 00 00 00 00 00 00 38 38 00 00 .....8......88..
00 00 00 00 24 05 57 72 69 74 65 43 6f 6e 73 6f ....$.WriteConso
6c 65 57 00 02 02 47 65 74 4c 61 73 74 45 72 72 leW...GetLastErr
6f 72 00 00 44 00 43 61 6e 63 65 6c 53 79 6e 63 or..D.CancelSync
68 72 6f 6e 6f 75 73 49 6f 00 64 02 47 65 74 53 hronousIo.d.GetS
74 64 48 61 6e 64 6c 65 00 00 52 00 43 6c 6f 73 tdHandle..R.Clos
65 48 61 6e 64 6c 65 00 bf 03 52 65 61 64 44 69 eHandle...ReadDi
72 65 63 74 6f 72 79 43 68 61 6e 67 65 73 57 00 rectoryChangesW.
f5 01 47 65 74 46 69 6e 61 6c 50 61 74 68 4e 61 ..GetFinalPathNa
6d 65 42 79 48 61 6e 64 6c 65 57 00 ed 01 47 65 meByHandleW...Ge
74 46 69 6c 65 49 6e 66 6f 72 6d 61 74 69 6f 6e tFileInformation
42 79 48 61 6e 64 6c 65 45 78 00 00 8f 00 43 72 ByHandleEx....Cr
65 61 74 65 46 69 6c 65 57 00 19 01 45 78 69 74 eateFileW...Exit
50 72 6f 63 65 73 73 00 48 03 4c 6f 63 61 6c 46 Process.H.LocalF
72 65 65 00 f7 04 57 61 69 74 46 6f 72 4d 75 6c ree...WaitForMul
74 69 70 6c 65 4f 62 6a 65 63 74 73 00 00 2d 04 tipleObjects..-.
53 65 74 43 6f 6e 73 6f 6c 65 43 74 72 6c 48 61 SetConsoleCtrlHa
6e 64 6c 65 72 00 b5 00 43 72 65 61 74 65 54 68 ndler...CreateTh
72 65 61 64 00 00 87 01 47 65 74 43 6f 6d 6d 61 read....GetComma
6e 64 4c 69 6e 65 57 00 4b 45 52 4e 45 4c 33 32 ndLineW.KERNEL32
2e 64 6c 6c 00 00 06 00 43 6f 6d 6d 61 6e 64 4c .dll....CommandL
69 6e 65 54 6f 41 72 67 76 57 00 00 53 48 45 4c ineToArgvW..SHEL
4c 33 32 2e 64 6c 6c 00 35 03 77 76 73 70 72 69 L32.dll.5.wvspri
6e 74 66 57 00 00 55 53 45 52 33 32 2e 64 6c 6c ntfW..USER32.dll
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file NOTIFIER.TXT
created in
step 3. to recreate the console application
Directory Change Notifier;
CERTUTIL.EXE /DecodeHex /V NOTIFIER.TXT NOTIFIER.COM
Input Length = 19584 Output Length = 4608 CertUtil: -decodehex command completed successfully.
PIDGENX.COM ‹pidgenx.dll› ‹pkeyconfig.xrm-ms› ‹product key› …
Note: due to the design and implementation of
Windows’ (classic alias legacy) console, the
Win32 function
WriteConsole()
can only write to a console, not to a file nor a pipe, i.e.
redirection of standard error
or standard output
is
not supported!
The MSDN article Console Handles provides background information.
importlibrary;
PIDGENX.DLL
is loaded
with the application PIDGENX.COM
and located per
DLL search order.
safedirectories.
Create the text file PIDGENX.C
with the following
content in an arbitrary, preferable empty directory:
// Copyright © 2004-2023, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#ifndef _DLL
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <shellapi.h>
#ifndef E_FILENOTFOUND
#define E_FILENOTFOUND 0x80070002L // file not found
#endif
#ifndef E_PATHNOTFOUND
#define E_PATHNOTFOUND 0x80070003L // path not found
#endif
#ifndef E_RESERVEDKEY
#define E_RESERVEDKEY 0x8A010001L // reserved product key
#endif
#ifndef E_INVALIDKEY
#define E_INVALIDKEY 0x8A010101L // invalid product key
#endif
#define VS_BINARY 0U
#define VS_TEXT 1U
typedef struct _VS_VERSIONINFO
{
WORD wSize; // size of 'VERSION' resource
WORD wCount; // = sizeof(VS_FIXEDFILEINFO)
// (number of bytes in binary value)
WORD wType; // = VS_BINARY
WCHAR szKey[16]; // = L"VS_VERSION_INFO"
WORD wPadding; // = 0 (alignment to DWORD)
VS_FIXEDFILEINFO vsFFI;
} VS_VERSIONINFO;
typedef struct _DigitalProductId
{
DWORD dwSize; // 0x000000A4 = 164
WORD wMajorVersion; // 0x0003
WORD wMinorVersion; // 0x0000
CHAR szProductId[24]; // "DUMMY-OEM-0123456-78901"
DWORD dwKeyIdx;
CHAR szEditionId[16];
BYTE bCdKey[16];
DWORD dwCloneStatus;
DWORD dwTime;
DWORD dwRandom;
DWORD dwLt;
DWORD dwLicenseData[2];
CHAR sOemId[8];
DWORD dwBundleId;
CHAR sHardwareIdStatic[8];
DWORD dwHardwareIdTypeStatic;
DWORD dwBiosChecksumStatic;
DWORD dwVolumeSerialStatic;
DWORD dwTotalRamStatic;
DWORD dwVideoBiosChecksumStatic;
CHAR sHardwareIdDynamic[8];
DWORD dwHardwareIdTypeDynamic;
DWORD dwBiosChecksumDynamic;
DWORD dwVolumeSerialDynamic;
DWORD dwTotalRamDynamic;
DWORD dwVideoBiosChecksumDynamic;
DWORD dwCRC32;
} DPI, *LPDPI;
typedef struct _DigitalProductId4
{
DWORD dwSize; // 0x000004F8 = 1272
WORD wMajorVersion; // 0x0004
WORD wMinorVersion; // 0x0000
WCHAR szAdvancedPid[64];
WCHAR szActivationId[64];
WCHAR szOemId[8];
WCHAR szEditionType[260];
BYTE bIsUpgrade;
BYTE bReserved[7];
BYTE bCdKey[16];
BYTE bCdKey256Hash[32];
BYTE b256Hash[32];
WCHAR szEditionId[64];
WCHAR szKeyType[64];
WCHAR szEULA[64];
} DPI4, *LPDPI4;
__declspec(dllimport)
HRESULT WINAPI PidGenX(LPCWSTR lpProductKey,
LPCWSTR lpPKeyConfig,
LPCWSTR lpMPC,
LPCWSTR lpOEMId,
LPCWSTR lpProductId,
LPDPI lpDigitalProductId,
LPDPI4 lpDigitalProductId4);
__declspec(safebuffers)
BOOL PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
DWORD dwBuffer;
DWORD dwConsole;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
if (!WriteConsole(hConsole, szBuffer, dwBuffer, &dwConsole, NULL))
return FALSE;
return dwConsole == dwBuffer;
}
__declspec(noreturn)
VOID WINAPI wmainCRTStartup(VOID)
{
VS_VERSIONINFO *lpVersion;
LPWSTR *lpArguments;
INT nArguments;
INT nArgument = 2;
DWORD dwError = ERROR_BAD_ARGUMENTS;
HMODULE hPidGenX;
HRSRC hResInfo;
HGLOBAL hResData;
WCHAR szPidGenX[MAX_PATH];
WCHAR szPid[24];
DPI dpi;
DPI4 dpi4;
HRESULT hr;
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole == INVALID_HANDLE_VALUE)
dwError = GetLastError();
else
{
lpArguments = CommandLineToArgvW(GetCommandLine(), &nArguments);
if (lpArguments == NULL)
PrintConsole(hConsole,
L"CommandLineToArgv() returned error %lu\n",
dwError = GetLastError());
else
{
if (nArguments < 3)
PrintConsole(hConsole,
L"Bad arguments: the file or path name of a \'PKeyConfig[*].xrm-ms\' data file plus\n"
L" at least one product key must be given!\n");
else
{
hPidGenX = GetModuleHandle(L"PidGenX");
if (hPidGenX == NULL)
PrintConsole(hConsole,
L"GetModuleHandle() returned error %lu\n",
dwError = GetLastError());
else
{
if (GetModuleFileName(hPidGenX, szPidGenX, sizeof(szPidGenX) / sizeof(*szPidGenX)) == 0)
PrintConsole(hConsole,
L"GetModuleFileName() returned error %lu\n",
dwError = GetLastError());
else
PrintConsole(hConsole,
L"Module \'%ls\'\n",
szPidGenX);
hResInfo = FindResource(hPidGenX, MAKEINTRESOURCE(VS_VERSION_INFO), RT_VERSION);
if (hResInfo == NULL)
PrintConsole(hConsole,
L"FindResource() returned error %lu\n",
dwError = GetLastError());
else
{
hResData = LoadResource(hPidGenX, hResInfo);
if (hResData == NULL)
PrintConsole(hConsole,
L"LoadResource() returned error %lu\n",
dwError = GetLastError());
else
{
lpVersion = LockResource(hResData);
if (lpVersion == NULL)
PrintConsole(hConsole,
L"LockResource() returned NULL\n");
else
PrintConsole(hConsole,
L"\tModule version:\t\t%hu.%hu:%hu.%hu\n"
L"\tProduct version:\t%hu.%hu:%hu.%hu\n",
HIWORD(lpVersion->vsFFI.dwFileVersionMS), LOWORD(lpVersion->vsFFI.dwFileVersionMS),
HIWORD(lpVersion->vsFFI.dwFileVersionLS), LOWORD(lpVersion->vsFFI.dwFileVersionLS),
HIWORD(lpVersion->vsFFI.dwProductVersionMS), LOWORD(lpVersion->vsFFI.dwProductVersionMS),
HIWORD(lpVersion->vsFFI.dwProductVersionLS), LOWORD(lpVersion->vsFFI.dwProductVersionLS));
}
}
}
dpi.dwSize = sizeof(dpi);
dpi4.dwSize = sizeof(dpi4);
do
{
hr = PidGenX(lpArguments[nArgument],
lpArguments[1],
L"DUMMY",
(LPCWSTR) NULL,
szPid,
&dpi,
&dpi4);
switch (hr)
{
case ERROR_FILE_NOT_FOUND:
case ERROR_PATH_NOT_FOUND:
case E_FILENOTFOUND: // file 'PKeyConfig.xrm-ms' not found
case E_PATHNOTFOUND: // path of 'PKeyConfig.xrm-ms' not found
PrintConsole(hConsole,
L"Data file \'%ls\' not found!\n",
lpArguments[1]);
nArguments = 0;
break;
case ERROR_INVALID_PARAMETER:
case E_INVALIDARG: // malformed product key
PrintConsole(hConsole,
L"Product key \'%ls\' is malformed!\n",
lpArguments[nArgument]);
break;
case E_RESERVEDKEY: // reserved product key
PrintConsole(hConsole,
L"Product key \'%ls\' is reserved!\n",
lpArguments[nArgument]);
break;
case E_INVALIDKEY: // invalid product key
PrintConsole(hConsole,
L"Product key \'%ls\' is invalid!\n",
lpArguments[nArgument]);
break;
case S_OK:
PrintConsole(hConsole,
L"Product key \'%ls\' is valid!\n",
lpArguments[nArgument]);
#ifdef VERBOSE
if ((dpi.dwSize != sizeof(dpi))
|| (dpi.wMajorVersion != 3)
|| (dpi.wMinorVersion != 0))
PrintConsole(hConsole,
L"Size of \'DigitalProductId\' not equal %lu or version not equal 3.0\n",
sizeof(dpi));
else
PrintConsole(hConsole,
L"\n"
L"DigitalProductId: size = %lu\n"
L"\tProduct ID:\t\t%hs\n"
L"\tEdition ID:\t\t%hs\n"
L"\tOEM ID:\t\t\t%.8hs\n"
L"\tHardware ID (static):\t%.8hs\n"
L"\tHardware ID (dynamic):\t%.8hs\n",
dpi.dwSize,
dpi.szProductId,
dpi.szEditionId,
dpi.sOemId,
dpi.sHardwareIdStatic,
dpi.sHardwareIdDynamic);
if ((dpi4.dwSize != sizeof(dpi4))
|| (dpi4.wMajorVersion != 4)
|| (dpi4.wMinorVersion != 0))
PrintConsole(hConsole,
L"Size of \'DigitalProductId4\' not equal %lu or version not equal 4.0\n",
sizeof(dpi4));
else
PrintConsole(hConsole,
L"\n"
L"DigitalProductId4: size = %lu\n"
L"\tAdvanced Product ID:\t%ls\n"
L"\tActivation ID:\t\t%ls\n"
L"\tOEM ID:\t\t\t%ls\n"
L"\tEdition Type:\t\t%ls\n"
L"\tEdition ID:\t\t%ls\n"
L"\tKey Type:\t\t%ls\n"
L"\tEULA:\t\t\t%ls\n",
dpi4.dwSize,
dpi4.szAdvancedPid,
dpi4.szActivationId,
dpi4.szOemId,
dpi4.szEditionType,
dpi4.szEditionId,
dpi4.szKeyType,
dpi4.szEULA);
#endif
break;
default:
PrintConsole(hConsole,
L"PidGenX() returned error 0x%08lX\n",
dwError = hr);
}
} while (++nArgument < nArguments);
}
if (LocalFree(lpArguments) != NULL)
PrintConsole(hConsole,
L"LocalFree() returned error %lu\n",
GetLastError());
}
if (!CloseHandle(hConsole))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
ExitProcess(dwError);
}
#else // _DLL
__declspec(dllexport)
long PidGenX(void *_1, void *_2, void *_3, void *_4, void *_5, void *_6, void *_7)
{ return 0; }
#endif // _DLL
Run the following four command lines to compile the source file
PIDGENX.C
created in step 1. a first time,
generate the import library PIDGENX.LIB
from the
compiled object file PIDGENX.OBJ
and cleanup
afterwards:
SET CL=/Gz /LD /MD /W4 /wd4100 /X /Zl SET LINK=/EXPORT:PidGenX /NODEFAULTLIB /NOENTRY CL.EXE PIDGENX.C ERASE PIDGENX.DLL PIDGENX.EXP PIDGENX.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. PIDGENX.C Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. … Creating library PIDGENX.lib and object PIDGENX.exp
Run the following four command lines to compile the source file
PIDGENX.C
created in step 1. a second time, link
the compiled object file PIDGENX.OBJ
with the import
library PIDGENX.LIB
generated in step 2. and
cleanup afterwards:
SET CL=/DVERBOSE /GA /GF /GS /Gy /O1 /Oi /Os /Oy /W4 /Zl SET LINK=/DEFAULTLIB:KERNEL32.LIB /DEFAULTLIB:PIDGENX.LIB /DEFAULTLIB:SHELL32.LIB /DEFAULTLIB:USER32.LIB /ENTRY:wmainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /OSVERSION:5.1 /RELEASE /SUBSYSTEM:CONSOLE /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /FePIDGENX.COM PIDGENX.C ERASE PIDGENX.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. PIDGENX.C Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Create the text file PIDGENX.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 33 2c 20 53 74 65 66 61 6e 20 4b 61 -2023, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 02 00 56 4f 49 44 00 00 00 00 PE..L...VOID....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 04 00 00 ......#.........
00 0c 00 00 00 00 00 00 4e 10 00 00 00 10 00 00 ........N.......
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
05 00 00 00 00 00 2f 03 05 00 00 00 00 00 00 00 ....../.........
00 30 00 00 00 02 00 00 fb 86 00 00 03 00 00 85 .0..............
00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
58 28 00 00 64 00 00 00 00 00 00 00 00 00 00 00 X(..d...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 20 00 00 4c 00 00 00 ......... ..L...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
c8 03 00 00 00 10 00 00 00 04 00 00 00 02 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 63 6f 6e 73 74 00 00 2c 0a 00 00 00 20 00 00 .const..,.... ..
00 0c 00 00 00 06 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 ....@..@........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
55 8b ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 U........V.E.P.u
0c 8d 85 f8 f7 ff ff 50 ff 15 44 20 40 00 8b f0 .......P..D @...
85 f6 75 04 33 c0 eb 23 6a 00 8d 45 fc 50 56 8d ..u.3..#j..E.PV.
85 f8 f7 ff ff 50 ff 75 08 ff 15 08 20 40 00 85 .....P.u.... @..
c0 74 e1 33 c0 39 75 fc 0f 94 c0 5e c9 c3 55 8d .t.3.9u....^..U.
6c 24 88 81 ec ec 07 00 00 53 56 57 6a f4 c7 45 l$.......SVWj..E
6c 02 00 00 00 c7 45 74 a0 00 00 00 ff 15 04 20 l.....Et.......
40 00 8b f0 89 75 70 83 fe ff 75 0e ff 15 24 20 @....up...u...$
40 00 89 45 74 e9 34 03 00 00 8d 45 64 50 ff 15 @..Et.4....EdP..
2c 20 40 00 50 ff 15 3c 20 40 00 8b 3d 24 20 40 , @.P..< @..=$ @
00 89 45 68 85 c0 75 15 ff d7 50 89 45 74 68 34 ..Eh..u...P.Eth4
28 40 00 bb 00 28 40 00 e9 da 02 00 00 83 7d 64 (@...(@.......}d
03 bb 00 28 40 00 7d 12 68 f0 26 40 00 56 e8 2d ...(@.}.h.&@.V.-
ff ff ff 59 59 e9 a8 02 00 00 68 e0 26 40 00 ff ...YY.....h.&@..
15 28 20 40 00 89 45 60 85 c0 75 0a ff d7 50 68 .( @..E`..u...Ph
c0 26 40 00 eb 74 68 04 01 00 00 8d 8d 8c f8 ff .&@..th.........
ff 51 50 ff 15 00 20 40 00 85 c0 75 17 ff d7 50 .QP... @...u...P
68 9c 26 40 00 53 56 89 45 74 e8 e1 fe ff ff 83 h.&@.SV.Et......
c4 10 eb 15 8d 85 8c f8 ff ff 50 68 80 26 40 00 ..........Ph.&@.
56 e8 ca fe ff ff 83 c4 0c 6a 10 6a 01 ff 75 60 V........j.j..u`
ff 15 20 20 40 00 85 c0 75 0a ff d7 50 68 64 26 .. @...u...Phd&
40 00 eb 16 50 ff 75 60 ff 15 1c 20 40 00 85 c0 @...P.u`... @...
75 17 ff d7 50 68 48 26 40 00 53 56 89 45 74 e8 u...PhH&@.SV.Et.
8c fe ff ff 83 c4 10 eb 50 50 ff 15 18 20 40 00 ........PP... @.
85 c0 75 0f 68 0c 26 40 00 56 e8 71 fe ff ff 59 ..u.h.&@.V.q...Y
59 eb 36 0f b7 48 3c 51 0f b7 48 3e 51 0f b7 48 Y.6..H<Q..H>Q..H
38 51 0f b7 48 3a 51 0f b7 48 34 51 0f b7 48 36 8Q..H:Q..H4Q..H6
51 0f b7 48 30 0f b7 40 32 51 50 68 80 25 40 00 Q..H0..@2QPh.%@.
56 e8 3a fe ff ff 83 c4 28 c7 45 bc a4 00 00 00 V.:.....(.E.....
c7 85 94 fa ff ff f8 04 00 00 8b 45 68 8b 4d 6c ...........Eh.Ml
8d 34 88 8d 85 94 fa ff ff 50 8d 45 bc 50 8d 45 .4.......P.E.P.E
8c 50 8b 45 68 6a 00 68 70 25 40 00 ff 70 04 ff .P.Ehj.hp%@..p..
36 ff 15 34 20 40 00 b9 01 01 01 8a 3b c1 7f 36 6..4 @......;..6
74 2b 3d 02 00 07 80 7c 68 3d 03 00 07 80 7e 42 t+=....|h=....~B
3d 57 00 07 80 74 32 3d 01 00 01 8a 75 53 ff 36 =W...t2=....uS.6
68 30 25 40 00 ff 75 70 e9 2b 01 00 00 ff 36 68 h0%@..up.+....6h
ec 24 40 00 eb ef 85 c0 74 55 83 f8 01 7e 32 83 .$@.....tU...~2.
f8 03 7e 0e 83 f8 57 75 28 ff 36 68 a8 24 40 00 ..~...Wu(.6h.$@.
eb d3 8b 45 68 ff 70 04 68 70 24 40 00 ff 75 70 ...Eh.p.hp$@..up
e8 8b fd ff ff 83 c4 0c 83 65 64 00 e9 ef 00 00 .........ed.....
00 50 68 e0 26 40 00 68 34 24 40 00 ff 75 70 89 .Ph.&@.h4$@..up.
45 74 e8 69 fd ff ff 83 c4 10 e9 d1 00 00 00 ff Et.i............
36 8b 75 70 68 f8 23 40 00 56 e8 51 fd ff ff b8 6.uph.#@.V.Q....
a4 00 00 00 83 c4 0c 39 45 bc 75 33 66 83 7d c0 .......9E.u3f.}.
03 75 2c 66 83 7d c2 00 75 25 8d 4d 40 51 8d 4d .u,f.}..u%.M@Q.M
24 51 8d 4d 18 51 8d 4d e0 51 8d 4d c4 51 50 68 $Q.M.Q.M.Q.M.QPh
d8 22 40 00 56 e8 16 fd ff ff 83 c4 20 eb 0f 50 ."@.V....... ..P
68 50 22 40 00 56 e8 05 fd ff ff 83 c4 0c b8 f8 hP"@.V..........
04 00 00 39 85 94 fa ff ff 75 56 66 83 bd 98 fa ...9.....uVf....
ff ff 04 75 4c 66 83 bd 9a fa ff ff 00 75 42 8d ...uLf.......uB.
8d 0c ff ff ff 51 8d 8d 8c fe ff ff 51 8d 8d 0c .....Q......Q...
fe ff ff 51 8d 8d ac fb ff ff 51 8d 8d 9c fb ff ...Q......Q.....
ff 51 8d 8d 1c fb ff ff 51 8d 8d 9c fa ff ff 51 .Q......Q......Q
50 68 08 21 40 00 56 e8 a4 fc ff ff 83 c4 28 eb Ph.!@.V.......(.
0f 50 68 80 20 40 00 56 e8 93 fc ff ff 83 c4 0c .Ph. @.V........
ff 45 6c 8b 45 6c 3b 45 64 0f 8c 5b fe ff ff 8b .El.El;Ed..[....
75 70 ff 75 68 ff 15 14 20 40 00 85 c0 74 12 ff up.uh... @...t..
d7 50 68 68 20 40 00 53 56 e8 62 fc ff ff 83 c4 .Phh @.SV.b.....
10 56 ff 15 10 20 40 00 85 c0 75 12 ff d7 50 68 .V... @...u...Ph
50 20 40 00 53 56 e8 45 fc ff ff 83 c4 10 ff 75 P @.SV.E.......u
74 ff 15 0c 20 40 00 cc 00 00 00 00 00 00 00 00 t... @..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
86 29 00 00 d2 29 00 00 1e 29 00 00 2e 29 00 00 .)...)...)...)..
3c 29 00 00 4a 29 00 00 56 29 00 00 66 29 00 00 <)..J)..V)..f)..
76 29 00 00 c2 29 00 00 9c 29 00 00 b0 29 00 00 v)...)...)...)..
00 00 00 00 08 29 00 00 00 00 00 00 f0 29 00 00 .....).......)..
00 00 00 00 12 2a 00 00 00 00 00 00 00 00 00 00 .....*..........
43 00 6c 00 6f 00 73 00 65 00 48 00 61 00 6e 00 C.l.o.s.e.H.a.n.
64 00 6c 00 65 00 00 00 4c 00 6f 00 63 00 61 00 d.l.e...L.o.c.a.
6c 00 46 00 72 00 65 00 65 00 00 00 00 00 00 00 l.F.r.e.e.......
53 00 69 00 7a 00 65 00 20 00 6f 00 66 00 20 00 S.i.z.e. .o.f. .
27 00 44 00 69 00 67 00 69 00 74 00 61 00 6c 00 '.D.i.g.i.t.a.l.
50 00 72 00 6f 00 64 00 75 00 63 00 74 00 49 00 P.r.o.d.u.c.t.I.
64 00 34 00 27 00 20 00 6e 00 6f 00 74 00 20 00 d.4.'. .n.o.t. .
65 00 71 00 75 00 61 00 6c 00 20 00 25 00 6c 00 e.q.u.a.l. .%.l.
75 00 20 00 6f 00 72 00 20 00 76 00 65 00 72 00 u. .o.r. .v.e.r.
73 00 69 00 6f 00 6e 00 20 00 6e 00 6f 00 74 00 s.i.o.n. .n.o.t.
20 00 65 00 71 00 75 00 61 00 6c 00 20 00 34 00 .e.q.u.a.l. .4.
2e 00 30 00 0a 00 00 00 0a 00 44 00 69 00 67 00 ..0.......D.i.g.
69 00 74 00 61 00 6c 00 50 00 72 00 6f 00 64 00 i.t.a.l.P.r.o.d.
75 00 63 00 74 00 49 00 64 00 34 00 3a 00 20 00 u.c.t.I.d.4.:. .
73 00 69 00 7a 00 65 00 20 00 3d 00 20 00 25 00 s.i.z.e. .=. .%.
6c 00 75 00 0a 00 09 00 41 00 64 00 76 00 61 00 l.u.....A.d.v.a.
6e 00 63 00 65 00 64 00 20 00 50 00 72 00 6f 00 n.c.e.d. .P.r.o.
64 00 75 00 63 00 74 00 20 00 49 00 44 00 3a 00 d.u.c.t. .I.D.:.
09 00 25 00 6c 00 73 00 0a 00 09 00 41 00 63 00 ..%.l.s.....A.c.
74 00 69 00 76 00 61 00 74 00 69 00 6f 00 6e 00 t.i.v.a.t.i.o.n.
20 00 49 00 44 00 3a 00 09 00 09 00 25 00 6c 00 .I.D.:.....%.l.
73 00 0a 00 09 00 4f 00 45 00 4d 00 20 00 49 00 s.....O.E.M. .I.
44 00 3a 00 09 00 09 00 09 00 25 00 6c 00 73 00 D.:.......%.l.s.
0a 00 09 00 45 00 64 00 69 00 74 00 69 00 6f 00 ....E.d.i.t.i.o.
6e 00 20 00 54 00 79 00 70 00 65 00 3a 00 09 00 n. .T.y.p.e.:...
09 00 25 00 6c 00 73 00 0a 00 09 00 45 00 64 00 ..%.l.s.....E.d.
69 00 74 00 69 00 6f 00 6e 00 20 00 49 00 44 00 i.t.i.o.n. .I.D.
3a 00 09 00 09 00 25 00 6c 00 73 00 0a 00 09 00 :.....%.l.s.....
4b 00 65 00 79 00 20 00 54 00 79 00 70 00 65 00 K.e.y. .T.y.p.e.
3a 00 09 00 09 00 25 00 6c 00 73 00 0a 00 09 00 :.....%.l.s.....
45 00 55 00 4c 00 41 00 3a 00 09 00 09 00 09 00 E.U.L.A.:.......
25 00 6c 00 73 00 0a 00 00 00 00 00 00 00 00 00 %.l.s...........
53 00 69 00 7a 00 65 00 20 00 6f 00 66 00 20 00 S.i.z.e. .o.f. .
27 00 44 00 69 00 67 00 69 00 74 00 61 00 6c 00 '.D.i.g.i.t.a.l.
50 00 72 00 6f 00 64 00 75 00 63 00 74 00 49 00 P.r.o.d.u.c.t.I.
64 00 27 00 20 00 6e 00 6f 00 74 00 20 00 65 00 d.'. .n.o.t. .e.
71 00 75 00 61 00 6c 00 20 00 25 00 6c 00 75 00 q.u.a.l. .%.l.u.
20 00 6f 00 72 00 20 00 76 00 65 00 72 00 73 00 .o.r. .v.e.r.s.
69 00 6f 00 6e 00 20 00 6e 00 6f 00 74 00 20 00 i.o.n. .n.o.t. .
65 00 71 00 75 00 61 00 6c 00 20 00 33 00 2e 00 e.q.u.a.l. .3...
30 00 0a 00 00 00 00 00 0a 00 44 00 69 00 67 00 0.........D.i.g.
69 00 74 00 61 00 6c 00 50 00 72 00 6f 00 64 00 i.t.a.l.P.r.o.d.
75 00 63 00 74 00 49 00 64 00 3a 00 20 00 73 00 u.c.t.I.d.:. .s.
69 00 7a 00 65 00 20 00 3d 00 20 00 25 00 6c 00 i.z.e. .=. .%.l.
75 00 0a 00 09 00 50 00 72 00 6f 00 64 00 75 00 u.....P.r.o.d.u.
63 00 74 00 20 00 49 00 44 00 3a 00 09 00 09 00 c.t. .I.D.:.....
25 00 68 00 73 00 0a 00 09 00 45 00 64 00 69 00 %.h.s.....E.d.i.
74 00 69 00 6f 00 6e 00 20 00 49 00 44 00 3a 00 t.i.o.n. .I.D.:.
09 00 09 00 25 00 68 00 73 00 0a 00 09 00 4f 00 ....%.h.s.....O.
45 00 4d 00 20 00 49 00 44 00 3a 00 09 00 09 00 E.M. .I.D.:.....
09 00 25 00 2e 00 38 00 68 00 73 00 0a 00 09 00 ..%...8.h.s.....
48 00 61 00 72 00 64 00 77 00 61 00 72 00 65 00 H.a.r.d.w.a.r.e.
20 00 49 00 44 00 20 00 28 00 73 00 74 00 61 00 .I.D. .(.s.t.a.
74 00 69 00 63 00 29 00 3a 00 09 00 25 00 2e 00 t.i.c.).:...%...
38 00 68 00 73 00 0a 00 09 00 48 00 61 00 72 00 8.h.s.....H.a.r.
64 00 77 00 61 00 72 00 65 00 20 00 49 00 44 00 d.w.a.r.e. .I.D.
20 00 28 00 64 00 79 00 6e 00 61 00 6d 00 69 00 .(.d.y.n.a.m.i.
63 00 29 00 3a 00 09 00 25 00 2e 00 38 00 68 00 c.).:...%...8.h.
73 00 0a 00 00 00 00 00 50 00 72 00 6f 00 64 00 s.......P.r.o.d.
75 00 63 00 74 00 20 00 6b 00 65 00 79 00 20 00 u.c.t. .k.e.y. .
27 00 25 00 6c 00 73 00 27 00 20 00 69 00 73 00 '.%.l.s.'. .i.s.
20 00 76 00 61 00 6c 00 69 00 64 00 21 00 0a 00 .v.a.l.i.d.!...
00 00 00 00 25 00 6c 00 73 00 28 00 29 00 20 00 ....%.l.s.(.). .
72 00 65 00 74 00 75 00 72 00 6e 00 65 00 64 00 r.e.t.u.r.n.e.d.
20 00 65 00 72 00 72 00 6f 00 72 00 20 00 30 00 .e.r.r.o.r. .0.
78 00 25 00 30 00 38 00 6c 00 58 00 0a 00 00 00 x.%.0.8.l.X.....
44 00 61 00 74 00 61 00 20 00 66 00 69 00 6c 00 D.a.t.a. .f.i.l.
65 00 20 00 27 00 25 00 6c 00 73 00 27 00 20 00 e. .'.%.l.s.'. .
6e 00 6f 00 74 00 20 00 66 00 6f 00 75 00 6e 00 n.o.t. .f.o.u.n.
64 00 21 00 0a 00 00 00 50 00 72 00 6f 00 64 00 d.!.....P.r.o.d.
75 00 63 00 74 00 20 00 6b 00 65 00 79 00 20 00 u.c.t. .k.e.y. .
27 00 25 00 6c 00 73 00 27 00 20 00 69 00 73 00 '.%.l.s.'. .i.s.
20 00 6d 00 61 00 6c 00 66 00 6f 00 72 00 6d 00 .m.a.l.f.o.r.m.
65 00 64 00 21 00 0a 00 00 00 00 00 50 00 72 00 e.d.!.......P.r.
6f 00 64 00 75 00 63 00 74 00 20 00 6b 00 65 00 o.d.u.c.t. .k.e.
79 00 20 00 27 00 25 00 6c 00 73 00 27 00 20 00 y. .'.%.l.s.'. .
69 00 73 00 20 00 69 00 6e 00 76 00 61 00 6c 00 i.s. .i.n.v.a.l.
69 00 64 00 21 00 0a 00 00 00 00 00 00 00 00 00 i.d.!...........
50 00 72 00 6f 00 64 00 75 00 63 00 74 00 20 00 P.r.o.d.u.c.t. .
6b 00 65 00 79 00 20 00 27 00 25 00 6c 00 73 00 k.e.y. .'.%.l.s.
27 00 20 00 69 00 73 00 20 00 72 00 65 00 73 00 '. .i.s. .r.e.s.
65 00 72 00 76 00 65 00 64 00 21 00 0a 00 00 00 e.r.v.e.d.!.....
44 00 55 00 4d 00 4d 00 59 00 00 00 00 00 00 00 D.U.M.M.Y.......
09 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 20 00 ..M.o.d.u.l.e. .
76 00 65 00 72 00 73 00 69 00 6f 00 6e 00 3a 00 v.e.r.s.i.o.n.:.
09 00 09 00 25 00 68 00 75 00 2e 00 25 00 68 00 ....%.h.u...%.h.
75 00 3a 00 25 00 68 00 75 00 2e 00 25 00 68 00 u.:.%.h.u...%.h.
75 00 0a 00 09 00 50 00 72 00 6f 00 64 00 75 00 u.....P.r.o.d.u.
63 00 74 00 20 00 76 00 65 00 72 00 73 00 69 00 c.t. .v.e.r.s.i.
6f 00 6e 00 3a 00 09 00 25 00 68 00 75 00 2e 00 o.n.:...%.h.u...
25 00 68 00 75 00 3a 00 25 00 68 00 75 00 2e 00 %.h.u.:.%.h.u...
25 00 68 00 75 00 0a 00 00 00 00 00 4c 00 6f 00 %.h.u.......L.o.
63 00 6b 00 52 00 65 00 73 00 6f 00 75 00 72 00 c.k.R.e.s.o.u.r.
63 00 65 00 28 00 29 00 20 00 72 00 65 00 74 00 c.e.(.). .r.e.t.
75 00 72 00 6e 00 65 00 64 00 20 00 4e 00 55 00 u.r.n.e.d. .N.U.
4c 00 4c 00 0a 00 00 00 4c 00 6f 00 61 00 64 00 L.L.....L.o.a.d.
52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 R.e.s.o.u.r.c.e.
00 00 00 00 46 00 69 00 6e 00 64 00 52 00 65 00 ....F.i.n.d.R.e.
73 00 6f 00 75 00 72 00 63 00 65 00 00 00 00 00 s.o.u.r.c.e.....
4d 00 6f 00 64 00 75 00 6c 00 65 00 20 00 27 00 M.o.d.u.l.e. .'.
25 00 6c 00 73 00 27 00 0a 00 00 00 47 00 65 00 %.l.s.'.....G.e.
74 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 46 00 t.M.o.d.u.l.e.F.
69 00 6c 00 65 00 4e 00 61 00 6d 00 65 00 00 00 i.l.e.N.a.m.e...
47 00 65 00 74 00 4d 00 6f 00 64 00 75 00 6c 00 G.e.t.M.o.d.u.l.
65 00 48 00 61 00 6e 00 64 00 6c 00 65 00 00 00 e.H.a.n.d.l.e...
50 00 69 00 64 00 47 00 65 00 6e 00 58 00 00 00 P.i.d.G.e.n.X...
42 00 61 00 64 00 20 00 61 00 72 00 67 00 75 00 B.a.d. .a.r.g.u.
6d 00 65 00 6e 00 74 00 73 00 3a 00 20 00 74 00 m.e.n.t.s.:. .t.
68 00 65 00 20 00 66 00 69 00 6c 00 65 00 20 00 h.e. .f.i.l.e. .
6f 00 72 00 20 00 70 00 61 00 74 00 68 00 20 00 o.r. .p.a.t.h. .
6e 00 61 00 6d 00 65 00 20 00 6f 00 66 00 20 00 n.a.m.e. .o.f. .
61 00 20 00 27 00 50 00 4b 00 65 00 79 00 43 00 a. .'.P.K.e.y.C.
6f 00 6e 00 66 00 69 00 67 00 5b 00 2a 00 5d 00 o.n.f.i.g.[.*.].
2e 00 78 00 72 00 6d 00 2d 00 6d 00 73 00 27 00 ..x.r.m.-.m.s.'.
20 00 64 00 61 00 74 00 61 00 20 00 66 00 69 00 .d.a.t.a. .f.i.
6c 00 65 00 20 00 70 00 6c 00 75 00 73 00 0a 00 l.e. .p.l.u.s...
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 61 00 . . . . . . .a.
74 00 20 00 6c 00 65 00 61 00 73 00 74 00 20 00 t. .l.e.a.s.t. .
6f 00 6e 00 65 00 20 00 70 00 72 00 6f 00 64 00 o.n.e. .p.r.o.d.
75 00 63 00 74 00 20 00 6b 00 65 00 79 00 20 00 u.c.t. .k.e.y. .
6d 00 75 00 73 00 74 00 20 00 62 00 65 00 20 00 m.u.s.t. .b.e. .
67 00 69 00 76 00 65 00 6e 00 21 00 0a 00 00 00 g.i.v.e.n.!.....
25 00 6c 00 73 00 28 00 29 00 20 00 72 00 65 00 %.l.s.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 65 00 t.u.r.n.e.d. .e.
72 00 72 00 6f 00 72 00 20 00 25 00 6c 00 75 00 r.r.o.r. .%.l.u.
0a 00 00 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 ....C.o.m.m.a.n.
64 00 4c 00 69 00 6e 00 65 00 54 00 6f 00 41 00 d.L.i.n.e.T.o.A.
72 00 67 00 76 00 00 00 f0 28 00 00 00 00 00 00 r.g.v....(......
00 00 00 00 12 29 00 00 34 20 00 00 bc 28 00 00 .....)..4 ...(..
00 00 00 00 00 00 00 00 e2 29 00 00 00 20 00 00 .........)... ..
f8 28 00 00 00 00 00 00 00 00 00 00 06 2a 00 00 .(...........*..
3c 20 00 00 00 29 00 00 00 00 00 00 00 00 00 00 < ...)..........
20 2a 00 00 44 20 00 00 00 00 00 00 00 00 00 00 *..D ..........
00 00 00 00 00 00 00 00 00 00 00 00 86 29 00 00 .............)..
d2 29 00 00 1e 29 00 00 2e 29 00 00 3c 29 00 00 .)...)...)..<)..
4a 29 00 00 56 29 00 00 66 29 00 00 76 29 00 00 J)..V)..f)..v)..
c2 29 00 00 9c 29 00 00 b0 29 00 00 00 00 00 00 .)...)...)......
08 29 00 00 00 00 00 00 f0 29 00 00 00 00 00 00 .).......)......
12 2a 00 00 00 00 00 00 00 00 50 69 64 47 65 6e .*........PidGen
58 00 50 49 44 47 45 4e 58 2e 64 6c 6c 00 24 05 X.PIDGENX.dll.$.
57 72 69 74 65 43 6f 6e 73 6f 6c 65 57 00 19 01 WriteConsoleW...
45 78 69 74 50 72 6f 63 65 73 73 00 52 00 43 6c ExitProcess.R.Cl
6f 73 65 48 61 6e 64 6c 65 00 48 03 4c 6f 63 61 oseHandle.H.Loca
6c 46 72 65 65 00 54 03 4c 6f 63 6b 52 65 73 6f lFree.T.LockReso
75 72 63 65 00 00 41 03 4c 6f 61 64 52 65 73 6f urce..A.LoadReso
75 72 63 65 00 00 4e 01 46 69 6e 64 52 65 73 6f urce..N.FindReso
75 72 63 65 57 00 14 02 47 65 74 4d 6f 64 75 6c urceW...GetModul
65 46 69 6c 65 4e 61 6d 65 57 00 00 18 02 47 65 eFileNameW....Ge
74 4d 6f 64 75 6c 65 48 61 6e 64 6c 65 57 00 00 tModuleHandleW..
87 01 47 65 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 ..GetCommandLine
57 00 02 02 47 65 74 4c 61 73 74 45 72 72 6f 72 W...GetLastError
00 00 64 02 47 65 74 53 74 64 48 61 6e 64 6c 65 ..d.GetStdHandle
00 00 4b 45 52 4e 45 4c 33 32 2e 64 6c 6c 00 00 ..KERNEL32.dll..
06 00 43 6f 6d 6d 61 6e 64 4c 69 6e 65 54 6f 41 ..CommandLineToA
72 67 76 57 00 00 53 48 45 4c 4c 33 32 2e 64 6c rgvW..SHELL32.dl
6c 00 35 03 77 76 73 70 72 69 6e 74 66 57 00 00 l.5.wvsprintfW..
55 53 45 52 33 32 2e 64 6c 6c 00 00 00 00 00 00 USER32.dll......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file PIDGENX.TXT
created in
step 4. to recreate the console application
Product Key Validator:
CERTUTIL.EXE /DecodeHex /V PIDGENX.TXT PIDGENX.COM
Input Length = 19584 Output Length = 4608 CertUtil: -decodehex command completed successfully.
Overwrite the text file PIDGENX.C
with the following
content:
// Copyright © 2004-2023, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <shellapi.h>
#ifndef LOAD_LIBRARY_SAFE_CURRENT_DIRS
#define LOAD_LIBRARY_SAFE_CURRENT_DIRS 0x00002000UL
#endif
#ifndef E_FILENOTFOUND
#define E_FILENOTFOUND 0x80070002L // file not found
#endif
#ifndef E_PATHNOTFOUND
#define E_PATHNOTFOUND 0x80070003L // path not found
#endif
#ifndef E_RESERVEDKEY
#define E_RESERVEDKEY 0x8A010001L // reserved product key
#endif
#ifndef E_INVALIDKEY
#define E_INVALIDKEY 0x8A010101L // invalid product key
#endif
#define VS_BINARY 0U
#define VS_TEXT 1U
typedef struct _VS_VERSIONINFO
{
WORD wSize; // size of 'VERSION' resource
WORD wCount; // = sizeof(VS_FIXEDFILEINFO)
// (number of bytes in binary value)
WORD wType; // = VS_BINARY
WCHAR szKey[16]; // = L"VS_VERSION_INFO"
WORD wPadding; // = 0 (alignment to DWORD)
VS_FIXEDFILEINFO vsFFI;
} VS_VERSIONINFO;
typedef struct _DigitalProductId
{
DWORD dwSize; // 0x000000A4 = 164
WORD wMajorVersion; // 0x0003
WORD wMinorVersion; // 0x0000
CHAR szProductId[24]; // "DUMMY-OEM-0123456-78901"
DWORD dwKeyIdx;
CHAR szEditionId[16];
BYTE bCdKey[16];
DWORD dwCloneStatus;
DWORD dwTime;
DWORD dwRandom;
DWORD dwLt;
DWORD dwLicenseData[2];
CHAR sOemId[8];
DWORD dwBundleId;
CHAR sHardwareIdStatic[8];
DWORD dwHardwareIdTypeStatic;
DWORD dwBiosChecksumStatic;
DWORD dwVolumeSerialStatic;
DWORD dwTotalRamStatic;
DWORD dwVideoBiosChecksumStatic;
CHAR sHardwareIdDynamic[8];
DWORD dwHardwareIdTypeDynamic;
DWORD dwBiosChecksumDynamic;
DWORD dwVolumeSerialDynamic;
DWORD dwTotalRamDynamic;
DWORD dwVideoBiosChecksumDynamic;
DWORD dwCRC32;
} DPI, *LPDPI;
typedef struct _DigitalProductId4
{
DWORD dwSize; // 0x000004F8 = 1272
WORD wMajorVersion; // 0x0004
WORD wMinorVersion; // 0x0000
WCHAR szAdvancedPid[64];
WCHAR szActivationId[64];
WCHAR szOemId[8];
WCHAR szEditionType[260];
BYTE bIsUpgrade;
BYTE bReserved[7];
BYTE bCdKey[16];
BYTE bCdKey256Hash[32];
BYTE b256Hash[32];
WCHAR szEditionId[64];
WCHAR szKeyType[64];
WCHAR szEULA[64];
} DPI4, *LPDPI4;
typedef HRESULT (WINAPI PIDGENX) (LPCWSTR lpProductKey,
LPCWSTR lpPKeyConfig,
LPCWSTR lpMPC,
LPCWSTR lpOEMId,
LPCWSTR lpProductId,
LPDPI lpDigitalProductId,
LPDPI4 lpDigitalProductId4);
__declspec(safebuffers)
BOOL PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
DWORD dwBuffer;
DWORD dwConsole;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
if (!WriteConsole(hConsole, szBuffer, dwBuffer, &dwConsole, NULL))
return FALSE;
return dwConsole == dwBuffer;
}
__declspec(noreturn)
VOID WINAPI wmainCRTStartup(VOID)
{
VS_VERSIONINFO *lpVersion;
LPWSTR *lpArguments;
INT nArguments;
INT nArgument = 3;
DWORD dwError = ERROR_BAD_ARGUMENTS;
WCHAR szPid[24];
DPI dpi;
DPI4 dpi4;
HMODULE hPidGenX;
FARPROC fpPidGenX;
HRESULT hr;
HRSRC hResInfo;
HGLOBAL hResData;
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole == INVALID_HANDLE_VALUE)
dwError = GetLastError();
else
{
lpArguments = CommandLineToArgvW(GetCommandLine(), &nArguments);
if (lpArguments == NULL)
PrintConsole(hConsole,
L"CommandLineToArgv() returned error %lu\n",
dwError = GetLastError());
else
{
if (nArguments < 4)
PrintConsole(hConsole,
L"Bad arguments: the (absolute or relative) path names of a \'PidGenX.dll\' and\n"
L" its associated \'PKeyConfig[*].xrm-ms\' data file plus at least\n"
L" one product key \'23467-89BCD-FGHJK-MNPQR-TVWXY\' must be given!\n");
else
{
hPidGenX = LoadLibraryEx(lpArguments[1], (HANDLE) NULL, LOAD_LIBRARY_SAFE_CURRENT_DIRS);
if (hPidGenX == NULL)
PrintConsole(hConsole,
L"LoadLibraryEx() returned error %lu\n",
dwError = GetLastError());
else
{
fpPidGenX = GetProcAddress(hPidGenX, "PidGenX");
if (fpPidGenX == NULL)
PrintConsole(hConsole,
L"GetProcAddress() returned error %lu\n",
dwError = GetLastError());
else
{
hResInfo = FindResource(hPidGenX, MAKEINTRESOURCE(VS_VERSION_INFO), RT_VERSION);
if (hResInfo == NULL)
PrintConsole(hConsole,
L"FindResource() returned error %lu\n",
dwError = GetLastError());
else
{
hResData = LoadResource(hPidGenX, hResInfo);
if (hResData == NULL)
PrintConsole(hConsole,
L"LoadResource() returned error %lu\n",
dwError = GetLastError());
else
{
lpVersion = LockResource(hResData);
if (lpVersion == NULL)
PrintConsole(hConsole,
L"LockResource() returned NULL\n");
else
PrintConsole(hConsole,
L"Library version = %hu.%hu:%hu.%hu\n"
L"Product version = %hu.%hu:%hu.%hu\n",
HIWORD(lpVersion->vsFFI.dwFileVersionMS), LOWORD(lpVersion->vsFFI.dwFileVersionMS),
HIWORD(lpVersion->vsFFI.dwFileVersionLS), LOWORD(lpVersion->vsFFI.dwFileVersionLS),
HIWORD(lpVersion->vsFFI.dwProductVersionMS), LOWORD(lpVersion->vsFFI.dwProductVersionMS),
HIWORD(lpVersion->vsFFI.dwProductVersionLS), LOWORD(lpVersion->vsFFI.dwProductVersionLS));
}
}
dpi.dwSize = sizeof(dpi);
dpi4.dwSize = sizeof(dpi4);
do
{
hr = ((PIDGENX *) fpPidGenX)(lpArguments[nArgument],
lpArguments[2],
L"DUMMY",
(LPCWSTR) NULL,
szPid,
&dpi,
&dpi4);
switch (hr)
{
case ERROR_FILE_NOT_FOUND:
case ERROR_PATH_NOT_FOUND:
case E_FILENOTFOUND: // file 'PKeyConfig.xrm-ms' not found
case E_PATHNOTFOUND: // path of 'PKeyConfig.xrm-ms' not found
PrintConsole(hConsole,
L"Data file \'%ls\' not found!\n",
lpArguments[2]);
nArguments = 0;
break;
case ERROR_INVALID_PARAMETER:
case E_INVALIDARG: // malformed product key
PrintConsole(hConsole,
L"Product key \'%ls\' is malformed!\n",
lpArguments[nArgument]);
break;
case E_RESERVEDKEY: // reserved product key
PrintConsole(hConsole,
L"Product key \'%ls\' is reserved!\n",
lpArguments[nArgument]);
break;
case E_INVALIDKEY: // invalid product key
PrintConsole(hConsole,
L"Product key \'%ls\' is invalid!\n",
lpArguments[nArgument]);
break;
case S_OK:
PrintConsole(hConsole,
L"Product key \'%ls\' is valid!\n",
lpArguments[nArgument]);
#ifdef VERBOSE
if ((dpi.dwSize != sizeof(dpi))
|| (dpi.wMajorVersion != 3)
|| (dpi.wMinorVersion != 0))
PrintConsole(hConsole,
L"Size of \'DigitalProductId\' not equal %lu or version not equal 3.0\n",
sizeof(dpi));
else
PrintConsole(hConsole,
L"\n"
L"DigitalProductId: size = %lu\n"
L"\tProduct ID:\t\t%hs\n"
L"\tEdition ID:\t\t%hs\n"
L"\tOEM ID:\t\t\t%.8hs\n"
L"\tHardware ID (static):\t%.8hs\n"
L"\tHardware ID (dynamic):\t%.8hs\n",
dpi.dwSize,
dpi.szProductId,
dpi.szEditionId,
dpi.sOemId,
dpi.sHardwareIdStatic,
dpi.sHardwareIdDynamic);
if ((dpi4.dwSize != sizeof(dpi4))
|| (dpi4.wMajorVersion != 4)
|| (dpi4.wMinorVersion != 0))
PrintConsole(hConsole,
L"Size of \'DigitalProductId4\' not equal %lu or version not equal 4.0\n",
sizeof(dpi4));
else
PrintConsole(hConsole,
L"\n"
L"DigitalProductId4: size = %lu\n"
L"\tAdvanced Product ID:\t%ls\n"
L"\tActivation ID:\t\t%ls\n"
L"\tOEM ID:\t\t\t%ls\n"
L"\tEdition Type:\t\t%ls\n"
L"\tEdition ID:\t\t%ls\n"
L"\tKey Type:\t\t%ls\n"
L"\tEULA:\t\t\t%ls\n",
dpi4.dwSize,
dpi4.szAdvancedPid,
dpi4.szActivationId,
dpi4.szOemId,
dpi4.szEditionType,
dpi4.szEditionId,
dpi4.szKeyType,
dpi4.szEULA);
#endif
break;
default:
PrintConsole(hConsole,
L"PidGenX() returned error 0x%08lX\n",
dwError = hr);
}
} while (++nArgument < nArguments);
}
if (!FreeLibrary(hPidGenX))
PrintConsole(hConsole,
L"FreeLibrary() returned error %lu\n",
GetLastError());
}
}
if (LocalFree(lpArguments) != NULL)
PrintConsole(hConsole,
L"LocalFree() returned error %lu\n",
GetLastError());
}
if (!CloseHandle(hConsole))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
ExitProcess(dwError);
}
Run the following four command lines to compile the source file
PIDGENX.C
created in step 1., link the compiled
object file PIDGENX.OBJ
and cleanup afterwards:
SET CL=/DVERBOSE /GA /GF /GS /Gy /O1 /Oi /Os /Oy /W4 /Zl SET LINK=/DEFAULTLIB:KERNEL32.LIB /DEFAULTLIB:SHELL32.LIB /DEFAULTLIB:USER32.LIB /ENTRY:wmainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /OSVERSION:5.0 /RELEASE /SUBSYSTEM:CONSOLE /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /FePIDGENX.COM PIDGENX.C ERASE PIDGENX.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. PIDGENX.C Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Create the text file PIDGENX.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 33 2c 20 53 74 65 66 61 6e 20 4b 61 -2023, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 02 00 56 4f 49 44 00 00 00 00 PE..L...VOID....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 04 00 00 ......#.........
00 0c 00 00 00 00 00 00 4e 10 00 00 00 10 00 00 ........N.......
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
05 00 00 00 00 00 2f 03 05 00 00 00 00 00 00 00 ....../.........
00 30 00 00 00 02 00 00 32 00 01 00 03 00 00 85 .0......2.......
00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
10 29 00 00 50 00 00 00 00 00 00 00 00 00 00 00 .)..P...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 ......... ..H...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
d9 03 00 00 00 10 00 00 00 04 00 00 00 02 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 63 6f 6e 73 74 00 00 be 0a 00 00 00 20 00 00 .const....... ..
00 0c 00 00 00 06 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 ....@..@........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
55 8b ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 U........V.E.P.u
0c 8d 85 f8 f7 ff ff 50 ff 15 40 20 40 00 8b f0 .......P..@ @...
85 f6 75 04 33 c0 eb 23 6a 00 8d 45 fc 50 56 8d ..u.3..#j..E.PV.
85 f8 f7 ff ff 50 ff 75 08 ff 15 00 20 40 00 85 .....P.u.... @..
c0 74 e1 33 c0 39 75 fc 0f 94 c0 5e c9 c3 55 8d .t.3.9u....^..U.
6c 24 88 81 ec e8 05 00 00 53 56 57 6a f4 c7 45 l$.......SVWj..E
6c 03 00 00 00 c7 45 74 a0 00 00 00 ff 15 30 20 l.....Et......0
40 00 8b f0 89 75 70 83 fe ff 75 0e ff 15 2c 20 @....up...u...,
40 00 89 45 74 e9 45 03 00 00 8d 45 64 50 ff 15 @..Et.E....EdP..
28 20 40 00 50 ff 15 38 20 40 00 8b 3d 2c 20 40 ( @.P..8 @..=, @
00 89 45 68 85 c0 75 15 ff d7 50 89 45 74 68 ec ..Eh..u...P.Eth.
28 40 00 bb b8 28 40 00 e9 eb 02 00 00 83 7d 64 (@...(@.......}d
04 bb b8 28 40 00 7d 12 68 e8 26 40 00 56 e8 2d ...(@.}.h.&@.V.-
ff ff ff 59 59 e9 b9 02 00 00 68 00 20 00 00 6a ...YY.....h. ..j
00 ff 70 04 ff 15 24 20 40 00 89 45 60 85 c0 75 ..p...$ @..E`..u
10 ff d7 50 89 45 74 68 c8 26 40 00 e9 88 02 00 ...P.Eth.&@.....
00 68 c0 26 40 00 50 ff 15 20 20 40 00 89 45 5c .h.&@.P.. @..E\
85 c0 75 1a ff d7 50 68 a0 26 40 00 53 56 89 45 ..u...Ph.&@.SV.E
74 e8 da fe ff ff 83 c4 10 e9 46 02 00 00 6a 10 t.........F...j.
6a 01 ff 75 60 ff 15 1c 20 40 00 85 c0 75 0a ff j..u`... @...u..
d7 50 68 84 26 40 00 eb 16 50 ff 75 60 ff 15 18 .Ph.&@...P.u`...
20 40 00 85 c0 75 17 ff d7 50 68 68 26 40 00 53 @...u...Phh&@.S
56 89 45 74 e8 97 fe ff ff 83 c4 10 eb 50 50 ff V.Et.........PP.
15 14 20 40 00 85 c0 75 0f 68 2c 26 40 00 56 e8 .. @...u.h,&@.V.
7c fe ff ff 59 59 eb 36 0f b7 48 3c 51 0f b7 48 |...YY.6..H<Q..H
3e 51 0f b7 48 38 51 0f b7 48 3a 51 0f b7 48 34 >Q..H8Q..H:Q..H4
51 0f b7 48 36 51 0f b7 48 30 0f b7 40 32 51 50 Q..H6Q..H0..@2QP
68 a0 25 40 00 56 e8 45 fe ff ff 83 c4 28 c7 45 h.%@.V.E.....(.E
b8 a4 00 00 00 c7 85 90 fa ff ff f8 04 00 00 8b ................
45 68 8b 4d 6c 8d 34 88 8d 85 90 fa ff ff 50 8d Eh.Ml.4.......P.
45 b8 50 8d 45 88 50 8b 45 68 6a 00 68 90 25 40 E.P.E.P.Ehj.h.%@
00 ff 70 08 ff 36 ff 55 5c b9 01 01 01 8a 3b c1 ..p..6.U\.....;.
7f 36 74 2b 3d 02 00 07 80 7c 68 3d 03 00 07 80 .6t+=....|h=....
7e 42 3d 57 00 07 80 74 32 3d 01 00 01 8a 75 53 ~B=W...t2=....uS
ff 36 68 50 25 40 00 ff 75 70 e9 2b 01 00 00 ff .6hP%@..up.+....
36 68 0c 25 40 00 eb ef 85 c0 74 55 83 f8 01 7e 6h.%@.....tU...~
32 83 f8 03 7e 0e 83 f8 57 75 28 ff 36 68 c8 24 2...~...Wu(.6h.$
40 00 eb d3 8b 45 68 ff 70 08 68 90 24 40 00 ff @....Eh.p.h.$@..
75 70 e8 99 fd ff ff 83 c4 0c 83 65 64 00 e9 ef up.........ed...
00 00 00 50 68 80 24 40 00 68 44 24 40 00 ff 75 ...Ph.$@.hD$@..u
70 89 45 74 e8 77 fd ff ff 83 c4 10 e9 d1 00 00 p.Et.w..........
00 ff 36 8b 75 70 68 08 24 40 00 56 e8 5f fd ff ..6.uph.$@.V._..
ff b8 a4 00 00 00 83 c4 0c 39 45 b8 75 33 66 83 .........9E.u3f.
7d bc 03 75 2c 66 83 7d be 00 75 25 8d 4d 3c 51 }..u,f.}..u%.M<Q
8d 4d 20 51 8d 4d 14 51 8d 4d dc 51 8d 4d c0 51 .M Q.M.Q.M.Q.M.Q
50 68 e8 22 40 00 56 e8 24 fd ff ff 83 c4 20 eb Ph."@.V.$..... .
0f 50 68 60 22 40 00 56 e8 13 fd ff ff 83 c4 0c .Ph`"@.V........
b8 f8 04 00 00 39 85 90 fa ff ff 75 56 66 83 bd .....9.....uVf..
94 fa ff ff 04 75 4c 66 83 bd 96 fa ff ff 00 75 .....uLf.......u
42 8d 8d 08 ff ff ff 51 8d 8d 88 fe ff ff 51 8d B......Q......Q.
8d 08 fe ff ff 51 8d 8d a8 fb ff ff 51 8d 8d 98 .....Q......Q...
fb ff ff 51 8d 8d 18 fb ff ff 51 8d 8d 98 fa ff ...Q......Q.....
ff 51 50 68 18 21 40 00 56 e8 b2 fc ff ff 83 c4 .QPh.!@.V.......
28 eb 0f 50 68 90 20 40 00 56 e8 a1 fc ff ff 83 (..Ph. @.V......
c4 0c ff 45 6c 8b 45 6c 3b 45 64 0f 8c 5e fe ff ...El.El;Ed..^..
ff 8b 75 70 ff 75 60 ff 15 10 20 40 00 85 c0 75 ..up.u`... @...u
12 ff d7 50 68 74 20 40 00 53 56 e8 70 fc ff ff ...Pht @.SV.p...
83 c4 10 ff 75 68 ff 15 0c 20 40 00 85 c0 74 12 ....uh... @...t.
ff d7 50 68 60 20 40 00 53 56 e8 51 fc ff ff 83 ..Ph` @.SV.Q....
c4 10 56 ff 15 08 20 40 00 85 c0 75 12 ff d7 50 ..V... @...u...P
68 48 20 40 00 53 56 e8 34 fc ff ff 83 c4 10 ff hH @.SV.4.......
75 74 ff 15 04 20 40 00 cc 00 00 00 00 00 00 00 ut... @.........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
a8 29 00 00 b8 29 00 00 c6 29 00 00 d4 29 00 00 .)...)...)...)..
e0 29 00 00 ee 29 00 00 fe 29 00 00 0e 2a 00 00 .)...)...)...*..
1e 2a 00 00 30 2a 00 00 42 2a 00 00 54 2a 00 00 .*..0*..B*..T*..
64 2a 00 00 00 00 00 00 82 2a 00 00 00 00 00 00 d*.......*......
a4 2a 00 00 00 00 00 00 43 00 6c 00 6f 00 73 00 .*......C.l.o.s.
65 00 48 00 61 00 6e 00 64 00 6c 00 65 00 00 00 e.H.a.n.d.l.e...
4c 00 6f 00 63 00 61 00 6c 00 46 00 72 00 65 00 L.o.c.a.l.F.r.e.
65 00 00 00 46 00 72 00 65 00 65 00 4c 00 69 00 e...F.r.e.e.L.i.
62 00 72 00 61 00 72 00 79 00 00 00 00 00 00 00 b.r.a.r.y.......
53 00 69 00 7a 00 65 00 20 00 6f 00 66 00 20 00 S.i.z.e. .o.f. .
27 00 44 00 69 00 67 00 69 00 74 00 61 00 6c 00 '.D.i.g.i.t.a.l.
50 00 72 00 6f 00 64 00 75 00 63 00 74 00 49 00 P.r.o.d.u.c.t.I.
64 00 34 00 27 00 20 00 6e 00 6f 00 74 00 20 00 d.4.'. .n.o.t. .
65 00 71 00 75 00 61 00 6c 00 20 00 25 00 6c 00 e.q.u.a.l. .%.l.
75 00 20 00 6f 00 72 00 20 00 76 00 65 00 72 00 u. .o.r. .v.e.r.
73 00 69 00 6f 00 6e 00 20 00 6e 00 6f 00 74 00 s.i.o.n. .n.o.t.
20 00 65 00 71 00 75 00 61 00 6c 00 20 00 34 00 .e.q.u.a.l. .4.
2e 00 30 00 0a 00 00 00 0a 00 44 00 69 00 67 00 ..0.......D.i.g.
69 00 74 00 61 00 6c 00 50 00 72 00 6f 00 64 00 i.t.a.l.P.r.o.d.
75 00 63 00 74 00 49 00 64 00 34 00 3a 00 20 00 u.c.t.I.d.4.:. .
73 00 69 00 7a 00 65 00 20 00 3d 00 20 00 25 00 s.i.z.e. .=. .%.
6c 00 75 00 0a 00 09 00 41 00 64 00 76 00 61 00 l.u.....A.d.v.a.
6e 00 63 00 65 00 64 00 20 00 50 00 72 00 6f 00 n.c.e.d. .P.r.o.
64 00 75 00 63 00 74 00 20 00 49 00 44 00 3a 00 d.u.c.t. .I.D.:.
09 00 25 00 6c 00 73 00 0a 00 09 00 41 00 63 00 ..%.l.s.....A.c.
74 00 69 00 76 00 61 00 74 00 69 00 6f 00 6e 00 t.i.v.a.t.i.o.n.
20 00 49 00 44 00 3a 00 09 00 09 00 25 00 6c 00 .I.D.:.....%.l.
73 00 0a 00 09 00 4f 00 45 00 4d 00 20 00 49 00 s.....O.E.M. .I.
44 00 3a 00 09 00 09 00 09 00 25 00 6c 00 73 00 D.:.......%.l.s.
0a 00 09 00 45 00 64 00 69 00 74 00 69 00 6f 00 ....E.d.i.t.i.o.
6e 00 20 00 54 00 79 00 70 00 65 00 3a 00 09 00 n. .T.y.p.e.:...
09 00 25 00 6c 00 73 00 0a 00 09 00 45 00 64 00 ..%.l.s.....E.d.
69 00 74 00 69 00 6f 00 6e 00 20 00 49 00 44 00 i.t.i.o.n. .I.D.
3a 00 09 00 09 00 25 00 6c 00 73 00 0a 00 09 00 :.....%.l.s.....
4b 00 65 00 79 00 20 00 54 00 79 00 70 00 65 00 K.e.y. .T.y.p.e.
3a 00 09 00 09 00 25 00 6c 00 73 00 0a 00 09 00 :.....%.l.s.....
45 00 55 00 4c 00 41 00 3a 00 09 00 09 00 09 00 E.U.L.A.:.......
25 00 6c 00 73 00 0a 00 00 00 00 00 00 00 00 00 %.l.s...........
53 00 69 00 7a 00 65 00 20 00 6f 00 66 00 20 00 S.i.z.e. .o.f. .
27 00 44 00 69 00 67 00 69 00 74 00 61 00 6c 00 '.D.i.g.i.t.a.l.
50 00 72 00 6f 00 64 00 75 00 63 00 74 00 49 00 P.r.o.d.u.c.t.I.
64 00 27 00 20 00 6e 00 6f 00 74 00 20 00 65 00 d.'. .n.o.t. .e.
71 00 75 00 61 00 6c 00 20 00 25 00 6c 00 75 00 q.u.a.l. .%.l.u.
20 00 6f 00 72 00 20 00 76 00 65 00 72 00 73 00 .o.r. .v.e.r.s.
69 00 6f 00 6e 00 20 00 6e 00 6f 00 74 00 20 00 i.o.n. .n.o.t. .
65 00 71 00 75 00 61 00 6c 00 20 00 33 00 2e 00 e.q.u.a.l. .3...
30 00 0a 00 00 00 00 00 0a 00 44 00 69 00 67 00 0.........D.i.g.
69 00 74 00 61 00 6c 00 50 00 72 00 6f 00 64 00 i.t.a.l.P.r.o.d.
75 00 63 00 74 00 49 00 64 00 3a 00 20 00 73 00 u.c.t.I.d.:. .s.
69 00 7a 00 65 00 20 00 3d 00 20 00 25 00 6c 00 i.z.e. .=. .%.l.
75 00 0a 00 09 00 50 00 72 00 6f 00 64 00 75 00 u.....P.r.o.d.u.
63 00 74 00 20 00 49 00 44 00 3a 00 09 00 09 00 c.t. .I.D.:.....
25 00 68 00 73 00 0a 00 09 00 45 00 64 00 69 00 %.h.s.....E.d.i.
74 00 69 00 6f 00 6e 00 20 00 49 00 44 00 3a 00 t.i.o.n. .I.D.:.
09 00 09 00 25 00 68 00 73 00 0a 00 09 00 4f 00 ....%.h.s.....O.
45 00 4d 00 20 00 49 00 44 00 3a 00 09 00 09 00 E.M. .I.D.:.....
09 00 25 00 2e 00 38 00 68 00 73 00 0a 00 09 00 ..%...8.h.s.....
48 00 61 00 72 00 64 00 77 00 61 00 72 00 65 00 H.a.r.d.w.a.r.e.
20 00 49 00 44 00 20 00 28 00 73 00 74 00 61 00 .I.D. .(.s.t.a.
74 00 69 00 63 00 29 00 3a 00 09 00 25 00 2e 00 t.i.c.).:...%...
38 00 68 00 73 00 0a 00 09 00 48 00 61 00 72 00 8.h.s.....H.a.r.
64 00 77 00 61 00 72 00 65 00 20 00 49 00 44 00 d.w.a.r.e. .I.D.
20 00 28 00 64 00 79 00 6e 00 61 00 6d 00 69 00 .(.d.y.n.a.m.i.
63 00 29 00 3a 00 09 00 25 00 2e 00 38 00 68 00 c.).:...%...8.h.
73 00 0a 00 00 00 00 00 50 00 72 00 6f 00 64 00 s.......P.r.o.d.
75 00 63 00 74 00 20 00 6b 00 65 00 79 00 20 00 u.c.t. .k.e.y. .
27 00 25 00 6c 00 73 00 27 00 20 00 69 00 73 00 '.%.l.s.'. .i.s.
20 00 76 00 61 00 6c 00 69 00 64 00 21 00 0a 00 .v.a.l.i.d.!...
00 00 00 00 25 00 6c 00 73 00 28 00 29 00 20 00 ....%.l.s.(.). .
72 00 65 00 74 00 75 00 72 00 6e 00 65 00 64 00 r.e.t.u.r.n.e.d.
20 00 65 00 72 00 72 00 6f 00 72 00 20 00 30 00 .e.r.r.o.r. .0.
78 00 25 00 30 00 38 00 6c 00 58 00 0a 00 00 00 x.%.0.8.l.X.....
50 00 69 00 64 00 47 00 65 00 6e 00 58 00 00 00 P.i.d.G.e.n.X...
44 00 61 00 74 00 61 00 20 00 66 00 69 00 6c 00 D.a.t.a. .f.i.l.
65 00 20 00 27 00 25 00 6c 00 73 00 27 00 20 00 e. .'.%.l.s.'. .
6e 00 6f 00 74 00 20 00 66 00 6f 00 75 00 6e 00 n.o.t. .f.o.u.n.
64 00 21 00 0a 00 00 00 50 00 72 00 6f 00 64 00 d.!.....P.r.o.d.
75 00 63 00 74 00 20 00 6b 00 65 00 79 00 20 00 u.c.t. .k.e.y. .
27 00 25 00 6c 00 73 00 27 00 20 00 69 00 73 00 '.%.l.s.'. .i.s.
20 00 6d 00 61 00 6c 00 66 00 6f 00 72 00 6d 00 .m.a.l.f.o.r.m.
65 00 64 00 21 00 0a 00 00 00 00 00 50 00 72 00 e.d.!.......P.r.
6f 00 64 00 75 00 63 00 74 00 20 00 6b 00 65 00 o.d.u.c.t. .k.e.
79 00 20 00 27 00 25 00 6c 00 73 00 27 00 20 00 y. .'.%.l.s.'. .
69 00 73 00 20 00 69 00 6e 00 76 00 61 00 6c 00 i.s. .i.n.v.a.l.
69 00 64 00 21 00 0a 00 00 00 00 00 00 00 00 00 i.d.!...........
50 00 72 00 6f 00 64 00 75 00 63 00 74 00 20 00 P.r.o.d.u.c.t. .
6b 00 65 00 79 00 20 00 27 00 25 00 6c 00 73 00 k.e.y. .'.%.l.s.
27 00 20 00 69 00 73 00 20 00 72 00 65 00 73 00 '. .i.s. .r.e.s.
65 00 72 00 76 00 65 00 64 00 21 00 0a 00 00 00 e.r.v.e.d.!.....
44 00 55 00 4d 00 4d 00 59 00 00 00 00 00 00 00 D.U.M.M.Y.......
4c 00 69 00 62 00 72 00 61 00 72 00 79 00 20 00 L.i.b.r.a.r.y. .
76 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 v.e.r.s.i.o.n. .
3d 00 20 00 25 00 68 00 75 00 2e 00 25 00 68 00 =. .%.h.u...%.h.
75 00 3a 00 25 00 68 00 75 00 2e 00 25 00 68 00 u.:.%.h.u...%.h.
75 00 0a 00 50 00 72 00 6f 00 64 00 75 00 63 00 u...P.r.o.d.u.c.
74 00 20 00 76 00 65 00 72 00 73 00 69 00 6f 00 t. .v.e.r.s.i.o.
6e 00 20 00 3d 00 20 00 25 00 68 00 75 00 2e 00 n. .=. .%.h.u...
25 00 68 00 75 00 3a 00 25 00 68 00 75 00 2e 00 %.h.u.:.%.h.u...
25 00 68 00 75 00 0a 00 00 00 00 00 4c 00 6f 00 %.h.u.......L.o.
63 00 6b 00 52 00 65 00 73 00 6f 00 75 00 72 00 c.k.R.e.s.o.u.r.
63 00 65 00 28 00 29 00 20 00 72 00 65 00 74 00 c.e.(.). .r.e.t.
75 00 72 00 6e 00 65 00 64 00 20 00 4e 00 55 00 u.r.n.e.d. .N.U.
4c 00 4c 00 0a 00 00 00 4c 00 6f 00 61 00 64 00 L.L.....L.o.a.d.
52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 R.e.s.o.u.r.c.e.
00 00 00 00 46 00 69 00 6e 00 64 00 52 00 65 00 ....F.i.n.d.R.e.
73 00 6f 00 75 00 72 00 63 00 65 00 00 00 00 00 s.o.u.r.c.e.....
47 00 65 00 74 00 50 00 72 00 6f 00 63 00 41 00 G.e.t.P.r.o.c.A.
64 00 64 00 72 00 65 00 73 00 73 00 00 00 00 00 d.d.r.e.s.s.....
50 69 64 47 65 6e 58 00 4c 00 6f 00 61 00 64 00 PidGenX.L.o.a.d.
4c 00 69 00 62 00 72 00 61 00 72 00 79 00 45 00 L.i.b.r.a.r.y.E.
78 00 00 00 00 00 00 00 42 00 61 00 64 00 20 00 x.......B.a.d. .
61 00 72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 a.r.g.u.m.e.n.t.
73 00 3a 00 20 00 74 00 68 00 65 00 20 00 28 00 s.:. .t.h.e. .(.
61 00 62 00 73 00 6f 00 6c 00 75 00 74 00 65 00 a.b.s.o.l.u.t.e.
20 00 6f 00 72 00 20 00 72 00 65 00 6c 00 61 00 .o.r. .r.e.l.a.
74 00 69 00 76 00 65 00 29 00 20 00 70 00 61 00 t.i.v.e.). .p.a.
74 00 68 00 20 00 6e 00 61 00 6d 00 65 00 73 00 t.h. .n.a.m.e.s.
20 00 6f 00 66 00 20 00 61 00 20 00 27 00 50 00 .o.f. .a. .'.P.
69 00 64 00 47 00 65 00 6e 00 58 00 2e 00 64 00 i.d.G.e.n.X...d.
6c 00 6c 00 27 00 20 00 61 00 6e 00 64 00 0a 00 l.l.'. .a.n.d...
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 69 00 . . . . . . .i.
74 00 73 00 20 00 61 00 73 00 73 00 6f 00 63 00 t.s. .a.s.s.o.c.
69 00 61 00 74 00 65 00 64 00 20 00 27 00 50 00 i.a.t.e.d. .'.P.
4b 00 65 00 79 00 43 00 6f 00 6e 00 66 00 69 00 K.e.y.C.o.n.f.i.
67 00 5b 00 2a 00 5d 00 2e 00 78 00 72 00 6d 00 g.[.*.]...x.r.m.
2d 00 6d 00 73 00 27 00 20 00 64 00 61 00 74 00 -.m.s.'. .d.a.t.
61 00 20 00 66 00 69 00 6c 00 65 00 20 00 70 00 a. .f.i.l.e. .p.
6c 00 75 00 73 00 20 00 61 00 74 00 20 00 6c 00 l.u.s. .a.t. .l.
65 00 61 00 73 00 74 00 0a 00 20 00 20 00 20 00 e.a.s.t... . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 6f 00 6e 00 65 00 20 00 . . . .o.n.e. .
70 00 72 00 6f 00 64 00 75 00 63 00 74 00 20 00 p.r.o.d.u.c.t. .
6b 00 65 00 79 00 20 00 27 00 32 00 33 00 34 00 k.e.y. .'.2.3.4.
36 00 37 00 2d 00 38 00 39 00 42 00 43 00 44 00 6.7.-.8.9.B.C.D.
2d 00 46 00 47 00 48 00 4a 00 4b 00 2d 00 4d 00 -.F.G.H.J.K.-.M.
4e 00 50 00 51 00 52 00 2d 00 54 00 56 00 57 00 N.P.Q.R.-.T.V.W.
58 00 59 00 27 00 20 00 6d 00 75 00 73 00 74 00 X.Y.'. .m.u.s.t.
20 00 62 00 65 00 20 00 67 00 69 00 76 00 65 00 .b.e. .g.i.v.e.
6e 00 21 00 0a 00 00 00 25 00 6c 00 73 00 28 00 n.!.....%.l.s.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 0a 00 00 00 43 00 6f 00 .%.l.u.....C.o.
6d 00 6d 00 61 00 6e 00 64 00 4c 00 69 00 6e 00 m.m.a.n.d.L.i.n.
65 00 54 00 6f 00 41 00 72 00 67 00 76 00 00 00 e.T.o.A.r.g.v...
60 29 00 00 00 00 00 00 00 00 00 00 74 2a 00 00 `)..........t*..
00 20 00 00 98 29 00 00 00 00 00 00 00 00 00 00 . ...)..........
98 2a 00 00 38 20 00 00 a0 29 00 00 00 00 00 00 .*..8 ...)......
00 00 00 00 b2 2a 00 00 40 20 00 00 00 00 00 00 .....*..@ ......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
a8 29 00 00 b8 29 00 00 c6 29 00 00 d4 29 00 00 .)...)...)...)..
e0 29 00 00 ee 29 00 00 fe 29 00 00 0e 2a 00 00 .)...)...)...*..
1e 2a 00 00 30 2a 00 00 42 2a 00 00 54 2a 00 00 .*..0*..B*..T*..
64 2a 00 00 00 00 00 00 82 2a 00 00 00 00 00 00 d*.......*......
a4 2a 00 00 00 00 00 00 24 05 57 72 69 74 65 43 .*......$.WriteC
6f 6e 73 6f 6c 65 57 00 19 01 45 78 69 74 50 72 onsoleW...ExitPr
6f 63 65 73 73 00 52 00 43 6c 6f 73 65 48 61 6e ocess.R.CloseHan
64 6c 65 00 48 03 4c 6f 63 61 6c 46 72 65 65 00 dle.H.LocalFree.
62 01 46 72 65 65 4c 69 62 72 61 72 79 00 54 03 b.FreeLibrary.T.
4c 6f 63 6b 52 65 73 6f 75 72 63 65 00 00 41 03 LockResource..A.
4c 6f 61 64 52 65 73 6f 75 72 63 65 00 00 4e 01 LoadResource..N.
46 69 6e 64 52 65 73 6f 75 72 63 65 57 00 45 02 FindResourceW.E.
47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 00 GetProcAddress..
3e 03 4c 6f 61 64 4c 69 62 72 61 72 79 45 78 57 >.LoadLibraryExW
00 00 87 01 47 65 74 43 6f 6d 6d 61 6e 64 4c 69 ....GetCommandLi
6e 65 57 00 02 02 47 65 74 4c 61 73 74 45 72 72 neW...GetLastErr
6f 72 00 00 64 02 47 65 74 53 74 64 48 61 6e 64 or..d.GetStdHand
6c 65 00 00 4b 45 52 4e 45 4c 33 32 2e 64 6c 6c le..KERNEL32.dll
00 00 06 00 43 6f 6d 6d 61 6e 64 4c 69 6e 65 54 ....CommandLineT
6f 41 72 67 76 57 00 00 53 48 45 4c 4c 33 32 2e oArgvW..SHELL32.
64 6c 6c 00 35 03 77 76 73 70 72 69 6e 74 66 57 dll.5.wvsprintfW
00 00 55 53 45 52 33 32 2e 64 6c 6c 00 00 00 00 ..USER32.dll....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file PIDGENX.TXT
created in
step 3. to recreate the console application
Product Key Validator:
CERTUTIL.EXE /DecodeHex /V PIDGENX.TXT PIDGENX.COM
Input Length = 19584 Output Length = 4608 CertUtil: -decodehex command completed successfully.
.pol
, are used either to store the
Registry keys and entries (to be) applied by
Group Policies as well as
Local Security Policies, or to restore the previous
contents of Registry keys and entries modified by
Group Policies as well as
Local Security Policies.
The MSDN article Registry Policy File Format documents their format.
The MSKB
article
How to add, modify, or delete registry subkeys and values by using a .reg file
documents the format of Registry Editor script files,
typically created with the extension .reg
.
POLYGLOT.COM [ /MACHINE | /USER ] ‹file name› …
Note: due to the design and implementation of
Windows’ (classic alias legacy) console, the
Win32 function
WriteConsole()
can only write to a console, not to a file nor a pipe, i.e.
redirection of standard error
or standard output
is
not supported!
The MSDN article Console Handles provides background information.
Create the text file POLYGLOT.C
with the following
content in an arbitrary, preferable empty directory:
// Copyright © 2004-2023, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <shellapi.h>
#define REGFILE_SIGNATURE 'geRP'
#define REGISTRY_FILE_VERSION 1UL
typedef unsigned __int64 QWORD, *LPQWORD;
__declspec(safebuffers)
BOOL PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
DWORD dwBuffer;
DWORD dwConsole;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
if (!WriteConsole(hConsole, szBuffer, dwBuffer, &dwConsole, NULL))
return FALSE;
return dwConsole == dwBuffer;
}
const LPCWSTR szHKEY[8] = {L"HKEY_CLASSES_ROOT",
L"HKEY_CURRENT_USER",
L"HKEY_LOCAL_MACHINE",
L"HKEY_USERS",
L"HKEY_PERFORMANCE_DATA",
L"HKEY_CURRENT_CONFIG",
L"HKEY_DYN_DATA",
L"HKEY_CURRENT_USER_LOCAL_SETTINGS"};
const LPCWSTR szTYPE[12] = {L"NONE",
L"SZ",
L"EXPAND_SZ",
L"BINARY",
L"DWORD", // alias DWORD_LITTLE_ENDIAN
L"DWORD_BIG_ENDIAN",
L"LINK",
L"MULTI_SZ",
L"RESOURCE_LIST",
L"FULL_RESOURCE_DESCRIPTOR",
L"RESOURCE_REQUIREMENTS_LIST",
L"QWORD"}; // alias QWORD_LITTLE_ENDIAN
const LPCWSTR szType[12] = {L"none:",
L"",
L"expand:",
L"hex:",
L"dword:",
L"dword:",
L"link:",
L"multi:",
L"hex(8):",
L"hex(9):",
L"hex(a):",
L"qword:"};
DWORD WINAPI Polyglot(HANDLE hConsole, HKEY hkHKEY, LPCWSTR lpArgument)
{
#ifdef REGISTRY
LPCWSTR lpHKEY = szHKEY[(DWORD) hkHKEY ^ (DWORD) HKEY_CLASSES_ROOT];
HKEY hkKey;
BYTE cbData[65536];
#endif
HANDLE hInput;
DWORD dwInput;
LPCWSTR lpInput;
WCHAR cwInput;
HANDLE hPolicy;
DWORD dwPolicy;
LPDWORD lpPolicy;
LPCWSTR lpKey, lpValue, lpData, lp;
DWORD dwKey, dwValue, dwData, dwType, dwSize;
DWORD dwError = ERROR_SUCCESS;
hInput = CreateFile(lpArgument,
FILE_READ_DATA,
FILE_SHARE_READ,
(LPSECURITY_ATTRIBUTES) NULL,
OPEN_EXISTING,
FILE_FLAG_SEQUENTIAL_SCAN,
(HANDLE) NULL);
if (hInput == INVALID_HANDLE_VALUE)
PrintConsole(hConsole,
L"CreateFile() returned error %lu for file \'%ls\'\n",
dwError = GetLastError(), lpArgument);
else
{
dwInput = GetFileSize(hInput, (LPDWORD) NULL);
if (dwInput == INVALID_FILE_SIZE)
PrintConsole(hConsole,
L"GetFileSize() returned error %lu for file \'%ls\'\n",
dwError = GetLastError(), lpArgument);
else
{
hPolicy = CreateFileMapping(hInput,
(LPSECURITY_ATTRIBUTES) NULL,
PAGE_READONLY,
0, 0,
(LPCWSTR) NULL);
if (hPolicy == NULL)
PrintConsole(hConsole,
L"CreateFileMapping() returned error %lu for file \'%ls\'\n",
dwError = GetLastError(), lpArgument);
else
{
lpPolicy = MapViewOfFile(hPolicy,
FILE_MAP_READ,
0, 0,
(SIZE_T) 0);
if (lpPolicy == NULL)
PrintConsole(hConsole,
L"MapViewOfFile() returned error %lu for file \'%ls\'\n",
dwError = GetLastError(), lpArgument);
else
{
if ((lpPolicy[0] != REGFILE_SIGNATURE)
|| (lpPolicy[1] != REGISTRY_FILE_VERSION))
PrintConsole(hConsole,
L"Signature \'PReg\\1\\0\\0\\0\' missing in file \'%ls\'!\n",
lpArgument);
else
{
PrintConsole(hConsole,
L"Windows Registry Editor Version 5.00\n"
L"\n"
L"; Registry Policy File \'%ls\'\n",
lpArgument);
// L'[' key L']'
// L'[' key L';' value L';' type L';' size L';' data L']'
// L'[' key L';' L"**Del." value L';' type L';' size L';' data L']'
// L'[' key L';' L"**DeleteKeys" { L';' key } ... L']'
// L'[' key L';' L"**DeleteVals" L']'
// L'[' key L';' L"**DeleteValues" { L';' value } ... L']'
// L'[' key L';' L"**SecureKey=0" L']'
// L'[' key L';' L"**SecureKey=1" L']'
//
// WCHAR key[] NUL-terminated path of registry key beneath
// HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER
//
// WCHAR value[] NUL-terminated name of registry entry
//
// DWORD type registry data type
//
// DWORD size size of registry data in bytes
//
// BYTE data[] registry data
lpInput = (LPCWSTR) (lpPolicy + 2);
lpKey = NULL;
dwKey = 0;
dwPolicy = dwInput;
while ((LPBYTE) lpInput < (LPBYTE) lpPolicy + dwPolicy)
{
if (*lpInput++ != L'[')
break;
dwInput = wcslen(lpInput);
if ((dwKey == 0)
|| (dwKey != dwInput)
|| (memcmp(lpInput, lpKey, dwKey * sizeof(L'\0')) != 0))
PrintConsole(hConsole,
L"\n"
L"[HKEY_RELATIVE\\%ls]\n",
lpInput);
lpKey = lpInput;
dwKey = dwInput;
lpInput += dwInput + 1;
cwInput = *lpInput++;
if (cwInput == L']')
continue;
if (cwInput != L';')
break;
lpValue = lpInput;
dwValue = wcslen(lpInput);
lpInput += dwValue + 1;
if ((dwValue == sizeof("**securekey=1") - 1)
&& ((memcmp(lpValue, L"**securekey=1", sizeof(L"**securekey=1") - sizeof(L"")) == 0)
|| (memcmp(lpValue, L"**SecureKey=1", sizeof(L"**securekey=1") - sizeof(L"")) == 0)))
{
PrintConsole(hConsole,
L"; SecureKey=1\n");
if (*lpInput++ != L']')
break;
}
else if ((dwValue == sizeof("**securekey=0") - 1)
&& ((memcmp(lpValue, L"**securekey=0", sizeof(L"**securekey=0") - sizeof(L"")) == 0)
|| (memcmp(lpValue, L"**SecureKey=0", sizeof(L"**securekey=0") - sizeof(L"")) == 0)))
{
PrintConsole(hConsole,
L"; SecureKey=0\n");
if (*lpInput++ != L']')
break;
}
else if ((dwValue == sizeof("**deletevals") - 1)
&& ((memcmp(lpValue, L"**deletevals", sizeof(L"**deletevals") - sizeof(L"")) == 0)
|| (memcmp(lpValue, L"**Deletevals", sizeof(L"**Deletevals") - sizeof(L"")) == 0)))
{
PrintConsole(hConsole,
L"*=-\n");
if (*lpInput++ != L']')
break;
}
else if ((dwValue == sizeof("**deletevalues") - 1)
&& ((memcmp(lpValue, L"**deletevalues", sizeof(L"**deletevalues") - sizeof(L"")) == 0)
|| (memcmp(lpValue, L"**Deletevalues", sizeof(L"**Deletevalues") - sizeof(L"")) == 0)))
{
while (*lpInput == L';')
{
PrintConsole(hConsole,
L"\'%ls\'=-\n",
++lpInput);
lpInput += wcslen(lpInput) + 1;
}
if (*lpInput++ != L']')
break;
}
else if ((dwValue == sizeof("**deletekeys") - 1)
&& ((memcmp(lpValue, L"**deletekeys", sizeof(L"**deletekeys") - sizeof(L"")) == 0)
|| (memcmp(lpValue, L"**Deletekeys", sizeof(L"**Deletekeys") - sizeof(L"")) == 0)))
{
while (*lpInput == L';')
{
PrintConsole(hConsole,
L"[-HKEY_RELATIVE\\%ls\\%ls]\n",
lpKey, ++lpInput);
lpInput += wcslen(lpInput) + 1;
}
if (*lpInput++ != L']')
break;
}
else
{
if ((dwValue > sizeof("**del."))
&& ((memcmp(lpValue, L"**del.", sizeof(L"**del.") - sizeof(L"")) == 0)
|| (memcmp(lpValue, L"**Del.", sizeof(L"**Del.") - sizeof(L"")) == 0)))
{
lpValue += sizeof("**Del.") - 1;
if (dwValue == sizeof("**Del.") - 1)
PrintConsole(hConsole,
L"@=- ; =");
else
PrintConsole(hConsole,
L"\'%ls\'=- ; =", lpValue);
}
else
if (dwValue == 0)
PrintConsole(hConsole,
L"@=");
else
PrintConsole(hConsole,
L"\'%ls\'=", lpValue);
cwInput = *lpInput++;
if (cwInput == L']')
continue;
if (cwInput != L';')
break;
dwType = *((LPDWORD) lpInput)++;
if (dwType < sizeof(szType) / sizeof(*szType))
PrintConsole(hConsole,
L"%ls", szType[dwType]);
else
PrintConsole(hConsole,
L"hex(%lx):", dwType);
cwInput = *lpInput++;
if (cwInput == L']')
continue;
if (cwInput != L';')
break;
dwSize = *((LPDWORD) lpInput)++;
cwInput = *lpInput++;
if (cwInput == L']')
continue;
if (cwInput != L';')
break;
lpData = lpInput;
(LPBYTE) lpInput += dwSize;
switch (dwType)
{
case REG_SZ:
case REG_EXPAND_SZ:
case REG_LINK:
if (dwSize == 0)
goto NEWLINE;
PrintConsole(hConsole,
L"\'%ls\'\n",
lpData);
dwData = wcslen(lpData);
if (dwSize != (dwData + 1) * sizeof(L'\0'))
PrintConsole(hConsole,
L"Size %lu of REG_%ls value data not equal length %lu of string plus terminating \'NUL\' character!\n",
dwSize, szTYPE[dwType], dwData);
break;
case REG_DWORD_BIG_ENDIAN:
*(LPDWORD) lpData = _byteswap_ulong(*(LPDWORD) lpData);
case REG_DWORD_LITTLE_ENDIAN:
// case REG_DWORD:
PrintConsole(hConsole,
L"%08lx\n",
*(LPDWORD) lpData);
if (dwSize != sizeof(DWORD))
PrintConsole(hConsole,
L"Size %lu of REG_%ls value data not equal \'sizeof(DWORD)\'!\n",
dwSize, szTYPE[dwType]);
break;
case REG_QWORD_LITTLE_ENDIAN:
// case REG_QWORD:
PrintConsole(hConsole,
L"%016I64x\n",
*(LPQWORD) lpData);
if (dwSize != sizeof(QWORD))
PrintConsole(hConsole,
L"Size %lu of REG_QWORD value data not equal \'sizeof(QWORD)\'!\n",
dwSize);
break;
case REG_MULTI_SZ:
if (dwSize == 0)
goto NEWLINE;
for (lp = lpData; (lp < lpInput) && (*lp != L'\0'); lp += wcslen(lp) + 1)
PrintConsole(hConsole,
L",\'%ls\'" + (lp == lpData),
lp);
PrintConsole(hConsole,
L"\n");
if ((lp > lpInput) || (*lp != L'\0'))
PrintConsole(hConsole,
L"REG_MULTI_SZ value data not terminated with extra \'NUL\' character!\n");
else
lp++;
if (lp != lpInput)
PrintConsole(hConsole,
L"Size %lu of REG_MULTI_SZ value data not equal sum of string lengths plus terminating \'NUL\' characters!\n",
dwSize);
break;
// case REG_NONE:
// case REG_BINARY:
// case REG_RESOURCE_LIST:
// case REG_FULL_RESOURCE_DESCRIPTOR:
// case REG_RESOURCE_REQUIREMENTS_LIST:
default:
for (lp = lpData; lp < lpInput; (LPBYTE) lp += 1)
PrintConsole(hConsole,
L",%02x" + (lp == lpData),
*(LPBYTE) lp);
NEWLINE:
PrintConsole(hConsole,
L"\n");
}
#ifdef REGISTRY
if (hkHKEY != HKEY_CLASSES_ROOT)
{
dwError = RegOpenKeyEx(hkHKEY,
lpKey,
REG_OPTION_RESERVED,
KEY_QUERY_VALUE,
&hkKey);
if (dwError != ERROR_SUCCESS)
PrintConsole(hConsole,
L"RegOpenKeyEx() returned error %lu for registry key \'%ls\\%ls\'\n",
dwError, lpHKEY, lpKey);
else
{
dwData = sizeof(cbData);
dwError = RegQueryValueEx(hkKey,
lpValue,
(LPDWORD) NULL,
&dwValue,
cbData,
&dwData);
if (dwError != ERROR_SUCCESS)
PrintConsole(hConsole,
L"RegQueryValueEx() returned error %lu for value \'%ls\' of registry key \'%ls\\%ls\'\n",
dwError, lpValue, lpHKEY, lpKey);
else
if ((dwValue != dwType)
|| (dwData != dwSize)
|| (memcmp(lpData, cbData, dwData) != 0))
PrintConsole(hConsole,
L"MISMATCH: data type, size or value in policy file differs from registry!\n");
dwError = RegCloseKey(hkKey);
if (dwError != ERROR_SUCCESS)
PrintConsole(hConsole,
L"RegCloseKey() returned error %lu for registry key \'%ls\\%ls\'\n",
dwError, lpHKEY, lpKey);
}
}
#endif // REGISTRY
if (*lpInput++ != L']')
break;
}
}
if ((LPBYTE) lpInput != (LPBYTE) lpPolicy + dwPolicy)
PrintConsole(hConsole,
L"Format error in policy file \'%ls\'!\n",
lpArgument);
}
if (!UnmapViewOfFile(lpPolicy))
PrintConsole(hConsole,
L"UnmapViewOfFile() returned error %lu for file \'%ls\'\n",
GetLastError(), lpArgument);
}
if (!CloseHandle(hPolicy))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu for file mapping \'%ls\'\n",
GetLastError(), lpArgument);
}
}
if (!CloseHandle(hInput))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu for file \'%ls\'\n",
GetLastError(), lpArgument);
}
return dwError;
}
__declspec(noreturn)
VOID WINAPI wmainCRTStartup(VOID)
{
#ifdef WILDCARD
WIN32_FIND_DATA wfd;
HANDLE hWildCard;
DWORD dwWildCard;
WCHAR szWildCard[32768];
LPWSTR lpWildCard;
#endif
LPWSTR *lpArguments;
INT nArguments;
INT nArgument = 1;
DWORD dwError = ERROR_BAD_ARGUMENTS;
HKEY hkHKEY = HKEY_CLASSES_ROOT;
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole == INVALID_HANDLE_VALUE)
dwError = GetLastError();
else
{
lpArguments = CommandLineToArgvW(GetCommandLine(), &nArguments);
if (lpArguments == NULL)
PrintConsole(hConsole,
L"CommandLineToArgv() returned error %lu\n",
dwError = GetLastError());
else
{
#ifdef REGISTRY
if ((nArguments > 1)
&& (*lpArguments[1] == L'/'))
if (wcscmp(lpArguments[1], L"/MACHINE") == 0)
{
hkHKEY = HKEY_LOCAL_MACHINE;
nArgument = 2;
}
else if (wcscmp(lpArguments[1], L"/USER") == 0)
{
hkHKEY = HKEY_CURRENT_USER;
nArgument = 2;
}
else
{
PrintConsole(hConsole,
L"Bad arguments: optional first argument must be \'%ls\' or \'%ls\'!\n",
L"/MACHINE", L"/USER");
nArguments = 0;
}
if (nArguments <= nArgument)
#else
if (nArguments < 2)
#endif
PrintConsole(hConsole,
L"No arguments: at least one \'.pol\' file name must be given!\n");
else
#ifndef WILDCARD
do
dwError = Polyglot(hConsole, hkHKEY, lpArguments[nArgument]);
while (++nArgument < nArguments);
#else
do
{
hWildCard = FindFirstFile(lpArguments[nArgument], &wfd);
if (hWildCard == INVALID_HANDLE_VALUE)
PrintConsole(hConsole,
L"FindFirstFile() returned error %lu for argument \'%ls\'\n",
dwError = GetLastError(), lpArguments[nArgument]);
else
{
wcscpy(szWildCard, lpArguments[nArgument]);
dwWildCard = 0;
lpWildCard = NULL;
do
if (szWildCard[dwWildCard] == L'\\')
lpWildCard = szWildCard + dwWildCard;
while (szWildCard[dwWildCard++] != L'\0');
if (dwWildCard > MAX_PATH)
PrintConsole(hConsole,
L"Argument \'%ls\' exceeds MAX_PATH!\n",
lpArguments[nArgument]);
if (lpWildCard != NULL)
lpWildCard++;
else
lpWildCard = szWildCard + 2 * (szWildCard[1] == L':');
dwWildCard = 0;
do
{
if ((wfd.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0)
continue;
dwWildCard++;
wcscpy(lpWildCard, wfd.cFileName);
dwError = Polyglot(hConsole, hkHKEY, szWildCard);
} while (FindNextFile(hWildCard, &wfd));
dwError = GetLastError();
if (dwError == ERROR_NO_MORE_FILES)
dwError = ERROR_SUCCESS;
else
PrintConsole(hConsole,
L"FindNextFile() returned error %lu for argument \'%ls\'\n",
dwError, lpArguments[nArgument]);
if (dwWildCard == 0)
PrintConsole(hConsole,
L"No match for argument \'%ls\'!\n",
lpArguments[nArgument]);
if (!FindClose(hWildCard))
PrintConsole(hConsole,
L"FindClose() returned error %lu for argument \'%ls\'\n",
GetLastError(), lpArguments[nArgument]);
}
} while (++nArgument < nArguments);
#endif // WILDCARD
if (LocalFree(lpArguments) != NULL)
PrintConsole(hConsole,
L"LocalFree() returned error %lu\n",
GetLastError());
}
if (!CloseHandle(hConsole))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
ExitProcess(dwError);
}
Note: with the preprocessor macro
REGISTRY
defined, an optional /MACHINE
or
/USER
is accepted as first command line argument to
compare the settings against the HKEY_LOCAL_MACHINE
or
HKEY_CURRENT_USER
branch of the
Registry!
Note: with the preprocessor macro
WILDCARD
defined, wildcard expansion of matching file
names is performed for the command line arguments!
Run the following four command lines to compile the source file
POLYGLOT.C
created in step 1., link the compiled
object file POLYGLOT.OBJ
and cleanup afterwards:
SET CL=/DREGISTRY /GA /GF /GS /Gs69632 /Gy /O1 /Oi /Os /Oy /W4 /Zl SET LINK=/DEFAULTLIB:ADVAPI32.LIB /DEFAULTLIB:KERNEL32.LIB /DEFAULTLIB:SHELL32.LIB /DEFAULTLIB:USER32.LIB /ENTRY:wmainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /OSVERSION:5.0 /RELEASE /STACK:1048576,65536 /SUBSYSTEM:CONSOLE /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /FePOLYGLOT.COM POLYGLOT.C ERASE POLYGLOT.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. POLYGLOT.C POLYGLOT.C(313) : warning C4213: nonstandard extension used : cast on l-value POLYGLOT.C(330) : warning C4213: nonstandard extension used : cast on l-value POLYGLOT.C(341) : warning C4213: nonstandard extension used : cast on l-value POLYGLOT.C(425) : warning C4213: nonstandard extension used : cast on l-value Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Finally execute the console application
POLYGLOT.COM
built in step 2. to display the contents of some
NTUser.pol
and Registry.pol
files that
eventually are (not yet) present on your machine:
VER .\POLYGLOT.COM "%USERPROFILE%\NTUser.pol" "%ALLUSERSPROFILE%\NTUser.pol" "%SystemRoot%\System32\GroupPolicy\Machine\Registry.pol" "%SystemRoot%\System32\GroupPolicy\User\Registry.pol" NET.EXE HelpMsg %ERRORLEVEL%Net services commands Ver
Microsoft Windows [Version 10.0.19044] Windows Registry Editor Version 5.00 ; Registry Policy File 'C:\Users\Stefan\NTUser.pol' [HKEY_RELATIVE\Software\Policies\Microsoft\Windows\Group Policy Objects\Local Group Policy Objects] '**Comment:GPO Name: Local Group Policy Objects'= [HKEY_RELATIVE\Software\Microsoft\Windows\CurrentVersion\Policies\System] 'LogonHoursAction'=dword:00000002 'DontDisplayLogonHoursWarnings'=dword:00000001 Windows Registry Editor Version 5.00 ; Registry Policy File 'C:\ProgramData\NTUser.pol' [HKEY_RELATIVE\Software\Policies\Microsoft\Windows\Group Policy Objects\Local Group Policy Objects] '**Comment:GPO Name: Local Group Policy Objects'= Windows Registry Editor Version 5.00 ; Registry Policy File 'C:\Windows\System32\GroupPolicy\Machine\Registry.pol' [HKEY_RELATIVE\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer] 'AuthentiCodeFlags'=dword:00000300 [HKEY_RELATIVE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers] 'PolicyScope'=dword:00000001 'TransparentEnabled'=dword:00000002 'ExecutableTypes'=multi:'WSF','WSC','VBS','VBE','VB','TMP','SHS','SCR','PIF','PCD','OCX','MST','MSP','MSI','MDE','MDB','JSE','JS','ISP','INS','HTA','HLP','EXE','DLL','CRT','CPL','COM','CMD','BAT','BAS','AX','ADP','ADE' 'DefaultLevel'=dword:00000000 'Levels'=dword:00071000 'LogFileName'='C:\Windows\System32\LogFiles\SAFER.Log' 'AuthenticodeEnabled'=dword:00000001 [HKEY_RELATIVE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes] @=none: [HKEY_RELATIVE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{191cd7fa-f240-4a17-8986-94d480a6c8ca}] 'LastModified'=qword:01cf68d87b202417 'Description'='' 'SaferFlags'=dword:00000000 'ItemData'=expand:'%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%' [HKEY_RELATIVE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{d2c34ab2-529a-46b2-b293-fc853fce72ea}] 'LastModified'=qword:01cf68d87b202417 'Description'='' 'SaferFlags'=dword:00000000 'ItemData'=expand:'%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%' [HKEY_RELATIVE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{4fcf2556-cf02-4356-ad71-f82ca93ccd0b}] 'LastModified'=qword:01cf68d979215214 'Description'='' 'SaferFlags'=dword:00000000 'ItemData'=expand:'%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)%' [HKEY_RELATIVE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{21c0b260-2d89-4fe0-8275-1c76746b3d2b}] 'LastModified'=qword:01d57587bb48c5c4 'Description'='' 'SaferFlags'=dword:00000000 'ItemData'=expand:'%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir%' CreateFile() returned error 3 for file 'C:\Windows\System32\GroupPolicy\User\Registry.pol' The system cannot find the path specified.
Create the text file POLYGLOT.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 33 2c 20 53 74 65 66 61 6e 20 4b 61 -2023, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 02 00 56 4f 49 44 00 00 00 00 PE..L...VOID....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 0a 00 00 ......#.........
00 12 00 00 00 00 00 00 d4 17 00 00 00 10 00 00 ................
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
05 00 00 00 00 00 2f 03 05 00 00 00 00 00 00 00 ....../.........
00 40 00 00 00 02 00 00 b6 c2 00 00 03 00 00 85 .@..............
00 00 10 00 00 00 01 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
cc 2f 00 00 64 00 00 00 00 00 00 00 00 00 00 00 ./..d...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 20 00 00 54 00 00 00 ......... ..T...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
7c 09 00 00 00 10 00 00 00 0a 00 00 00 02 00 00 |...............
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 63 6f 6e 73 74 00 00 cc 11 00 00 00 20 00 00 .const....... ..
00 12 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 ....@..@........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
55 8b ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 U........V.E.P.u
0c 8d 85 f8 f7 ff ff 50 ff 15 4c 20 40 00 8b f0 .......P..L @...
85 f6 75 04 33 c0 eb 23 6a 00 8d 45 fc 50 56 8d ..u.3..#j..E.PV.
85 f8 f7 ff ff 50 ff 75 08 ff 15 10 20 40 00 85 .....P.u.... @..
c0 74 e1 33 c0 39 75 fc 0f 94 c0 5e c9 c3 55 8b .t.3.9u....^..U.
ec 81 ec 38 00 01 00 8b 45 0c 53 8b 5d 10 56 57 ...8....E.S.].VW
33 ff 57 68 00 00 00 08 6a 03 57 6a 01 35 00 00 3.Wh....j.Wj.5..
00 80 8b 04 85 4c 23 40 00 6a 01 53 89 45 e4 89 .....L#@.j.S.E..
7d e8 ff 15 2c 20 40 00 8b f0 89 75 c8 83 fe ff }..., @....u....
75 14 ff 15 28 20 40 00 53 8b f0 56 68 2c 2e 40 u...( @.S..Vh,.@
00 e9 ff 06 00 00 57 56 ff 15 24 20 40 00 89 45 ......WV..$ @..E
fc 83 f8 ff 75 19 ff 15 28 20 40 00 53 8b f0 56 ....u...( @.S..V
68 14 2e 40 00 68 c0 2d 40 00 e9 b1 06 00 00 57 h..@.h.-@......W
57 57 6a 02 57 56 ff 15 20 20 40 00 89 45 d4 3b WWj.WV.. @..E.;
c7 75 11 ff 15 28 20 40 00 53 8b f0 56 68 9c 2d .u...( @.S..Vh.-
40 00 eb d1 57 57 57 6a 04 50 ff 15 1c 20 40 00 @...WWWj.P... @.
8b f0 89 75 d8 3b f7 75 24 ff 15 28 20 40 00 53 ...u.;.u$..( @.S
8b f0 56 68 80 2d 40 00 68 c0 2d 40 00 ff 75 08 ..Vh.-@.h.-@..u.
e8 db fe ff ff 83 c4 14 e9 34 06 00 00 81 3e 50 .........4....>P
52 65 67 0f 85 85 06 00 00 83 7e 04 01 0f 85 7b Reg.......~....{
06 00 00 53 68 f8 2c 40 00 ff 75 08 e8 af fe ff ...Sh.,@..u.....
ff 8b 45 fc 03 c6 8d 5e 08 83 c4 0c 89 7d f8 89 ..E....^.....}..
7d f0 89 45 dc 3b d8 0f 83 ad 05 00 00 eb 02 33 }..E.;.........3
ff 66 8b 03 83 c3 02 66 83 f8 5b 0f 85 99 05 00 .f.....f..[.....
00 8b c3 8d 50 02 66 8b 08 83 c0 02 66 3b cf 75 ....P.f.....f;.u
f5 2b c2 d1 f8 89 45 fc 39 7d f0 74 15 39 45 f0 .+....E.9}.t.9E.
75 10 8b 4d f0 8b 7d f8 03 c9 8b f3 33 c0 f3 a6 u..M..}.....3...
74 11 53 68 c8 2c 40 00 ff 75 08 e8 40 fe ff ff t.Sh.,@..u..@...
83 c4 0c 8b 45 fc 89 5d f8 8d 5c 43 02 89 45 f0 ....E..]..\C..E.
0f b7 03 83 c3 02 83 f8 5d 0f 84 32 05 00 00 83 ........]..2....
f8 3b 0f 85 32 05 00 00 8b d3 8b c3 89 55 f4 8d .;..2........U..
70 02 66 8b 08 83 c0 02 66 85 c9 75 f5 2b c6 d1 p.f.....f..u.+..
f8 6a 0d 59 89 45 ec 8d 5c 43 02 3b c1 75 60 bf .j.Y.E..\C.;.u`.
ac 2c 40 00 8b f2 33 c0 66 f3 a7 74 11 6a 0d 59 .,@...3.f..t.j.Y
bf 90 2c 40 00 8b f2 33 c0 66 f3 a7 75 14 68 70 ..,@...3.f..u.hp
2c 40 00 ff 75 08 e8 c5 fd ff ff 59 59 e9 c3 04 ,@..u......YY...
00 00 6a 0d 59 bf 54 2c 40 00 8b f2 33 c0 66 f3 ..j.Y.T,@...3.f.
a7 74 15 6a 0d 59 bf 38 2c 40 00 8b f2 33 c0 66 .t.j.Y.8,@...3.f
f3 a7 0f 85 fa 00 00 00 68 18 2c 40 00 eb c4 83 ........h.,@....
f8 0c 75 27 6a 06 59 bf fc 2b 40 00 8b f2 33 c0 ..u'j.Y..+@...3.
f3 a7 74 10 6a 06 59 bf e0 2b 40 00 8b f2 33 c0 ..t.j.Y..+@...3.
f3 a7 75 6d 68 d4 2b 40 00 eb 98 83 f8 0e 0f 85 ..umh.+@........
b9 00 00 00 6a 07 59 bf b4 2b 40 00 8b f2 33 c0 ....j.Y..+@...3.
f3 a7 74 42 6a 07 59 bf 94 2b 40 00 8b f2 33 c0 ..tBj.Y..+@...3.
f3 a7 0f 85 9a 00 00 00 eb 2c 83 c3 02 53 68 80 .........,...Sh.
2b 40 00 ff 75 08 e8 25 fd ff ff 8b c3 83 c4 0c +@..u..%........
8d 50 02 66 8b 08 83 c0 02 66 85 c9 75 f5 2b c2 .P.f.....f..u.+.
d1 f8 8d 5c 43 02 66 83 3b 3b 74 ce e9 04 04 00 ...\C.f.;;t.....
00 6a 06 59 bf 64 2b 40 00 8b f2 33 c0 f3 a7 74 .j.Y.d+@...3...t
41 6a 06 59 bf 48 2b 40 00 8b f2 33 c0 f3 a7 75 Aj.Y.H+@...3...u
41 eb 2f 83 c3 02 53 ff 75 f8 68 14 2b 40 00 ff A./...S.u.h.+@..
75 08 e8 c9 fc ff ff 8b c3 83 c4 10 8d 48 02 66 u............H.f
8b 10 83 c0 02 66 85 d2 75 f5 2b c1 d1 f8 8d 5c .....f..u.+....\
43 02 66 83 3b 3b 74 cb e9 a8 03 00 00 83 f8 07 C.f.;;t.........
76 40 6a 03 59 bf 04 2b 40 00 8b f2 33 c0 f3 a7 v@j.Y..+@...3...
74 10 6a 03 59 bf f4 2a 40 00 8b f2 33 c0 f3 a7 t.j.Y..*@...3...
75 1d 83 c2 0c 83 7d ec 06 89 55 f4 75 07 68 e4 u.....}...U.u.h.
2a 40 00 eb 16 ff 75 f4 68 cc 2a 40 00 eb 20 8b *@....u.h.*@.. .
45 ec 85 c0 75 11 68 c4 2a 40 00 ff 75 08 e8 4d E...u.h.*@..u..M
fc ff ff 59 59 eb 13 ff 75 f4 68 b4 2a 40 00 ff ...YY...u.h.*@..
75 08 e8 39 fc ff ff 83 c4 0c 0f b7 03 83 c3 02 u..9............
83 f8 5d 0f 84 38 03 00 00 83 f8 3b 0f 85 38 03 ..]..8.....;..8.
00 00 8b 03 89 45 fc 83 f8 0c 73 0e ff 34 85 9c .....E....s..4..
23 40 00 68 ac 2a 40 00 eb 06 50 68 98 2a 40 00 #@.h.*@...Ph.*@.
ff 75 08 e8 f8 fb ff ff 0f b7 43 04 83 c4 0c 83 .u........C.....
c3 06 83 f8 5d 0f 84 f6 02 00 00 83 f8 3b 0f 85 ....]........;..
f6 02 00 00 0f b7 43 04 8b 3b 83 c3 06 89 7d d0 ......C..;....}.
83 f8 5d 0f 84 d8 02 00 00 83 f8 3b 0f 85 d8 02 ..]........;....
00 00 8b 45 fc 8b f3 03 df 85 c0 0f 84 8a 01 00 ...E............
00 83 f8 02 0f 86 2b 01 00 00 83 f8 04 0f 84 e7 ......+.........
00 00 00 83 f8 05 0f 84 d8 00 00 00 83 f8 06 0f ................
84 10 01 00 00 83 f8 07 74 3d 83 f8 0b 0f 85 58 ........t=.....X
01 00 00 ff 76 04 ff 36 68 84 2a 40 00 ff 75 08 ....v..6h.*@..u.
e8 6b fb ff ff 83 c4 10 83 ff 08 0f 84 8b 01 00 .k..............
00 57 68 08 2a 40 00 ff 75 08 e8 51 fb ff ff 83 .Wh.*@..u..Q....
c4 0c e9 75 01 00 00 85 ff 0f 84 5e 01 00 00 8b ...u.......^....
fe 3b f3 73 3d 66 83 3f 00 74 37 33 c0 3b fe 0f .;.s=f.?.t73.;..
94 c0 57 8d 04 45 f4 29 40 00 50 ff 75 08 e8 1d ..W..E.)@.P.u...
fb ff ff 8b c7 83 c4 0c 8d 50 02 66 8b 08 83 c0 .........P.f....
02 66 85 c9 75 f5 2b c2 d1 f8 8d 7c 47 02 3b fb .f..u.+....|G.;.
72 c3 68 f0 29 40 00 ff 75 08 e8 f1 fa ff ff 59 r.h.)@..u......Y
59 3b fb 77 0b 66 83 3f 00 75 05 83 c7 02 eb 0f Y;.w.f.?.u......
68 68 29 40 00 ff 75 08 e8 d3 fa ff ff 59 59 3b hh)@..u......YY;
fb 0f 84 f5 00 00 00 ff 75 d0 68 98 28 40 00 e9 ........u.h.(@..
63 ff ff ff 8b 06 0f c8 89 06 ff 36 68 88 28 40 c..........6h.(@
00 ff 75 08 e8 a7 fa ff ff 83 c4 0c 83 ff 04 0f ..u.............
84 c7 00 00 00 8b 45 fc ff 34 85 6c 23 40 00 57 ......E..4.l#@.W
68 10 28 40 00 ff 75 08 e8 83 fa ff ff 83 c4 10 h.(@..u.........
e9 a7 00 00 00 85 ff 0f 84 90 00 00 00 56 68 fc .............Vh.
27 40 00 ff 75 08 e8 65 fa ff ff 8b c6 83 c4 0c '@..u..e........
8d 50 02 66 8b 08 83 c0 02 66 85 c9 75 f5 2b c2 .P.f.....f..u.+.
d1 f8 8d 4c 00 02 89 45 e0 3b f9 74 6f 50 8b 45 ...L...E.;.toP.E
fc ff 34 85 6c 23 40 00 57 68 38 27 40 00 ff 75 ..4.l#@.Wh8'@..u
08 e8 2a fa ff ff 83 c4 14 eb 51 8b fe 3b f3 73 ..*.......Q..;.s
3c 0f b6 07 8b c8 c1 e8 04 0f b7 04 45 14 27 40 <...........E.'@
00 83 e1 0f 0f b7 0c 4d 14 27 40 00 51 50 33 c0 .......M.'@.QP3.
3b fe 0f 94 c0 8d 04 45 04 27 40 00 50 ff 75 08 ;......E.'@.P.u.
e8 eb f9 ff ff 83 c4 10 47 3b fb 72 c4 68 f0 29 ........G;.r.h.)
40 00 ff 75 08 e8 d6 f9 ff ff 59 59 81 7d 0c 00 @..u......YY.}..
00 00 80 0f 84 cc 00 00 00 8d 45 cc 50 6a 01 6a ..........E.Pj.j
00 ff 75 f8 ff 75 0c ff 15 04 20 40 00 89 45 e8 ..u..u.... @..E.
85 c0 74 11 ff 75 f8 ff 75 e4 50 68 e8 26 40 00 ..t..u..u.Ph.&@.
e9 90 00 00 00 8d 45 e0 50 8d 85 c8 ff fe ff 50 ......E.P......P
8d 45 ec 50 6a 00 ff 75 f4 c7 45 e0 00 00 01 00 .E.Pj..u..E.....
ff 75 cc ff 15 00 20 40 00 85 c0 74 21 ff 75 f8 .u.... @...t!.u.
ff 75 e4 ff 75 f4 50 68 c8 26 40 00 68 40 26 40 .u..u.Ph.&@.h@&@
00 ff 75 08 e8 57 f9 ff ff 83 c4 1c eb 2b 8b 45 ..u..W.......+.E
fc 39 45 ec 75 14 8b 4d e0 3b 4d d0 75 0c 8d bd .9E.u..M.;M.u...
c8 ff fe ff 33 c0 f3 a6 74 0f 68 a8 25 40 00 ff ....3...t.h.%@..
75 08 e8 29 f9 ff ff 59 59 ff 75 cc ff 15 08 20 u..)...YY.u....
40 00 89 45 e8 85 c0 74 1c ff 75 f8 ff 75 e4 50 @..E...t..u..u.P
68 8c 25 40 00 68 20 25 40 00 ff 75 08 e8 fe f8 h.%@.h %@..u....
ff ff 83 c4 18 66 8b 03 83 c3 02 66 83 f8 5d 75 .....f.....f..]u
09 3b 5d dc 0f 82 55 fa ff ff 3b 5d dc 8b 5d 10 .;]...U...;]..].
74 11 53 68 d8 24 40 00 ff 75 08 e8 d0 f8 ff ff t.Sh.$@..u......
83 c4 0c 8b 75 d8 56 ff 15 18 20 40 00 85 c0 75 ....u.V... @...u
1d 53 ff 15 28 20 40 00 50 68 b4 24 40 00 68 c0 .S..( @.Ph.$@.h.
2d 40 00 ff 75 08 e8 a5 f8 ff ff 83 c4 14 8b 75 -@..u..........u
e8 ff 75 d4 ff 15 14 20 40 00 85 c0 75 1d 53 ff ..u.... @...u.S.
15 28 20 40 00 50 68 9c 24 40 00 68 38 24 40 00 .( @.Ph.$@.h8$@.
ff 75 08 e8 78 f8 ff ff 83 c4 14 ff 75 c8 ff 15 .u..x.......u...
14 20 40 00 85 c0 75 1d 53 ff 15 28 20 40 00 50 . @...u.S..( @.P
68 9c 24 40 00 68 c0 2d 40 00 ff 75 08 e8 4e f8 h.$@.h.-@..u..N.
ff ff 83 c4 14 5f 8b c6 5e 5b c9 c2 0c 00 53 68 ....._..^[....Sh
d0 23 40 00 ff 75 08 e8 34 f8 ff ff 83 c4 0c e9 .#@..u..4.......
62 ff ff ff 55 8b ec 83 ec 18 53 56 33 f6 46 6a b...U.....SV3.Fj
f4 89 75 f0 c7 45 f4 a0 00 00 00 c7 45 ec 00 00 ..u..E......E...
00 80 ff 15 3c 20 40 00 89 45 fc 83 f8 ff 75 0e ....< @..E....u.
ff 15 28 20 40 00 89 45 f4 e9 64 01 00 00 8d 45 ..( @..E..d....E
f8 50 ff 15 38 20 40 00 50 ff 15 44 20 40 00 89 .P..8 @.P..D @..
45 e8 85 c0 75 14 ff 15 28 20 40 00 50 89 45 f4 E...u...( @.P.E.
68 a8 2f 40 00 e9 ff 00 00 00 39 75 f8 0f 8e ce h./@......9u....
00 00 00 8b 40 04 66 83 38 2f 0f 85 9d 00 00 00 ....@.f.8/......
bb 94 2f 40 00 8b d3 8b c8 66 8b 31 66 3b 32 75 ../@.....f.1f;2u
1e 66 85 f6 74 15 66 8b 71 02 66 3b 72 02 75 0f .f..t.f.q.f;r.u.
83 c1 04 83 c2 04 66 85 f6 75 de 33 c9 eb 05 1b ......f..u.3....
c9 83 d9 ff 85 c9 75 09 c7 45 ec 02 00 00 80 eb ......u..E......
3d be 88 2f 40 00 8b ce 66 8b 10 66 3b 11 75 1e =../@...f..f;.u.
66 85 d2 74 15 66 8b 50 02 66 3b 51 02 75 0f 83 f..t.f.P.f;Q.u..
c0 04 83 c1 04 66 85 d2 75 de 33 c0 eb 05 1b c0 .....f..u.3.....
83 d8 ff 85 c0 75 10 c7 45 ec 01 00 00 80 c7 45 .....u..E......E
f0 02 00 00 00 eb 16 56 53 68 08 2f 40 00 ff 75 .......VSh./@..u
fc e8 1a f7 ff ff 83 c4 10 83 65 f8 00 8b 75 f0 ..........e...u.
39 75 f8 7e 1c 8b 45 e8 ff 34 b0 ff 75 ec ff 75 9u.~..E..4..u..u
fc e8 48 f7 ff ff 46 89 45 f4 3b 75 f8 7c e6 eb ..H...F.E.;u.|..
0f 68 90 2e 40 00 ff 75 fc e8 e2 f6 ff ff 59 59 .h..@..u......YY
ff 75 e8 ff 15 34 20 40 00 85 c0 74 1c ff 15 28 .u...4 @...t...(
20 40 00 50 68 78 2e 40 00 68 44 2e 40 00 ff 75 @.Phx.@.hD.@..u
fc e8 ba f6 ff ff 83 c4 10 ff 75 fc ff 15 14 20 ..........u....
40 00 85 c0 75 1c ff 15 28 20 40 00 50 68 9c 24 @...u...( @.Ph.$
40 00 68 44 2e 40 00 ff 75 fc e8 91 f6 ff ff 83 @.hD.@..u.......
c4 10 ff 75 f4 ff 15 30 20 40 00 cc 00 00 00 00 ...u...0 @......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
92 30 00 00 a6 30 00 00 84 30 00 00 00 00 00 00 .0...0...0......
c4 30 00 00 d4 30 00 00 e2 30 00 00 f4 30 00 00 .0...0...0...0..
04 31 00 00 1a 31 00 00 28 31 00 00 38 31 00 00 .1...1..(1..81..
46 31 00 00 54 31 00 00 60 31 00 00 72 31 00 00 F1..T1..`1..r1..
00 00 00 00 90 31 00 00 00 00 00 00 b2 31 00 00 .....1.......1..
00 00 00 00 00 00 00 00 71 00 77 00 6f 00 72 00 ........q.w.o.r.
64 00 3a 00 00 00 00 00 68 00 65 00 78 00 28 00 d.:.....h.e.x.(.
61 00 29 00 3a 00 00 00 68 00 65 00 78 00 28 00 a.).:...h.e.x.(.
39 00 29 00 3a 00 00 00 68 00 65 00 78 00 28 00 9.).:...h.e.x.(.
38 00 29 00 3a 00 00 00 6d 00 75 00 6c 00 74 00 8.).:...m.u.l.t.
69 00 3a 00 00 00 00 00 6c 00 69 00 6e 00 6b 00 i.:.....l.i.n.k.
3a 00 00 00 64 00 77 00 6f 00 72 00 64 00 3a 00 :...d.w.o.r.d.:.
00 00 00 00 68 00 65 00 78 00 3a 00 00 00 00 00 ....h.e.x.:.....
65 00 78 00 70 00 61 00 6e 00 64 00 3a 00 00 00 e.x.p.a.n.d.:...
00 00 00 00 6e 00 6f 00 6e 00 65 00 3a 00 00 00 ....n.o.n.e.:...
51 00 57 00 4f 00 52 00 44 00 00 00 52 00 45 00 Q.W.O.R.D...R.E.
53 00 4f 00 55 00 52 00 43 00 45 00 5f 00 52 00 S.O.U.R.C.E._.R.
45 00 51 00 55 00 49 00 52 00 45 00 4d 00 45 00 E.Q.U.I.R.E.M.E.
4e 00 54 00 53 00 5f 00 4c 00 49 00 53 00 54 00 N.T.S._.L.I.S.T.
00 00 00 00 46 00 55 00 4c 00 4c 00 5f 00 52 00 ....F.U.L.L._.R.
45 00 53 00 4f 00 55 00 52 00 43 00 45 00 5f 00 E.S.O.U.R.C.E._.
44 00 45 00 53 00 43 00 52 00 49 00 50 00 54 00 D.E.S.C.R.I.P.T.
4f 00 52 00 00 00 00 00 52 00 45 00 53 00 4f 00 O.R.....R.E.S.O.
55 00 52 00 43 00 45 00 5f 00 4c 00 49 00 53 00 U.R.C.E._.L.I.S.
54 00 00 00 4d 00 55 00 4c 00 54 00 49 00 5f 00 T...M.U.L.T.I._.
53 00 5a 00 00 00 00 00 4c 00 49 00 4e 00 4b 00 S.Z.....L.I.N.K.
00 00 00 00 44 00 57 00 4f 00 52 00 44 00 5f 00 ....D.W.O.R.D._.
42 00 49 00 47 00 5f 00 45 00 4e 00 44 00 49 00 B.I.G._.E.N.D.I.
41 00 4e 00 00 00 00 00 44 00 57 00 4f 00 52 00 A.N.....D.W.O.R.
44 00 00 00 42 00 49 00 4e 00 41 00 52 00 59 00 D...B.I.N.A.R.Y.
00 00 00 00 45 00 58 00 50 00 41 00 4e 00 44 00 ....E.X.P.A.N.D.
5f 00 53 00 5a 00 00 00 53 00 5a 00 00 00 00 00 _.S.Z...S.Z.....
4e 00 4f 00 4e 00 45 00 00 00 00 00 00 00 00 00 N.O.N.E.........
48 00 4b 00 45 00 59 00 5f 00 43 00 55 00 52 00 H.K.E.Y._.C.U.R.
52 00 45 00 4e 00 54 00 5f 00 55 00 53 00 45 00 R.E.N.T._.U.S.E.
52 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 R._.L.O.C.A.L._.
53 00 45 00 54 00 54 00 49 00 4e 00 47 00 53 00 S.E.T.T.I.N.G.S.
00 00 00 00 48 00 4b 00 45 00 59 00 5f 00 44 00 ....H.K.E.Y._.D.
59 00 4e 00 5f 00 44 00 41 00 54 00 41 00 00 00 Y.N._.D.A.T.A...
48 00 4b 00 45 00 59 00 5f 00 43 00 55 00 52 00 H.K.E.Y._.C.U.R.
52 00 45 00 4e 00 54 00 5f 00 43 00 4f 00 4e 00 R.E.N.T._.C.O.N.
46 00 49 00 47 00 00 00 48 00 4b 00 45 00 59 00 F.I.G...H.K.E.Y.
5f 00 50 00 45 00 52 00 46 00 4f 00 52 00 4d 00 _.P.E.R.F.O.R.M.
41 00 4e 00 43 00 45 00 5f 00 44 00 41 00 54 00 A.N.C.E._.D.A.T.
41 00 00 00 48 00 4b 00 45 00 59 00 5f 00 55 00 A...H.K.E.Y._.U.
53 00 45 00 52 00 53 00 00 00 00 00 48 00 4b 00 S.E.R.S.....H.K.
45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 E.Y._.L.O.C.A.L.
5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 _.M.A.C.H.I.N.E.
00 00 00 00 48 00 4b 00 45 00 59 00 5f 00 43 00 ....H.K.E.Y._.C.
55 00 52 00 52 00 45 00 4e 00 54 00 5f 00 55 00 U.R.R.E.N.T._.U.
53 00 45 00 52 00 00 00 48 00 4b 00 45 00 59 00 S.E.R...H.K.E.Y.
5f 00 43 00 4c 00 41 00 53 00 53 00 45 00 53 00 _.C.L.A.S.S.E.S.
5f 00 52 00 4f 00 4f 00 54 00 00 00 28 23 40 00 _.R.O.O.T...(#@.
04 23 40 00 dc 22 40 00 c4 22 40 00 98 22 40 00 .#@.."@.."@.."@.
70 22 40 00 54 22 40 00 10 22 40 00 00 22 40 00 p"@.T"@.."@.."@.
f8 21 40 00 e4 21 40 00 d4 21 40 00 c8 21 40 00 .!@..!@..!@..!@.
a4 21 40 00 98 21 40 00 84 21 40 00 68 21 40 00 .!@..!@..!@.h!@.
34 21 40 00 fc 20 40 00 f0 20 40 00 e4 20 40 00 4!@.. @.. @.. @.
e0 20 40 00 d0 20 40 00 c4 20 40 00 b4 20 40 00 . @.. @.. @.. @.
b4 20 40 00 a8 20 40 00 98 20 40 00 88 20 40 00 . @.. @.. @.. @.
78 20 40 00 68 20 40 00 58 20 40 00 00 00 00 00 x @.h @.X @.....
53 00 69 00 67 00 6e 00 61 00 74 00 75 00 72 00 S.i.g.n.a.t.u.r.
65 00 20 00 27 00 50 00 52 00 65 00 67 00 5c 00 e. .'.P.R.e.g.\.
78 00 30 00 31 00 5c 00 30 00 5c 00 30 00 5c 00 x.0.1.\.0.\.0.\.
30 00 27 00 20 00 6d 00 69 00 73 00 73 00 69 00 0.'. .m.i.s.s.i.
6e 00 67 00 20 00 69 00 6e 00 20 00 66 00 69 00 n.g. .i.n. .f.i.
6c 00 65 00 20 00 27 00 25 00 6c 00 73 00 27 00 l.e. .'.%.l.s.'.
21 00 0a 00 00 00 00 00 25 00 6c 00 73 00 28 00 !.......%.l.s.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 20 00 66 00 6f 00 72 00 .%.l.u. .f.o.r.
20 00 66 00 69 00 6c 00 65 00 20 00 6d 00 61 00 .f.i.l.e. .m.a.
70 00 70 00 69 00 6e 00 67 00 20 00 27 00 25 00 p.p.i.n.g. .'.%.
6c 00 73 00 27 00 0a 00 00 00 00 00 43 00 6c 00 l.s.'.......C.l.
6f 00 73 00 65 00 48 00 61 00 6e 00 64 00 6c 00 o.s.e.H.a.n.d.l.
65 00 00 00 55 00 6e 00 6d 00 61 00 70 00 56 00 e...U.n.m.a.p.V.
69 00 65 00 77 00 4f 00 66 00 46 00 69 00 6c 00 i.e.w.O.f.F.i.l.
65 00 00 00 00 00 00 00 46 00 6f 00 72 00 6d 00 e.......F.o.r.m.
61 00 74 00 20 00 65 00 72 00 72 00 6f 00 72 00 a.t. .e.r.r.o.r.
20 00 69 00 6e 00 20 00 70 00 6f 00 6c 00 69 00 .i.n. .p.o.l.i.
63 00 79 00 20 00 66 00 69 00 6c 00 65 00 20 00 c.y. .f.i.l.e. .
27 00 25 00 6c 00 73 00 27 00 21 00 0a 00 00 00 '.%.l.s.'.!.....
25 00 6c 00 73 00 28 00 29 00 20 00 72 00 65 00 %.l.s.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 65 00 t.u.r.n.e.d. .e.
72 00 72 00 6f 00 72 00 20 00 25 00 6c 00 75 00 r.r.o.r. .%.l.u.
20 00 66 00 6f 00 72 00 20 00 72 00 65 00 67 00 .f.o.r. .r.e.g.
69 00 73 00 74 00 72 00 79 00 20 00 6b 00 65 00 i.s.t.r.y. .k.e.
79 00 20 00 27 00 25 00 6c 00 73 00 5c 00 25 00 y. .'.%.l.s.\.%.
6c 00 73 00 27 00 0a 00 00 00 00 00 52 00 65 00 l.s.'.......R.e.
67 00 43 00 6c 00 6f 00 73 00 65 00 4b 00 65 00 g.C.l.o.s.e.K.e.
79 00 00 00 00 00 00 00 4d 00 49 00 53 00 4d 00 y.......M.I.S.M.
41 00 54 00 43 00 48 00 3a 00 20 00 64 00 61 00 A.T.C.H.:. .d.a.
74 00 61 00 20 00 74 00 79 00 70 00 65 00 2c 00 t.a. .t.y.p.e.,.
20 00 73 00 69 00 7a 00 65 00 20 00 6f 00 72 00 .s.i.z.e. .o.r.
20 00 76 00 61 00 6c 00 75 00 65 00 20 00 69 00 .v.a.l.u.e. .i.
6e 00 20 00 70 00 6f 00 6c 00 69 00 63 00 79 00 n. .p.o.l.i.c.y.
20 00 66 00 69 00 6c 00 65 00 20 00 64 00 69 00 .f.i.l.e. .d.i.
66 00 66 00 65 00 72 00 73 00 20 00 66 00 72 00 f.f.e.r.s. .f.r.
6f 00 6d 00 20 00 72 00 65 00 67 00 69 00 73 00 o.m. .r.e.g.i.s.
74 00 72 00 79 00 21 00 0a 00 00 00 00 00 00 00 t.r.y.!.........
25 00 6c 00 73 00 28 00 29 00 20 00 72 00 65 00 %.l.s.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 65 00 t.u.r.n.e.d. .e.
72 00 72 00 6f 00 72 00 20 00 25 00 6c 00 75 00 r.r.o.r. .%.l.u.
20 00 66 00 6f 00 72 00 20 00 76 00 61 00 6c 00 .f.o.r. .v.a.l.
75 00 65 00 20 00 27 00 25 00 6c 00 73 00 27 00 u.e. .'.%.l.s.'.
20 00 6f 00 66 00 20 00 72 00 65 00 67 00 69 00 .o.f. .r.e.g.i.
73 00 74 00 72 00 79 00 20 00 6b 00 65 00 79 00 s.t.r.y. .k.e.y.
20 00 27 00 25 00 6c 00 73 00 5c 00 25 00 6c 00 .'.%.l.s.\.%.l.
73 00 27 00 0a 00 00 00 52 00 65 00 67 00 51 00 s.'.....R.e.g.Q.
75 00 65 00 72 00 79 00 56 00 61 00 6c 00 75 00 u.e.r.y.V.a.l.u.
65 00 45 00 78 00 00 00 52 00 65 00 67 00 4f 00 e.E.x...R.e.g.O.
70 00 65 00 6e 00 4b 00 65 00 79 00 45 00 78 00 p.e.n.K.e.y.E.x.
00 00 00 00 2c 00 25 00 6c 00 63 00 25 00 6c 00 ....,.%.l.c.%.l.
63 00 00 00 30 00 31 00 32 00 33 00 34 00 35 00 c...0.1.2.3.4.5.
36 00 37 00 38 00 39 00 61 00 62 00 63 00 64 00 6.7.8.9.a.b.c.d.
65 00 66 00 00 00 00 00 53 00 69 00 7a 00 65 00 e.f.....S.i.z.e.
20 00 25 00 6c 00 75 00 20 00 6f 00 66 00 20 00 .%.l.u. .o.f. .
52 00 45 00 47 00 5f 00 25 00 6c 00 73 00 20 00 R.E.G._.%.l.s. .
76 00 61 00 6c 00 75 00 65 00 20 00 64 00 61 00 v.a.l.u.e. .d.a.
74 00 61 00 20 00 6e 00 6f 00 74 00 20 00 65 00 t.a. .n.o.t. .e.
71 00 75 00 61 00 6c 00 20 00 6c 00 65 00 6e 00 q.u.a.l. .l.e.n.
67 00 74 00 68 00 20 00 25 00 6c 00 75 00 20 00 g.t.h. .%.l.u. .
6f 00 66 00 20 00 73 00 74 00 72 00 69 00 6e 00 o.f. .s.t.r.i.n.
67 00 20 00 70 00 6c 00 75 00 73 00 20 00 74 00 g. .p.l.u.s. .t.
65 00 72 00 6d 00 69 00 6e 00 61 00 74 00 69 00 e.r.m.i.n.a.t.i.
6e 00 67 00 20 00 27 00 4e 00 55 00 4c 00 27 00 n.g. .'.N.U.L.'.
20 00 63 00 68 00 61 00 72 00 61 00 63 00 74 00 .c.h.a.r.a.c.t.
65 00 72 00 21 00 0a 00 00 00 00 00 27 00 25 00 e.r.!.......'.%.
6c 00 73 00 27 00 0a 00 00 00 00 00 00 00 00 00 l.s.'...........
53 00 69 00 7a 00 65 00 20 00 25 00 6c 00 75 00 S.i.z.e. .%.l.u.
20 00 6f 00 66 00 20 00 52 00 45 00 47 00 5f 00 .o.f. .R.E.G._.
25 00 6c 00 73 00 20 00 76 00 61 00 6c 00 75 00 %.l.s. .v.a.l.u.
65 00 20 00 64 00 61 00 74 00 61 00 20 00 6e 00 e. .d.a.t.a. .n.
6f 00 74 00 20 00 65 00 71 00 75 00 61 00 6c 00 o.t. .e.q.u.a.l.
20 00 27 00 73 00 69 00 7a 00 65 00 6f 00 66 00 .'.s.i.z.e.o.f.
28 00 44 00 57 00 4f 00 52 00 44 00 29 00 27 00 (.D.W.O.R.D.).'.
21 00 0a 00 00 00 00 00 25 00 30 00 38 00 6c 00 !.......%.0.8.l.
78 00 0a 00 00 00 00 00 53 00 69 00 7a 00 65 00 x.......S.i.z.e.
20 00 25 00 6c 00 75 00 20 00 6f 00 66 00 20 00 .%.l.u. .o.f. .
52 00 45 00 47 00 5f 00 4d 00 55 00 4c 00 54 00 R.E.G._.M.U.L.T.
49 00 5f 00 53 00 5a 00 20 00 76 00 61 00 6c 00 I._.S.Z. .v.a.l.
75 00 65 00 20 00 64 00 61 00 74 00 61 00 20 00 u.e. .d.a.t.a. .
6e 00 6f 00 74 00 20 00 65 00 71 00 75 00 61 00 n.o.t. .e.q.u.a.
6c 00 20 00 73 00 75 00 6d 00 20 00 6f 00 66 00 l. .s.u.m. .o.f.
20 00 73 00 74 00 72 00 69 00 6e 00 67 00 20 00 .s.t.r.i.n.g. .
6c 00 65 00 6e 00 67 00 74 00 68 00 73 00 20 00 l.e.n.g.t.h.s. .
70 00 6c 00 75 00 73 00 20 00 74 00 65 00 72 00 p.l.u.s. .t.e.r.
6d 00 69 00 6e 00 61 00 74 00 69 00 6e 00 67 00 m.i.n.a.t.i.n.g.
20 00 27 00 4e 00 55 00 4c 00 27 00 20 00 63 00 .'.N.U.L.'. .c.
68 00 61 00 72 00 61 00 63 00 74 00 65 00 72 00 h.a.r.a.c.t.e.r.
73 00 21 00 0a 00 00 00 52 00 45 00 47 00 5f 00 s.!.....R.E.G._.
4d 00 55 00 4c 00 54 00 49 00 5f 00 53 00 5a 00 M.U.L.T.I._.S.Z.
20 00 76 00 61 00 6c 00 75 00 65 00 20 00 64 00 .v.a.l.u.e. .d.
61 00 74 00 61 00 20 00 6e 00 6f 00 74 00 20 00 a.t.a. .n.o.t. .
74 00 65 00 72 00 6d 00 69 00 6e 00 61 00 74 00 t.e.r.m.i.n.a.t.
65 00 64 00 20 00 77 00 69 00 74 00 68 00 20 00 e.d. .w.i.t.h. .
65 00 78 00 74 00 72 00 61 00 20 00 27 00 4e 00 e.x.t.r.a. .'.N.
55 00 4c 00 27 00 20 00 63 00 68 00 61 00 72 00 U.L.'. .c.h.a.r.
61 00 63 00 74 00 65 00 72 00 21 00 0a 00 00 00 a.c.t.e.r.!.....
0a 00 00 00 2c 00 27 00 25 00 6c 00 73 00 27 00 ....,.'.%.l.s.'.
00 00 00 00 00 00 00 00 53 00 69 00 7a 00 65 00 ........S.i.z.e.
20 00 25 00 6c 00 75 00 20 00 6f 00 66 00 20 00 .%.l.u. .o.f. .
52 00 45 00 47 00 5f 00 51 00 57 00 4f 00 52 00 R.E.G._.Q.W.O.R.
44 00 20 00 76 00 61 00 6c 00 75 00 65 00 20 00 D. .v.a.l.u.e. .
64 00 61 00 74 00 61 00 20 00 6e 00 6f 00 74 00 d.a.t.a. .n.o.t.
20 00 65 00 71 00 75 00 61 00 6c 00 20 00 27 00 .e.q.u.a.l. .'.
73 00 69 00 7a 00 65 00 6f 00 66 00 28 00 51 00 s.i.z.e.o.f.(.Q.
57 00 4f 00 52 00 44 00 29 00 27 00 21 00 0a 00 W.O.R.D.).'.!...
00 00 00 00 25 00 30 00 31 00 36 00 49 00 36 00 ....%.0.1.6.I.6.
34 00 78 00 0a 00 00 00 68 00 65 00 78 00 28 00 4.x.....h.e.x.(.
25 00 6c 00 78 00 29 00 3a 00 00 00 25 00 6c 00 %.l.x.).:...%.l.
73 00 00 00 27 00 25 00 6c 00 73 00 27 00 3d 00 s...'.%.l.s.'.=.
00 00 00 00 40 00 3d 00 00 00 00 00 27 00 25 00 ....@.=.....'.%.
6c 00 73 00 27 00 3d 00 2d 00 20 00 3b 00 20 00 l.s.'.=.-. .;. .
3d 00 00 00 40 00 3d 00 2d 00 20 00 3b 00 20 00 =...@.=.-. .;. .
3d 00 00 00 2a 00 2a 00 44 00 65 00 6c 00 2e 00 =...*.*.D.e.l...
00 00 00 00 2a 00 2a 00 64 00 65 00 6c 00 2e 00 ....*.*.d.e.l...
00 00 00 00 5b 00 2d 00 48 00 4b 00 45 00 59 00 ....[.-.H.K.E.Y.
5f 00 52 00 45 00 4c 00 41 00 54 00 49 00 56 00 _.R.E.L.A.T.I.V.
45 00 5c 00 25 00 6c 00 73 00 5c 00 25 00 6c 00 E.\.%.l.s.\.%.l.
73 00 5d 00 0a 00 00 00 2a 00 2a 00 44 00 65 00 s.].....*.*.D.e.
6c 00 65 00 74 00 65 00 6b 00 65 00 79 00 73 00 l.e.t.e.k.e.y.s.
00 00 00 00 2a 00 2a 00 64 00 65 00 6c 00 65 00 ....*.*.d.e.l.e.
74 00 65 00 6b 00 65 00 79 00 73 00 00 00 00 00 t.e.k.e.y.s.....
27 00 25 00 6c 00 73 00 27 00 3d 00 2d 00 0a 00 '.%.l.s.'.=.-...
00 00 00 00 2a 00 2a 00 44 00 65 00 6c 00 65 00 ....*.*.D.e.l.e.
74 00 65 00 76 00 61 00 6c 00 75 00 65 00 73 00 t.e.v.a.l.u.e.s.
00 00 00 00 2a 00 2a 00 64 00 65 00 6c 00 65 00 ....*.*.d.e.l.e.
74 00 65 00 76 00 61 00 6c 00 75 00 65 00 73 00 t.e.v.a.l.u.e.s.
00 00 00 00 2a 00 3d 00 2d 00 0a 00 00 00 00 00 ....*.=.-.......
2a 00 2a 00 44 00 65 00 6c 00 65 00 74 00 65 00 *.*.D.e.l.e.t.e.
76 00 61 00 6c 00 73 00 00 00 00 00 2a 00 2a 00 v.a.l.s.....*.*.
64 00 65 00 6c 00 65 00 74 00 65 00 76 00 61 00 d.e.l.e.t.e.v.a.
6c 00 73 00 00 00 00 00 3b 00 20 00 53 00 65 00 l.s.....;. .S.e.
63 00 75 00 72 00 65 00 4b 00 65 00 79 00 3d 00 c.u.r.e.K.e.y.=.
30 00 0a 00 00 00 00 00 2a 00 2a 00 53 00 65 00 0.......*.*.S.e.
63 00 75 00 72 00 65 00 4b 00 65 00 79 00 3d 00 c.u.r.e.K.e.y.=.
30 00 00 00 2a 00 2a 00 73 00 65 00 63 00 75 00 0...*.*.s.e.c.u.
72 00 65 00 6b 00 65 00 79 00 3d 00 30 00 00 00 r.e.k.e.y.=.0...
3b 00 20 00 53 00 65 00 63 00 75 00 72 00 65 00 ;. .S.e.c.u.r.e.
4b 00 65 00 79 00 3d 00 31 00 0a 00 00 00 00 00 K.e.y.=.1.......
2a 00 2a 00 53 00 65 00 63 00 75 00 72 00 65 00 *.*.S.e.c.u.r.e.
4b 00 65 00 79 00 3d 00 31 00 00 00 2a 00 2a 00 K.e.y.=.1...*.*.
73 00 65 00 63 00 75 00 72 00 65 00 6b 00 65 00 s.e.c.u.r.e.k.e.
79 00 3d 00 31 00 00 00 0a 00 5b 00 48 00 4b 00 y.=.1.....[.H.K.
45 00 59 00 5f 00 52 00 45 00 4c 00 41 00 54 00 E.Y._.R.E.L.A.T.
49 00 56 00 45 00 5c 00 25 00 6c 00 73 00 5d 00 I.V.E.\.%.l.s.].
0a 00 00 00 00 00 00 00 57 00 69 00 6e 00 64 00 ........W.i.n.d.
6f 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 o.w.s. .R.e.g.i.
73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 s.t.r.y. .E.d.i.
74 00 6f 00 72 00 20 00 56 00 65 00 72 00 73 00 t.o.r. .V.e.r.s.
69 00 6f 00 6e 00 20 00 35 00 2e 00 30 00 30 00 i.o.n. .5...0.0.
0a 00 0a 00 3b 00 20 00 52 00 65 00 67 00 69 00 ....;. .R.e.g.i.
73 00 74 00 72 00 79 00 20 00 50 00 6f 00 6c 00 s.t.r.y. .P.o.l.
69 00 63 00 79 00 20 00 46 00 69 00 6c 00 65 00 i.c.y. .F.i.l.e.
20 00 27 00 25 00 6c 00 73 00 27 00 0a 00 00 00 .'.%.l.s.'.....
4d 00 61 00 70 00 56 00 69 00 65 00 77 00 4f 00 M.a.p.V.i.e.w.O.
66 00 46 00 69 00 6c 00 65 00 00 00 43 00 72 00 f.F.i.l.e...C.r.
65 00 61 00 74 00 65 00 46 00 69 00 6c 00 65 00 e.a.t.e.F.i.l.e.
4d 00 61 00 70 00 70 00 69 00 6e 00 67 00 00 00 M.a.p.p.i.n.g...
25 00 6c 00 73 00 28 00 29 00 20 00 72 00 65 00 %.l.s.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 65 00 t.u.r.n.e.d. .e.
72 00 72 00 6f 00 72 00 20 00 25 00 6c 00 75 00 r.r.o.r. .%.l.u.
20 00 66 00 6f 00 72 00 20 00 66 00 69 00 6c 00 .f.o.r. .f.i.l.
65 00 20 00 27 00 25 00 6c 00 73 00 27 00 0a 00 e. .'.%.l.s.'...
00 00 00 00 47 00 65 00 74 00 46 00 69 00 6c 00 ....G.e.t.F.i.l.
65 00 53 00 69 00 7a 00 65 00 00 00 43 00 72 00 e.S.i.z.e...C.r.
65 00 61 00 74 00 65 00 46 00 69 00 6c 00 65 00 e.a.t.e.F.i.l.e.
00 00 00 00 25 00 6c 00 73 00 28 00 29 00 20 00 ....%.l.s.(.). .
72 00 65 00 74 00 75 00 72 00 6e 00 65 00 64 00 r.e.t.u.r.n.e.d.
20 00 65 00 72 00 72 00 6f 00 72 00 20 00 25 00 .e.r.r.o.r. .%.
6c 00 75 00 0a 00 00 00 4c 00 6f 00 63 00 61 00 l.u.....L.o.c.a.
6c 00 46 00 72 00 65 00 65 00 00 00 00 00 00 00 l.F.r.e.e.......
4e 00 6f 00 20 00 61 00 72 00 67 00 75 00 6d 00 N.o. .a.r.g.u.m.
65 00 6e 00 74 00 73 00 3a 00 20 00 61 00 74 00 e.n.t.s.:. .a.t.
20 00 6c 00 65 00 61 00 73 00 74 00 20 00 6f 00 .l.e.a.s.t. .o.
6e 00 65 00 20 00 27 00 2e 00 70 00 6f 00 6c 00 n.e. .'...p.o.l.
27 00 20 00 66 00 69 00 6c 00 65 00 20 00 6e 00 '. .f.i.l.e. .n.
61 00 6d 00 65 00 20 00 6d 00 75 00 73 00 74 00 a.m.e. .m.u.s.t.
20 00 62 00 65 00 20 00 67 00 69 00 76 00 65 00 .b.e. .g.i.v.e.
6e 00 21 00 0a 00 00 00 42 00 61 00 64 00 20 00 n.!.....B.a.d. .
61 00 72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 a.r.g.u.m.e.n.t.
73 00 3a 00 20 00 6f 00 70 00 74 00 69 00 6f 00 s.:. .o.p.t.i.o.
6e 00 61 00 6c 00 20 00 66 00 69 00 72 00 73 00 n.a.l. .f.i.r.s.
74 00 20 00 61 00 72 00 67 00 75 00 6d 00 65 00 t. .a.r.g.u.m.e.
6e 00 74 00 20 00 6d 00 75 00 73 00 74 00 20 00 n.t. .m.u.s.t. .
62 00 65 00 20 00 27 00 25 00 6c 00 73 00 27 00 b.e. .'.%.l.s.'.
20 00 6f 00 72 00 20 00 27 00 25 00 6c 00 73 00 .o.r. .'.%.l.s.
27 00 21 00 0a 00 00 00 2f 00 55 00 53 00 45 00 '.!...../.U.S.E.
52 00 00 00 2f 00 4d 00 41 00 43 00 48 00 49 00 R.../.M.A.C.H.I.
4e 00 45 00 00 00 00 00 43 00 6f 00 6d 00 6d 00 N.E.....C.o.m.m.
61 00 6e 00 64 00 4c 00 69 00 6e 00 65 00 54 00 a.n.d.L.i.n.e.T.
6f 00 41 00 72 00 67 00 76 00 00 00 30 30 00 00 o.A.r.g.v...00..
00 00 00 00 00 00 00 00 b6 30 00 00 00 20 00 00 .........0... ..
40 30 00 00 00 00 00 00 00 00 00 00 82 31 00 00 @0...........1..
10 20 00 00 74 30 00 00 00 00 00 00 00 00 00 00 . ..t0..........
a6 31 00 00 44 20 00 00 7c 30 00 00 00 00 00 00 .1..D ..|0......
00 00 00 00 c0 31 00 00 4c 20 00 00 00 00 00 00 .....1..L ......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
92 30 00 00 a6 30 00 00 84 30 00 00 00 00 00 00 .0...0...0......
c4 30 00 00 d4 30 00 00 e2 30 00 00 f4 30 00 00 .0...0...0...0..
04 31 00 00 1a 31 00 00 28 31 00 00 38 31 00 00 .1...1..(1..81..
46 31 00 00 54 31 00 00 60 31 00 00 72 31 00 00 F1..T1..`1..r1..
00 00 00 00 90 31 00 00 00 00 00 00 b2 31 00 00 .....1.......1..
00 00 00 00 30 02 52 65 67 43 6c 6f 73 65 4b 65 ....0.RegCloseKe
79 00 6e 02 52 65 67 51 75 65 72 79 56 61 6c 75 y.n.RegQueryValu
65 45 78 57 00 00 61 02 52 65 67 4f 70 65 6e 4b eExW..a.RegOpenK
65 79 45 78 57 00 41 44 56 41 50 49 33 32 2e 64 eyExW.ADVAPI32.d
6c 6c 00 00 24 05 57 72 69 74 65 43 6f 6e 73 6f ll..$.WriteConso
6c 65 57 00 52 00 43 6c 6f 73 65 48 61 6e 64 6c leW.R.CloseHandl
65 00 d6 04 55 6e 6d 61 70 56 69 65 77 4f 66 46 e...UnmapViewOfF
69 6c 65 00 57 03 4d 61 70 56 69 65 77 4f 66 46 ile.W.MapViewOfF
69 6c 65 00 8c 00 43 72 65 61 74 65 46 69 6c 65 ile...CreateFile
4d 61 70 70 69 6e 67 57 00 00 f0 01 47 65 74 46 MappingW....GetF
69 6c 65 53 69 7a 65 00 02 02 47 65 74 4c 61 73 ileSize...GetLas
74 45 72 72 6f 72 00 00 8f 00 43 72 65 61 74 65 tError....Create
46 69 6c 65 57 00 19 01 45 78 69 74 50 72 6f 63 FileW...ExitProc
65 73 73 00 48 03 4c 6f 63 61 6c 46 72 65 65 00 ess.H.LocalFree.
87 01 47 65 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 ..GetCommandLine
57 00 64 02 47 65 74 53 74 64 48 61 6e 64 6c 65 W.d.GetStdHandle
00 00 4b 45 52 4e 45 4c 33 32 2e 64 6c 6c 00 00 ..KERNEL32.dll..
06 00 43 6f 6d 6d 61 6e 64 4c 69 6e 65 54 6f 41 ..CommandLineToA
72 67 76 57 00 00 53 48 45 4c 4c 33 32 2e 64 6c rgvW..SHELL32.dl
6c 00 35 03 77 76 73 70 72 69 6e 74 66 57 00 00 l.5.wvsprintfW..
55 53 45 52 33 32 2e 64 6c 6c 00 00 00 00 00 00 USER32.dll......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file POLYGLOT.TXT
created in
step 3. to recreate the console application
Registry Policy Reader:
CERTUTIL.EXE /DecodeHex /V POLYGLOT.TXT POLYGLOT.COM
Input Length = 32640 Output Length = 7680 CertUtil: -decodehex command completed successfully.
offlineregistry hive formatted as .inf file in UTF-16LE encoding on
standard output(which must be redirected to a file or piped into an application that reads from
standard input, like Clip or More).
ORCloseHive()
ORCloseKey()
ORCreateHive()
ORCreateKey()
ORDeleteKey()
ORDeleteValue()
OREnumKey()
OREnumValue()
ORGetKeySecurity()
ORGetValue()
ORGetVersion()
ORGetVirtualFlags()
OROpenHive()
OROpenKey()
ORQueryInfoKey()
ORSaveHive()
ORSetKeySecurity()
ORSetValue()
ORSetVirtualFlags()
OFFREG.COM ‹input file name› >‹output file name› OFFREG.COM ‹input file name› | MORE.COM
Note: due to the design and implementation of
Windows’ (classic alias legacy) console, the
Win32 function
WriteConsole()
can only write to a console, not to a file nor a pipe, i.e.
redirection of standard error
is not supported!
The MSDN article Console Handles provides background information.
Create the text file OFFREG.C
with the following
content in an arbitrary, preferable empty directory:
// Copyright © 2004-2023, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <shellapi.h>
#include <sddl.h>
#include <offreg.h>
#define MAX_DEPTH 512UL
#define MAX_KEY_LENGTH 255UL
#define MAX_VALUE_NAME 16383UL
#define MAX_VALUE_DATA 1048576UL
typedef unsigned __int64 QWORD, *LPQWORD;
BYTE cbData[MAX_VALUE_DATA];
WCHAR szKey[(MAX_KEY_LENGTH + 1) * MAX_DEPTH];
WCHAR szValue[MAX_VALUE_NAME + 1];
__declspec(safebuffers)
BOOL PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
DWORD dwBuffer;
DWORD dwConsole;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
if (!WriteConsole(hConsole, szBuffer, dwBuffer, &dwConsole, NULL))
return FALSE;
return dwConsole == dwBuffer;
}
__declspec(safebuffers)
BOOL PrintFormat(HANDLE hFile, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
LPBYTE lpBuffer;
DWORD dwBuffer;
DWORD dwFile;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
dwBuffer *= sizeof(*szBuffer);
lpBuffer = (LPBYTE) szBuffer;
do
{
if (!WriteFile(hFile, lpBuffer, dwBuffer, &dwFile, (LPOVERLAPPED) NULL))
return FALSE;
lpBuffer += dwFile;
dwBuffer -= dwFile;
} while (dwBuffer > 0);
return TRUE;
}
#define PrintString(HANDLE, LITERAL) PrintDirect(HANDLE, LITERAL, sizeof(LITERAL) / sizeof(*LITERAL) - 1UL)
__inline
BOOL WINAPI PrintDirect(HANDLE hFile, LPCWSTR lpString, DWORD dwString)
{
DWORD dwFile;
dwString *= sizeof(*lpString);
do
{
if (!WriteFile(hFile, lpString, dwString, &dwFile, (LPOVERLAPPED) NULL))
return FALSE;
lpString = (LPCWSTR) ((LPBYTE) lpString + dwFile);
dwString -= dwFile;
} while (dwString > 0);
return TRUE;
}
__inline
LPCWSTR WINAPI InfEscape(LPCWSTR lpString)
{
do
if ((*lpString == L'"')
|| (*lpString == L'%'))
return lpString;
while (*lpString++ != L'\0');
return NULL;
}
#ifndef TINY
const WCHAR szBytes[256][4] = {L",00", L",01", L",02", L",03", L",04", L",05", L",06", L",07", L",08", L",09", L",0a", L",0b", L",0c", L",0d", L",0e", L",0f",
L",10", L",11", L",12", L",13", L",14", L",15", L",16", L",17", L",18", L",19", L",1a", L",1b", L",1c", L",1d", L",1e", L",1f",
L",20", L",21", L",22", L",23", L",24", L",25", L",26", L",27", L",28", L",29", L",2a", L",2b", L",2c", L",2d", L",2e", L",2f",
L",30", L",31", L",32", L",33", L",34", L",35", L",36", L",37", L",38", L",39", L",3a", L",3b", L",3c", L",3d", L",3e", L",3f",
L",40", L",41", L",42", L",43", L",44", L",45", L",46", L",47", L",48", L",49", L",4a", L",4b", L",4c", L",4d", L",4e", L",4f",
L",50", L",51", L",52", L",53", L",54", L",55", L",56", L",57", L",58", L",59", L",5a", L",5b", L",5c", L",5d", L",5e", L",5f",
L",60", L",61", L",62", L",63", L",64", L",65", L",66", L",67", L",68", L",69", L",6a", L",6b", L",6c", L",6d", L",6e", L",6f",
L",70", L",71", L",72", L",73", L",74", L",75", L",76", L",77", L",78", L",79", L",7a", L",7b", L",7c", L",7d", L",7e", L",7f",
L",80", L",81", L",82", L",83", L",84", L",85", L",86", L",87", L",88", L",89", L",8a", L",8b", L",8c", L",8d", L",8e", L",8f",
L",90", L",91", L",92", L",93", L",94", L",95", L",96", L",97", L",98", L",99", L",9a", L",9b", L",9c", L",9d", L",9e", L",9f",
L",a0", L",a1", L",a2", L",a3", L",a4", L",a5", L",a6", L",a7", L",a8", L",a9", L",aa", L",ab", L",ac", L",ad", L",ae", L",af",
L",b0", L",b1", L",b2", L",b3", L",b4", L",b5", L",b6", L",b7", L",b8", L",b9", L",ba", L",bb", L",bc", L",bd", L",be", L",bf",
L",c0", L",c1", L",c2", L",c3", L",c4", L",c5", L",c6", L",c7", L",c8", L",c9", L",ca", L",cb", L",cc", L",cd", L",ce", L",cf",
L",d0", L",d1", L",d2", L",d3", L",d4", L",d5", L",d6", L",d7", L",d8", L",d9", L",da", L",db", L",dc", L",dd", L",de", L",df",
L",e0", L",e1", L",e2", L",e3", L",e4", L",e5", L",e6", L",e7", L",e8", L",e9", L",ea", L",eb", L",ec", L",ed", L",ee", L",ef",
L",f0", L",f1", L",f2", L",f3", L",f4", L",f5", L",f6", L",f7", L",f8", L",f9", L",fa", L",fb", L",fc", L",fd", L",fe", L",ff"};
#endif
const LPCWSTR szType[12] = {L"NONE",
L"SZ",
L"EXPAND_SZ",
L"BINARY",
L"DWORD", // alias DWORD_LITTLE_ENDIAN
L"DWORD_BIG_ENDIAN",
L"LINK",
L"MULTI_SZ",
L"RESOURCE_LIST",
L"FULL_RESOURCE_DESCRIPTOR",
L"RESOURCE_REQUIREMENTS_LIST",
L"QWORD"}; // alias QWORD_LITTLE_ENDIAN
DWORD WINAPI Offline(HANDLE hConsole, HANDLE hOutput, ORHKEY hkKey, DWORD dwKey)
{
BOOL bOutput;
ORHKEY hkSubKey;
LPCWSTR lpSubKey = szKey + dwKey + 1;
LPCWSTR lpData, lpEscape, lpLast, lpMulti;
#ifdef SANITY
LPCWSTR lpCount;
DWORD dwCount, dwChars;
#endif
DWORD dwError;
DWORD dwSubKeys, dwSubKey;
DWORD dwValues, dwValue, dwType, dwData, dwBytes;
#ifdef SECURITY
dwData = sizeof(cbData);
dwError = ORGetKeySecurity(hkKey,
OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION | LABEL_SECURITY_INFORMATION,
cbData,
&dwData);
if (dwError != ERROR_SUCCESS)
PrintConsole(hConsole,
L"ORGetKeySecurity() returned error %lu for registry key \'%ls\'\n",
dwError, szKey);
else
if (!ConvertSecurityDescriptorToStringSecurityDescriptor(cbData,
SDDL_REVISION_1,
OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION | LABEL_SECURITY_INFORMATION,
&lpData,
(LPDWORD) NULL))
PrintConsole(hConsole,
L"ConvertSecurityDescriptorToStringSecurityDescriptor() returned error %lu for registry key \'%ls\'\n",
dwError = GetLastError(), szKey);
else
{
if (dwKey < sizeof("HKEY_OFFLINE"))
bOutput = PrintString(hOutput,
L"HKO,,,%REG_KEYONLY%\r\n");
else
bOutput = PrintFormat(hOutput,
L"HKO,\"%ls\",,%%REG_KEYONLY%%\r\n",
szKey + sizeof("HKEY_OFFLINE"));
bOutput &= PrintString(hOutput, L"; ");
bOutput &= PrintDirect(hOutput, lpData, wcslen(lpData));
bOutput &= PrintString(hOutput, L"\r\n");
if (!bOutput)
PrintConsole(hConsole,
L"WriteFile() returned error %lu for registry key \'%ls\'\n",
dwError = GetLastError(), szKey);
if (LocalFree(lpData) != NULL)
PrintConsole(hConsole,
L"LocalFree() returned error %lu\n",
GetLastError());
}
#endif
for (dwValues = 0;; dwValues++)
{
// *szValue = L'\0';
dwValue = sizeof(szValue) / sizeof(*szValue);
dwData = sizeof(cbData);
dwError = OREnumValue(hkKey,
dwValues,
szValue,
&dwValue,
&dwType,
cbData,
&dwData);
if (dwError == ERROR_NO_MORE_ITEMS)
break;
if (dwError != ERROR_SUCCESS)
PrintConsole(hConsole,
L"OREnumValue() returned error %lu for registry key \'%ls\'\n",
dwError, szKey);
else
{
#ifdef SANITY
dwChars = wcslen(szValue);
if (dwValue < dwChars)
PrintConsole(hConsole,
L"ERROR: size (%lu characters) of value name \'%ls\' in registry key \'%ls\' smaller than actual string length (%lu characters)!\n",
dwValue, szValue, dwChars, szKey);
else if (dwValue > dwChars)
PrintConsole(hConsole,
L"WARNING: size (%lu characters) of value name \'%ls\' in registry key \'%ls\' greater than actual string length (%lu characters)\n",
dwValue, szValue, dwChars, szKey);
if (dwData == 0)
PrintConsole(hConsole,
L"WARNING: no value data for value name \'%ls\' in registry key \'%ls\'\n",
szValue, szKey);
else
switch (dwType)
{
case REG_LINK:
if (dwData % sizeof(L'\0'))
PrintConsole(hConsole,
L"ERROR: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' not a multiple of WCHAR size!\n",
dwData, szValue, szKey);
break;
case REG_DWORD_BIG_ENDIAN:
case REG_DWORD_LITTLE_ENDIAN:
// case REG_DWORD:
if (dwData < sizeof(DWORD))
PrintConsole(hConsole,
L"ERROR: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' smaller than DWORD size!\n",
dwData, szValue, szKey);
else if (dwData > sizeof(DWORD))
PrintConsole(hConsole,
L"WARNING: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' greater than DWORD size\n",
dwData, szValue, szKey);
break;
case REG_QWORD_LITTLE_ENDIAN:
// case REG_QWORD:
if (dwData < sizeof(QWORD))
PrintConsole(hConsole,
L"ERROR: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' smaller than QWORD size!\n",
dwData, szValue, szKey);
else if (dwData > sizeof(QWORD))
PrintConsole(hConsole,
L"WARNING: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' greater than QWORD size\n",
dwData, szValue, szKey);
break;
case REG_SZ:
case REG_EXPAND_SZ:
dwChars = wcslen((LPCWSTR) cbData);
dwBytes = (dwChars + 1) * sizeof(L'\0');
if (dwData < dwBytes)
PrintConsole(hConsole,
L"ERROR: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' smaller than actual string length (%lu + 1 characters = %lu bytes)\n",
dwData, szValue, szKey, dwChars, dwBytes);
else if (dwData > dwBytes)
PrintConsole(hConsole,
L"WARNING: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' greater than actual string length (%lu + 1 characters = %lu bytes)\n",
dwData, szValue, szKey, dwChars, dwBytes);
break;
case REG_MULTI_SZ:
dwChars = 0;
dwCount = 1;
lpCount = (LPCWSTR) cbData;
while (*lpCount != L'\0')
{
dwChars += wcslen(lpCount);
dwCount++;
lpCount += wcslen(lpCount) + 1;
}
dwBytes = (dwChars + dwCount) * sizeof(L'\0');
if (dwData < dwBytes)
PrintConsole(hConsole,
L"ERROR: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' smaller than sum of actual string lengths (%lu + %lu characters = %lu bytes)\n",
dwData, szValue, szKey, dwChars, dwCount, dwBytes);
else if (dwData > dwBytes)
PrintConsole(hConsole,
L"WARNING: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' greater than sum of actual string lengths (%lu + %lu characters = %lu bytes)\n",
dwData, szValue, szKey, dwChars, dwCount, dwBytes);
break;
// case REG_NONE:
// case REG_BINARY:
// case REG_RESOURCE_LIST:
// case REG_FULL_RESOURCE_DESCRIPTOR:
// case REG_RESOURCE_REQUIREMENTS_LIST:
}
#ifdef UNKNOWN
if (dwType > REG_QWORD)
PrintConsole(hConsole,
L"WARNING: unknown data type (0x%08lx) for value name \'%ls\' in registry key \'%ls\'\n",
dwType, szValue, szKey);
#endif
#endif // SANITY
if (dwKey < sizeof("HKEY_OFFLINE"))
bOutput = PrintFormat(hOutput,
L"HKO,,");
else
bOutput = PrintFormat(hOutput,
L"HKO,\"%ls\",",
szKey + sizeof("HKEY_OFFLINE"));
if (dwType < sizeof(szType) / sizeof(*szType))
if (dwValue == 0)
bOutput &= PrintFormat(hOutput, L",%%REG_%ls%%", szType[dwType]);
else
bOutput &= PrintFormat(hOutput, L"\"%ls\",%%REG_%ls%%", szValue, szType[dwType]);
else
if (dwValue == 0)
bOutput &= PrintFormat(hOutput, L",0x%08lx", dwType);
else
bOutput &= PrintFormat(hOutput, L"\"%ls\",0x%08lx", szValue, dwType);
if (dwData == 0)
bOutput &= PrintString(hOutput, L"\r\n");
else
switch (dwType)
{
case REG_LINK:
if (dwData % sizeof(L'\0'))
goto DEFAULT;
bOutput &= PrintString(hOutput, L",\"");
bOutput &= PrintDirect(hOutput, (LPCWSTR) cbData, dwData / sizeof(L'\0'));
bOutput &= PrintString(hOutput, L"\"\r\n");
break;
case REG_SZ:
case REG_EXPAND_SZ:
if (dwData % sizeof(L'\0'))
goto DEFAULT;
if (*(LPCWSTR) cbData == L'\0')
bOutput &= PrintString(hOutput, L",\"\"\r\n");
else
{
lpData = (LPCWSTR) cbData;
((LPWSTR) lpData)[dwData / sizeof(L'\0')] = L'\0';
dwData = wcslen(lpData);
bOutput &= PrintString(hOutput, L",\"");
for (lpEscape = InfEscape(lpData); lpEscape != NULL; lpData = lpEscape, lpEscape = InfEscape(lpEscape + 1))
bOutput &= PrintDirect(hOutput, lpData, lpEscape + 1 - lpData);
bOutput &= PrintDirect(hOutput, lpData, (LPCWSTR) cbData + dwData - lpData);
bOutput &= PrintString(hOutput, L"\"\r\n");
}
break;
case REG_MULTI_SZ:
if (dwData % sizeof(L'\0'))
goto DEFAULT;
if ((dwData == sizeof(L'\0'))
&& (*(LPCWSTR) cbData == L'\0'))
bOutput &= PrintString(hOutput, L";\r\n");
else
{
lpData = (LPCWSTR) cbData;
dwData /= sizeof(L'\0');
lpLast = lpData + dwData;
if ((dwData > 1)
&& (lpData[dwData - 1] == L'\0')
&& (lpData[dwData - 2] == L'\0'))
lpLast--;
else
*(LPWSTR) lpLast = L'\0';
do
if (*lpData == L'\0')
bOutput &= PrintString(hOutput, L";\"\"");
else
{
dwData = wcslen(lpData);
bOutput &= PrintString(hOutput, L",\"");
for (lpEscape = InfEscape(lpMulti = lpData), lpData += dwData;
lpEscape != NULL; lpMulti = lpEscape,
lpEscape = InfEscape(lpEscape + 1))
bOutput &= PrintDirect(hOutput, lpMulti, lpEscape + 1 - lpMulti);
bOutput &= PrintDirect(hOutput, lpMulti, lpData - lpMulti);
bOutput &= PrintString(hOutput, L"\"");
}
while (++lpData < lpLast);
bOutput &= PrintString(hOutput, L"\r\n");
}
break;
case REG_DWORD_BIG_ENDIAN:
if (dwData != sizeof(DWORD))
goto DEFAULT;
#if 0
bOutput &= PrintFormat(hOutput, L",%lu\r\n", _byteswap_ulong(*(LPDWORD) cbData));
#else
bOutput &= PrintFormat(hOutput, L",%lu ; 0x%08lx\r\n", _byteswap_ulong(*(LPDWORD) cbData), *(LPDWORD) cbData);
#endif
break;
case REG_DWORD_LITTLE_ENDIAN:
// case REG_DWORD:
if (dwData != sizeof(DWORD))
goto DEFAULT;
#if 0
bOutput &= PrintFormat(hOutput, L",%lu\r\n", *(LPDWORD) cbData);
#else
bOutput &= PrintFormat(hOutput, L",%lu ; 0x%08lx\r\n", *(LPDWORD) cbData, *(LPDWORD) cbData);
#endif
break;
case REG_QWORD_LITTLE_ENDIAN:
// case REG_QWORD:
if (dwData != sizeof(QWORD))
goto DEFAULT;
#if 0
bOutput &= PrintFormat(hOutput, L",%I64u\r\n", *(LPQWORD) cbData);
#else
bOutput &= PrintFormat(hOutput, L",%I64u ; 0x%016I64x\r\n", *(LPQWORD) cbData, *(LPQWORD) cbData);
#endif
break;
// case REG_NONE:
// case REG_BINARY:
// case REG_RESOURCE_LIST:
// case REG_FULL_RESOURCE_DESCRIPTOR:
// case REG_RESOURCE_REQUIREMENTS_LIST:
default:
DEFAULT:
for (dwBytes = 0; dwBytes < dwData; dwBytes++)
#ifdef TINY
bOutput &= PrintFormat(hOutput, L",%02x", cbData[dwBytes]);
#else
bOutput &= PrintDirect(hOutput, szBytes[cbData[dwBytes]], 3);
#endif
bOutput &= PrintString(hOutput, L"\r\n");
}
if (!bOutput)
PrintConsole(hConsole,
L"WriteFile() returned error %lu for value \'%ls\' of registry key \'%ls\'\n",
dwError = GetLastError(), szValue, szKey);
}
}
for (dwSubKeys = 0;; dwSubKeys++)
{
dwSubKey = sizeof(szKey) / sizeof(*szKey) - dwKey - 1;
dwError = OREnumKey(hkKey,
dwSubKeys,
lpSubKey,
&dwSubKey,
(LPWSTR) NULL,
(LPDWORD) NULL,
(LPFILETIME) NULL);
if (dwError == ERROR_NO_MORE_ITEMS)
break;
if (dwError != ERROR_SUCCESS)
PrintConsole(hConsole,
L"OREnumKey() returned error %lu for registry key \'%ls\'\n",
dwError, szKey);
else
{
#ifdef SANITY
dwChars = wcslen(lpSubKey);
if (dwChars > dwSubKey)
PrintConsole(hConsole,
L"ERROR: size (%lu characters) of subkey name \'%ls\' in registry key \'%ls\' smaller than actual string length (%lu characters)\n",
dwSubKey, lpSubKey, szKey, dwChars);
else if (dwChars < dwSubKey)
PrintConsole(hConsole,
L"WARNING: size (%lu characters) of subkey name \'%ls\' in registry key \'%ls\' greater than actual string length (%lu characters)\n",
dwSubKey, lpSubKey, szKey, dwChars);
#endif // SANITY
szKey[dwKey] = L'\\';
dwError = OROpenKey(hkKey,
lpSubKey,
&hkSubKey);
if (dwError != ERROR_SUCCESS)
PrintConsole(hConsole,
L"OROpenKey() returned error %lu for registry key \'%ls\'\n",
dwError, szKey);
else
{
dwError = Offline(hConsole, hOutput, hkSubKey, dwKey + 1 + dwSubKey);
dwValue = ORCloseKey(hkSubKey);
if (dwValue != ERROR_SUCCESS)
PrintConsole(hConsole,
L"ORCloseKey() returned error %lu for registry key \'%ls\'\n",
dwValue, szKey);
}
szKey[dwKey] = L'\0';
}
}
#ifndef SECURITY
if ((dwValues == 0) && (dwSubKeys == 0))
{
if (dwKey < sizeof("HKEY_OFFLINE"))
bOutput = PrintString(hOutput,
L"HKO,,,%REG_KEYONLY%\r\n");
else
bOutput = PrintFormat(hOutput,
L"HKO,\"%ls\",,%%REG_KEYONLY%%\r\n",
szKey + sizeof("HKEY_OFFLINE"));
if (!bOutput)
PrintConsole(hConsole,
L"WriteFile() returned error %lu for empty registry key \'%ls\'\n",
dwError = GetLastError(), szKey);
}
#endif
return dwError;
}
__declspec(noreturn)
VOID WINAPI wmainCRTStartup(VOID)
{
SYSTEMTIME st;
LPWSTR *lpArguments;
INT nArguments;
DWORD dwError = ERROR_BAD_ARGUMENTS;
DWORD dwMajor, dwMinor;
HKEY hkRoot;
HANDLE hOutput;
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole == INVALID_HANDLE_VALUE)
dwError = GetLastError();
else
{
lpArguments = CommandLineToArgvW(GetCommandLine(), &nArguments);
if (lpArguments == NULL)
PrintConsole(hConsole,
L"CommandLineToArgv() returned error %lu\n",
dwError = GetLastError());
else
{
if (nArguments != 2)
PrintConsole(hConsole,
L"Bad arguments: a single file or path name of a registry hive must be given!\n");
else
{
hOutput = GetStdHandle(STD_OUTPUT_HANDLE);
if (hOutput == INVALID_HANDLE_VALUE)
PrintConsole(hConsole,
L"GetStdHandle() returned error %lu\n",
dwError = GetLastError());
else
{
if (!FlushFileBuffers(hOutput))
PrintConsole(hConsole,
L"FlushFileBuffers() returned error %lu: standard output is not redirected to a file!\n",
dwError = GetLastError());
else
{
ORGetVersion(&dwMajor, &dwMinor);
PrintConsole(hConsole,
L"OFFREG.DLL version %lu.%lu\n",
dwMajor, dwMinor);
dwError = OROpenHive(lpArguments[1], &hkRoot);
if (dwError != ERROR_SUCCESS)
PrintConsole(hConsole,
L"OROpenHive() returned error %lu\n",
dwError);
else
{
GetSystemTime(&st);
if (!PrintFormat(hOutput,
L"\xFEFF" // UTF-16LE BOM
L"[Version]\r\n"
L"DriverVer = %02hu/%02hu/%04hu,%02hu.%02hu.%02hu.%03hu ; UTC\r\n"
L"Provider = \"Stefan Kanthak\"\r\n"
L"Signature = \"$Windows NT$\"\r\n"
L"\r\n"
L"[Strings]\r\n"
L"REG_SZ = 0x00000000\r\n"
L"REG_BINARY = 0x00000001\r\n"
L"REG_KEYONLY = 0x00000010\r\n"
L"REG_MULTI_SZ = 0x00010000\r\n"
L"REG_DWORD = 0x00010001\r\n"
L"REG_EXPAND_SZ = 0x00020000\r\n"
L"REG_NONE = 0x00020001\r\n"
L"REG_COMPATIBLE = 0x00030001 ; same as REG_BINARY\r\n"
L"REG_DWORD_LITTLE_ENDIAN = 0x00040001 ; same as REG_DWORD\r\n"
L"REG_DWORD_BIG_ENDIAN = 0x00050001\r\n"
L"REG_LINK = 0x00060000\r\n"
L"REG_RESOURCE_LIST = 0x00080001\r\n"
L"REG_FULL_RESOURCE_DESCRIPTOR = 0x00090001\r\n"
L"REG_RESOURCE_REQUIREMENTS_LIST = 0x000a0001\r\n"
L"REG_QWORD = 0x000b0001\r\n"
L"REG_QWORD_LITTLE_ENDIAN = 0x000b0001 ; same as REG_QWORD\r\n"
L"\r\n"
L"[DefaultInstall.NT]\r\n"
L";AddReg = AddReg.HKO\r\n"
L"\r\n"
L"[AddReg.HKO]\r\n",
st.wMonth, st.wDay, st.wYear, st.wHour, st.wMinute, st.wSecond, st.wMilliseconds))
PrintConsole(hConsole,
L"WriteFile() returned error %lu\n",
dwError = GetLastError());
memcpy(szKey, L"HKEY_OFFLINE", sizeof(L"HKEY_OFFLINE"));
dwError = Offline(hConsole, hOutput, hkRoot, sizeof("HKEY_OFFLINE") - 1);
if (!PrintString(hOutput,
L"\r\n"
L"; EOF\r\n"))
PrintConsole(hConsole,
L"WriteFile() returned error %lu\n",
dwError = GetLastError());
dwError = ORCloseHive(hkRoot);
if (dwError != ERROR_SUCCESS)
PrintConsole(hConsole,
L"ORCloseHive() returned error %lu\n",
dwError);
}
}
if (!CloseHandle(hOutput))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
}
if (LocalFree(lpArguments) != NULL)
PrintConsole(hConsole,
L"LocalFree() returned error %lu\n",
GetLastError());
}
if (!CloseHandle(hConsole))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
ExitProcess(dwError);
}
Note: with the preprocessor macro
SANITY
defined, several consistency and sanity checks
regarding the size of key and value names as well as value data and
value data types are performed.
Note: with the preprocessor macro
SECURITY
defined, the
security descriptors
of enumerated keys are printed in
Security Descriptor Definition Language
notation.
Note: with the preprocessor macro TINY
defined, the application gets 2036 bytes smaller, but also a little
slower!
Run the following four command lines to compile the source file
OFFREG.C
created in step 1., link the compiled
object file OFFREG.OBJ
and cleanup afterwards:
SET CL=/GA /GF /GS /Gy /O1 /Oi /Os /Oy /W4 /Zl SET LINK=/DEFAULTLIB:ADVAPI32.LIB /DEFAULTLIB:KERNEL32.LIB /DEFAULTLIB:OFFREG.LIB /DEFAULTLIB:SHELL32.LIB /DEFAULTLIB:USER32.LIB /ENTRY:mainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /OSVERSION:5.0 /RELEASE /SUBSYSTEM:CONSOLE /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /FeOFFREG.COM OFFREG.C ERASE OFFREG.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. OFFREG.C OFFREG.C(520) : warning C4090: 'function' : different 'const' qualifiers Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Finally execute the console application
OFFREG.COM
built in step 2. to dump the contents of the registry hive
%SystemDrive%\Users\Default\NTUSER.DAT
to the file
ntuser.inf
and display it afterwards:
VER .\OFFREG.COM "%SystemDrive%\Users\Default\NTUSER.DAT" 1>ntuser.inf NET.EXE HelpMsg %ERRORLEVEL% TYPE ntuser.infNet services commands Ver
Microsoft Windows [Version 10.0.19041] OFFREG.DLL version 1.0 The operation completed successfully. [Version] DriverVer = 08/15/2021,12.34.56.789 ; UTC Provider = "Stefan Kanthak" Signature = "$Windows NT$" [Strings] REG_SZ = 0x00000000 REG_BINARY = 0x00000001 REG_KEYONLY = 0x00000010 REG_MULTI_SZ = 0x00010000 REG_DWORD = 0x00010001 REG_EXPAND_SZ = 0x00020000 REG_NONE = 0x00020001 REG_COMPATIBLE = 0x00030001 ; same as REG_BINARY REG_DWORD_LITTLE_ENDIAN = 0x00040001 ; same as REG_DWORD REG_DWORD_BIG_ENDIAN = 0x00050001 REG_LINK = 0x00060000 REG_RESOURCE_LIST = 0x00080001 REG_FULL_RESOURCE_DESCRIPTOR = 0x00090001 REG_RESOURCE_REQUIREMENTS_LIST = 0x000a0001 REG_QWORD = 0x000b0001 REG_QWORD_LITTLE_ENDIAN = 0x000b0001 ; same as REG_QWORD [DefaultInstall.NT] ;AddReg = AddReg.HKO [AddReg.HKO] HKO,"AppEvents\EventLabels\.Default",,%REG_SZ%,"Default Beep" HKO,"AppEvents\EventLabels\.Default","DispFileName",%REG_SZ%,"@mmres.dll,-5824" HKO,"AppEvents\EventLabels\ActivatingDocument",,%REG_SZ%,"Complete Navigation" HKO,"AppEvents\EventLabels\ActivatingDocument","DispFileName",%REG_SZ%,"@ieframe.dll,-10321" HKO,"AppEvents\EventLabels\AppGPFault",,%REG_SZ%,"Program Error" HKO,"AppEvents\EventLabels\AppGPFault","DispFileName",%REG_SZ%,"@mmres.dll,-5825" HKO,"AppEvents\EventLabels\BlockedPopup",,%REG_SZ%,"Blocked Pop-up Window" HKO,"AppEvents\EventLabels\BlockedPopup","DispFileName",%REG_SZ%,"@ieframe.dll,-10325" HKO,"AppEvents\EventLabels\CCSelect",,%REG_SZ%,"Select" HKO,"AppEvents\EventLabels\CCSelect","DispFileName",%REG_SZ%,"@ieframe.dll,-10323" HKO,"AppEvents\EventLabels\ChangeTheme",,%REG_SZ%,"Change Theme" HKO,"AppEvents\EventLabels\ChangeTheme","DispFileName",%REG_SZ%,"@mmres.dll,-5860" HKO,"AppEvents\EventLabels\Close",,%REG_SZ%,"Close Program" HKO,"AppEvents\EventLabels\Close","DispFileName",%REG_SZ%,"@mmres.dll,-5826" HKO,"AppEvents\EventLabels\CriticalBatteryAlarm",,%REG_SZ%,"Critical Battery Alarm" HKO,"AppEvents\EventLabels\CriticalBatteryAlarm","DispFileName",%REG_SZ%,"@mmres.dll,-5827" HKO,"AppEvents\EventLabels\DeviceConnect",,%REG_SZ%,"Device Connect" HKO,"AppEvents\EventLabels\DeviceConnect","DispFileName",%REG_SZ%,"@mmres.dll,-5828" HKO,"AppEvents\EventLabels\DeviceDisconnect",,%REG_SZ%,"Device Disconnect" HKO,"AppEvents\EventLabels\DeviceDisconnect","DispFileName",%REG_SZ%,"@mmres.dll,-5829" HKO,"AppEvents\EventLabels\DeviceFail",,%REG_SZ%,"Device Failed to Connect" HKO,"AppEvents\EventLabels\DeviceFail","DispFileName",%REG_SZ%,"@mmres.dll,-5830" HKO,"AppEvents\EventLabels\DisNumbersSound",,%REG_SZ%,"Disambiguation Numbers" HKO,"AppEvents\EventLabels\DisNumbersSound","DispFileName",%REG_SZ%,"@C:\Windows\System32\speech\speechux\sapi.cpl,-5566" HKO,"AppEvents\EventLabels\EmptyRecycleBin",,%REG_SZ%,"Empty Recycle Bin" HKO,"AppEvents\EventLabels\EmptyRecycleBin","DispFileName",%REG_SZ%,"@mmres.dll,-5831" HKO,"AppEvents\EventLabels\FaxBeep",,%REG_SZ%,"New Fax Notification" HKO,"AppEvents\EventLabels\FaxBeep","DispFileName",%REG_SZ%,"@mmres.dll,-5858" HKO,"AppEvents\EventLabels\FeedDiscovered",,%REG_SZ%,"Feed Discovered" HKO,"AppEvents\EventLabels\FeedDiscovered","DispFileName",%REG_SZ%,"@ieframe.dll,-17315" HKO,"AppEvents\EventLabels\HubOffSound",,%REG_SZ%,"Off" HKO,"AppEvents\EventLabels\HubOffSound","DispFileName",%REG_SZ%,"@C:\Windows\System32\speech\speechux\sapi.cpl,-5563" HKO,"AppEvents\EventLabels\HubOnSound",,%REG_SZ%,"On" HKO,"AppEvents\EventLabels\HubOnSound","DispFileName",%REG_SZ%,"@C:\Windows\System32\speech\speechux\sapi.cpl,-5562" HKO,"AppEvents\EventLabels\HubSleepSound",,%REG_SZ%,"Sleep" HKO,"AppEvents\EventLabels\HubSleepSound","DispFileName",%REG_SZ%,"@C:\Windows\System32\speech\speechux\sapi.cpl,-5564" HKO,"AppEvents\EventLabels\LowBatteryAlarm",,%REG_SZ%,"Low Battery Alarm" HKO,"AppEvents\EventLabels\LowBatteryAlarm","DispFileName",%REG_SZ%,"@mmres.dll,-5832" HKO,"AppEvents\EventLabels\MailBeep",,%REG_SZ%,"Desktop Mail Notification" HKO,"AppEvents\EventLabels\MailBeep","DispFileName",%REG_SZ%,"@mmres.dll,-5837" HKO,"AppEvents\EventLabels\Maximize",,%REG_SZ%,"Maximize" HKO,"AppEvents\EventLabels\Maximize","DispFileName",%REG_SZ%,"@mmres.dll,-5833" HKO,"AppEvents\EventLabels\MenuCommand",,%REG_SZ%,"Menu Command" HKO,"AppEvents\EventLabels\MenuCommand","DispFileName",%REG_SZ%,"@mmres.dll,-5834" HKO,"AppEvents\EventLabels\MenuPopup",,%REG_SZ%,"Menu Pop-up" HKO,"AppEvents\EventLabels\MenuPopup","DispFileName",%REG_SZ%,"@mmres.dll,-5835" HKO,"AppEvents\EventLabels\MessageNudge",,%REG_SZ%,"Message Nudge" HKO,"AppEvents\EventLabels\MessageNudge","DispFileName",%REG_SZ%,"@mmres.dll,-5866" HKO,"AppEvents\EventLabels\Minimize",,%REG_SZ%,"Minimize" HKO,"AppEvents\EventLabels\Minimize","DispFileName",%REG_SZ%,"@mmres.dll,-5836" HKO,"AppEvents\EventLabels\MisrecoSound",,%REG_SZ%,"Misrecognition" HKO,"AppEvents\EventLabels\MisrecoSound","DispFileName",%REG_SZ%,"@C:\Windows\System32\speech\speechux\sapi.cpl,-5561" HKO,"AppEvents\EventLabels\MoveMenuItem",,%REG_SZ%,"Move Menu Item" HKO,"AppEvents\EventLabels\MoveMenuItem","DispFileName",%REG_SZ%,"@ieframe.dll,-10322" HKO,"AppEvents\EventLabels\Navigating",,%REG_SZ%,"Start Navigation" HKO,"AppEvents\EventLabels\Navigating","DispFileName",%REG_SZ%,"@ieframe.dll,-10320" HKO,"AppEvents\EventLabels\Notification.Default",,%REG_SZ%,"Notification" HKO,"AppEvents\EventLabels\Notification.Default","DispFileName",%REG_SZ%,"@mmres.dll,-5865" HKO,"AppEvents\EventLabels\Notification.IM",,%REG_SZ%,"Instant Message Notification" HKO,"AppEvents\EventLabels\Notification.IM","DispFileName",%REG_SZ%,"@mmres.dll,-5863" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm",,%REG_SZ%,"Alarm 1" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm","DispFileName",%REG_SZ%,"@mmres.dll,-5888" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Alarm10",,%REG_SZ%,"Alarm 10" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm10","DispFileName",%REG_SZ%,"@mmres.dll,-5897" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm10","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Alarm2",,%REG_SZ%,"Alarm 2" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm2","DispFileName",%REG_SZ%,"@mmres.dll,-5889" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm2","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Alarm3",,%REG_SZ%,"Alarm 3" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm3","DispFileName",%REG_SZ%,"@mmres.dll,-5890" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm3","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Alarm4",,%REG_SZ%,"Alarm 4" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm4","DispFileName",%REG_SZ%,"@mmres.dll,-5891" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm4","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Alarm5",,%REG_SZ%,"Alarm 5" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm5","DispFileName",%REG_SZ%,"@mmres.dll,-5892" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm5","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Alarm6",,%REG_SZ%,"Alarm 6" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm6","DispFileName",%REG_SZ%,"@mmres.dll,-5893" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm6","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Alarm7",,%REG_SZ%,"Alarm 7" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm7","DispFileName",%REG_SZ%,"@mmres.dll,-5894" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm7","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Alarm8",,%REG_SZ%,"Alarm 8" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm8","DispFileName",%REG_SZ%,"@mmres.dll,-5895" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm8","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Alarm9",,%REG_SZ%,"Alarm 9" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm9","DispFileName",%REG_SZ%,"@mmres.dll,-5896" HKO,"AppEvents\EventLabels\Notification.Looping.Alarm9","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Call",,%REG_SZ%,"Incoming Call Notification 1" HKO,"AppEvents\EventLabels\Notification.Looping.Call","DispFileName",%REG_SZ%,"@mmres.dll,-5872" HKO,"AppEvents\EventLabels\Notification.Looping.Call","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Call10",,%REG_SZ%,"Incoming Call Notification 10" HKO,"AppEvents\EventLabels\Notification.Looping.Call10","DispFileName",%REG_SZ%,"@mmres.dll,-5881" HKO,"AppEvents\EventLabels\Notification.Looping.Call10","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Call2",,%REG_SZ%,"Incoming Call Notification 2" HKO,"AppEvents\EventLabels\Notification.Looping.Call2","DispFileName",%REG_SZ%,"@mmres.dll,-5873" HKO,"AppEvents\EventLabels\Notification.Looping.Call2","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Call3",,%REG_SZ%,"Incoming Call Notification 3" HKO,"AppEvents\EventLabels\Notification.Looping.Call3","DispFileName",%REG_SZ%,"@mmres.dll,-5874" HKO,"AppEvents\EventLabels\Notification.Looping.Call3","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Call4",,%REG_SZ%,"Incoming Call Notification 4" HKO,"AppEvents\EventLabels\Notification.Looping.Call4","DispFileName",%REG_SZ%,"@mmres.dll,-5875" HKO,"AppEvents\EventLabels\Notification.Looping.Call4","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Call5",,%REG_SZ%,"Incoming Call Notification 5" HKO,"AppEvents\EventLabels\Notification.Looping.Call5","DispFileName",%REG_SZ%,"@mmres.dll,-5876" HKO,"AppEvents\EventLabels\Notification.Looping.Call5","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Call6",,%REG_SZ%,"Incoming Call Notification 6" HKO,"AppEvents\EventLabels\Notification.Looping.Call6","DispFileName",%REG_SZ%,"@mmres.dll,-5877" HKO,"AppEvents\EventLabels\Notification.Looping.Call6","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Call7",,%REG_SZ%,"Incoming Call Notification 7" HKO,"AppEvents\EventLabels\Notification.Looping.Call7","DispFileName",%REG_SZ%,"@mmres.dll,-5878" HKO,"AppEvents\EventLabels\Notification.Looping.Call7","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Call8",,%REG_SZ%,"Incoming Call Notification 8" HKO,"AppEvents\EventLabels\Notification.Looping.Call8","DispFileName",%REG_SZ%,"@mmres.dll,-5879" HKO,"AppEvents\EventLabels\Notification.Looping.Call8","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Looping.Call9",,%REG_SZ%,"Incoming Call Notification 9" HKO,"AppEvents\EventLabels\Notification.Looping.Call9","DispFileName",%REG_SZ%,"@mmres.dll,-5880" HKO,"AppEvents\EventLabels\Notification.Looping.Call9","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\Notification.Mail",,%REG_SZ%,"New Mail Notification" HKO,"AppEvents\EventLabels\Notification.Mail","DispFileName",%REG_SZ%,"@mmres.dll,-5861" HKO,"AppEvents\EventLabels\Notification.Proximity",,%REG_SZ%,"NFP Completion" HKO,"AppEvents\EventLabels\Notification.Proximity","DispFileName",%REG_SZ%,"@mmres.dll,-5868" HKO,"AppEvents\EventLabels\Notification.Reminder",,%REG_SZ%,"Calendar Reminder" HKO,"AppEvents\EventLabels\Notification.Reminder","DispFileName",%REG_SZ%,"@mmres.dll,-5864" HKO,"AppEvents\EventLabels\Notification.SMS",,%REG_SZ%,"New Text Message Notification" HKO,"AppEvents\EventLabels\Notification.SMS","DispFileName",%REG_SZ%,"@mmres.dll,-5862" HKO,"AppEvents\EventLabels\Open",,%REG_SZ%,"Open Program" HKO,"AppEvents\EventLabels\Open","DispFileName",%REG_SZ%,"@mmres.dll,-5839" HKO,"AppEvents\EventLabels\PanelSound",,%REG_SZ%,"Disambiguation Panel" HKO,"AppEvents\EventLabels\PanelSound","DispFileName",%REG_SZ%,"@C:\Windows\System32\speech\speechux\sapi.cpl,-5565" HKO,"AppEvents\EventLabels\PrintComplete",,%REG_SZ%,"Print Complete" HKO,"AppEvents\EventLabels\PrintComplete","DispFileName",%REG_SZ%,"@mmres.dll,-5840" HKO,"AppEvents\EventLabels\ProximityConnection",,%REG_SZ%,"NFP Connection" HKO,"AppEvents\EventLabels\ProximityConnection","DispFileName",%REG_SZ%,"@mmres.dll,-5867" HKO,"AppEvents\EventLabels\RestoreDown",,%REG_SZ%,"Restore Down" HKO,"AppEvents\EventLabels\RestoreDown","DispFileName",%REG_SZ%,"@mmres.dll,-5841" HKO,"AppEvents\EventLabels\RestoreUp",,%REG_SZ%,"Restore Up" HKO,"AppEvents\EventLabels\RestoreUp","DispFileName",%REG_SZ%,"@mmres.dll,-5842" HKO,"AppEvents\EventLabels\SecurityBand",,%REG_SZ%,"Information Bar" HKO,"AppEvents\EventLabels\SecurityBand","DispFileName",%REG_SZ%,"@ieframe.dll,-10326" HKO,"AppEvents\EventLabels\ShowBand",,%REG_SZ%,"Show Toolbar Band" HKO,"AppEvents\EventLabels\ShowBand","DispFileName",%REG_SZ%,"@ieframe.dll,-10324" HKO,"AppEvents\EventLabels\SystemAsterisk",,%REG_SZ%,"Asterisk" HKO,"AppEvents\EventLabels\SystemAsterisk","DispFileName",%REG_SZ%,"@mmres.dll,-5843" HKO,"AppEvents\EventLabels\SystemExclamation",,%REG_SZ%,"Exclamation" HKO,"AppEvents\EventLabels\SystemExclamation","DispFileName",%REG_SZ%,"@mmres.dll,-5845" HKO,"AppEvents\EventLabels\SystemExit",,%REG_SZ%,"Exit Windows" HKO,"AppEvents\EventLabels\SystemExit","DispFileName",%REG_SZ%,"@mmres.dll,-5846" HKO,"AppEvents\EventLabels\SystemExit","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\SystemHand",,%REG_SZ%,"Critical Stop" HKO,"AppEvents\EventLabels\SystemHand","DispFileName",%REG_SZ%,"@mmres.dll,-5847" HKO,"AppEvents\EventLabels\SystemNotification",,%REG_SZ%,"System Notification" HKO,"AppEvents\EventLabels\SystemNotification","DispFileName",%REG_SZ%,"@mmres.dll,-5848" HKO,"AppEvents\EventLabels\SystemQuestion",,%REG_SZ%,"Question" HKO,"AppEvents\EventLabels\SystemQuestion","DispFileName",%REG_SZ%,"@mmres.dll,-5849" HKO,"AppEvents\EventLabels\WindowsLogoff",,%REG_SZ%,"Windows Logoff" HKO,"AppEvents\EventLabels\WindowsLogoff","DispFileName",%REG_SZ%,"@mmres.dll,-5852" HKO,"AppEvents\EventLabels\WindowsLogoff","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\WindowsLogon",,%REG_SZ%,"Windows Logon" HKO,"AppEvents\EventLabels\WindowsLogon","DispFileName",%REG_SZ%,"@mmres.dll,-5853" HKO,"AppEvents\EventLabels\WindowsLogon","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\EventLabels\WindowsUAC",,%REG_SZ%,"Windows User Account Control" HKO,"AppEvents\EventLabels\WindowsUAC","DispFileName",%REG_SZ%,"@mmres.dll,-5859" HKO,"AppEvents\EventLabels\WindowsUnlock",,%REG_SZ%,"Windows Unlock" HKO,"AppEvents\EventLabels\WindowsUnlock","DispFileName",%REG_SZ%,"@mmres.dll,-5869" HKO,"AppEvents\EventLabels\WindowsUnlock","ExcludeFromCPL",%REG_DWORD%,1 ; 0x00000001 HKO,"AppEvents\Schemes",,%REG_SZ%,".Default" HKO,"AppEvents\Schemes\Apps\.Default",,%REG_SZ%,"Windows" HKO,"AppEvents\Schemes\Apps\.Default","DispFileName",%REG_SZ%,"@mmres.dll,-5856" HKO,"AppEvents\Schemes\Apps\.Default\.Default\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Background.wav" HKO,"AppEvents\Schemes\Apps\.Default\.Default\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Background.wav" HKO,"AppEvents\Schemes\Apps\.Default\AppGPFault\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\AppGPFault\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\CCSelect",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\ChangeTheme\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\ChangeTheme\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\Close\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\Close\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Foreground.wav" HKO,"AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Foreground.wav" HKO,"AppEvents\Schemes\Apps\.Default\DeviceConnect\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Hardware Insert.wav" HKO,"AppEvents\Schemes\Apps\.Default\DeviceConnect\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Hardware Insert.wav" HKO,"AppEvents\Schemes\Apps\.Default\DeviceDisconnect\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Hardware Remove.wav" HKO,"AppEvents\Schemes\Apps\.Default\DeviceDisconnect\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Hardware Remove.wav" HKO,"AppEvents\Schemes\Apps\.Default\DeviceFail\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Hardware Fail.wav" HKO,"AppEvents\Schemes\Apps\.Default\DeviceFail\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Hardware Fail.wav" HKO,"AppEvents\Schemes\Apps\.Default\FaxBeep\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Notify Email.wav" HKO,"AppEvents\Schemes\Apps\.Default\FaxBeep\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Notify Email.wav" HKO,"AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Background.wav" HKO,"AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Background.wav" HKO,"AppEvents\Schemes\Apps\.Default\MailBeep\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Notify Email.wav" HKO,"AppEvents\Schemes\Apps\.Default\MailBeep\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Notify Email.wav" HKO,"AppEvents\Schemes\Apps\.Default\Maximize\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\Maximize\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\MenuCommand\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\MenuCommand\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\MenuPopup\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\MenuPopup\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\MessageNudge\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Message Nudge.wav" HKO,"AppEvents\Schemes\Apps\.Default\MessageNudge\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Message Nudge.wav" HKO,"AppEvents\Schemes\Apps\.Default\Minimize\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\Minimize\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\Notification.Default\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Notify System Generic.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Default\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Notify System Generic.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.IM\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Notify Messaging.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.IM\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Notify Messaging.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm01.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm01.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm10\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm10.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm10\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm10.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm2\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm02.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm2\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm02.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm3\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm03.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm3\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm03.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm4\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm04.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm4\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm04.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm5\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm05.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm5\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm05.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm6\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm06.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm6\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm06.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm7\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm07.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm7\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm07.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm8\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm08.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm8\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm08.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm9\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm09.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm9\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Alarm09.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring01.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring01.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call10\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring10.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call10\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring10.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call2\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring02.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call2\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring02.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call3\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring03.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call3\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring03.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call4\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring04.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call4\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring04.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call5\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring05.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call5\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring05.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call6\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring06.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call6\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring06.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call7\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring07.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call7\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring07.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call8\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring08.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call8\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring08.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call9\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring09.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Looping.Call9\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Ring09.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Mail\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Notify Email.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Mail\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Notify Email.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Proximity\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Proximity Notification.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Proximity\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Proximity Notification.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Reminder\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Notify Calendar.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.Reminder\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Notify Calendar.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.SMS\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Notify Messaging.wav" HKO,"AppEvents\Schemes\Apps\.Default\Notification.SMS\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Notify Messaging.wav" HKO,"AppEvents\Schemes\Apps\.Default\Open\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\Open\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\PrintComplete\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\PrintComplete\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\ProximityConnection\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Proximity Connection.wav" HKO,"AppEvents\Schemes\Apps\.Default\ProximityConnection\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Proximity Connection.wav" HKO,"AppEvents\Schemes\Apps\.Default\RestoreDown\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\RestoreDown\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\RestoreUp\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\RestoreUp\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\ShowBand",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\SystemAsterisk\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Background.wav" HKO,"AppEvents\Schemes\Apps\.Default\SystemAsterisk\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Background.wav" HKO,"AppEvents\Schemes\Apps\.Default\SystemExclamation\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Background.wav" HKO,"AppEvents\Schemes\Apps\.Default\SystemExclamation\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Background.wav" HKO,"AppEvents\Schemes\Apps\.Default\SystemExit\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\SystemExit\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\SystemHand\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Foreground.wav" HKO,"AppEvents\Schemes\Apps\.Default\SystemHand\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Foreground.wav" HKO,"AppEvents\Schemes\Apps\.Default\SystemNotification\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Background.wav" HKO,"AppEvents\Schemes\Apps\.Default\SystemNotification\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Background.wav" HKO,"AppEvents\Schemes\Apps\.Default\SystemQuestion\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\SystemQuestion\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\WindowsLogoff\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\WindowsLogoff\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\.Default\WindowsLogon\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Logon.wav" HKO,"AppEvents\Schemes\Apps\.Default\WindowsLogon\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Logon.wav" HKO,"AppEvents\Schemes\Apps\.Default\WindowsUAC\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows User Account Control.wav" HKO,"AppEvents\Schemes\Apps\.Default\WindowsUAC\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows User Account Control.wav" HKO,"AppEvents\Schemes\Apps\.Default\WindowsUnlock\.Current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Unlock.wav" HKO,"AppEvents\Schemes\Apps\.Default\WindowsUnlock\.Default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Windows Unlock.wav" HKO,"AppEvents\Schemes\Apps\Explorer",,%REG_SZ%,"File Explorer" HKO,"AppEvents\Schemes\Apps\Explorer","DispFileName",%REG_SZ%,"@mmres.dll,-5854" HKO,"AppEvents\Schemes\Apps\Explorer\ActivatingDocument",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\Explorer\BlockedPopup\.current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\Explorer\BlockedPopup\.default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\Explorer\FeedDiscovered\.current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\Explorer\FeedDiscovered\.default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\Explorer\MoveMenuItem",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\Explorer\Navigating\.Current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\Explorer\Navigating\.Default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\Explorer\SecurityBand\.current",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\Explorer\SecurityBand\.default",,%REG_KEYONLY% HKO,"AppEvents\Schemes\Apps\sapisvr",,%REG_SZ%,"Speech Recognition" HKO,"AppEvents\Schemes\Apps\sapisvr","DispFileName",%REG_SZ%,"@C:\Windows\System32\speech\speechux\sapi.cpl,-5555" HKO,"AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\.current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Speech Disambiguation.wav" HKO,"AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\.default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Speech Disambiguation.wav" HKO,"AppEvents\Schemes\Apps\sapisvr\HubOffSound\.current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Speech Off.wav" HKO,"AppEvents\Schemes\Apps\sapisvr\HubOffSound\.default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Speech Off.wav" HKO,"AppEvents\Schemes\Apps\sapisvr\HubOnSound\.current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Speech On.wav" HKO,"AppEvents\Schemes\Apps\sapisvr\HubOnSound\.default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Speech On.wav" HKO,"AppEvents\Schemes\Apps\sapisvr\HubSleepSound\.current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Speech Sleep.wav" HKO,"AppEvents\Schemes\Apps\sapisvr\HubSleepSound\.default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Speech Sleep.wav" HKO,"AppEvents\Schemes\Apps\sapisvr\MisrecoSound\.current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Speech Misrecognition.wav" HKO,"AppEvents\Schemes\Apps\sapisvr\MisrecoSound\.default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Speech Misrecognition.wav" HKO,"AppEvents\Schemes\Apps\sapisvr\PanelSound\.current",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Speech Disambiguation.wav" HKO,"AppEvents\Schemes\Apps\sapisvr\PanelSound\.default",,%REG_EXPAND_SZ%,"%%SystemRoot%%\media\Speech Disambiguation.wav" HKO,"AppEvents\Schemes\Names\.Default",,%REG_SZ%,"@mmres.dll,-800" HKO,"AppEvents\Schemes\Names\.None",,%REG_SZ%,"@mmres.dll,-801" HKO,"Console","ColorTable00",%REG_DWORD%,789516 ; 0x000c0c0c HKO,"Console","ColorTable01",%REG_DWORD%,14300928 ; 0x00da3700 HKO,"Console","ColorTable02",%REG_DWORD%,958739 ; 0x000ea113 HKO,"Console","ColorTable03",%REG_DWORD%,14521914 ; 0x00dd963a HKO,"Console","ColorTable04",%REG_DWORD%,2035653 ; 0x001f0fc5 HKO,"Console","ColorTable05",%REG_DWORD%,9967496 ; 0x00981788 HKO,"Console","ColorTable06",%REG_DWORD%,40129 ; 0x00009cc1 HKO,"Console","ColorTable07",%REG_DWORD%,13421772 ; 0x00cccccc HKO,"Console","ColorTable08",%REG_DWORD%,7763574 ; 0x00767676 HKO,"Console","ColorTable09",%REG_DWORD%,16742459 ; 0x00ff783b HKO,"Console","ColorTable10",%REG_DWORD%,837142 ; 0x000cc616 HKO,"Console","ColorTable11",%REG_DWORD%,14079585 ; 0x00d6d661 HKO,"Console","ColorTable12",%REG_DWORD%,5654759 ; 0x005648e7 HKO,"Console","ColorTable13",%REG_DWORD%,10354868 ; 0x009e00b4 HKO,"Console","ColorTable14",%REG_DWORD%,10875385 ; 0x00a5f1f9 HKO,"Console","ColorTable15",%REG_DWORD%,15921906 ; 0x00f2f2f2 HKO,"Console","CtrlKeyShortcutsDisabled",%REG_DWORD%,0 ; 0x00000000 HKO,"Console","CursorColor",%REG_DWORD%,4294967295 ; 0xffffffff HKO,"Console","CursorSize",%REG_DWORD%,25 ; 0x00000019 HKO,"Console","DefaultBackground",%REG_DWORD%,4294967295 ; 0xffffffff HKO,"Console","DefaultForeground",%REG_DWORD%,4294967295 ; 0xffffffff HKO,"Console","EnableColorSelection",%REG_DWORD%,0 ; 0x00000000 HKO,"Console","ExtendedEditKey",%REG_DWORD%,1 ; 0x00000001 HKO,"Console","ExtendedEditKeyCustom",%REG_DWORD%,0 ; 0x00000000 HKO,"Console","FaceName",%REG_SZ%,"__DefaultTTFont__" HKO,"Console","FilterOnPaste",%REG_DWORD%,1 ; 0x00000001 HKO,"Console","FontFamily",%REG_DWORD%,0 ; 0x00000000 HKO,"Console","FontSize",%REG_DWORD%,1048576 ; 0x00100000 HKO,"Console","FontWeight",%REG_DWORD%,0 ; 0x00000000 HKO,"Console","ForceV2",%REG_DWORD%,1 ; 0x00000001 HKO,"Console","FullScreen",%REG_DWORD%,0 ; 0x00000000 HKO,"Console","HistoryBufferSize",%REG_DWORD%,50 ; 0x00000032 HKO,"Console","HistoryNoDup",%REG_DWORD%,0 ; 0x00000000 HKO,"Console","InsertMode",%REG_DWORD%,1 ; 0x00000001 HKO,"Console","LineSelection",%REG_DWORD%,1 ; 0x00000001 HKO,"Console","LineWrap",%REG_DWORD%,1 ; 0x00000001 HKO,"Console","LoadConIme",%REG_DWORD%,1 ; 0x00000001 HKO,"Console","NumberOfHistoryBuffers",%REG_DWORD%,4 ; 0x00000004 HKO,"Console","PopupColors",%REG_DWORD%,245 ; 0x000000f5 HKO,"Console","QuickEdit",%REG_DWORD%,1 ; 0x00000001 HKO,"Console","ScreenBufferSize",%REG_DWORD%,589889656 ; 0x23290078 HKO,"Console","ScreenColors",%REG_DWORD%,7 ; 0x00000007 HKO,"Console","ScrollScale",%REG_DWORD%,1 ; 0x00000001 HKO,"Console","TerminalScrolling",%REG_DWORD%,0 ; 0x00000000 HKO,"Console","TrimLeadingZeros",%REG_DWORD%,0 ; 0x00000000 HKO,"Console","WindowAlpha",%REG_DWORD%,255 ; 0x000000ff HKO,"Console","WindowSize",%REG_DWORD%,1966200 ; 0x001e0078 HKO,"Console","WordDelimiters",%REG_DWORD%,0 ; 0x00000000 HKO,"Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe","ColorTable05",%REG_DWORD%,5645313 ; 0x00562401 HKO,"Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe","ColorTable06",%REG_DWORD%,15789550 ; 0x00f0edee HKO,"Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe","FaceName",%REG_SZ%,"Lucida Console" HKO,"Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe","FontFamily",%REG_DWORD%,54 ; 0x00000036 HKO,"Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe","FontWeight",%REG_DWORD%,400 ; 0x00000190 HKO,"Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe","PopupColors",%REG_DWORD%,243 ; 0x000000f3 HKO,"Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe","QuickEdit",%REG_DWORD%,1 ; 0x00000001 HKO,"Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe","ScreenBufferSize",%REG_DWORD%,196608120 ; 0x0bb80078 HKO,"Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe","ScreenColors",%REG_DWORD%,86 ; 0x00000056 HKO,"Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe","WindowSize",%REG_DWORD%,3276920 ; 0x00320078 HKO,"Console\%SystemRoot%_SysWOW64_WindowsPowerShell_v1.0_powershell.exe","ColorTable05",%REG_DWORD%,5645313 ; 0x00562401 HKO,"Console\%SystemRoot%_SysWOW64_WindowsPowerShell_v1.0_powershell.exe","ColorTable06",%REG_DWORD%,15789550 ; 0x00f0edee HKO,"Console\%SystemRoot%_SysWOW64_WindowsPowerShell_v1.0_powershell.exe","FaceName",%REG_SZ%,"Lucida Console" HKO,"Console\%SystemRoot%_SysWOW64_WindowsPowerShell_v1.0_powershell.exe","FontFamily",%REG_DWORD%,54 ; 0x00000036 HKO,"Console\%SystemRoot%_SysWOW64_WindowsPowerShell_v1.0_powershell.exe","FontWeight",%REG_DWORD%,400 ; 0x00000190 HKO,"Console\%SystemRoot%_SysWOW64_WindowsPowerShell_v1.0_powershell.exe","PopupColors",%REG_DWORD%,243 ; 0x000000f3 HKO,"Console\%SystemRoot%_SysWOW64_WindowsPowerShell_v1.0_powershell.exe","QuickEdit",%REG_DWORD%,1 ; 0x00000001 HKO,"Console\%SystemRoot%_SysWOW64_WindowsPowerShell_v1.0_powershell.exe","ScreenBufferSize",%REG_DWORD%,196608120 ; 0x0bb80078 HKO,"Console\%SystemRoot%_SysWOW64_WindowsPowerShell_v1.0_powershell.exe","ScreenColors",%REG_DWORD%,86 ; 0x00000056 HKO,"Console\%SystemRoot%_SysWOW64_WindowsPowerShell_v1.0_powershell.exe","WindowSize",%REG_DWORD%,3276920 ; 0x00320078 HKO,"Control Panel\Accessibility","MessageDuration",%REG_DWORD%,5 ; 0x00000005 HKO,"Control Panel\Accessibility","MinimumHitRadius",%REG_DWORD%,0 ; 0x00000000 HKO,"Control Panel\Accessibility\AudioDescription","Locale",%REG_SZ%,"" HKO,"Control Panel\Accessibility\AudioDescription","On",%REG_SZ%,"0" HKO,"Control Panel\Accessibility\Blind Access","On",%REG_SZ%,"0" HKO,"Control Panel\Accessibility\HighContrast","Flags",%REG_SZ%,"126" HKO,"Control Panel\Accessibility\HighContrast","High Contrast Scheme",%REG_SZ%,"" HKO,"Control Panel\Accessibility\Keyboard Preference","On",%REG_SZ%,"0" HKO,"Control Panel\Accessibility\Keyboard Response","AutoRepeatDelay",%REG_SZ%,"1000" HKO,"Control Panel\Accessibility\Keyboard Response","AutoRepeatRate",%REG_SZ%,"500" HKO,"Control Panel\Accessibility\Keyboard Response","BounceTime",%REG_SZ%,"0" HKO,"Control Panel\Accessibility\Keyboard Response","DelayBeforeAcceptance",%REG_SZ%,"1000" HKO,"Control Panel\Accessibility\Keyboard Response","Flags",%REG_SZ%,"126" HKO,"Control Panel\Accessibility\Keyboard Response","Last BounceKey Setting",%REG_DWORD%,0 ; 0x00000000 HKO,"Control Panel\Accessibility\Keyboard Response","Last Valid Delay",%REG_DWORD%,0 ; 0x00000000 HKO,"Control Panel\Accessibility\Keyboard Response","Last Valid Repeat",%REG_DWORD%,0 ; 0x00000000 HKO,"Control Panel\Accessibility\Keyboard Response","Last Valid Wait",%REG_DWORD%,1000 ; 0x000003e8 HKO,"Control Panel\Accessibility\MouseKeys","Flags",%REG_SZ%,"62" HKO,"Control Panel\Accessibility\MouseKeys","MaximumSpeed",%REG_SZ%,"80" HKO,"Control Panel\Accessibility\MouseKeys","TimeToMaximumSpeed",%REG_SZ%,"3000" HKO,"Control Panel\Accessibility\On","Locale",%REG_DWORD%,0 ; 0x00000000 HKO,"Control Panel\Accessibility\On","On",%REG_DWORD%,0 ; 0x00000000 HKO,"Control Panel\Accessibility\ShowSounds","On",%REG_SZ%,"0" HKO,"Control Panel\Accessibility\SlateLaunch","ATapp",%REG_SZ%,"narrator" HKO,"Control Panel\Accessibility\SlateLaunch","LaunchAT",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\Accessibility\SoundSentry","Flags",%REG_SZ%,"2" HKO,"Control Panel\Accessibility\SoundSentry","FSTextEffect",%REG_SZ%,"0" HKO,"Control Panel\Accessibility\SoundSentry","TextEffect",%REG_SZ%,"0" HKO,"Control Panel\Accessibility\SoundSentry","WindowsEffect",%REG_SZ%,"1" HKO,"Control Panel\Accessibility\StickyKeys","Flags",%REG_SZ%,"510" HKO,"Control Panel\Accessibility\TimeOut","Flags",%REG_SZ%,"2" HKO,"Control Panel\Accessibility\TimeOut","TimeToWait",%REG_SZ%,"300000" HKO,"Control Panel\Accessibility\ToggleKeys","Flags",%REG_SZ%,"62" HKO,"Control Panel\Appearance\New Schemes",,%REG_KEYONLY% HKO,"Control Panel\Appearance\Schemes","@themeui.dll,-850",%REG_BINARY%,02,00,00,00,46,00,00,00,01,00,00,00,11,00,00,00,11,00,00,00,14,00,00,00,14,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,fc,7f,22,14,fc,7f,b0,fe,12,00,00,00,00,00,00,00,00,00,98,23,eb,77,0f,00,00,00,0f,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,f0,77,00,20,14,00,00,00,00,10,80,05,14,00,f0,1f,14,00,00,00,14,00,12,00,00,00,12,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,14,00,88,fb,e8,77,02,02,00,00,ac,b9,f0,77,00,00,00,00,20,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,7c,6b,e8,77,00,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,00,00,06,00,00,00,18,00,00,00,ff,ff,ff,ff,f0,4b,21,fc,00,c4,f0,77,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,14,00,0b,00,00,00,00,ff,12,00,50,00,00,00,c0,fe,12,00,0c,10,00,01,00,00,00,00,00,00,00,00,00,00,ff,00,00,ff,ff,00,00,00,00,00,00,00,00,00,ff,ff,ff,00,ff,ff,ff,00,ff,ff,00,00,ff,ff,ff,00,00,00,ff,00,00,ff,ff,00,00,00,00,00,00,80,00,00,ff,ff,ff,00,00,00,00,00,80,80,80,00,00,ff,00,00,ff,ff,ff,00,00,00,00,00,c0,c0,c0,00,ff,ff,ff,00,ff,ff,ff,00,ff,ff,00,00,00,00,00,00,c0,c0,c0,00,80,80,ff,00,00,00,ff,00,00,ff,ff,00 HKO,"Control Panel\Appearance\Schemes","@themeui.dll,-851",%REG_BINARY%,02,00,00,00,46,00,00,00,01,00,00,00,11,00,00,00,11,00,00,00,14,00,00,00,14,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,fc,7f,22,14,fc,7f,b0,fe,12,00,00,00,00,00,00,00,00,00,98,23,eb,77,0f,00,00,00,0f,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,f0,77,00,20,14,00,00,00,00,10,80,05,14,00,f0,1f,14,00,00,00,14,00,12,00,00,00,12,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,14,00,88,fb,e8,77,02,02,00,00,ac,b9,f0,77,00,00,00,00,20,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,7c,6b,e8,77,00,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,00,00,06,00,00,00,18,00,00,00,ff,ff,ff,ff,f0,4b,21,fc,00,c4,f0,77,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,14,00,0b,00,00,00,00,ff,12,00,50,00,00,00,c0,fe,12,00,0c,10,00,01,00,00,00,00,00,00,00,00,00,ff,ff,00,00,00,ff,00,00,00,00,00,00,00,00,00,ff,ff,ff,00,00,ff,00,00,00,ff,00,00,00,00,00,00,00,ff,ff,00,00,00,ff,00,ff,ff,ff,00,00,00,ff,00,ff,ff,ff,00,00,00,00,00,80,80,80,00,c0,c0,c0,00,00,ff,00,00,ff,ff,ff,00,c0,c0,c0,00,ff,ff,ff,00,ff,ff,ff,00,00,00,00,00,ff,ff,00,00,c0,c0,c0,00,80,80,ff,00,00,ff,ff,00,00,00,ff,00 HKO,"Control Panel\Appearance\Schemes","@themeui.dll,-852",%REG_BINARY%,02,00,00,00,46,00,00,00,01,00,00,00,11,00,00,00,11,00,00,00,14,00,00,00,14,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,fc,7f,22,14,fc,7f,b0,fe,12,00,00,00,00,00,00,00,00,00,98,23,eb,77,0f,00,00,00,0f,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,f0,77,00,20,14,00,00,00,00,10,80,05,14,00,f0,1f,14,00,00,00,14,00,12,00,00,00,12,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,14,00,88,fb,e8,77,02,02,00,00,ac,b9,f0,77,00,00,00,00,20,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,7c,6b,e8,77,00,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,00,00,06,00,00,00,18,00,00,00,ff,ff,ff,ff,f0,4b,21,fc,00,c4,f0,77,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,14,00,0b,00,00,00,00,ff,12,00,50,00,00,00,c0,fe,12,00,0c,10,00,01,00,00,00,00,00,00,00,00,80,00,80,00,00,80,00,00,00,00,00,00,00,00,00,00,ff,ff,ff,00,ff,ff,ff,00,ff,ff,ff,00,ff,ff,ff,00,ff,ff,00,00,00,80,00,00,00,00,00,00,80,00,80,00,ff,ff,ff,00,00,00,00,00,80,80,80,00,00,ff,00,00,ff,ff,ff,00,ff,ff,ff,00,c0,c0,c0,00,ff,ff,ff,00,ff,ff,ff,00,ff,ff,ff,00,00,00,00,00,c0,c0,c0,00,80,80,ff,00,80,00,80,00,00,80,00,00 HKO,"Control Panel\Appearance\Schemes","@themeui.dll,-853",%REG_BINARY%,02,00,00,00,46,00,00,00,01,00,00,00,11,00,00,00,11,00,00,00,14,00,00,00,14,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,fc,7f,22,14,fc,7f,b0,fe,12,00,00,00,00,00,00,00,00,00,98,23,eb,77,0f,00,00,00,0f,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,f0,77,00,20,14,00,00,00,00,10,80,05,14,00,f0,1f,14,00,00,00,14,00,12,00,00,00,12,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,14,00,88,fb,e8,77,02,02,00,00,ac,b9,f0,77,00,00,00,00,20,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,7c,6b,e8,77,00,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,00,00,06,00,00,00,18,00,00,00,ff,ff,ff,ff,f0,4b,21,fc,00,c4,f0,77,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,61,00,6e,00,73,00,20,00,53,00,65,00,72,00,69,00,66,00,00,00,14,00,0b,00,00,00,00,ff,12,00,50,00,00,00,c0,fe,12,00,0c,10,00,01,ff,ff,ff,00,ff,ff,ff,00,00,00,00,00,ff,ff,ff,00,ff,ff,ff,00,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,00,ff,ff,ff,00,80,80,80,00,c0,c0,c0,00,80,80,80,00,00,00,00,00,ff,ff,ff,00,ff,ff,ff,00,80,80,80,00,00,80,00,00,00,00,00,00,00,00,00,00,c0,c0,c0,00,00,00,00,00,c0,c0,c0,00,00,00,00,00,ff,ff,ff,00,c0,c0,c0,00,00,00,00,00,00,00,00,00,ff,ff,ff,00 HKO,"Control Panel\Appearance\Schemes","@themeui.dll,-854",%REG_BINARY%,02,00,00,00,f4,01,00,00,01,00,00,00,10,00,00,00,10,00,00,00,12,00,00,00,12,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,54,00,61,00,68,00,6f,00,6d,00,61,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0c,00,00,00,0f,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,54,00,61,00,68,00,6f,00,6d,00,61,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,12,00,00,00,12,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,54,00,61,00,68,00,6f,00,6d,00,61,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,54,00,61,00,68,00,6f,00,6d,00,61,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,54,00,61,00,68,00,6f,00,6d,00,61,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,54,00,61,00,68,00,6f,00,6d,00,61,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,d4,d0,c8,00,3a,6e,a5,00,0a,24,6a,00,80,80,80,00,d4,d0,c8,00,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,00,ff,ff,ff,00,d4,d0,c8,00,d4,d0,c8,00,80,80,80,00,0a,24,6a,00,ff,ff,ff,00,d4,d0,c8,00,80,80,80,00,80,80,80,00,00,00,00,00,d4,d0,c8,00,ff,ff,ff,00,40,40,40,00,d4,d0,c8,00,00,00,00,00,ff,ff,e1,00,b5,b5,b5,00,00,00,80,00,a6,ca,f0,00,c0,c0,c0,00 HKO,"Control Panel\Colors","ActiveBorder",%REG_SZ%,"180 180 180" HKO,"Control Panel\Colors","ActiveTitle",%REG_SZ%,"153 180 209" HKO,"Control Panel\Colors","AppWorkspace",%REG_SZ%,"171 171 171" HKO,"Control Panel\Colors","Background",%REG_SZ%,"0 0 0" HKO,"Control Panel\Colors","ButtonAlternateFace",%REG_SZ%,"0 0 0" HKO,"Control Panel\Colors","ButtonDkShadow",%REG_SZ%,"105 105 105" HKO,"Control Panel\Colors","ButtonFace",%REG_SZ%,"240 240 240" HKO,"Control Panel\Colors","ButtonHilight",%REG_SZ%,"255 255 255" HKO,"Control Panel\Colors","ButtonLight",%REG_SZ%,"227 227 227" HKO,"Control Panel\Colors","ButtonShadow",%REG_SZ%,"160 160 160" HKO,"Control Panel\Colors","ButtonText",%REG_SZ%,"0 0 0" HKO,"Control Panel\Colors","GradientActiveTitle",%REG_SZ%,"185 209 234" HKO,"Control Panel\Colors","GradientInactiveTitle",%REG_SZ%,"215 228 242" HKO,"Control Panel\Colors","GrayText",%REG_SZ%,"109 109 109" HKO,"Control Panel\Colors","Hilight",%REG_SZ%,"51 153 255" HKO,"Control Panel\Colors","HilightText",%REG_SZ%,"255 255 255" HKO,"Control Panel\Colors","HotTrackingColor",%REG_SZ%,"0 102 204" HKO,"Control Panel\Colors","InactiveBorder",%REG_SZ%,"244 247 252" HKO,"Control Panel\Colors","InactiveTitle",%REG_SZ%,"191 205 219" HKO,"Control Panel\Colors","InactiveTitleText",%REG_SZ%,"0 0 0" HKO,"Control Panel\Colors","InfoText",%REG_SZ%,"0 0 0" HKO,"Control Panel\Colors","InfoWindow",%REG_SZ%,"255 255 225" HKO,"Control Panel\Colors","Menu",%REG_SZ%,"240 240 240" HKO,"Control Panel\Colors","MenuBar",%REG_SZ%,"240 240 240" HKO,"Control Panel\Colors","MenuHilight",%REG_SZ%,"51 153 255" HKO,"Control Panel\Colors","MenuText",%REG_SZ%,"0 0 0" HKO,"Control Panel\Colors","Scrollbar",%REG_SZ%,"200 200 200" HKO,"Control Panel\Colors","TitleText",%REG_SZ%,"0 0 0" HKO,"Control Panel\Colors","Window",%REG_SZ%,"255 255 255" HKO,"Control Panel\Colors","WindowFrame",%REG_SZ%,"100 100 100" HKO,"Control Panel\Colors","WindowText",%REG_SZ%,"0 0 0" HKO,"Control Panel\Cursors","AppStarting",%REG_EXPAND_SZ%,"%%SystemRoot%%\cursors\aero_working.ani" HKO,"Control Panel\Cursors","Arrow",%REG_EXPAND_SZ%,"%%SystemRoot%%\cursors\aero_arrow.cur" HKO,"Control Panel\Cursors","ContactVisualization",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\Cursors","Crosshair",%REG_EXPAND_SZ%,"" HKO,"Control Panel\Cursors","CursorBaseSize",%REG_DWORD%,32 ; 0x00000020 HKO,"Control Panel\Cursors","GestureVisualization",%REG_DWORD%,31 ; 0x0000001f HKO,"Control Panel\Cursors","Hand",%REG_EXPAND_SZ%,"%%SystemRoot%%\cursors\aero_link.cur" HKO,"Control Panel\Cursors","Help",%REG_EXPAND_SZ%,"%%SystemRoot%%\cursors\aero_helpsel.cur" HKO,"Control Panel\Cursors","IBeam",%REG_EXPAND_SZ%,"" HKO,"Control Panel\Cursors","No",%REG_EXPAND_SZ%,"%%SystemRoot%%\cursors\aero_unavail.cur" HKO,"Control Panel\Cursors","NWPen",%REG_EXPAND_SZ%,"%%SystemRoot%%\cursors\aero_pen.cur" HKO,"Control Panel\Cursors","Scheme Source",%REG_DWORD%,2 ; 0x00000002 HKO,"Control Panel\Cursors","SizeAll",%REG_EXPAND_SZ%,"%%SystemRoot%%\cursors\aero_move.cur" HKO,"Control Panel\Cursors","SizeNESW",%REG_EXPAND_SZ%,"%%SystemRoot%%\cursors\aero_nesw.cur" HKO,"Control Panel\Cursors","SizeNS",%REG_EXPAND_SZ%,"%%SystemRoot%%\cursors\aero_ns.cur" HKO,"Control Panel\Cursors","SizeNWSE",%REG_EXPAND_SZ%,"%%SystemRoot%%\cursors\aero_nwse.cur" HKO,"Control Panel\Cursors","SizeWE",%REG_EXPAND_SZ%,"%%SystemRoot%%\cursors\aero_ew.cur" HKO,"Control Panel\Cursors","UpArrow",%REG_EXPAND_SZ%,"%%SystemRoot%%\cursors\aero_up.cur" HKO,"Control Panel\Cursors","Wait",%REG_EXPAND_SZ%,"%%SystemRoot%%\cursors\aero_busy.ani" HKO,"Control Panel\Desktop","ActiveWndTrackTimeout",%REG_DWORD%,0 ; 0x00000000 HKO,"Control Panel\Desktop","BlockSendInputResets",%REG_SZ%,"0" HKO,"Control Panel\Desktop","CaretTimeout",%REG_DWORD%,5000 ; 0x00001388 HKO,"Control Panel\Desktop","CaretWidth",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\Desktop","ClickLockTime",%REG_DWORD%,1200 ; 0x000004b0 HKO,"Control Panel\Desktop","CoolSwitchColumns",%REG_SZ%,"7" HKO,"Control Panel\Desktop","CoolSwitchRows",%REG_SZ%,"3" HKO,"Control Panel\Desktop","CursorBlinkRate",%REG_SZ%,"530" HKO,"Control Panel\Desktop","DockMoving",%REG_SZ%,"1" HKO,"Control Panel\Desktop","DragFromMaximize",%REG_SZ%,"1" HKO,"Control Panel\Desktop","DragFullWindows",%REG_SZ%,"1" HKO,"Control Panel\Desktop","DragHeight",%REG_SZ%,"4" HKO,"Control Panel\Desktop","DragWidth",%REG_SZ%,"4" HKO,"Control Panel\Desktop","FocusBorderHeight",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\Desktop","FocusBorderWidth",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\Desktop","FontSmoothing",%REG_SZ%,"2" HKO,"Control Panel\Desktop","FontSmoothingGamma",%REG_DWORD%,0 ; 0x00000000 HKO,"Control Panel\Desktop","FontSmoothingOrientation",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\Desktop","FontSmoothingType",%REG_DWORD%,2 ; 0x00000002 HKO,"Control Panel\Desktop","ForegroundFlashCount",%REG_DWORD%,7 ; 0x00000007 HKO,"Control Panel\Desktop","ForegroundLockTimeout",%REG_DWORD%,200000 ; 0x00030d40 HKO,"Control Panel\Desktop","LeftOverlapChars",%REG_SZ%,"3" HKO,"Control Panel\Desktop","MenuShowDelay",%REG_SZ%,"400" HKO,"Control Panel\Desktop","MouseWheelRouting",%REG_DWORD%,2 ; 0x00000002 HKO,"Control Panel\Desktop","PaintDesktopVersion",%REG_DWORD%,0 ; 0x00000000 HKO,"Control Panel\Desktop","Pattern",%REG_DWORD%,0 ; 0x00000000 HKO,"Control Panel\Desktop","RightOverlapChars",%REG_SZ%,"3" HKO,"Control Panel\Desktop","ScreenSaveActive",%REG_SZ%,"1" HKO,"Control Panel\Desktop","SnapSizing",%REG_SZ%,"1" HKO,"Control Panel\Desktop","TileWallpaper",%REG_SZ%,"0" HKO,"Control Panel\Desktop","WallPaper",%REG_SZ%,"C:\Windows\Web\Wallpaper\Windows\img0.jpg" HKO,"Control Panel\Desktop","WallpaperOriginX",%REG_DWORD%,0 ; 0x00000000 HKO,"Control Panel\Desktop","WallpaperOriginY",%REG_DWORD%,0 ; 0x00000000 HKO,"Control Panel\Desktop","WallpaperStyle",%REG_SZ%,"10" HKO,"Control Panel\Desktop","WheelScrollChars",%REG_SZ%,"3" HKO,"Control Panel\Desktop","WheelScrollLines",%REG_SZ%,"3" HKO,"Control Panel\Desktop","WindowArrangementActive",%REG_SZ%,"1" HKO,"Control Panel\Desktop\Colors","ActiveBorder",%REG_SZ%,"212 208 200" HKO,"Control Panel\Desktop\Colors","ActiveTitle",%REG_SZ%,"10 36 106" HKO,"Control Panel\Desktop\Colors","AppWorkSpace",%REG_SZ%,"128 128 128" HKO,"Control Panel\Desktop\Colors","ButtonAlternateFace",%REG_SZ%,"181 181 181" HKO,"Control Panel\Desktop\Colors","ButtonDkShadow",%REG_SZ%,"64 64 64" HKO,"Control Panel\Desktop\Colors","ButtonFace",%REG_SZ%,"212 208 200" HKO,"Control Panel\Desktop\Colors","ButtonHiLight",%REG_SZ%,"255 255 255" HKO,"Control Panel\Desktop\Colors","ButtonLight",%REG_SZ%,"212 208 200" HKO,"Control Panel\Desktop\Colors","ButtonShadow",%REG_SZ%,"128 128 128" HKO,"Control Panel\Desktop\Colors","ButtonText",%REG_SZ%,"0 0 0" HKO,"Control Panel\Desktop\Colors","GradientActiveTitle",%REG_SZ%,"166 202 240" HKO,"Control Panel\Desktop\Colors","GradientInactiveTitle",%REG_SZ%,"192 192 192" HKO,"Control Panel\Desktop\Colors","GrayText",%REG_SZ%,"128 128 128" HKO,"Control Panel\Desktop\Colors","Hilight",%REG_SZ%,"10 36 106" HKO,"Control Panel\Desktop\Colors","HilightText",%REG_SZ%,"255 255 255" HKO,"Control Panel\Desktop\Colors","HotTrackingColor",%REG_SZ%,"0 0 128" HKO,"Control Panel\Desktop\Colors","InactiveBorder",%REG_SZ%,"212 208 200" HKO,"Control Panel\Desktop\Colors","InactiveTitle",%REG_SZ%,"128 128 128" HKO,"Control Panel\Desktop\Colors","InactiveTitleText",%REG_SZ%,"212 208 200" HKO,"Control Panel\Desktop\Colors","InfoText",%REG_SZ%,"0 0 0" HKO,"Control Panel\Desktop\Colors","InfoWindow",%REG_SZ%,"255 255 255" HKO,"Control Panel\Desktop\Colors","Menu",%REG_SZ%,"212 208 200" HKO,"Control Panel\Desktop\Colors","MenuText",%REG_SZ%,"0 0 0" HKO,"Control Panel\Desktop\Colors","Scrollbar",%REG_SZ%,"212 208 200" HKO,"Control Panel\Desktop\Colors","TitleText",%REG_SZ%,"255 255 255" HKO,"Control Panel\Desktop\Colors","Window",%REG_SZ%,"255 255 255" HKO,"Control Panel\Desktop\Colors","WindowFrame",%REG_SZ%,"0 0 0" HKO,"Control Panel\Desktop\Colors","WindowText",%REG_SZ%,"0 0 0" HKO,"Control Panel\Desktop\WindowMetrics","BorderWidth",%REG_SZ%,"#USR:Control Panel\Desktop\WindowMetrics" HKO,"Control Panel\Desktop\WindowMetrics","CaptionFont",%REG_BINARY%,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,54,00,61,00,68,00,6f,00,6d,00,61,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 HKO,"Control Panel\Desktop\WindowMetrics","CaptionHeight",%REG_SZ%,"-270" HKO,"Control Panel\Desktop\WindowMetrics","CaptionWidth",%REG_SZ%,"-270" HKO,"Control Panel\Desktop\WindowMetrics","IconFont",%REG_BINARY%,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,54,00,61,00,68,00,6f,00,6d,00,61,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 HKO,"Control Panel\Desktop\WindowMetrics","IconTitleWrap",%REG_SZ%,"1" HKO,"Control Panel\Desktop\WindowMetrics","MenuFont",%REG_BINARY%,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,54,00,61,00,68,00,6f,00,6d,00,61,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 HKO,"Control Panel\Desktop\WindowMetrics","MenuHeight",%REG_SZ%,"-270" HKO,"Control Panel\Desktop\WindowMetrics","MenuWidth",%REG_SZ%,"-270" HKO,"Control Panel\Desktop\WindowMetrics","MessageFont",%REG_BINARY%,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,54,00,61,00,68,00,6f,00,6d,00,61,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 HKO,"Control Panel\Desktop\WindowMetrics","ScrollHeight",%REG_SZ%,"-240" HKO,"Control Panel\Desktop\WindowMetrics","ScrollWidth",%REG_SZ%,"-240" HKO,"Control Panel\Desktop\WindowMetrics","Shell Icon Size",%REG_SZ%,"32" HKO,"Control Panel\Desktop\WindowMetrics","SmCaptionFont",%REG_BINARY%,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,bc,02,00,00,00,00,00,00,00,00,00,00,54,00,61,00,68,00,6f,00,6d,00,61,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 HKO,"Control Panel\Desktop\WindowMetrics","SmCaptionHeight",%REG_SZ%,"-180" HKO,"Control Panel\Desktop\WindowMetrics","SmCaptionWidth",%REG_SZ%,"-180" HKO,"Control Panel\Desktop\WindowMetrics","StatusFont",%REG_BINARY%,f5,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,00,00,00,00,00,00,00,00,00,54,00,61,00,68,00,6f,00,6d,00,61,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 HKO,"Control Panel\Input Method","Show Status",%REG_SZ%,"1" HKO,"Control Panel\Input Method\Hot Keys\00000010","Key Modifiers",%REG_BINARY%,02,c0,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000010","Target IME",%REG_BINARY%,00,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000010","Virtual Key",%REG_BINARY%,20,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000011","Key Modifiers",%REG_BINARY%,04,c0,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000011","Target IME",%REG_BINARY%,00,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000011","Virtual Key",%REG_BINARY%,20,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000012","Key Modifiers",%REG_BINARY%,02,c0,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000012","Target IME",%REG_BINARY%,00,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000012","Virtual Key",%REG_BINARY%,be,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000070","Key Modifiers",%REG_BINARY%,02,c0,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000070","Target IME",%REG_BINARY%,00,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000070","Virtual Key",%REG_BINARY%,20,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000071","Key Modifiers",%REG_BINARY%,04,c0,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000071","Target IME",%REG_BINARY%,00,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000071","Virtual Key",%REG_BINARY%,20,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000072","Key Modifiers",%REG_BINARY%,03,c0,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000072","Target IME",%REG_BINARY%,00,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000072","Virtual Key",%REG_BINARY%,bc,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000104","Key Modifiers",%REG_BINARY%,06,c0,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000104","Target IME",%REG_BINARY%,11,04,01,e0 HKO,"Control Panel\Input Method\Hot Keys\00000104","Virtual Key",%REG_BINARY%,30,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000200","Key Modifiers",%REG_BINARY%,03,c0,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000200","Target IME",%REG_BINARY%,00,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000200","Virtual Key",%REG_BINARY%,47,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000201","Key Modifiers",%REG_BINARY%,03,c0,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000201","Target IME",%REG_BINARY%,00,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000201","Virtual Key",%REG_BINARY%,4b,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000202","Key Modifiers",%REG_BINARY%,03,c0,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000202","Target IME",%REG_BINARY%,00,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000202","Virtual Key",%REG_BINARY%,4c,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000203","Key Modifiers",%REG_BINARY%,03,c0,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000203","Target IME",%REG_BINARY%,00,00,00,00 HKO,"Control Panel\Input Method\Hot Keys\00000203","Virtual Key",%REG_BINARY%,56,00,00,00 HKO,"Control Panel\International","Locale",%REG_SZ%,"00000407" HKO,"Control Panel\International","LocaleName",%REG_SZ%,"de-DE" HKO,"Control Panel\International","s1159",%REG_SZ%,"" HKO,"Control Panel\International","s2359",%REG_SZ%,"" HKO,"Control Panel\International","sCurrency",%REG_SZ%,"€" HKO,"Control Panel\International","sDate",%REG_SZ%,"." HKO,"Control Panel\International","sDecimal",%REG_SZ%,"," HKO,"Control Panel\International","sGrouping",%REG_SZ%,"3;0" HKO,"Control Panel\International","sLanguage",%REG_SZ%,"DEU" HKO,"Control Panel\International","sList",%REG_SZ%,";" HKO,"Control Panel\International","sLongDate",%REG_SZ%,"dddd, d. MMMM yyyy" HKO,"Control Panel\International","sMonDecimalSep",%REG_SZ%,"," HKO,"Control Panel\International","sMonGrouping",%REG_SZ%,"3;0" HKO,"Control Panel\International","sMonThousandSep",%REG_SZ%,"." HKO,"Control Panel\International","sNativeDigits",%REG_SZ%,"0123456789" HKO,"Control Panel\International","sNegativeSign",%REG_SZ%,"-" HKO,"Control Panel\International","sPositiveSign",%REG_SZ%,"" HKO,"Control Panel\International","sShortDate",%REG_SZ%,"dd.MM.yyyy" HKO,"Control Panel\International","sThousand",%REG_SZ%,"." HKO,"Control Panel\International","sTime",%REG_SZ%,":" HKO,"Control Panel\International","sTimeFormat",%REG_SZ%,"HH:mm:ss" HKO,"Control Panel\International","sShortTime",%REG_SZ%,"HH:mm" HKO,"Control Panel\International","sYearMonth",%REG_SZ%,"MMMM yyyy" HKO,"Control Panel\International","iCalendarType",%REG_SZ%,"1" HKO,"Control Panel\International","iCountry",%REG_SZ%,"49" HKO,"Control Panel\International","iCurrDigits",%REG_SZ%,"2" HKO,"Control Panel\International","iCurrency",%REG_SZ%,"3" HKO,"Control Panel\International","iDate",%REG_SZ%,"1" HKO,"Control Panel\International","iDigits",%REG_SZ%,"2" HKO,"Control Panel\International","NumShape",%REG_SZ%,"1" HKO,"Control Panel\International","iFirstDayOfWeek",%REG_SZ%,"0" HKO,"Control Panel\International","iFirstWeekOfYear",%REG_SZ%,"2" HKO,"Control Panel\International","iLZero",%REG_SZ%,"1" HKO,"Control Panel\International","iMeasure",%REG_SZ%,"0" HKO,"Control Panel\International","iNegCurr",%REG_SZ%,"8" HKO,"Control Panel\International","iNegNumber",%REG_SZ%,"1" HKO,"Control Panel\International","iPaperSize",%REG_SZ%,"9" HKO,"Control Panel\International","iTime",%REG_SZ%,"1" HKO,"Control Panel\International","iTimePrefix",%REG_SZ%,"0" HKO,"Control Panel\International","iTLZero",%REG_SZ%,"1" HKO,"Control Panel\International\Geo","Nation",%REG_SZ%,"94" HKO,"Control Panel\International\Geo","Name",%REG_SZ%,"DE" HKO,"Control Panel\International\User Profile","Languages",%REG_MULTI_SZ%,"de-DE" HKO,"Control Panel\International\User Profile","ShowAutoCorrection",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\International\User Profile","ShowTextPrediction",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\International\User Profile","ShowCasing",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\International\User Profile","ShowShiftLock",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\International\User Profile\de-DE","0407:00000407",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\International\User Profile System Backup","Languages",%REG_MULTI_SZ%,"de-DE" HKO,"Control Panel\International\User Profile System Backup","ShowAutoCorrection",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\International\User Profile System Backup","ShowTextPrediction",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\International\User Profile System Backup","ShowCasing",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\International\User Profile System Backup","ShowShiftLock",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\International\User Profile System Backup\de-DE","0407:00000407",%REG_DWORD%,1 ; 0x00000001 HKO,"Control Panel\Keyboard","InitialKeyboardIndicators",%REG_SZ%,"2147483648" HKO,"Control Panel\Keyboard","KeyboardDelay",%REG_SZ%,"1" HKO,"Control Panel\Keyboard","KeyboardSpeed",%REG_SZ%,"31" HKO,"Control Panel\Mouse","ActiveWindowTracking",%REG_DWORD%,0 ; 0x00000000 HKO,"Control Panel\Mouse","Beep",%REG_SZ%,"No" HKO,"Control Panel\Mouse","DoubleClickHeight",%REG_SZ%,"4" HKO,"Control Panel\Mouse","DoubleClickSpeed",%REG_SZ%,"500" HKO,"Control Panel\Mouse","DoubleClickWidth",%REG_SZ%,"4" HKO,"Control Panel\Mouse","ExtendedSounds",%REG_SZ%,"No" HKO,"Control Panel\Mouse","MouseHoverHeight",%REG_SZ%,"4" HKO,"Control Panel\Mouse","MouseHoverTime",%REG_SZ%,"400" HKO,"Control Panel\Mouse","MouseHoverWidth",%REG_SZ%,"4" HKO,"Control Panel\Mouse","MouseSensitivity",%REG_SZ%,"10" HKO,"Control Panel\Mouse","MouseSpeed",%REG_SZ%,"1" HKO,"Control Panel\Mouse","MouseThreshold1",%REG_SZ%,"6" HKO,"Control Panel\Mouse","MouseThreshold2",%REG_SZ%,"10" HKO,"Control Panel\Mouse","MouseTrails",%REG_SZ%,"0" HKO,"Control Panel\Mouse","SmoothMouseXCurve",%REG_BINARY%,00,00,00,00,00,00,00,00,15,6e,00,00,00,00,00,00,00,40,01,00,00,00,00,00,29,dc,03,00,00,00,00,00,00,00,28,00,00,00,00,00 HKO,"Control Panel\Mouse","SmoothMouseYCurve",%REG_BINARY%,00,00,00,00,00,00,00,00,fd,11,01,00,00,00,00,00,00,24,04,00,00,00,00,00,00,fc,12,00,00,00,00,00,00,c0,bb,01,00,00,00,00 HKO,"Control Panel\Mouse","SnapToDefaultButton",%REG_SZ%,"0" HKO,"Control Panel\Mouse","SwapMouseButtons",%REG_SZ%,"0" HKO,"Control Panel\PowerCfg","CurrentPowerPolicy",%REG_SZ%,"0" HKO,"Control Panel\PowerCfg\GlobalPowerPolicy","Policies",%REG_BINARY%,01,00,00,00,00,00,00,00,03,00,00,00,10,00,00,00,00,00,00,00,03,00,00,00,10,00,00,00,02,00,00,00,03,00,00,00,00,00,00,00,02,00,00,00,03,00,00,00,00,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,03,00,00,00,03,00,00,00,00,00,00,c0,01,00,00,00,05,00,00,00,01,00,00,00,0a,00,00,00,00,00,00,00,03,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,16,00,00,00 HKO,"Control Panel\PowerCfg\PowerPolicies\0","Description",%REG_SZ%,"This scheme is suited to most home or desktop computers that are left plugged in all the time." HKO,"Control Panel\PowerCfg\PowerPolicies\0","Name",%REG_SZ%,"Home/Office Desk" HKO,"Control Panel\PowerCfg\PowerPolicies\0","Policies",%REG_BINARY%,01,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,02,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2c,01,00,00,32,32,00,03,04,00,00,00,04,00,00,00,00,00,00,00,00,00,00,00,b0,04,00,00,2c,01,00,00,00,00,00,00,58,02,00,00,01,01,64,50,64,64,00,00 HKO,"Control Panel\PowerCfg\PowerPolicies\1","Description",%REG_SZ%,"This scheme is designed for extended battery life for portable computers on the road." HKO,"Control Panel\PowerCfg\PowerPolicies\1","Name",%REG_SZ%,"Portable/Laptop" HKO,"Control Panel\PowerCfg\PowerPolicies\1","Policies",%REG_BINARY%,01,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,b0,04,00,00,2c,01,00,00,32,32,03,03,04,00,00,00,04,00,00,00,00,00,00,00,00,00,00,00,84,03,00,00,2c,01,00,00,08,07,00,00,2c,01,00,00,01,01,64,50,64,64,00,00 HKO,"Control Panel\PowerCfg\PowerPolicies\2","Description",%REG_SZ%,"This scheme keeps the monitor on for doing presentations." HKO,"Control Panel\PowerCfg\PowerPolicies\2","Name",%REG_SZ%,"Presentation" HKO,"Control Panel\PowerCfg\PowerPolicies\2","Policies",%REG_BINARY%,01,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00,84,03,00,00,32,32,03,02,04,00,00,00,04,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2c,01,00,00,01,01,50,50,64,64,00,00 HKO,"Control Panel\PowerCfg\PowerPolicies\3","Description",%REG_SZ%,"This scheme keeps the computer running so that it can be accessed from the network. Use this scheme if you do not have network wakeup hardware." HKO,"Control Panel\PowerCfg\PowerPolicies\3","Name",%REG_SZ%,"Always On" HKO,"Control Panel\PowerCfg\PowerPolicies\3","Policies",%REG_BINARY%,01,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,02,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,32,32,00,00,04,00,00,00,04,00,00,00,00,00,00,00,00,00,00,00,b0,04,00,00,84,03,00,00,00,00,00,00,08,07,00,00,00,01,64,64,64,64,00,00 HKO,"Control Panel\PowerCfg\PowerPolicies\4","Description",%REG_SZ%,"This scheme keeps the computer on and optimizes it for high performance." HKO,"Control Panel\PowerCfg\PowerPolicies\4","Name",%REG_SZ%,"Minimal Power Management" HKO,"Control Panel\PowerCfg\PowerPolicies\4","Policies",%REG_BINARY%,01,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,02,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2c,01,00,00,32,32,03,03,04,00,00,00,04,00,00,00,00,00,00,00,00,00,00,00,84,03,00,00,2c,01,00,00,00,00,00,00,84,03,00,00,00,01,64,64,64,64,00,00 HKO,"Control Panel\PowerCfg\PowerPolicies\5","Description",%REG_SZ%,"This scheme is extremely aggressive for saving power." HKO,"Control Panel\PowerCfg\PowerPolicies\5","Name",%REG_SZ%,"Max Battery" HKO,"Control Panel\PowerCfg\PowerPolicies\5","Policies",%REG_BINARY%,01,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,02,00,00,00,05,00,00,00,00,00,00,00,b0,04,00,00,78,00,00,00,32,32,03,02,04,00,00,00,04,00,00,00,00,00,00,00,00,00,00,00,84,03,00,00,3c,00,00,00,00,00,00,00,b4,00,00,00,01,01,64,32,64,64,00,00 HKO,"Control Panel\Quick Actions\Pinned",,%REG_KEYONLY% HKO,"Control Panel\Sound","Beep",%REG_SZ%,"yes" HKO,"Control Panel\Sound","ExtendedSounds",%REG_SZ%,"yes" HKO,"Environment","Path",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Local\Microsoft\WindowsApps;" HKO,"Environment","TEMP",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Local\Temp" HKO,"Environment","TMP",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Local\Temp" HKO,"EUDC\932","SystemDefaultEUDCFont",%REG_SZ%,"EUDC.TTE" HKO,"EUDC\936","SystemDefaultEUDCFont",%REG_SZ%,"EUDC.TTE" HKO,"EUDC\949","SystemDefaultEUDCFont",%REG_SZ%,"EUDC.TTE" HKO,"EUDC\950","SystemDefaultEUDCFont",%REG_SZ%,"EUDC.TTE" HKO,"Keyboard Layout\Preload","1",%REG_SZ%,"00000407" HKO,"Keyboard Layout\Substitutes",,%REG_KEYONLY% HKO,"Keyboard Layout\Toggle",,%REG_KEYONLY% HKO,"Network",,%REG_KEYONLY% HKO,"SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.browsercore",,%REG_SZ%,"C:\Program Files\Windows Security\BrowserCore\manifest.json" HKO,"SOFTWARE\Microsoft\Accessibility",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Assistance\Client\1.0\Settings","FirstTimeHelppaneStartup",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Assistance\Client\1.0\Settings","Height",%REG_DWORD%,340 ; 0x00000154 HKO,"SOFTWARE\Microsoft\Assistance\Client\1.0\Settings","ImplicitFeedback",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Assistance\Client\1.0\Settings","OnlineAssist",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Assistance\Client\1.0\Settings","PositionX",%REG_DWORD%,4294967295 ; 0xffffffff HKO,"SOFTWARE\Microsoft\Assistance\Client\1.0\Settings","PositionY",%REG_DWORD%,4294967295 ; 0xffffffff HKO,"SOFTWARE\Microsoft\Assistance\Client\1.0\Settings","UserID",%REG_SZ%,"" HKO,"SOFTWARE\Microsoft\Assistance\Client\1.0\Settings","Width",%REG_DWORD%,510 ; 0x000001fe HKO,"SOFTWARE\Microsoft\Avalon.Graphics",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\CommsAPHost\Test",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\CTF\Assemblies\0x00000407\{34745C63-B2F0-4784-8B67-5E12C8701A31}","Default",%REG_SZ%,"{00000000-0000-0000-0000-000000000000}" HKO,"SOFTWARE\Microsoft\CTF\Assemblies\0x00000407\{34745C63-B2F0-4784-8B67-5E12C8701A31}","Profile",%REG_SZ%,"{00000000-0000-0000-0000-000000000000}" HKO,"SOFTWARE\Microsoft\CTF\Assemblies\0x00000407\{34745C63-B2F0-4784-8B67-5E12C8701A31}","KeyboardLayout",%REG_DWORD%,67568647 ; 0x04070407 HKO,"SOFTWARE\Microsoft\CTF\DirectSwitchHotkeys",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\CTF\HiddenDummyLayouts",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\CTF\SortOrder\AssemblyItem\0x00000407\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000","CLSID",%REG_SZ%,"{00000000-0000-0000-0000-000000000000}" HKO,"SOFTWARE\Microsoft\CTF\SortOrder\AssemblyItem\0x00000407\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000","KeyboardLayout",%REG_DWORD%,67568647 ; 0x04070407 HKO,"SOFTWARE\Microsoft\CTF\SortOrder\AssemblyItem\0x00000407\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000","Profile",%REG_SZ%,"{00000000-0000-0000-0000-000000000000}" HKO,"SOFTWARE\Microsoft\CTF\SortOrder\Language","00000000",%REG_SZ%,"00000407" HKO,"SOFTWARE\Microsoft\CTF\TIP",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Fax\FaxOptions",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Fax\fxsclnt\Archive",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Fax\fxsclnt\Confirm",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Fax\Setup",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Fax\UserInfo",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\GameBarApi",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\IME",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Input\TIPC",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Input\TSF\Tsf3Override",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\InputMethod",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\InputPersonalization","RestrictImplicitInkCollection",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\InputPersonalization","RestrictImplicitTextCollection",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore","HarvestContacts",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Internet Connection Wizard","Completed",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Internet Explorer\Document Windows","height",%REG_BINARY%,00,00,00,00 HKO,"SOFTWARE\Microsoft\Internet Explorer\Document Windows","Maximized",%REG_SZ%,"no" HKO,"SOFTWARE\Microsoft\Internet Explorer\Document Windows","width",%REG_BINARY%,00,00,00,80 HKO,"SOFTWARE\Microsoft\Internet Explorer\Document Windows","x",%REG_BINARY%,00,00,00,80 HKO,"SOFTWARE\Microsoft\Internet Explorer\Document Windows","y",%REG_BINARY%,00,00,00,00 HKO,"SOFTWARE\Microsoft\Internet Explorer\International","AcceptLanguage",%REG_SZ%,"de-DE,de;q=0.5" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","Anchor Underline",%REG_SZ%,"yes" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","Cache_Update_Frequency",%REG_SZ%,"yes" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","Disable Script Debugger",%REG_SZ%,"yes" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","DisableScriptDebuggerIE",%REG_SZ%,"yes" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","Display Inline Images",%REG_SZ%,"yes" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","Do404Search",%REG_BINARY%,01,00,00,00 HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","Local Page",%REG_SZ%,"%%11%%\blank.htm" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","Save_Session_History_On_Exit",%REG_SZ%,"no" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","Search Page",%REG_SZ%,"http://go.microsoft.com/fwlink/?LinkId=54896" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","Show_FullURL",%REG_SZ%,"no" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","Show_StatusBar",%REG_SZ%,"yes" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","Show_ToolBar",%REG_SZ%,"yes" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","Show_URLinStatusBar",%REG_SZ%,"yes" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","Show_URLToolBar",%REG_SZ%,"yes" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","Use_DlgBox_Colors",%REG_SZ%,"yes" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","UseClearType",%REG_SZ%,"no" HKO,"SOFTWARE\Microsoft\Internet Explorer\Main","XMLHTTP",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Internet Explorer\New Windows","PopupMgr",%REG_SZ%,"yes" HKO,"SOFTWARE\Microsoft\Internet Explorer\New Windows","Use Anchor Hover Color",%REG_SZ%,"1" HKO,"SOFTWARE\Microsoft\Internet Explorer\New Windows","UseSecBand",%REG_SZ%,"1" HKO,"SOFTWARE\Microsoft\Internet Explorer\Security","Safety Warning Level",%REG_SZ%,"Query" HKO,"SOFTWARE\Microsoft\Internet Explorer\Security","Sending_Security",%REG_SZ%,"Medium" HKO,"SOFTWARE\Microsoft\Internet Explorer\Security","Viewing_Security",%REG_SZ%,"Low" HKO,"SOFTWARE\Microsoft\Internet Explorer\Services",,%REG_SZ%,"" HKO,"SOFTWARE\Microsoft\Internet Explorer\Settings","Anchor Color",%REG_SZ%,"0,0,255" HKO,"SOFTWARE\Microsoft\Internet Explorer\Settings","Anchor Color Visited",%REG_SZ%,"128,0,128" HKO,"SOFTWARE\Microsoft\Internet Explorer\Settings","Background Color",%REG_SZ%,"192,192,192" HKO,"SOFTWARE\Microsoft\Internet Explorer\Settings","Text Color",%REG_SZ%,"0,0,0" HKO,"SOFTWARE\Microsoft\Internet Explorer\Settings","Use Anchor Hover Color",%REG_SZ%,"No" HKO,"SOFTWARE\Microsoft\Internet Explorer\TypedURLs","url1",%REG_SZ%,"http://go.microsoft.com/fwlink/p/?LinkId=255141" HKO,"SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks","{CFBFAE00-17A6-11D0-99CB-00C04FD64497}",%REG_SZ%,"" HKO,"SOFTWARE\Microsoft\MobilePC\AdaptableSettings",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Multimedia\Audio\DefaultEndpoint",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Narrator\NoRoam","RunningState",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\OneDrive","EnableDownlevelInstallOnBluePlus",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\OneDrive","EnableTHDFFeatures",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Osk","RunningState",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\PeerNet\Event_Config",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Personalization\Settings","AcceptedPrivacyPolicy",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Phone\ShellUI",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Remote Assistance",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\ScreenMagnifier","RunningState",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Sensors",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Speech\Preferences\AppCompatDisableDictation","dwm.exe",%REG_SZ%,"" HKO,"SOFTWARE\Microsoft\Speech\Preferences\AppCompatDisableDictation","tabtip.exe",%REG_SZ%,"" HKO,"SOFTWARE\Microsoft\Speech\Preferences\AppCompatDisableMSAA","devenv.exe",%REG_SZ%,"" HKO,"SOFTWARE\Microsoft\Speech\Preferences\AppCompatDisableMSAA","taskmgr.exe",%REG_SZ%,"" HKO,"SOFTWARE\Microsoft\TabletTip\1.7",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\UEV\Agent","UserConsoleVersion",%REG_SZ%,"10.0.19041.1387" HKO,"SOFTWARE\Microsoft\WAB\WAB4\Wab File Name",,%REG_SZ%,"" HKO,"SOFTWARE\Microsoft\WcmSvc\Tethering\Roaming",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\wfs\DraftsView",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\wfs\InboxView",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\wfs\IncomingView",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\wfs\OutboxView",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\wfs\SentItemsView",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\AssignedAccessConfiguration",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ClickNote\UserCustomization\DoubleClickBelowLock","Override",%REG_DWORD%,5 ; 0x00000005 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ClickNote\UserCustomization\DoubleClickBelowLock","PenWorkspaceVerb",%REG_DWORD%,3 ; 0x00000003 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ClickNote\UserCustomization\LongPressBelowLock","Override",%REG_DWORD%,5 ; 0x00000005 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ClickNote\UserCustomization\LongPressBelowLock","PenWorkspaceVerb",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ClickNote\UserCustomization\SingleClickBelowLock","Override",%REG_DWORD%,8 ; 0x00000008 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ClickNote\UserCustomization\SingleClickBelowLock","PenWorkspaceVerb",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager","FeatureManagementEnabled",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager","OemPreInstalledAppsEnabled",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager","PreInstalledAppsEnabled",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager","RotatingLockScreenEnabled",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager","RotatingLockScreenOverlayEnabled",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager","SilentInstalledAppsEnabled",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager","SoftLandingEnabled",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager","SystemPaneSuggestionsEnabled",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager","SlideshowEnabled",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Renderers\SubscribedContent-310091","Version",%REG_SZ%,"2" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Renderers\SubscribedContent-310092","Version",%REG_SZ%,"2" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Renderers\SubscribedContent-338380","Version",%REG_SZ%,"2" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Renderers\SubscribedContent-338381","Version",%REG_SZ%,"2" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Renderers\SubscribedContent-338387","Version",%REG_SZ%,"2" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Renderers\SubscribedContent-338388","Version",%REG_SZ%,"2" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced","Start_SearchFiles",%REG_DWORD%,2 ; 0x00000002 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers","DisableAutoplay",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection",,%REG_SZ%,"" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers",,%REG_SZ%,"" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon","empty",%REG_EXPAND_SZ%,"%%SystemRoot%%\System32\imageres.dll,-55" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon","full",%REG_EXPAND_SZ%,"%%SystemRoot%%\System32\imageres.dll,-54" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SearchPlatform\Preferences","BreadCrumbBarSearchDefault",%REG_SZ%,"MSNSearch" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SearchPlatform\Preferences","DisableAutoNavigateURL",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SearchPlatform\Preferences","DisableAutoResolveEmailAddrs",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SearchPlatform\Preferences","DisableResultsInNewWindow",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SearchPlatform\Preferences","DisableTabbedBrowsing",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SearchPlatform\Preferences","EditSavedSearch",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SearchPlatform\Preferences","IEAddressBarSearchDefault",%REG_SZ%,"MSNSearch" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","!Do not use this registry key",%REG_SZ%,"Use the SHGetFolderPath or SHGetKnownFolderPath function instead" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","AppData",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Roaming" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","Cache",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Local\Microsoft\Windows\INetCache" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","Cookies",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Local\Microsoft\Windows\INetCookies" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","Desktop",%REG_EXPAND_SZ%,"%%USERPROFILE%%\Desktop" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","Favorites",%REG_EXPAND_SZ%,"%%USERPROFILE%%\Favorites" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","History",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Local\Microsoft\Windows\History" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","Local AppData",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Local" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","My Music",%REG_EXPAND_SZ%,"%%USERPROFILE%%\Music" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","My Pictures",%REG_EXPAND_SZ%,"%%USERPROFILE%%\Pictures" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","My Video",%REG_EXPAND_SZ%,"%%USERPROFILE%%\Videos" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","NetHood",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Roaming\Microsoft\Windows\Network Shortcuts" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","Personal",%REG_EXPAND_SZ%,"%%USERPROFILE%%\Documents" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","PrintHood",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Roaming\Microsoft\Windows\Printer Shortcuts" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","Programs",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","Recent",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Roaming\Microsoft\Windows\Recent" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SendTo",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Roaming\Microsoft\Windows\SendTo" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","Start Menu",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Roaming\Microsoft\Windows\Start Menu" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","Startup",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","Templates",%REG_EXPAND_SZ%,"%%USERPROFILE%%\AppData\Roaming\Microsoft\Windows\Templates" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","{374DE290-123F-4565-9164-39C4925E467B}",%REG_EXPAND_SZ%,"%%USERPROFILE%%\Downloads" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\FileHistory\RestoreUI","FolderViewType",%REG_SZ%,"MediumIcons" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\FileHistory\RestoreUI","SearchResultsViewType",%REG_SZ%,"Content" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\FileHistory\RestoreUI","WindowLocation",%REG_SZ%,"" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Holographic","FirstRunSucceeded",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Holographic\StageManagement","DisableQuickRoomSetup",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Holographic\StageManagement","DisableStageNearbyRequirement",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","ActiveLearning",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","AnsiChar",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","AutoCandState",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","BallonUI",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","BeepEnable",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Big5CharOnly",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","CandidateLargeFont",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","CandidateSortType",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","ChangJie.All.ActiveAlphaNum",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","ChangJie.All.ZkeyAsWildCard",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","ChangJie.AssociatedWord",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","ChangJie.IsOfflineReading",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","ChangJie.ReadLayout",%REG_SZ%,"0x00010030" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","CharMode",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","CustomLayout",%REG_BINARY%,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","DefaultLanguage",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Delemiter",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Domain",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","EnableCNSReading",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","EnableExtensionA_Char",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","EnableExtensionB_Char",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","EudpSCK",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Fuzzy",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","HFTLearning",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Intellegnt.Eudp",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Intelligent.AssociatedWord",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Intelligent.AutoFinalize",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Intelligent.AutoInputSwitch",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Intelligent.EnableFinal",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Intelligent.EscapeFunc",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","LeadingIndicator",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Legacy.AutoFinalize",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Legacy.AutoInputSwitch",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Legacy.EnableFinal",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Legacy.EscapeFunc",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Legacy.Eudp",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Legacy.Modeless",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","MaxCharPerSentence",%REG_SZ%,"0x00000020" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","NewChangJie.Modeless",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","NewPhonetic.IntCharMode",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","NewPhonetic.Modeless",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","NewQuick.Modeless",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Phonetic.All.ActiveAlphaNum",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Phonetic.All.ZkeyAsWildCard",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Phonetic.AssociatedWord",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Phonetic.IntCharMode",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Phonetic.IsOfflineReading",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Phonetic.ReadLayout",%REG_SZ%,"0x00020010" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","PhrManEudpSortType",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","PhrManSelfLearnSortType",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","PluginLexiconInfo",%REG_BINARY%,00,00,00,00,00,00,00,00 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","PuncEnable",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Quick.AssociatedWord",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Quick.ZkeyAsWildCard",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","ReconvertLength",%REG_SZ%,"0x00000020" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","ReservedWord",%REG_BINARY%,08,00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,2f,00,2f,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,66,00,69,00,6c,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,66,00,74,00,70,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,68,00,74,00,74,00,70,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,6d,00,61,00,69,00,6c,00,74,00,6f,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,6e,00,65,00,77,00,73,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,77,00,69,00,6e,00,64,00,6f,00,77,00,73,00,00,00,00,00,00,00,00,00,00,00,00,00,77,00,77,00,77,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","ReversedReadingType",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","SelfLearning",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","SharedEudp",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","ShiftLeft",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","ShiftRight",%REG_SZ%,"0x00000001" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Surrogate",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","Trigram",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","UserSymbolMapping",%REG_BINARY%,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,20,00,31,00,32,00,33,00,34,00,35,00,36,00,37,00,38,00,39,00,30,00,61,00,62,00,63,00,64,00,65,00,66,00,67,00,68,00,69,00,6a,00,6b,00,6c,00,6d,00,6e,00,6f,00,70,00,71,00,72,00,73,00,74,00,75,00,76,00,77,00,78,00,79,00,7a,00,2d,00,3d,00,5c,00,5b,00,5d,00,3b,00,27,00,2c,00,2e,00,2f,00,60,00,00,30,11,ff,12,ff,13,ff,14,ff,15,ff,16,ff,17,ff,18,ff,19,ff,10,ff,41,ff,42,ff,43,ff,44,ff,45,ff,46,ff,47,ff,48,ff,49,ff,4a,ff,4b,ff,4c,ff,4d,ff,4e,ff,4f,ff,50,ff,51,ff,52,ff,53,ff,54,ff,55,ff,56,ff,57,ff,58,ff,59,ff,5a,ff,00,25,1d,ff,3c,ff,14,30,15,30,54,fe,19,20,0c,ff,02,30,0f,ff,35,20,20,00,21,00,40,00,23,00,24,00,25,00,5e,00,26,00,2a,00,28,00,29,00,41,00,42,00,43,00,44,00,45,00,46,00,47,00,48,00,49,00,4a,00,4b,00,4c,00,4d,00,4e,00,4f,00,50,00,51,00,52,00,53,00,54,00,55,00,56,00,57,00,58,00,59,00,5a,00,5f,00,2b,00,7c,00,7b,00,7d,00,3a,00,22,00,3c,00,3e,00,3f,00,7e,00,00,30,01,ff,20,ff,03,ff,04,ff,05,ff,3f,fe,06,ff,0a,ff,08,ff,09,ff,21,ff,22,ff,23,ff,24,ff,25,ff,26,ff,27,ff,28,ff,29,ff,2a,ff,2b,ff,2c,ff,2d,ff,2e,ff,2f,ff,30,ff,31,ff,32,ff,33,ff,34,ff,35,ff,36,ff,37,ff,38,ff,39,ff,3a,ff,3f,ff,0b,ff,5c,ff,5b,ff,5d,ff,1a,ff,1d,20,1c,ff,1e,ff,1f,ff,5e,ff,20,00,31,00,32,00,33,00,34,00,35,00,36,00,37,00,38,00,39,00,30,00,61,00,62,00,63,00,64,00,65,00,66,00,67,00,68,00,69,00,6a,00,6b,00,6c,00,6d,00,6e,00,6f,00,70,00,71,00,72,00,73,00,74,00,75,00,76,00,77,00,78,00,79,00,7a,00,2d,00,3d,00,5c,00,5b,00,5d,00,3b,00,27,00,2c,00,2e,00,2f,00,60,00,00,30,11,ff,12,ff,13,ff,14,ff,15,ff,16,ff,17,ff,18,ff,19,ff,10,ff,41,ff,42,ff,43,ff,44,ff,45,ff,46,ff,47,ff,48,ff,49,ff,4a,ff,4b,ff,4c,ff,4d,ff,4e,ff,4f,ff,50,ff,51,ff,52,ff,53,ff,54,ff,55,ff,56,ff,57,ff,58,ff,59,ff,5a,ff,00,25,1d,ff,3c,ff,14,30,15,30,54,fe,19,20,0c,ff,02,30,0f,ff,35,20,20,00,21,00,40,00,23,00,24,00,25,00,5e,00,26,00,2a,00,28,00,29,00,41,00,42,00,43,00,44,00,45,00,46,00,47,00,48,00,49,00,4a,00,4b,00,4c,00,4d,00,4e,00,4f,00,50,00,51,00,52,00,53,00,54,00,55,00,56,00,57,00,58,00,59,00,5a,00,5f,00,2b,00,7c,00,7b,00,7d,00,3a,00,22,00,3c,00,3e,00,3f,00,7e,00,00,30,01,ff,20,ff,03,ff,04,ff,05,ff,3f,fe,06,ff,0a,ff,08,ff,09,ff,21,ff,22,ff,23,ff,24,ff,25,ff,26,ff,27,ff,28,ff,29,ff,2a,ff,2b,ff,2c,ff,2d,ff,2e,ff,2f,ff,30,ff,31,ff,32,ff,33,ff,34,ff,35,ff,36,ff,37,ff,38,ff,39,ff,3a,ff,3f,ff,0b,ff,5c,ff,5b,ff,5d,ff,1a,ff,1d,20,1c,ff,1e,ff,1f,ff,5e,ff,20,00,31,00,32,00,33,00,34,00,35,00,36,00,37,00,38,00,39,00,30,00,61,00,62,00,63,00,64,00,65,00,66,00,67,00,68,00,69,00,6a,00,6b,00,6c,00,6d,00,6e,00,6f,00,70,00,71,00,72,00,73,00,74,00,75,00,76,00,77,00,78,00,79,00,7a,00,2d,00,3d,00,5c,00,5b,00,5d,00,3b,00,27,00,2c,00,2e,00,2f,00,60,00,00,30,11,ff,12,ff,13,ff,14,ff,15,ff,16,ff,17,ff,18,ff,19,ff,10,ff,41,ff,42,ff,43,ff,44,ff,45,ff,46,ff,47,ff,48,ff,49,ff,4a,ff,4b,ff,4c,ff,4d,ff,4e,ff,4f,ff,50,ff,51,ff,52,ff,53,ff,54,ff,55,ff,56,ff,57,ff,58,ff,59,ff,5a,ff,00,25,1d,ff,3c,ff,14,30,15,30,54,fe,19,20,0c,ff,02,30,0f,ff,35,20,20,00,21,00,40,00,23,00,24,00,25,00,5e,00,26,00,2a,00,28,00,29,00,41,00,42,00,43,00,44,00,45,00,46,00,47,00,48,00,49,00,4a,00,4b,00,4c,00,4d,00,4e,00,4f,00,50,00,51,00,52,00,53,00,54,00,55,00,56,00,57,00,58,00,59,00,5a,00,5f,00,2b,00,7c,00,7b,00,7d,00,3a,00,22,00,3c,00,3e,00,3f,00,7e,00,00,30,01,ff,20,ff,03,ff,04,ff,05,ff,3f,fe,06,ff,0a,ff,08,ff,09,ff,21,ff,22,ff,23,ff,24,ff,25,ff,26,ff,27,ff,28,ff,29,ff,2a,ff,2b,ff,2c,ff,2d,ff,2e,ff,2f,ff,30,ff,31,ff,32,ff,33,ff,34,ff,35,ff,36,ff,37,ff,38,ff,39,ff,3a,ff,3f,ff,0b,ff,5c,ff,5b,ff,5d,ff,1a,ff,1d,20,1c,ff,1e,ff,1f,ff,5e,ff HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70","VirtualInputMode",%REG_SZ%,"0x00000000" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70\FuzzyScheme","Data",%REG_BINARY%,87,3f,00,00 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70\FuzzyScheme","Name",%REG_SZ%,"{EF8C6C27-997A-4af2-BC0E-A15C84790F8C}" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings","CertificateRevocation",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings","DisableCachingOfSSLPages",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings","IE5_UA_Backup_Flag",%REG_SZ%,"5.0" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings","PrivacyAdvanced",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings","SecureProtocols",%REG_DWORD%,2688 ; 0x00000a80 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings","User Agent",%REG_SZ%,"Mozilla/5.0 (compatible; MSIE 9.0; Win32)" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache","Persistent",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Passport",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Lock Screen","LockAppAumId",%REG_SZ%,"Microsoft.LockApp_cw5n1h2txyewy!WindowsDefaultLockScreen" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Mobility",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PenWorkspace\Notes","NotesApp",%REG_SZ%,"Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe!App" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PrecisionTouchPad","AAPThreshold",%REG_DWORD%,2 ; 0x00000002 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PrecisionTouchPad","CursorSpeed",%REG_DWORD%,10 ; 0x0000000a HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PrecisionTouchPad","EnableEdgy",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PrecisionTouchPad","LeaveOnWithMouse",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PrecisionTouchPad","PanEnabled",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PrecisionTouchPad","RightClickZoneEnabled",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PrecisionTouchPad","ScrollDirection",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PrecisionTouchPad","TapAndDrag",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PrecisionTouchPad","TapsEnabled",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PrecisionTouchPad","TwoFingerTapEnabled",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PrecisionTouchPad","ZoomEnabled",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PrecisionTouchPad\Status","Enabled",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Privacy","TailoredExperiencesWithDiagnosticDataEnabled",%REG_DWORD%,2 ; 0x00000002 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.CloudExperienceHostLauncher","ApplicationType",%REG_DWORD%,1073741824 ; 0x40000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.CloudExperienceHostLauncher","Capabilities",%REG_DWORD%,9471 ; 0x000024ff HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.CloudExperienceHostLauncher","PackageMoniker",%REG_SZ%,"System" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.CloudExperienceHostLauncherCustom","ApplicationType",%REG_DWORD%,1073741824 ; 0x40000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.CloudExperienceHostLauncherCustom","Capabilities",%REG_DWORD%,9471 ; 0x000024ff HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.CloudExperienceHostLauncherCustom","PackageMoniker",%REG_SZ%,"System" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.DisplaySettings","ApplicationType",%REG_DWORD%,1073741824 ; 0x40000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.DisplaySettings","Capabilities",%REG_DWORD%,9471 ; 0x000024ff HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.DisplaySettings","PackageMoniker",%REG_SZ%,"System" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.FodHelper","ApplicationType",%REG_DWORD%,1073741824 ; 0x40000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.FodHelper","Capabilities",%REG_DWORD%,9471 ; 0x000024ff HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.FodHelper","PackageMoniker",%REG_SZ%,"System" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.MobilityExperience","ApplicationType",%REG_DWORD%,1073741824 ; 0x40000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.MobilityExperience","Capabilities",%REG_DWORD%,9471 ; 0x000024ff HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.MobilityExperience","PackageMoniker",%REG_SZ%,"System" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.Suggested","ApplicationType",%REG_DWORD%,1073741824 ; 0x40000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.Suggested","Capabilities",%REG_DWORD%,9471 ; 0x000024ff HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.Suggested","PackageMoniker",%REG_SZ%,"System" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.WindowsTip","ApplicationType",%REG_DWORD%,1073741824 ; 0x40000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.WindowsTip","Capabilities",%REG_DWORD%,9471 ; 0x000024ff HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\Applications\Windows.SystemToast.WindowsTip","PackageMoniker",%REG_SZ%,"System" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\RADAR","CLResolutionInterval",%REG_DWORD%,5 ; 0x00000005 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\RADAR","DisplayInterval",%REG_DWORD%,1440 ; 0x000005a0 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run","OneDriveSetup",%REG_SZ%,"C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Bubbles\Screen 1",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Bubbles\Screen 2",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Mystify\Screen 1",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Mystify\Screen 2",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Ribbons\Screen 1",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Ribbons\Screen 2",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\ssText3d\Screen 1",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\ssText3d\Screen 2",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\AppSync","Enabled",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\SmartGlass","UserAuthPolicy",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities","RequestMakeCall",%REG_SZ%,"DIALER.EXE" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities\MediaModes",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager","DllName",%REG_EXPAND_SZ%,"%%SystemRoot%%\resources\themes\Aero\Aero.msstyles" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager","PrePolicy-DllName",%REG_SZ%,"C:\Windows\resources\themes\Aero\Aero.msstyles" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Themes","InstallVisualStyleColor",%REG_SZ%,"NormalColor" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Themes","InstallVisualStyleSize",%REG_SZ%,"NormalSize" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Themes","LastHighContrastTheme",%REG_EXPAND_SZ%,"%%SystemRoot%%\resources\Ease of Access Themes\hcblack.theme" HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Themes","ThemeChangesDesktopIcons",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Themes","ThemeChangesMousePointers",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize","ColorPrevalence",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize","EnableTransparency",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing","State",%REG_DWORD%,146432 ; 0x00023c00 HKO,"SOFTWARE\Microsoft\Windows\DWM","Composition",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows\TabletPC\Snipping Tool",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\TabletPC\TabSetup",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows\Windows Error Reporting\Hangs",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices","Microsoft XPS Document Writer",%REG_SZ%,"winspool,Ne00:" HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices","Microsoft Print to PDF",%REG_SZ%,"winspool,Ne01:" HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices","Fax",%REG_SZ%,"winspool,Ne02:" HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\EFS",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\MsiCorruptedFileRecovery\RepairedProducts","AnyIdMax",%REG_DWORD%,5 ; 0x00000005 HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\MsiCorruptedFileRecovery\RepairedProducts","SameIdMax",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\MsiCorruptedFileRecovery\RepairedProducts","TimeWindowMinutes",%REG_DWORD%,1440 ; 0x000005a0 HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts","Microsoft XPS Document Writer",%REG_SZ%,"winspool,Ne00:,15,45" HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts","Microsoft Print to PDF",%REG_SZ%,"winspool,Ne01:,15,45" HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts","Fax",%REG_SZ%,"winspool,Ne02:,15,45" HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\TileDataModel\Migration",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows","Device",%REG_SZ%,"" HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows","IsMRUEstablished",%REG_DWORD%,4294967295 ; 0xffffffff HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows","LegacyDefaultPrinterMode",%REG_DWORD%,4294967295 ; 0xffffffff HKO,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Pen","PenArbitrationType",%REG_DWORD%,3 ; 0x00000003 HKO,"SOFTWARE\Microsoft\Wisp\MultiTouch",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters","DblDist",%REG_DWORD%,20 ; 0x00000014 HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters","DblTime",%REG_DWORD%,300 ; 0x0000012c HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters","EraseEnable",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters","FlickMode",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters","FlickTolerance",%REG_DWORD%,50 ; 0x00000032 HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters","HoldMode",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters","HoldTime",%REG_DWORD%,2300 ; 0x000008fc HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters","RightMaskEnable",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters","Splash",%REG_DWORD%,50 ; 0x00000032 HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters","TapTime",%REG_DWORD%,100 ; 0x00000064 HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters","WaitTime",%REG_DWORD%,300 ; 0x0000012c HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters\CustomFlickCommands",,%REG_KEYONLY% HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters\FlickCommands","down",%REG_SZ%,"{00000000-0000-0000-0000-000000000000}" HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters\FlickCommands","downLeft",%REG_SZ%,"{00000000-0000-0000-0000-000000000000}" HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters\FlickCommands","downRight",%REG_SZ%,"{00000000-0000-0000-0000-000000000000}" HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters\FlickCommands","left",%REG_SZ%,"{00000000-0000-0000-0000-000000000000}" HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters\FlickCommands","right",%REG_SZ%,"{00000000-0000-0000-0000-000000000000}" HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters\FlickCommands","up",%REG_SZ%,"{00000000-0000-0000-0000-000000000000}" HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters\FlickCommands","upLeft",%REG_SZ%,"{00000000-0000-0000-0000-000000000000}" HKO,"SOFTWARE\Microsoft\Wisp\Pen\SysEventParameters\FlickCommands","upRight",%REG_SZ%,"{00000000-0000-0000-0000-000000000000}" HKO,"SOFTWARE\Microsoft\Wisp\Touch","Bouncing",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Wisp\Touch","Friction",%REG_DWORD%,50 ; 0x00000032 HKO,"SOFTWARE\Microsoft\Wisp\Touch","Inertia",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Wisp\Touch","TouchMode_hold",%REG_DWORD%,1 ; 0x00000001 HKO,"SOFTWARE\Microsoft\Wisp\Touch","TouchModeN_DtapDist",%REG_DWORD%,50 ; 0x00000032 HKO,"SOFTWARE\Microsoft\Wisp\Touch","TouchModeN_DtapTime",%REG_DWORD%,50 ; 0x00000032 HKO,"SOFTWARE\Microsoft\Wisp\Touch","TouchModeN_HoldTime_Animation",%REG_DWORD%,50 ; 0x00000032 HKO,"SOFTWARE\Microsoft\Wisp\Touch","TouchModeN_HoldTime_BeforeAnimation",%REG_DWORD%,50 ; 0x00000032 HKO,"SOFTWARE\Microsoft\Wisp\Touch","TouchUI",%REG_DWORD%,0 ; 0x00000000 HKO,"SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache",,%REG_KEYONLY% HKO,"SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Cache",,%REG_KEYONLY% HKO,"SOFTWARE\Policies\Power\PowerSettings",,%REG_KEYONLY% HKO,"System\CurrentControlSet\Control\Network\NetworkLocationWizard","ShowCount",%REG_DWORD%,0 ; 0x00000000 ; EOF
Create the text file OFFREG.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 33 2c 20 53 74 65 66 61 6e 20 4b 61 -2023, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 03 00 56 4f 49 44 00 00 00 00 PE..L...VOID....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 0a 00 00 ......#.........
00 1a 00 00 00 80 14 00 8b 16 00 00 00 10 00 00 ................
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
05 00 00 00 00 00 2f 03 05 00 00 00 00 00 00 00 ....../.........
00 c0 14 00 00 02 00 00 d1 73 00 00 03 00 00 85 .........s......
00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
30 b7 14 00 64 00 00 00 00 00 00 00 00 00 00 00 0...d...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 a0 14 00 5c 00 00 00 ............\...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
d0 08 00 00 00 10 00 00 00 0a 00 00 00 02 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 62 73 73 00 00 00 00 00 80 14 00 00 20 00 00 .bss......... ..
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 80 00 00 c0 2e 63 6f 6e 73 74 00 00 .........const..
40 19 00 00 00 a0 14 00 00 1a 00 00 00 0c 00 00 @...............
00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 ............@..@
55 8b ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 U........V.E.P.u
0c 8d 85 f8 f7 ff ff 50 ff 15 54 a0 54 00 8b f0 .......P..T.T...
85 f6 75 04 33 c0 eb 23 6a 00 8d 45 fc 50 56 8d ..u.3..#j..E.PV.
85 f8 f7 ff ff 50 ff 75 08 ff 15 00 a0 54 00 85 .....P.u.....T..
c0 74 e1 33 c0 39 75 fc 0f 94 c0 5e c9 c3 55 8b .t.3.9u....^..U.
ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 0c 8d .......V.E.P.u..
b5 f8 f7 ff ff 8b c6 50 ff 15 54 a0 54 00 85 c0 .......P..T.T...
74 25 57 8d 3c 00 6a 00 8d 45 fc 50 57 56 ff 75 t%W.<.j..E.PWV.u
08 ff 15 04 a0 54 00 85 c0 74 0f 03 75 fc 2b 7d .....T...t..u.+}
fc 75 e3 33 c0 40 5f 5e c9 c3 33 c0 eb f8 55 8b .u.3.@_^..3...U.
ec 56 8b 75 10 57 8b 7d 0c 03 f6 6a 00 8d 45 10 .V.u.W.}...j..E.
50 56 57 ff 75 08 ff 15 04 a0 54 00 85 c0 74 11 PVW.u.....T...t.
03 7d 10 2b 75 10 75 e3 33 c0 40 5f 5e 5d c2 0c .}.+u.u.3.@_^]..
00 33 c0 eb f6 8b 44 24 04 0f b7 08 83 f9 22 74 .3....D$......"t
0f 83 f9 25 74 0a 83 c0 02 66 85 c9 75 eb 33 c0 ...%t....f..u.3.
c2 04 00 55 8b ec 83 ec 24 53 56 57 8d 45 fc 50 ...U....$SVW.E.P
be 00 a0 44 00 56 8d 45 e4 50 8d 45 f8 50 33 db ...D.V.E.P.E.P3.
68 00 20 44 00 53 ff 75 10 89 5d ec c7 45 f8 00 h. D.S.u..]..E..
40 00 00 c7 45 fc 00 00 10 00 ff 15 38 a0 54 00 @...E.......8.T.
bf 03 01 00 00 e9 eb 03 00 00 3b c3 74 20 68 00 ..........;.t h.
20 40 00 50 68 dc ac 54 00 68 78 ac 54 00 ff 75 @.Ph..T.hx.T..u
08 e8 aa fe ff ff 83 c4 14 e9 98 03 00 00 83 7d ...............}
14 0d 73 11 68 6c ac 54 00 ff 75 0c e8 dd fe ff ..s.hl.T..u.....
ff 59 59 eb 15 68 1a 20 40 00 68 54 ac 54 00 ff .YY..h. @.hT.T..
75 0c e8 c7 fe ff ff 83 c4 0c 8b d8 8b 45 e4 83 u............E..
f8 0c 73 2b 83 7d f8 00 ff 34 85 80 a9 54 00 75 ..s+.}...4...T.u
12 68 38 ac 54 00 ff 75 0c e8 a0 fe ff ff 83 c4 .h8.T..u........
0c eb 2f 68 00 20 44 00 68 14 ac 54 00 eb 18 83 ../h. D.h..T....
7d f8 00 50 75 07 68 00 ac 54 00 eb d9 68 00 20 }..Pu.h..T...h.
44 00 68 e4 ab 54 00 ff 75 0c e8 6f fe ff ff 83 D.h..T..u..o....
c4 10 23 d8 8b 45 fc 33 d2 3b c2 0f 84 c8 02 00 ..#..E.3.;......
00 8b 4d e4 3b ca 0f 86 8d 02 00 00 83 f9 02 0f ..M.;...........
86 df 01 00 00 83 f9 04 0f 84 c5 01 00 00 83 f9 ................
05 0f 84 95 01 00 00 83 f9 06 0f 84 56 01 00 00 ............V...
83 f9 07 74 36 83 f9 0b 0f 85 5b 02 00 00 83 f8 ...t6.....[.....
08 0f 85 52 02 00 00 a1 04 a0 44 00 8b 0d 00 a0 ...R......D.....
44 00 50 51 50 51 68 b8 ab 54 00 ff 75 0c e8 fb D.PQPQh..T..u...
fd ff ff 83 c4 18 e9 6d 02 00 00 a8 01 0f 85 26 .......m.......&
02 00 00 83 f8 02 75 15 66 39 15 00 a0 44 00 75 ......u.f9...D.u
0c 6a 03 68 b0 ab 54 00 e9 43 02 00 00 d1 e8 8d .j.h..T..C......
0c 45 00 a0 44 00 8b fe 89 45 fc 89 4d e0 83 f8 .E..D....E..M...
01 76 19 8d 51 fe 66 83 3a 00 75 10 66 83 3c 45 .v..Q.f.:.u.f.<E
fc 9f 44 00 00 75 05 89 55 e0 eb 05 33 c0 66 89 ..D..u..U...3.f.
01 66 83 3f 00 75 0c 6a 03 68 a8 ab 54 00 e9 84 .f.?.u.j.h..T...
00 00 00 8b c7 8d 50 02 66 8b 08 83 c0 02 66 85 ......P.f.....f.
c9 75 f5 6a 02 2b c2 68 a0 ab 54 00 ff 75 0c d1 .u.j.+.h..T..u..
f8 89 45 fc e8 b5 fd ff ff 57 23 d8 89 7d f4 e8 ..E......W#..}..
e1 fd ff ff 8b 4d fc 8d 3c 4f eb 28 8b 45 e8 2b .....M..<O.(.E.+
45 f4 83 c0 02 d1 f8 50 ff 75 f4 ff 75 0c e8 8b E......P.u..u...
fd ff ff 23 d8 8b 45 e8 89 45 f4 83 c0 02 50 e8 ...#..E..E....P.
b1 fd ff ff 89 45 e8 85 c0 75 d1 8b c7 2b 45 f4 .....E...u...+E.
d1 f8 50 ff 75 f4 ff 75 0c e8 60 fd ff ff 6a 01 ..P.u..u..`...j.
23 d8 68 9c ab 54 00 ff 75 0c e8 4f fd ff ff 83 #.h..T..u..O....
c7 02 23 d8 3b 7d e0 0f 82 54 ff ff ff 6a 02 68 ..#.;}...T...j.h
94 ab 54 00 ff 75 0c e8 32 fd ff ff bf 03 01 00 ..T..u..2.......
00 e9 52 01 00 00 a8 01 0f 85 0b 01 00 00 6a 02 ..R...........j.
68 a0 ab 54 00 ff 75 0c e8 11 fd ff ff 23 d8 8b h..T..u......#..
45 fc d1 e8 50 56 ff 75 0c e8 00 fd ff ff 6a 03 E...PV.u......j.
23 d8 68 8c ab 54 00 e9 14 01 00 00 83 f8 04 0f #.h..T..........
85 d4 00 00 00 a1 00 a0 44 00 50 0f c8 50 68 68 ........D.P..Phh
ab 54 00 ff 75 0c e8 83 fc ff ff 83 c4 10 e9 f5 .T..u...........
00 00 00 83 f8 04 0f 85 ad 00 00 00 a1 00 a0 44 ...............D
00 50 eb d9 a8 01 0f 85 9d 00 00 00 66 39 15 00 .P..........f9..
a0 44 00 75 0c 6a 05 68 5c ab 54 00 e9 bf 00 00 .D.u.j.h\.T.....
00 d1 e8 33 c9 66 89 0c 45 00 a0 44 00 8b c6 89 ...3.f..E..D....
75 f4 8d 48 02 66 8b 10 83 c0 02 66 85 d2 75 f5 u..H.f.....f..u.
6a 02 2b c1 68 a0 ab 54 00 ff 75 0c d1 f8 89 45 j.+.h..T..u....E
fc e8 68 fc ff ff 56 eb 1d 8b c7 2b 45 f4 83 c0 ..h...V....+E...
02 d1 f8 50 ff 75 f4 ff 75 0c e8 4f fc ff ff 89 ...P.u..u..O....
7d f4 83 c7 02 57 23 d8 e8 78 fc ff ff 8b f8 85 }....W#..x......
ff 75 d6 8b 45 fc 03 c0 2b 45 f4 03 c6 d1 f8 50 .u..E...+E.....P
ff 75 f4 ff 75 0c e8 23 fc ff ff 6a 03 23 d8 68 .u..u..#...j.#.h
8c ab 54 00 e9 db fe ff ff 89 55 f4 3b c2 76 29 ..T.......U.;.v)
8b 45 f4 0f b6 80 00 a0 44 00 6a 03 8d 04 c5 80 .E......D.j.....
a1 54 00 50 ff 75 0c e8 f2 fb ff ff 23 d8 ff 45 .T.P.u......#..E
f4 8b 45 f4 3b 45 fc 72 d7 6a 02 68 94 ab 54 00 ..E.;E.r.j.h..T.
ff 75 0c e8 d6 fb ff ff 23 d8 85 db 75 26 ff 15 .u......#...u&..
08 a0 54 00 68 00 20 40 00 68 00 20 44 00 50 68 ..T.h. @.h. D.Ph
48 ab 54 00 68 c8 aa 54 00 ff 75 08 e8 0f fb ff H.T.h..T..u.....
ff 83 c4 18 33 db ff 45 ec 8d 45 fc 50 56 8d 45 ....3..E..E.PV.E
e4 50 8d 45 f8 50 68 00 20 44 00 ff 75 ec c7 45 .P.E.Ph. D..u..E
f8 00 40 00 00 ff 75 10 c7 45 fc 00 00 10 00 ff ..@...u..E......
15 38 a0 54 00 3b c7 0f 85 0d fc ff ff 8b 75 14 .8.T.;........u.
53 b8 ff ff 01 00 2b c6 53 89 45 e0 89 45 f0 53 S.....+.S.E..E.S
8d 45 f0 50 8d 04 75 02 20 40 00 50 89 5d f4 53 .E.P..u. @.P.].S
e9 bb 00 00 00 39 5d 14 74 1f 68 00 20 40 00 ff .....9].t.h. @..
75 14 68 b4 aa 54 00 68 78 ac 54 00 ff 75 08 e8 u.h..T.hx.T..u..
8c fa ff ff 83 c4 14 eb 7c 6a 5c 58 66 89 04 75 ........|j\Xf..u
00 20 40 00 8d 45 dc 50 8d 04 75 02 20 40 00 50 . @..E.P..u. @.P
ff 75 10 ff 15 34 a0 54 00 3b c3 74 0d 68 00 20 .u...4.T.;.t.h.
40 00 50 68 a0 aa 54 00 eb 31 8b 45 f0 8d 44 30 @.Ph..T..1.E..D0
01 50 ff 75 dc ff 75 0c ff 75 08 e8 33 fb ff ff .P.u..u..u..3...
ff 75 dc ff 15 30 a0 54 00 89 45 f8 3b c3 74 1b .u...0.T..E.;.t.
68 00 20 40 00 50 68 88 aa 54 00 68 78 ac 54 00 h. @.Ph..T.hx.T.
ff 75 08 e8 18 fa ff ff 83 c4 14 33 c0 66 89 04 .u.........3.f..
75 00 20 40 00 8b 45 e0 ff 45 f4 53 53 89 45 f0 u. @..E..E.SS.E.
53 8d 45 f0 50 8d 04 75 02 20 40 00 50 ff 75 f4 S.E.P..u. @.P.u.
ff 75 10 ff 15 2c a0 54 00 89 45 14 3b c7 0f 85 .u...,.T..E.;...
31 ff ff ff 39 5d ec 75 58 39 5d f4 75 53 83 fe 1...9].uX9].uS..
0d 73 11 6a 15 68 5c aa 54 00 ff 75 0c e8 5c fa .s.j.h\.T..u..\.
ff ff eb 15 68 1a 20 40 00 68 20 aa 54 00 ff 75 ....h. @.h .T..u
0c e8 f8 f9 ff ff 83 c4 0c 3b c3 75 24 ff 15 08 .........;.u$...
a0 54 00 68 00 20 40 00 50 68 48 ab 54 00 68 b0 .T.h. @.PhH.T.h.
a9 54 00 ff 75 08 89 45 14 e8 82 f9 ff ff 83 c4 .T..u..E........
14 8b 45 14 5f 5e 5b c9 c2 10 00 83 ec 2c 56 57 ..E._^[......,VW
6a f4 bf a0 00 00 00 ff 15 24 a0 54 00 8b f0 89 j........$.T....
74 24 08 83 fe ff 75 0d ff 15 08 a0 54 00 8b f8 t$....u.....T...
e9 12 02 00 00 53 55 8d 44 24 20 50 ff 15 20 a0 .....SU.D$ P.. .
54 00 50 ff 15 4c a0 54 00 8b 2d 08 a0 54 00 89 T.P..L.T..-..T..
44 24 1c 85 c0 75 14 ff d5 8b f8 57 68 0c b7 54 D$...u.....Wh..T
00 bb d8 b6 54 00 e9 b3 01 00 00 83 7c 24 20 02 ....T.......|$ .
bb d8 b6 54 00 74 12 68 40 b6 54 00 56 e8 fe f8 ...T.t.h@.T.V...
ff ff 59 59 e9 7f 01 00 00 6a f5 ff 15 24 a0 54 ..YY.....j...$.T
00 89 44 24 14 83 f8 ff 75 0f ff d5 8b f8 57 68 ..D$....u.....Wh
24 b6 54 00 e9 55 01 00 00 50 ff 15 1c a0 54 00 $.T..U...P....T.
85 c0 75 11 ff d5 8b f8 57 68 00 b6 54 00 68 70 ..u.....Wh..T.hp
b5 54 00 eb 45 8d 44 24 24 50 8d 44 24 2c 50 ff .T..E.D$$P.D$,P.
15 44 a0 54 00 ff 74 24 24 ff 74 24 2c 68 38 b5 .D.T..t$$.t$,h8.
54 00 56 e8 98 f8 ff ff 83 c4 10 8d 44 24 18 50 T.V.........D$.P
8b 44 24 20 ff 70 04 ff 15 40 a0 54 00 8b f8 85 .D$ .p...@.T....
ff 74 15 57 68 20 b5 54 00 53 56 e8 70 f8 ff ff .t.Wh .T.SV.p...
83 c4 10 e9 d0 00 00 00 8d 44 24 2c 50 ff 15 18 .........D$,P...
a0 54 00 0f b7 44 24 3a 50 0f b7 44 24 3c 50 0f .T...D$:P..D$<P.
b7 44 24 3e 50 0f b7 44 24 40 50 0f b7 44 24 3c .D$>P..D$@P..D$<
50 0f b7 44 24 46 50 0f b7 44 24 46 50 68 68 ad P..D$FP..D$FPhh.
54 00 ff 74 24 34 e8 73 f8 ff ff 83 c4 24 85 c0 T..t$4.s.....$..
75 12 ff d5 50 68 48 ab 54 00 53 56 e8 0f f8 ff u...PhH.T.SV....
ff 83 c4 10 6a 06 59 be 4c ad 54 00 bf 00 20 40 ....j.Y.L.T... @
00 f3 a5 6a 0c ff 74 24 1c 66 a5 ff 74 24 1c ff ...j..t$.f..t$..
74 24 1c e8 db f8 ff ff 6a 09 68 38 ad 54 00 ff t$......j.h8.T..
74 24 1c e8 76 f8 ff ff 85 c0 75 15 ff d5 50 68 t$..v.....u...Ph
48 ab 54 00 53 ff 74 24 1c e8 c2 f7 ff ff 83 c4 H.T.S.t$........
10 ff 74 24 18 ff 15 3c a0 54 00 8b f8 85 ff 74 ..t$...<.T.....t
13 57 68 20 ad 54 00 53 ff 74 24 1c e8 9f f7 ff .Wh .T.S.t$.....
ff 83 c4 10 8b 74 24 10 ff 74 24 14 ff 15 14 a0 .....t$..t$.....
54 00 85 c0 75 12 ff d5 50 68 08 ad 54 00 53 56 T...u...Ph..T.SV
e8 7b f7 ff ff 83 c4 10 ff 74 24 1c ff 15 10 a0 .{.......t$.....
54 00 85 c0 74 12 ff d5 50 68 f4 ac 54 00 53 56 T...t...Ph..T.SV
e8 5b f7 ff ff 83 c4 10 56 ff 15 14 a0 54 00 85 .[......V....T..
c0 75 12 ff d5 50 68 08 ad 54 00 53 56 e8 3e f7 .u...Ph..T.SV.>.
ff ff 83 c4 10 5d 5b 57 ff 15 0c a0 54 00 5f 5e .....][W....T._^
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
f0 b7 14 00 00 b8 14 00 0c b8 14 00 1c b8 14 00 ................
2a b8 14 00 36 b8 14 00 44 b8 14 00 54 b8 14 00 *...6...D...T...
68 b8 14 00 7a b8 14 00 00 00 00 00 98 b8 14 00 h...z...........
a4 b8 14 00 b2 b8 14 00 be b8 14 00 cc b8 14 00 ................
da b8 14 00 e8 b8 14 00 00 00 00 00 04 b9 14 00 ................
00 00 00 00 26 b9 14 00 00 00 00 00 00 00 00 00 ....&...........
51 00 57 00 4f 00 52 00 44 00 00 00 52 00 45 00 Q.W.O.R.D...R.E.
53 00 4f 00 55 00 52 00 43 00 45 00 5f 00 52 00 S.O.U.R.C.E._.R.
45 00 51 00 55 00 49 00 52 00 45 00 4d 00 45 00 E.Q.U.I.R.E.M.E.
4e 00 54 00 53 00 5f 00 4c 00 49 00 53 00 54 00 N.T.S._.L.I.S.T.
00 00 00 00 46 00 55 00 4c 00 4c 00 5f 00 52 00 ....F.U.L.L._.R.
45 00 53 00 4f 00 55 00 52 00 43 00 45 00 5f 00 E.S.O.U.R.C.E._.
44 00 45 00 53 00 43 00 52 00 49 00 50 00 54 00 D.E.S.C.R.I.P.T.
4f 00 52 00 00 00 00 00 52 00 45 00 53 00 4f 00 O.R.....R.E.S.O.
55 00 52 00 43 00 45 00 5f 00 4c 00 49 00 53 00 U.R.C.E._.L.I.S.
54 00 00 00 4d 00 55 00 4c 00 54 00 49 00 5f 00 T...M.U.L.T.I._.
53 00 5a 00 00 00 00 00 4c 00 49 00 4e 00 4b 00 S.Z.....L.I.N.K.
00 00 00 00 44 00 57 00 4f 00 52 00 44 00 5f 00 ....D.W.O.R.D._.
42 00 49 00 47 00 5f 00 45 00 4e 00 44 00 49 00 B.I.G._.E.N.D.I.
41 00 4e 00 00 00 00 00 44 00 57 00 4f 00 52 00 A.N.....D.W.O.R.
44 00 00 00 42 00 49 00 4e 00 41 00 52 00 59 00 D...B.I.N.A.R.Y.
00 00 00 00 45 00 58 00 50 00 41 00 4e 00 44 00 ....E.X.P.A.N.D.
5f 00 53 00 5a 00 00 00 53 00 5a 00 00 00 00 00 _.S.Z...S.Z.....
4e 00 4f 00 4e 00 45 00 00 00 00 00 00 00 00 00 N.O.N.E.........
2c 00 30 00 30 00 00 00 2c 00 30 00 31 00 00 00 ,.0.0...,.0.1...
2c 00 30 00 32 00 00 00 2c 00 30 00 33 00 00 00 ,.0.2...,.0.3...
2c 00 30 00 34 00 00 00 2c 00 30 00 35 00 00 00 ,.0.4...,.0.5...
2c 00 30 00 36 00 00 00 2c 00 30 00 37 00 00 00 ,.0.6...,.0.7...
2c 00 30 00 38 00 00 00 2c 00 30 00 39 00 00 00 ,.0.8...,.0.9...
2c 00 30 00 61 00 00 00 2c 00 30 00 62 00 00 00 ,.0.a...,.0.b...
2c 00 30 00 63 00 00 00 2c 00 30 00 64 00 00 00 ,.0.c...,.0.d...
2c 00 30 00 65 00 00 00 2c 00 30 00 66 00 00 00 ,.0.e...,.0.f...
2c 00 31 00 30 00 00 00 2c 00 31 00 31 00 00 00 ,.1.0...,.1.1...
2c 00 31 00 32 00 00 00 2c 00 31 00 33 00 00 00 ,.1.2...,.1.3...
2c 00 31 00 34 00 00 00 2c 00 31 00 35 00 00 00 ,.1.4...,.1.5...
2c 00 31 00 36 00 00 00 2c 00 31 00 37 00 00 00 ,.1.6...,.1.7...
2c 00 31 00 38 00 00 00 2c 00 31 00 39 00 00 00 ,.1.8...,.1.9...
2c 00 31 00 61 00 00 00 2c 00 31 00 62 00 00 00 ,.1.a...,.1.b...
2c 00 31 00 63 00 00 00 2c 00 31 00 64 00 00 00 ,.1.c...,.1.d...
2c 00 31 00 65 00 00 00 2c 00 31 00 66 00 00 00 ,.1.e...,.1.f...
2c 00 32 00 30 00 00 00 2c 00 32 00 31 00 00 00 ,.2.0...,.2.1...
2c 00 32 00 32 00 00 00 2c 00 32 00 33 00 00 00 ,.2.2...,.2.3...
2c 00 32 00 34 00 00 00 2c 00 32 00 35 00 00 00 ,.2.4...,.2.5...
2c 00 32 00 36 00 00 00 2c 00 32 00 37 00 00 00 ,.2.6...,.2.7...
2c 00 32 00 38 00 00 00 2c 00 32 00 39 00 00 00 ,.2.8...,.2.9...
2c 00 32 00 61 00 00 00 2c 00 32 00 62 00 00 00 ,.2.a...,.2.b...
2c 00 32 00 63 00 00 00 2c 00 32 00 64 00 00 00 ,.2.c...,.2.d...
2c 00 32 00 65 00 00 00 2c 00 32 00 66 00 00 00 ,.2.e...,.2.f...
2c 00 33 00 30 00 00 00 2c 00 33 00 31 00 00 00 ,.3.0...,.3.1...
2c 00 33 00 32 00 00 00 2c 00 33 00 33 00 00 00 ,.3.2...,.3.3...
2c 00 33 00 34 00 00 00 2c 00 33 00 35 00 00 00 ,.3.4...,.3.5...
2c 00 33 00 36 00 00 00 2c 00 33 00 37 00 00 00 ,.3.6...,.3.7...
2c 00 33 00 38 00 00 00 2c 00 33 00 39 00 00 00 ,.3.8...,.3.9...
2c 00 33 00 61 00 00 00 2c 00 33 00 62 00 00 00 ,.3.a...,.3.b...
2c 00 33 00 63 00 00 00 2c 00 33 00 64 00 00 00 ,.3.c...,.3.d...
2c 00 33 00 65 00 00 00 2c 00 33 00 66 00 00 00 ,.3.e...,.3.f...
2c 00 34 00 30 00 00 00 2c 00 34 00 31 00 00 00 ,.4.0...,.4.1...
2c 00 34 00 32 00 00 00 2c 00 34 00 33 00 00 00 ,.4.2...,.4.3...
2c 00 34 00 34 00 00 00 2c 00 34 00 35 00 00 00 ,.4.4...,.4.5...
2c 00 34 00 36 00 00 00 2c 00 34 00 37 00 00 00 ,.4.6...,.4.7...
2c 00 34 00 38 00 00 00 2c 00 34 00 39 00 00 00 ,.4.8...,.4.9...
2c 00 34 00 61 00 00 00 2c 00 34 00 62 00 00 00 ,.4.a...,.4.b...
2c 00 34 00 63 00 00 00 2c 00 34 00 64 00 00 00 ,.4.c...,.4.d...
2c 00 34 00 65 00 00 00 2c 00 34 00 66 00 00 00 ,.4.e...,.4.f...
2c 00 35 00 30 00 00 00 2c 00 35 00 31 00 00 00 ,.5.0...,.5.1...
2c 00 35 00 32 00 00 00 2c 00 35 00 33 00 00 00 ,.5.2...,.5.3...
2c 00 35 00 34 00 00 00 2c 00 35 00 35 00 00 00 ,.5.4...,.5.5...
2c 00 35 00 36 00 00 00 2c 00 35 00 37 00 00 00 ,.5.6...,.5.7...
2c 00 35 00 38 00 00 00 2c 00 35 00 39 00 00 00 ,.5.8...,.5.9...
2c 00 35 00 61 00 00 00 2c 00 35 00 62 00 00 00 ,.5.a...,.5.b...
2c 00 35 00 63 00 00 00 2c 00 35 00 64 00 00 00 ,.5.c...,.5.d...
2c 00 35 00 65 00 00 00 2c 00 35 00 66 00 00 00 ,.5.e...,.5.f...
2c 00 36 00 30 00 00 00 2c 00 36 00 31 00 00 00 ,.6.0...,.6.1...
2c 00 36 00 32 00 00 00 2c 00 36 00 33 00 00 00 ,.6.2...,.6.3...
2c 00 36 00 34 00 00 00 2c 00 36 00 35 00 00 00 ,.6.4...,.6.5...
2c 00 36 00 36 00 00 00 2c 00 36 00 37 00 00 00 ,.6.6...,.6.7...
2c 00 36 00 38 00 00 00 2c 00 36 00 39 00 00 00 ,.6.8...,.6.9...
2c 00 36 00 61 00 00 00 2c 00 36 00 62 00 00 00 ,.6.a...,.6.b...
2c 00 36 00 63 00 00 00 2c 00 36 00 64 00 00 00 ,.6.c...,.6.d...
2c 00 36 00 65 00 00 00 2c 00 36 00 66 00 00 00 ,.6.e...,.6.f...
2c 00 37 00 30 00 00 00 2c 00 37 00 31 00 00 00 ,.7.0...,.7.1...
2c 00 37 00 32 00 00 00 2c 00 37 00 33 00 00 00 ,.7.2...,.7.3...
2c 00 37 00 34 00 00 00 2c 00 37 00 35 00 00 00 ,.7.4...,.7.5...
2c 00 37 00 36 00 00 00 2c 00 37 00 37 00 00 00 ,.7.6...,.7.7...
2c 00 37 00 38 00 00 00 2c 00 37 00 39 00 00 00 ,.7.8...,.7.9...
2c 00 37 00 61 00 00 00 2c 00 37 00 62 00 00 00 ,.7.a...,.7.b...
2c 00 37 00 63 00 00 00 2c 00 37 00 64 00 00 00 ,.7.c...,.7.d...
2c 00 37 00 65 00 00 00 2c 00 37 00 66 00 00 00 ,.7.e...,.7.f...
2c 00 38 00 30 00 00 00 2c 00 38 00 31 00 00 00 ,.8.0...,.8.1...
2c 00 38 00 32 00 00 00 2c 00 38 00 33 00 00 00 ,.8.2...,.8.3...
2c 00 38 00 34 00 00 00 2c 00 38 00 35 00 00 00 ,.8.4...,.8.5...
2c 00 38 00 36 00 00 00 2c 00 38 00 37 00 00 00 ,.8.6...,.8.7...
2c 00 38 00 38 00 00 00 2c 00 38 00 39 00 00 00 ,.8.8...,.8.9...
2c 00 38 00 61 00 00 00 2c 00 38 00 62 00 00 00 ,.8.a...,.8.b...
2c 00 38 00 63 00 00 00 2c 00 38 00 64 00 00 00 ,.8.c...,.8.d...
2c 00 38 00 65 00 00 00 2c 00 38 00 66 00 00 00 ,.8.e...,.8.f...
2c 00 39 00 30 00 00 00 2c 00 39 00 31 00 00 00 ,.9.0...,.9.1...
2c 00 39 00 32 00 00 00 2c 00 39 00 33 00 00 00 ,.9.2...,.9.3...
2c 00 39 00 34 00 00 00 2c 00 39 00 35 00 00 00 ,.9.4...,.9.5...
2c 00 39 00 36 00 00 00 2c 00 39 00 37 00 00 00 ,.9.6...,.9.7...
2c 00 39 00 38 00 00 00 2c 00 39 00 39 00 00 00 ,.9.8...,.9.9...
2c 00 39 00 61 00 00 00 2c 00 39 00 62 00 00 00 ,.9.a...,.9.b...
2c 00 39 00 63 00 00 00 2c 00 39 00 64 00 00 00 ,.9.c...,.9.d...
2c 00 39 00 65 00 00 00 2c 00 39 00 66 00 00 00 ,.9.e...,.9.f...
2c 00 61 00 30 00 00 00 2c 00 61 00 31 00 00 00 ,.a.0...,.a.1...
2c 00 61 00 32 00 00 00 2c 00 61 00 33 00 00 00 ,.a.2...,.a.3...
2c 00 61 00 34 00 00 00 2c 00 61 00 35 00 00 00 ,.a.4...,.a.5...
2c 00 61 00 36 00 00 00 2c 00 61 00 37 00 00 00 ,.a.6...,.a.7...
2c 00 61 00 38 00 00 00 2c 00 61 00 39 00 00 00 ,.a.8...,.a.9...
2c 00 61 00 61 00 00 00 2c 00 61 00 62 00 00 00 ,.a.a...,.a.b...
2c 00 61 00 63 00 00 00 2c 00 61 00 64 00 00 00 ,.a.c...,.a.d...
2c 00 61 00 65 00 00 00 2c 00 61 00 66 00 00 00 ,.a.e...,.a.f...
2c 00 62 00 30 00 00 00 2c 00 62 00 31 00 00 00 ,.b.0...,.b.1...
2c 00 62 00 32 00 00 00 2c 00 62 00 33 00 00 00 ,.b.2...,.b.3...
2c 00 62 00 34 00 00 00 2c 00 62 00 35 00 00 00 ,.b.4...,.b.5...
2c 00 62 00 36 00 00 00 2c 00 62 00 37 00 00 00 ,.b.6...,.b.7...
2c 00 62 00 38 00 00 00 2c 00 62 00 39 00 00 00 ,.b.8...,.b.9...
2c 00 62 00 61 00 00 00 2c 00 62 00 62 00 00 00 ,.b.a...,.b.b...
2c 00 62 00 63 00 00 00 2c 00 62 00 64 00 00 00 ,.b.c...,.b.d...
2c 00 62 00 65 00 00 00 2c 00 62 00 66 00 00 00 ,.b.e...,.b.f...
2c 00 63 00 30 00 00 00 2c 00 63 00 31 00 00 00 ,.c.0...,.c.1...
2c 00 63 00 32 00 00 00 2c 00 63 00 33 00 00 00 ,.c.2...,.c.3...
2c 00 63 00 34 00 00 00 2c 00 63 00 35 00 00 00 ,.c.4...,.c.5...
2c 00 63 00 36 00 00 00 2c 00 63 00 37 00 00 00 ,.c.6...,.c.7...
2c 00 63 00 38 00 00 00 2c 00 63 00 39 00 00 00 ,.c.8...,.c.9...
2c 00 63 00 61 00 00 00 2c 00 63 00 62 00 00 00 ,.c.a...,.c.b...
2c 00 63 00 63 00 00 00 2c 00 63 00 64 00 00 00 ,.c.c...,.c.d...
2c 00 63 00 65 00 00 00 2c 00 63 00 66 00 00 00 ,.c.e...,.c.f...
2c 00 64 00 30 00 00 00 2c 00 64 00 31 00 00 00 ,.d.0...,.d.1...
2c 00 64 00 32 00 00 00 2c 00 64 00 33 00 00 00 ,.d.2...,.d.3...
2c 00 64 00 34 00 00 00 2c 00 64 00 35 00 00 00 ,.d.4...,.d.5...
2c 00 64 00 36 00 00 00 2c 00 64 00 37 00 00 00 ,.d.6...,.d.7...
2c 00 64 00 38 00 00 00 2c 00 64 00 39 00 00 00 ,.d.8...,.d.9...
2c 00 64 00 61 00 00 00 2c 00 64 00 62 00 00 00 ,.d.a...,.d.b...
2c 00 64 00 63 00 00 00 2c 00 64 00 64 00 00 00 ,.d.c...,.d.d...
2c 00 64 00 65 00 00 00 2c 00 64 00 66 00 00 00 ,.d.e...,.d.f...
2c 00 65 00 30 00 00 00 2c 00 65 00 31 00 00 00 ,.e.0...,.e.1...
2c 00 65 00 32 00 00 00 2c 00 65 00 33 00 00 00 ,.e.2...,.e.3...
2c 00 65 00 34 00 00 00 2c 00 65 00 35 00 00 00 ,.e.4...,.e.5...
2c 00 65 00 36 00 00 00 2c 00 65 00 37 00 00 00 ,.e.6...,.e.7...
2c 00 65 00 38 00 00 00 2c 00 65 00 39 00 00 00 ,.e.8...,.e.9...
2c 00 65 00 61 00 00 00 2c 00 65 00 62 00 00 00 ,.e.a...,.e.b...
2c 00 65 00 63 00 00 00 2c 00 65 00 64 00 00 00 ,.e.c...,.e.d...
2c 00 65 00 65 00 00 00 2c 00 65 00 66 00 00 00 ,.e.e...,.e.f...
2c 00 66 00 30 00 00 00 2c 00 66 00 31 00 00 00 ,.f.0...,.f.1...
2c 00 66 00 32 00 00 00 2c 00 66 00 33 00 00 00 ,.f.2...,.f.3...
2c 00 66 00 34 00 00 00 2c 00 66 00 35 00 00 00 ,.f.4...,.f.5...
2c 00 66 00 36 00 00 00 2c 00 66 00 37 00 00 00 ,.f.6...,.f.7...
2c 00 66 00 38 00 00 00 2c 00 66 00 39 00 00 00 ,.f.8...,.f.9...
2c 00 66 00 61 00 00 00 2c 00 66 00 62 00 00 00 ,.f.a...,.f.b...
2c 00 66 00 63 00 00 00 2c 00 66 00 64 00 00 00 ,.f.c...,.f.d...
2c 00 66 00 65 00 00 00 2c 00 66 00 66 00 00 00 ,.f.e...,.f.f...
70 a1 54 00 68 a1 54 00 54 a1 54 00 44 a1 54 00 p.T.h.T.T.T.D.T.
38 a1 54 00 14 a1 54 00 08 a1 54 00 f4 a0 54 00 8.T...T...T...T.
d8 a0 54 00 a4 a0 54 00 6c a0 54 00 60 a0 54 00 ..T...T.l.T.`.T.
25 00 6c 00 73 00 28 00 29 00 20 00 72 00 65 00 %.l.s.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 65 00 t.u.r.n.e.d. .e.
72 00 72 00 6f 00 72 00 20 00 25 00 6c 00 75 00 r.r.o.r. .%.l.u.
20 00 66 00 6f 00 72 00 20 00 65 00 6d 00 70 00 .f.o.r. .e.m.p.
74 00 79 00 20 00 72 00 65 00 67 00 69 00 73 00 t.y. .r.e.g.i.s.
74 00 72 00 79 00 20 00 6b 00 65 00 79 00 20 00 t.r.y. .k.e.y. .
27 00 25 00 6c 00 73 00 27 00 0a 00 00 00 00 00 '.%.l.s.'.......
48 00 4b 00 4f 00 2c 00 22 00 25 00 6c 00 73 00 H.K.O.,.".%.l.s.
22 00 2c 00 2c 00 25 00 25 00 52 00 45 00 47 00 ".,.,.%.%.R.E.G.
5f 00 4b 00 45 00 59 00 4f 00 4e 00 4c 00 59 00 _.K.E.Y.O.N.L.Y.
25 00 25 00 0d 00 0a 00 00 00 00 00 48 00 4b 00 %.%.........H.K.
4f 00 2c 00 2c 00 2c 00 25 00 52 00 45 00 47 00 O.,.,.,.%.R.E.G.
5f 00 4b 00 45 00 59 00 4f 00 4e 00 4c 00 59 00 _.K.E.Y.O.N.L.Y.
25 00 0d 00 0a 00 00 00 4f 00 52 00 43 00 6c 00 %.......O.R.C.l.
6f 00 73 00 65 00 4b 00 65 00 79 00 00 00 00 00 o.s.e.K.e.y.....
4f 00 52 00 4f 00 70 00 65 00 6e 00 4b 00 65 00 O.R.O.p.e.n.K.e.
79 00 00 00 4f 00 52 00 45 00 6e 00 75 00 6d 00 y...O.R.E.n.u.m.
4b 00 65 00 79 00 00 00 25 00 6c 00 73 00 28 00 K.e.y...%.l.s.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 20 00 66 00 6f 00 72 00 .%.l.u. .f.o.r.
20 00 76 00 61 00 6c 00 75 00 65 00 20 00 27 00 .v.a.l.u.e. .'.
25 00 6c 00 73 00 27 00 20 00 6f 00 66 00 20 00 %.l.s.'. .o.f. .
72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 r.e.g.i.s.t.r.y.
20 00 6b 00 65 00 79 00 20 00 27 00 25 00 6c 00 .k.e.y. .'.%.l.
73 00 27 00 0a 00 00 00 57 00 72 00 69 00 74 00 s.'.....W.r.i.t.
65 00 46 00 69 00 6c 00 65 00 00 00 2c 00 22 00 e.F.i.l.e...,.".
22 00 0d 00 0a 00 00 00 2c 00 25 00 6c 00 75 00 ".......,.%.l.u.
20 00 3b 00 20 00 30 00 78 00 25 00 30 00 38 00 .;. .0.x.%.0.8.
6c 00 78 00 0d 00 0a 00 00 00 00 00 22 00 0d 00 l.x........."...
0a 00 00 00 0d 00 0a 00 00 00 00 00 22 00 00 00 ............"...
2c 00 22 00 00 00 00 00 3b 00 22 00 22 00 00 00 ,.".....;."."...
3b 00 0d 00 0a 00 00 00 2c 00 25 00 49 00 36 00 ;.......,.%.I.6.
34 00 75 00 20 00 3b 00 20 00 30 00 78 00 25 00 4.u. .;. .0.x.%.
30 00 31 00 36 00 49 00 36 00 34 00 78 00 0d 00 0.1.6.I.6.4.x...
0a 00 00 00 22 00 25 00 6c 00 73 00 22 00 2c 00 ....".%.l.s.".,.
30 00 78 00 25 00 30 00 38 00 6c 00 78 00 00 00 0.x.%.0.8.l.x...
2c 00 30 00 78 00 25 00 30 00 38 00 6c 00 78 00 ,.0.x.%.0.8.l.x.
00 00 00 00 22 00 25 00 6c 00 73 00 22 00 2c 00 ....".%.l.s.".,.
25 00 25 00 52 00 45 00 47 00 5f 00 25 00 6c 00 %.%.R.E.G._.%.l.
73 00 25 00 25 00 00 00 2c 00 25 00 25 00 52 00 s.%.%...,.%.%.R.
45 00 47 00 5f 00 25 00 6c 00 73 00 25 00 25 00 E.G._.%.l.s.%.%.
00 00 00 00 48 00 4b 00 4f 00 2c 00 22 00 25 00 ....H.K.O.,.".%.
6c 00 73 00 22 00 2c 00 00 00 00 00 48 00 4b 00 l.s.".,.....H.K.
4f 00 2c 00 2c 00 00 00 25 00 6c 00 73 00 28 00 O.,.,...%.l.s.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 20 00 66 00 6f 00 72 00 .%.l.u. .f.o.r.
20 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 .r.e.g.i.s.t.r.
79 00 20 00 6b 00 65 00 79 00 20 00 27 00 25 00 y. .k.e.y. .'.%.
6c 00 73 00 27 00 0a 00 00 00 00 00 4f 00 52 00 l.s.'.......O.R.
45 00 6e 00 75 00 6d 00 56 00 61 00 6c 00 75 00 E.n.u.m.V.a.l.u.
65 00 00 00 4c 00 6f 00 63 00 61 00 6c 00 46 00 e...L.o.c.a.l.F.
72 00 65 00 65 00 00 00 43 00 6c 00 6f 00 73 00 r.e.e...C.l.o.s.
65 00 48 00 61 00 6e 00 64 00 6c 00 65 00 00 00 e.H.a.n.d.l.e...
4f 00 52 00 43 00 6c 00 6f 00 73 00 65 00 48 00 O.R.C.l.o.s.e.H.
69 00 76 00 65 00 00 00 0d 00 0a 00 3b 00 20 00 i.v.e.......;. .
45 00 4f 00 46 00 0d 00 0a 00 00 00 48 00 4b 00 E.O.F.......H.K.
45 00 59 00 5f 00 4f 00 46 00 46 00 4c 00 49 00 E.Y._.O.F.F.L.I.
4e 00 45 00 00 00 00 00 ff fe 5b 00 56 00 65 00 N.E.......[.V.e.
72 00 73 00 69 00 6f 00 6e 00 5d 00 0d 00 0a 00 r.s.i.o.n.].....
44 00 72 00 69 00 76 00 65 00 72 00 56 00 65 00 D.r.i.v.e.r.V.e.
72 00 20 00 3d 00 20 00 25 00 30 00 32 00 68 00 r. .=. .%.0.2.h.
75 00 2f 00 25 00 30 00 32 00 68 00 75 00 2f 00 u./.%.0.2.h.u./.
25 00 30 00 34 00 68 00 75 00 2c 00 25 00 30 00 %.0.4.h.u.,.%.0.
32 00 68 00 75 00 2e 00 25 00 30 00 32 00 68 00 2.h.u...%.0.2.h.
75 00 2e 00 25 00 30 00 32 00 68 00 75 00 2e 00 u...%.0.2.h.u...
25 00 30 00 33 00 68 00 75 00 20 00 3b 00 20 00 %.0.3.h.u. .;. .
55 00 54 00 43 00 0d 00 0a 00 50 00 72 00 6f 00 U.T.C.....P.r.o.
76 00 69 00 64 00 65 00 72 00 20 00 20 00 3d 00 v.i.d.e.r. . .=.
20 00 22 00 53 00 74 00 65 00 66 00 61 00 6e 00 .".S.t.e.f.a.n.
20 00 4b 00 61 00 6e 00 74 00 68 00 61 00 6b 00 .K.a.n.t.h.a.k.
22 00 0d 00 0a 00 53 00 69 00 67 00 6e 00 61 00 ".....S.i.g.n.a.
74 00 75 00 72 00 65 00 20 00 3d 00 20 00 22 00 t.u.r.e. .=. .".
24 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 $.W.i.n.d.o.w.s.
20 00 4e 00 54 00 24 00 22 00 0d 00 0a 00 0d 00 .N.T.$.".......
0a 00 5b 00 53 00 74 00 72 00 69 00 6e 00 67 00 ..[.S.t.r.i.n.g.
73 00 5d 00 0d 00 0a 00 52 00 45 00 47 00 5f 00 s.].....R.E.G._.
53 00 5a 00 20 00 20 00 20 00 20 00 20 00 20 00 S.Z. . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 3d 00 20 00 30 00 78 00 30 00 . . .=. .0.x.0.
30 00 30 00 30 00 30 00 30 00 30 00 30 00 0d 00 0.0.0.0.0.0.0...
0a 00 52 00 45 00 47 00 5f 00 42 00 49 00 4e 00 ..R.E.G._.B.I.N.
41 00 52 00 59 00 20 00 20 00 20 00 20 00 20 00 A.R.Y. . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
3d 00 20 00 30 00 78 00 30 00 30 00 30 00 30 00 =. .0.x.0.0.0.0.
30 00 30 00 30 00 31 00 0d 00 0a 00 52 00 45 00 0.0.0.1.....R.E.
47 00 5f 00 4b 00 45 00 59 00 4f 00 4e 00 4c 00 G._.K.E.Y.O.N.L.
59 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 Y. . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 3d 00 20 00 30 00 . . . . .=. .0.
78 00 30 00 30 00 30 00 30 00 30 00 30 00 31 00 x.0.0.0.0.0.0.1.
30 00 0d 00 0a 00 52 00 45 00 47 00 5f 00 4d 00 0.....R.E.G._.M.
55 00 4c 00 54 00 49 00 5f 00 53 00 5a 00 20 00 U.L.T.I._.S.Z. .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 3d 00 20 00 30 00 78 00 30 00 30 00 . .=. .0.x.0.0.
30 00 31 00 30 00 30 00 30 00 30 00 0d 00 0a 00 0.1.0.0.0.0.....
52 00 45 00 47 00 5f 00 44 00 57 00 4f 00 52 00 R.E.G._.D.W.O.R.
44 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 D. . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 3d 00 . . . . . . .=.
20 00 30 00 78 00 30 00 30 00 30 00 31 00 30 00 .0.x.0.0.0.1.0.
30 00 30 00 31 00 0d 00 0a 00 52 00 45 00 47 00 0.0.1.....R.E.G.
5f 00 45 00 58 00 50 00 41 00 4e 00 44 00 5f 00 _.E.X.P.A.N.D._.
53 00 5a 00 20 00 20 00 20 00 20 00 20 00 20 00 S.Z. . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 3d 00 20 00 30 00 78 00 . . . .=. .0.x.
30 00 30 00 30 00 32 00 30 00 30 00 30 00 30 00 0.0.0.2.0.0.0.0.
0d 00 0a 00 52 00 45 00 47 00 5f 00 4e 00 4f 00 ....R.E.G._.N.O.
4e 00 45 00 20 00 20 00 20 00 20 00 20 00 20 00 N.E. . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 3d 00 20 00 30 00 78 00 30 00 30 00 30 00 .=. .0.x.0.0.0.
32 00 30 00 30 00 30 00 31 00 0d 00 0a 00 52 00 2.0.0.0.1.....R.
45 00 47 00 5f 00 43 00 4f 00 4d 00 50 00 41 00 E.G._.C.O.M.P.A.
54 00 49 00 42 00 4c 00 45 00 20 00 20 00 20 00 T.I.B.L.E. . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 3d 00 20 00 . . . . . .=. .
30 00 78 00 30 00 30 00 30 00 33 00 30 00 30 00 0.x.0.0.0.3.0.0.
30 00 31 00 20 00 3b 00 20 00 73 00 61 00 6d 00 0.1. .;. .s.a.m.
65 00 20 00 61 00 73 00 20 00 52 00 45 00 47 00 e. .a.s. .R.E.G.
5f 00 42 00 49 00 4e 00 41 00 52 00 59 00 0d 00 _.B.I.N.A.R.Y...
0a 00 52 00 45 00 47 00 5f 00 44 00 57 00 4f 00 ..R.E.G._.D.W.O.
52 00 44 00 5f 00 4c 00 49 00 54 00 54 00 4c 00 R.D._.L.I.T.T.L.
45 00 5f 00 45 00 4e 00 44 00 49 00 41 00 4e 00 E._.E.N.D.I.A.N.
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
3d 00 20 00 30 00 78 00 30 00 30 00 30 00 34 00 =. .0.x.0.0.0.4.
30 00 30 00 30 00 31 00 20 00 3b 00 20 00 73 00 0.0.0.1. .;. .s.
61 00 6d 00 65 00 20 00 61 00 73 00 20 00 52 00 a.m.e. .a.s. .R.
45 00 47 00 5f 00 44 00 57 00 4f 00 52 00 44 00 E.G._.D.W.O.R.D.
0d 00 0a 00 52 00 45 00 47 00 5f 00 44 00 57 00 ....R.E.G._.D.W.
4f 00 52 00 44 00 5f 00 42 00 49 00 47 00 5f 00 O.R.D._.B.I.G._.
45 00 4e 00 44 00 49 00 41 00 4e 00 20 00 20 00 E.N.D.I.A.N. . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 3d 00 20 00 30 00 78 00 30 00 30 00 30 00 .=. .0.x.0.0.0.
35 00 30 00 30 00 30 00 31 00 0d 00 0a 00 52 00 5.0.0.0.1.....R.
45 00 47 00 5f 00 4c 00 49 00 4e 00 4b 00 20 00 E.G._.L.I.N.K. .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 3d 00 20 00 . . . . . .=. .
30 00 78 00 30 00 30 00 30 00 36 00 30 00 30 00 0.x.0.0.0.6.0.0.
30 00 30 00 0d 00 0a 00 52 00 45 00 47 00 5f 00 0.0.....R.E.G._.
52 00 45 00 53 00 4f 00 55 00 52 00 43 00 45 00 R.E.S.O.U.R.C.E.
5f 00 4c 00 49 00 53 00 54 00 20 00 20 00 20 00 _.L.I.S.T. . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 3d 00 20 00 30 00 78 00 30 00 . . .=. .0.x.0.
30 00 30 00 38 00 30 00 30 00 30 00 31 00 0d 00 0.0.8.0.0.0.1...
0a 00 52 00 45 00 47 00 5f 00 46 00 55 00 4c 00 ..R.E.G._.F.U.L.
4c 00 5f 00 52 00 45 00 53 00 4f 00 55 00 52 00 L._.R.E.S.O.U.R.
43 00 45 00 5f 00 44 00 45 00 53 00 43 00 52 00 C.E._.D.E.S.C.R.
49 00 50 00 54 00 4f 00 52 00 20 00 20 00 20 00 I.P.T.O.R. . . .
3d 00 20 00 30 00 78 00 30 00 30 00 30 00 39 00 =. .0.x.0.0.0.9.
30 00 30 00 30 00 31 00 0d 00 0a 00 52 00 45 00 0.0.0.1.....R.E.
47 00 5f 00 52 00 45 00 53 00 4f 00 55 00 52 00 G._.R.E.S.O.U.R.
43 00 45 00 5f 00 52 00 45 00 51 00 55 00 49 00 C.E._.R.E.Q.U.I.
52 00 45 00 4d 00 45 00 4e 00 54 00 53 00 5f 00 R.E.M.E.N.T.S._.
4c 00 49 00 53 00 54 00 20 00 3d 00 20 00 30 00 L.I.S.T. .=. .0.
78 00 30 00 30 00 30 00 61 00 30 00 30 00 30 00 x.0.0.0.a.0.0.0.
31 00 0d 00 0a 00 52 00 45 00 47 00 5f 00 51 00 1.....R.E.G._.Q.
57 00 4f 00 52 00 44 00 20 00 20 00 20 00 20 00 W.O.R.D. . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 3d 00 20 00 30 00 78 00 30 00 30 00 . .=. .0.x.0.0.
30 00 62 00 30 00 30 00 30 00 31 00 0d 00 0a 00 0.b.0.0.0.1.....
52 00 45 00 47 00 5f 00 51 00 57 00 4f 00 52 00 R.E.G._.Q.W.O.R.
44 00 5f 00 4c 00 49 00 54 00 54 00 4c 00 45 00 D._.L.I.T.T.L.E.
5f 00 45 00 4e 00 44 00 49 00 41 00 4e 00 20 00 _.E.N.D.I.A.N. .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 3d 00 . . . . . . .=.
20 00 30 00 78 00 30 00 30 00 30 00 62 00 30 00 .0.x.0.0.0.b.0.
30 00 30 00 31 00 20 00 3b 00 20 00 73 00 61 00 0.0.1. .;. .s.a.
6d 00 65 00 20 00 61 00 73 00 20 00 52 00 45 00 m.e. .a.s. .R.E.
47 00 5f 00 51 00 57 00 4f 00 52 00 44 00 0d 00 G._.Q.W.O.R.D...
0a 00 0d 00 0a 00 5b 00 44 00 65 00 66 00 61 00 ......[.D.e.f.a.
75 00 6c 00 74 00 49 00 6e 00 73 00 74 00 61 00 u.l.t.I.n.s.t.a.
6c 00 6c 00 2e 00 4e 00 54 00 5d 00 0d 00 0a 00 l.l...N.T.].....
3b 00 41 00 64 00 64 00 52 00 65 00 67 00 20 00 ;.A.d.d.R.e.g. .
3d 00 20 00 41 00 64 00 64 00 52 00 65 00 67 00 =. .A.d.d.R.e.g.
2e 00 48 00 4b 00 4f 00 0d 00 0a 00 0d 00 0a 00 ..H.K.O.........
5b 00 41 00 64 00 64 00 52 00 65 00 67 00 2e 00 [.A.d.d.R.e.g...
48 00 4b 00 4f 00 5d 00 0d 00 0a 00 00 00 00 00 H.K.O.].........
4f 00 52 00 4f 00 70 00 65 00 6e 00 48 00 69 00 O.R.O.p.e.n.H.i.
76 00 65 00 00 00 00 00 4f 00 46 00 46 00 52 00 v.e.....O.F.F.R.
45 00 47 00 2e 00 44 00 4c 00 4c 00 20 00 76 00 E.G...D.L.L. .v.
65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 25 00 e.r.s.i.o.n. .%.
6c 00 75 00 2e 00 25 00 6c 00 75 00 0a 00 00 00 l.u...%.l.u.....
25 00 6c 00 73 00 28 00 29 00 20 00 72 00 65 00 %.l.s.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 65 00 t.u.r.n.e.d. .e.
72 00 72 00 6f 00 72 00 20 00 25 00 6c 00 75 00 r.r.o.r. .%.l.u.
3a 00 20 00 73 00 74 00 61 00 6e 00 64 00 61 00 :. .s.t.a.n.d.a.
72 00 64 00 20 00 6f 00 75 00 74 00 70 00 75 00 r.d. .o.u.t.p.u.
74 00 20 00 69 00 73 00 20 00 6e 00 6f 00 74 00 t. .i.s. .n.o.t.
20 00 72 00 65 00 64 00 69 00 72 00 65 00 63 00 .r.e.d.i.r.e.c.
74 00 65 00 64 00 20 00 74 00 6f 00 20 00 61 00 t.e.d. .t.o. .a.
20 00 66 00 69 00 6c 00 65 00 21 00 0a 00 00 00 .f.i.l.e.!.....
46 00 6c 00 75 00 73 00 68 00 46 00 69 00 6c 00 F.l.u.s.h.F.i.l.
65 00 42 00 75 00 66 00 66 00 65 00 72 00 73 00 e.B.u.f.f.e.r.s.
00 00 00 00 47 00 65 00 74 00 53 00 74 00 64 00 ....G.e.t.S.t.d.
48 00 61 00 6e 00 64 00 6c 00 65 00 00 00 00 00 H.a.n.d.l.e.....
4e 00 6f 00 20 00 61 00 72 00 67 00 75 00 6d 00 N.o. .a.r.g.u.m.
65 00 6e 00 74 00 3a 00 20 00 61 00 20 00 73 00 e.n.t.:. .a. .s.
69 00 6e 00 67 00 6c 00 65 00 20 00 66 00 69 00 i.n.g.l.e. .f.i.
6c 00 65 00 20 00 6f 00 72 00 20 00 70 00 61 00 l.e. .o.r. .p.a.
74 00 68 00 20 00 6e 00 61 00 6d 00 65 00 20 00 t.h. .n.a.m.e. .
6f 00 66 00 20 00 61 00 20 00 72 00 65 00 67 00 o.f. .a. .r.e.g.
69 00 73 00 74 00 72 00 79 00 20 00 68 00 69 00 i.s.t.r.y. .h.i.
76 00 65 00 20 00 6d 00 75 00 73 00 74 00 20 00 v.e. .m.u.s.t. .
62 00 65 00 20 00 67 00 69 00 76 00 65 00 6e 00 b.e. .g.i.v.e.n.
21 00 0a 00 00 00 00 00 25 00 6c 00 73 00 28 00 !.......%.l.s.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 0a 00 00 00 43 00 6f 00 .%.l.u.....C.o.
6d 00 6d 00 61 00 6e 00 64 00 4c 00 69 00 6e 00 m.m.a.n.d.L.i.n.
65 00 54 00 6f 00 41 00 72 00 67 00 76 00 00 00 e.T.o.A.r.g.v...
94 b7 14 00 00 00 00 00 00 00 00 00 8a b8 14 00 ................
00 a0 14 00 c0 b7 14 00 00 00 00 00 00 00 00 00 ................
f8 b8 14 00 2c a0 14 00 e0 b7 14 00 00 00 00 00 ....,...........
00 00 00 00 1a b9 14 00 4c a0 14 00 e8 b7 14 00 ........L.......
00 00 00 00 00 00 00 00 34 b9 14 00 54 a0 14 00 ........4...T...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 f0 b7 14 00 00 b8 14 00 0c b8 14 00 ................
1c b8 14 00 2a b8 14 00 36 b8 14 00 44 b8 14 00 ....*...6...D...
54 b8 14 00 68 b8 14 00 7a b8 14 00 00 00 00 00 T...h...z.......
98 b8 14 00 a4 b8 14 00 b2 b8 14 00 be b8 14 00 ................
cc b8 14 00 da b8 14 00 e8 b8 14 00 00 00 00 00 ................
04 b9 14 00 00 00 00 00 26 b9 14 00 00 00 00 00 ........&.......
24 05 57 72 69 74 65 43 6f 6e 73 6f 6c 65 57 00 $.WriteConsoleW.
25 05 57 72 69 74 65 46 69 6c 65 00 02 02 47 65 %.WriteFile...Ge
74 4c 61 73 74 45 72 72 6f 72 00 00 19 01 45 78 tLastError....Ex
69 74 50 72 6f 63 65 73 73 00 48 03 4c 6f 63 61 itProcess.H.Loca
6c 46 72 65 65 00 52 00 43 6c 6f 73 65 48 61 6e lFree.R.CloseHan
64 6c 65 00 77 02 47 65 74 53 79 73 74 65 6d 54 dle.w.GetSystemT
69 6d 65 00 57 01 46 6c 75 73 68 46 69 6c 65 42 ime.W.FlushFileB
75 66 66 65 72 73 00 00 87 01 47 65 74 43 6f 6d uffers....GetCom
6d 61 6e 64 4c 69 6e 65 57 00 64 02 47 65 74 53 mandLineW.d.GetS
74 64 48 61 6e 64 6c 65 00 00 4b 45 52 4e 45 4c tdHandle..KERNEL
33 32 2e 64 6c 6c 00 00 06 00 4f 52 45 6e 75 6d 32.dll....OREnum
4b 65 79 00 01 00 4f 52 43 6c 6f 73 65 4b 65 79 Key...ORCloseKey
00 00 0d 00 4f 52 4f 70 65 6e 4b 65 79 00 07 00 ....OROpenKey...
4f 52 45 6e 75 6d 56 61 6c 75 65 00 00 00 4f 52 OREnumValue...OR
43 6c 6f 73 65 48 69 76 65 00 0c 00 4f 52 4f 70 CloseHive...OROp
65 6e 48 69 76 65 00 00 0a 00 4f 52 47 65 74 56 enHive....ORGetV
65 72 73 69 6f 6e 00 00 4f 46 46 52 45 47 2e 64 ersion..OFFREG.d
6c 6c 00 00 06 00 43 6f 6d 6d 61 6e 64 4c 69 6e ll....CommandLin
65 54 6f 41 72 67 76 57 00 00 53 48 45 4c 4c 33 eToArgvW..SHELL3
32 2e 64 6c 6c 00 35 03 77 76 73 70 72 69 6e 74 2.dll.5.wvsprint
66 57 00 00 55 53 45 52 33 32 2e 64 6c 6c 00 00 fW..USER32.dll..
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file OFFREG.TXT
created in
step 3. to recreate the console application
Offline Registry Reader:
CERTUTIL.EXE /DecodeHex /V OFFREG.TXT OFFREG.COM
Input Length = 41344 Output Length = 9728 CertUtil: -decodehex command completed successfully.
HKCC
,
HKCR
,
HKCU
,
HKLM
,
HKLS
,
HKPD
,
HKU
) and print them as an
.inf
file in
UTF-16LE
encoding on standard output(which must be redirected to a file or piped into an application that reads from
standard input, like Clip or More).
Note: to dump the entire Registry
specify the branches HKLM
and HKU
.
REGISTRY.COM { HKCC | HKEY_CURRENT_CONFIG | HKCR | HKEY_CLASSES_ROOT | HKCU | HKEY_CURRENT_USER | HKDD | HKEY_DYN_DATA | HKLM | HKEY_LOCAL_MACHINE | HKLS | HKEY_CURRENT_USER_LOCAL_SETTINGS | HKPD | HKEY_PERFORMANCE_DATA | HKU | HKEY_USERS } … >‹output file name› REGISTRY.COM { HKCC | HKEY_CURRENT_CONFIG | HKCR | HKEY_CLASSES_ROOT | HKCU | HKEY_CURRENT_USER | HKDD | HKEY_DYN_DATA | HKLM | HKEY_LOCAL_MACHINE | HKLS | HKEY_CURRENT_USER_LOCAL_SETTINGS | HKPD | HKEY_PERFORMANCE_DATA | HKU | HKEY_USERS } … | MORE.COMNote: when run under a user account which has the privilege
SeBackupPrivilege
assigned, the
Registry INF Dumper
enables it to enumerate all registry keys below the
specified branch(es).
Note: when run under a user account which has the
privilege SeSecurityPrivilege
assigned, the
Registry INF Dumper
enables it to include the
system access control list
in the optionally printed
security descriptors.
Note: due to the design and implementation of
Windows’ (classic alias legacy) console, the
Win32 function
WriteConsole()
can only write to a console, not to a file nor a pipe, i.e.
redirection of standard error
is not supported!
The MSDN article Console Handles provides background information.
Create the text file REGISTRY.C
with the following
content in an arbitrary, preferable empty directory:
// Copyright © 2004-2023, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define _CRT_SECURE_NO_WARNINGS
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <shellapi.h>
#include <sddl.h>
#define memcpy __movsb
#define wmemcpy __movsw
#define MAX_DEPTH 512UL
#define MAX_KEY_LENGTH 255UL
#define MAX_VALUE_NAME 16383UL
#define MAX_VALUE_DATA 1048576UL
#define SE_SECURITY_PRIVILEGE 8UL // "SeSecurityPrivilege"
#define SE_BACKUP_PRIVILEGE 17UL // "SeBackupPrivilege"
const TOKEN_PRIVILEGES tpBackup = {1UL, {SE_BACKUP_PRIVILEGE, 0L, SE_PRIVILEGE_ENABLED}};
#ifdef SECURITY
const TOKEN_PRIVILEGES tpSecurity = {1UL, {SE_SECURITY_PRIVILEGE, 0L, SE_PRIVILEGE_ENABLED}};
#endif
typedef unsigned __int64 QWORD, *LPQWORD;
BYTE cbData[MAX_VALUE_DATA];
WCHAR szKey[(MAX_KEY_LENGTH + 1) * MAX_DEPTH];
WCHAR szValue[MAX_VALUE_NAME + 1];
__declspec(safebuffers)
BOOL PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
DWORD dwBuffer;
DWORD dwConsole;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
if (!WriteConsole(hConsole, szBuffer, dwBuffer, &dwConsole, NULL))
return FALSE;
return dwConsole == dwBuffer;
}
__declspec(safebuffers)
BOOL PrintFormat(HANDLE hFile, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
LPBYTE lpBuffer;
DWORD dwBuffer;
DWORD dwFile;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
dwBuffer *= sizeof(*szBuffer);
lpBuffer = (LPBYTE) szBuffer;
do
{
if (!WriteFile(hFile, lpBuffer, dwBuffer, &dwFile, (LPOVERLAPPED) NULL))
return FALSE;
lpBuffer += dwFile;
dwBuffer -= dwFile;
} while (dwBuffer > 0);
return TRUE;
}
#define PrintString(HANDLE, LITERAL) PrintDirect(HANDLE, LITERAL, sizeof(LITERAL) / sizeof(*LITERAL) - 1UL)
__inline
BOOL WINAPI PrintDirect(HANDLE hFile, LPCWSTR lpString, DWORD dwString)
{
DWORD dwFile;
dwString *= sizeof(*lpString);
do
{
if (!WriteFile(hFile, lpString, dwString, &dwFile, (LPOVERLAPPED) NULL))
return FALSE;
lpString = (LPCWSTR) ((LPBYTE) lpString + dwFile);
dwString -= dwFile;
} while (dwString > 0);
return TRUE;
}
__inline
LPCWSTR WINAPI InfEscape(LPCWSTR lpString)
{
do
if ((*lpString == L'"')
|| (*lpString == L'%'))
return lpString;
while (*lpString++ != L'\0');
return NULL;
}
#ifndef TINY
const WCHAR szBytes[256][4] = {L",00", L",01", L",02", L",03", L",04", L",05", L",06", L",07", L",08", L",09", L",0a", L",0b", L",0c", L",0d", L",0e", L",0f",
L",10", L",11", L",12", L",13", L",14", L",15", L",16", L",17", L",18", L",19", L",1a", L",1b", L",1c", L",1d", L",1e", L",1f",
L",20", L",21", L",22", L",23", L",24", L",25", L",26", L",27", L",28", L",29", L",2a", L",2b", L",2c", L",2d", L",2e", L",2f",
L",30", L",31", L",32", L",33", L",34", L",35", L",36", L",37", L",38", L",39", L",3a", L",3b", L",3c", L",3d", L",3e", L",3f",
L",40", L",41", L",42", L",43", L",44", L",45", L",46", L",47", L",48", L",49", L",4a", L",4b", L",4c", L",4d", L",4e", L",4f",
L",50", L",51", L",52", L",53", L",54", L",55", L",56", L",57", L",58", L",59", L",5a", L",5b", L",5c", L",5d", L",5e", L",5f",
L",60", L",61", L",62", L",63", L",64", L",65", L",66", L",67", L",68", L",69", L",6a", L",6b", L",6c", L",6d", L",6e", L",6f",
L",70", L",71", L",72", L",73", L",74", L",75", L",76", L",77", L",78", L",79", L",7a", L",7b", L",7c", L",7d", L",7e", L",7f",
L",80", L",81", L",82", L",83", L",84", L",85", L",86", L",87", L",88", L",89", L",8a", L",8b", L",8c", L",8d", L",8e", L",8f",
L",90", L",91", L",92", L",93", L",94", L",95", L",96", L",97", L",98", L",99", L",9a", L",9b", L",9c", L",9d", L",9e", L",9f",
L",a0", L",a1", L",a2", L",a3", L",a4", L",a5", L",a6", L",a7", L",a8", L",a9", L",aa", L",ab", L",ac", L",ad", L",ae", L",af",
L",b0", L",b1", L",b2", L",b3", L",b4", L",b5", L",b6", L",b7", L",b8", L",b9", L",ba", L",bb", L",bc", L",bd", L",be", L",bf",
L",c0", L",c1", L",c2", L",c3", L",c4", L",c5", L",c6", L",c7", L",c8", L",c9", L",ca", L",cb", L",cc", L",cd", L",ce", L",cf",
L",d0", L",d1", L",d2", L",d3", L",d4", L",d5", L",d6", L",d7", L",d8", L",d9", L",da", L",db", L",dc", L",dd", L",de", L",df",
L",e0", L",e1", L",e2", L",e3", L",e4", L",e5", L",e6", L",e7", L",e8", L",e9", L",ea", L",eb", L",ec", L",ed", L",ee", L",ef",
L",f0", L",f1", L",f2", L",f3", L",f4", L",f5", L",f6", L",f7", L",f8", L",f9", L",fa", L",fb", L",fc", L",fd", L",fe", L",ff"};
#endif
const LPCWSTR szHKey[8] = {L"HKCR",
L"HKCU",
L"HKLM",
L"HKU",
L"HKPD",
L"HKCC",
L"HKDD",
L"HKLS"};
const LPCWSTR szHKEY[8] = {L"HKEY_CLASSES_ROOT",
L"HKEY_CURRENT_USER",
L"HKEY_LOCAL_MACHINE",
L"HKEY_USERS",
L"HKEY_PERFORMANCE_DATA",
L"HKEY_CURRENT_CONFIG",
L"HKEY_DYN_DATA",
L"HKEY_CURRENT_USER_LOCAL_SETTINGS"};
const DWORD dwHKEY[8] = {sizeof("HKEY_CLASSES_ROOT"),
sizeof("HKEY_CURRENT_USER"),
sizeof("HKEY_LOCAL_MACHINE"),
sizeof("HKEY_USERS"),
sizeof("HKEY_PERFORMANCE_DATA"),
sizeof("HKEY_CURRENT_CONFIG"),
sizeof("HKEY_DYN_DATA"),
sizeof("HKEY_CURRENT_USER_LOCAL_SETTINGS")};
const LPCWSTR szType[12] = {L"NONE",
L"SZ",
L"EXPAND_SZ",
L"BINARY",
L"DWORD", // alias DWORD_LITTLE_ENDIAN
L"DWORD_BIG_ENDIAN",
L"LINK",
L"MULTI_SZ",
L"RESOURCE_LIST",
L"FULL_RESOURCE_DESCRIPTOR",
L"RESOURCE_REQUIREMENTS_LIST",
L"QWORD"}; // alias QWORD_LITTLE_ENDIAN
DWORD WINAPI Registry(HANDLE hConsole, HANDLE hOutput, QWORD qwPrivileges, HKEY hkHKEY, DWORD dwKey)
{
HKEY hkKey;
BOOL bOutput;
DWORD dwError;
DWORD dwIndex = (DWORD) hkHKEY ^ (DWORD) HKEY_CLASSES_ROOT;
DWORD dwSubKeys, dwSubKey;
DWORD dwValues, dwValue, dwType, dwData, dwBytes;
#ifdef SANITY
DWORD dwCount, dwChars;
LPCWSTR lpCount;
#endif
LPCWSTR lpHKey = szHKey[dwIndex];
LPCWSTR lpKey = dwKey < dwHKEY[dwIndex] ? NULL : szKey + dwHKEY[dwIndex];
LPCWSTR lpSubKey = szKey + dwKey + 1;
LPCWSTR lpData, lpEscape, lpLast, lpMulti;
dwError = RegOpenKeyEx(hkHKEY,
lpKey,
qwPrivileges & (1ULL << SE_BACKUP_PRIVILEGE) ? REG_OPTION_BACKUP_RESTORE | REG_OPTION_OPEN_LINK : REG_OPTION_OPEN_LINK,
#ifdef SECURITY
qwPrivileges & (1ULL << SE_SECURITY_PRIVILEGE) ? ACCESS_SYSTEM_SECURITY | KEY_READ | KEY_WOW64_64KEY : KEY_READ | KEY_WOW64_64KEY,
#else
KEY_READ | KEY_WOW64_64KEY,
#endif
&hkKey);
if (dwError != ERROR_SUCCESS)
PrintConsole(hConsole,
L"RegOpenKeyEx() returned error %lu for registry key \'%ls\'\n",
dwError, szKey);
else
{
#ifdef SECURITY
dwData = sizeof(cbData);
dwError = RegGetKeySecurity(hkHKEY,
qwPrivileges & (1ULL << SE_SECURITY_PRIVILEGE) ? OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION | LABEL_SECURITY_INFORMATION : OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION | LABEL_SECURITY_INFORMATION,
cbData,
&dwData);
if (dwError != ERROR_SUCCESS)
PrintConsole(hConsole,
L"RegGetKeySecurity() returned error %lu for registry key \'%ls\'\n",
dwError, szKey);
else
if (!ConvertSecurityDescriptorToStringSecurityDescriptor(cbData,
SDDL_REVISION_1,
OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION | LABEL_SECURITY_INFORMATION,
&lpData,
(LPDWORD) NULL))
PrintConsole(hConsole,
L"ConvertSecurityDescriptorToStringSecurityDescriptor() returned error %lu for registry key \'%ls\'\n",
dwError = GetLastError(), szKey);
else
{
if (lpKey == NULL)
bOutput = PrintFormat(hOutput,
L"%ls,,,%%REG_KEYONLY%%\r\n",
lpHKey);
else
bOutput = PrintFormat(hOutput,
L"%ls,\"%ls\",,%%REG_KEYONLY%%\r\n",
lpHKey, lpKey);
bOutput &= PrintString(hOutput, L"; ");
bOutput &= PrintDirect(hOutput, lpData, wcslen(lpData));
bOutput &= PrintString(hOutput, L"\r\n");
if (!bOutput)
PrintConsole(hConsole,
L"WriteFile() returned error %lu for registry key \'%ls\'\n",
dwError = GetLastError(), szKey);
if (LocalFree(lpData) != NULL)
PrintConsole(hConsole,
L"LocalFree() returned error %lu\n",
GetLastError());
}
#endif
for (dwValues = 0;; dwValues++)
{
// *szValue = L'\0';
dwValue = sizeof(szValue) / sizeof(*szValue);
dwData = sizeof(cbData);
dwError = RegEnumValue(hkKey,
dwValues,
szValue,
&dwValue,
(LPDWORD) NULL,
&dwType,
cbData,
&dwData);
if (dwError != ERROR_SUCCESS)
{
if (dwError == ERROR_NO_MORE_ITEMS)
break;
PrintConsole(hConsole,
L"RegEnumValue() returned error %lu for registry key \'%ls\'\n",
dwError, szKey);
if (dwError == ERROR_ACCESS_DENIED)
break;
}
else
{
#ifdef SANITY
dwChars = wcslen(szValue);
if (dwValue < dwChars)
PrintConsole(hConsole,
L"ERROR: size (%lu characters) of value name \'%ls\' in registry key \'%ls\' smaller than actual string length (%lu characters)!\n",
dwValue, szValue, dwChars, szKey);
else if (dwValue > dwChars)
PrintConsole(hConsole,
L"WARNING: size (%lu characters) of value name \'%ls\' in registry key \'%ls\' greater than actual string length (%lu characters)\n",
dwValue, szValue, dwChars, szKey);
if (dwData == 0)
PrintConsole(hConsole,
L"WARNING: no value data for value name \'%ls\' in registry key \'%ls\'\n",
szValue, szKey);
else
switch (dwType)
{
case REG_LINK:
if (dwData % sizeof(L'\0'))
PrintConsole(hConsole,
L"ERROR: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' not a multiple of WCHAR size!\n",
dwData, szValue, szKey);
break;
case REG_DWORD_BIG_ENDIAN:
case REG_DWORD_LITTLE_ENDIAN:
// case REG_DWORD:
if (dwData < sizeof(DWORD))
PrintConsole(hConsole,
L"ERROR: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' smaller than DWORD size!\n",
dwData, szValue, szKey);
else if (dwData > sizeof(DWORD))
PrintConsole(hConsole,
L"WARNING: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' greater than DWORD size\n",
dwData, szValue, szKey);
break;
case REG_QWORD_LITTLE_ENDIAN:
// case REG_QWORD:
if (dwData < sizeof(QWORD))
PrintConsole(hConsole,
L"ERROR: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' smaller than QWORD size!\n",
dwData, szValue, szKey);
else if (dwData > sizeof(QWORD))
PrintConsole(hConsole,
L"WARNING: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' greater than QWORD size\n",
dwData, szValue, szKey);
break;
case REG_SZ:
case REG_EXPAND_SZ:
dwChars = wcslen((LPCWSTR) cbData);
dwBytes = (dwChars + 1) * sizeof(L'\0');
if (dwData < dwBytes)
PrintConsole(hConsole,
L"ERROR: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' smaller than actual string length (%lu + 1 characters = %lu bytes)\n",
dwData, szValue, szKey, dwChars, dwBytes);
else if (dwData > dwBytes)
PrintConsole(hConsole,
L"WARNING: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' greater than actual string length (%lu + 1 characters = %lu bytes)\n",
dwData, szValue, szKey, dwChars, dwBytes);
break;
case REG_MULTI_SZ:
dwChars = 0;
dwCount = 1;
lpCount = (LPCWSTR) cbData;
while (*lpCount != L'\0')
{
dwChars += wcslen(lpCount);
dwCount++;
lpCount += wcslen(lpCount) + 1;
}
dwBytes = (dwChars + dwCount) * sizeof(L'\0');
if (dwData < dwBytes)
PrintConsole(hConsole,
L"ERROR: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' smaller than sum of actual string lengths (%lu + %lu characters = %lu bytes)\n",
dwData, szValue, szKey, dwChars, dwCount, dwBytes);
else if (dwData > dwBytes)
PrintConsole(hConsole,
L"WARNING: size (%lu bytes) of value data for value name \'%ls\' in registry key \'%ls\' greater than sum of actual string lengths (%lu + %lu characters = %lu bytes)\n",
dwData, szValue, szKey, dwChars, dwCount, dwBytes);
break;
// case REG_NONE:
// case REG_BINARY:
// case REG_RESOURCE_LIST:
// case REG_FULL_RESOURCE_DESCRIPTOR:
// case REG_RESOURCE_REQUIREMENTS_LIST:
}
#ifdef UNKNOWN
if (dwType > REG_QWORD)
PrintConsole(hConsole,
L"WARNING: unknown data type (0x%08lx) for value name \'%ls\' in registry key \'%ls\'\n",
dwType, szValue, szKey);
#endif
#endif // SANITY
if (lpKey == NULL)
bOutput = PrintFormat(hOutput, L"%ls,,", lpHKey);
else
bOutput = PrintFormat(hOutput, L"%ls,\"%ls\",", lpHKey, lpKey);
if (dwType < sizeof(szType) / sizeof(*szType))
if (dwValue == 0)
bOutput &= PrintFormat(hOutput, L",%%REG_%ls%%", szType[dwType]);
else
bOutput &= PrintFormat(hOutput, L"\"%ls\",%%REG_%ls%%", szValue, szType[dwType]);
else
if (dwValue == 0)
bOutput &= PrintFormat(hOutput, L",0x%08lx", dwType);
else
bOutput &= PrintFormat(hOutput, L"\"%ls\",0x%08lx", dwType);
if (dwData == 0)
bOutput &= PrintString(hOutput, L"\r\n");
else
switch (dwType)
{
case REG_LINK:
if (dwData % sizeof(L'\0'))
goto DEFAULT;
bOutput &= PrintString(hOutput, L",\"");
bOutput &= PrintDirect(hOutput, (LPCWSTR) cbData, dwData / sizeof(L'\0'));
bOutput &= PrintString(hOutput, L"\"\r\n");
break;
case REG_SZ:
case REG_EXPAND_SZ:
if (dwData % sizeof(L'\0'))
goto DEFAULT;
if (*(LPCWSTR) cbData == L'\0')
bOutput &= PrintString(hOutput, L",\"\"\r\n");
else
{
lpData = (LPCWSTR) cbData;
((LPWSTR) lpData)[dwData / sizeof(L'\0')] = L'\0';
dwData = wcslen(lpData);
bOutput &= PrintString(hOutput, L",\"");
for (lpEscape = InfEscape(lpData); lpEscape != NULL; lpData = lpEscape, lpEscape = InfEscape(lpData + 1))
bOutput &= PrintDirect(hOutput, lpData, lpEscape + 1 - lpData);
bOutput &= PrintDirect(hOutput, lpData, (LPCWSTR) cbData + dwData - lpData);
bOutput &= PrintString(hOutput, L"\"\r\n");
}
break;
case REG_MULTI_SZ:
if (dwData % sizeof(L'\0'))
goto DEFAULT;
if ((dwData == sizeof(L'\0'))
&& (*(LPCWSTR) cbData == L'\0'))
bOutput &= PrintString(hOutput, L";\r\n");
else
{
lpData = (LPCWSTR) cbData;
dwData /= sizeof(L'\0');
lpLast = lpData + dwData;
if ((dwData > 1)
&& (lpData[dwData - 1] == L'\0')
&& (lpData[dwData - 2] == L'\0'))
lpLast--;
else
*(LPWSTR) lpLast = L'\0';
do
if (*lpData == L'\0')
bOutput &= PrintString(hOutput, L";\"\"");
else
{
dwData = wcslen(lpData);
bOutput &= PrintString(hOutput, L",\"");
for (lpEscape = InfEscape(lpMulti = lpData), lpData += dwData;
lpEscape != NULL; lpMulti = lpEscape,
lpEscape = InfEscape(lpEscape + 1))
bOutput &= PrintDirect(hOutput, lpMulti, lpEscape + 1 - lpMulti);
bOutput &= PrintDirect(hOutput, lpMulti, lpData - lpMulti);
bOutput &= PrintString(hOutput, L"\"");
}
while (++lpData < lpLast);
bOutput &= PrintString(hOutput, L"\r\n");
}
break;
case REG_DWORD_BIG_ENDIAN:
if (dwData != sizeof(DWORD))
goto DEFAULT;
#if 0
bOutput &= PrintFormat(hOutput, L",%lu\r\n", _byteswap_ulong(*(LPDWORD) cbData));
#else
bOutput &= PrintFormat(hOutput, L",%lu ; 0x%08lx\r\n", _byteswap_ulong(*(LPDWORD) cbData), *(LPDWORD) cbData);
#endif
break;
case REG_DWORD_LITTLE_ENDIAN:
// case REG_DWORD:
if (dwData != sizeof(DWORD))
goto DEFAULT;
#if 0
bOutput &= PrintFormat(hOutput, L",%lu\r\n", *(LPDWORD) cbData);
#else
bOutput &= PrintFormat(hOutput, L",%lu ; 0x%08lx\r\n", *(LPDWORD) cbData, *(LPDWORD) cbData);
#endif
break;
case REG_QWORD_LITTLE_ENDIAN:
// case REG_QWORD:
if (dwData != sizeof(QWORD))
goto DEFAULT;
#if 0
bOutput &= PrintFormat(hOutput, L",%I64u\r\n", *(LPQWORD) cbData);
#else
bOutput &= PrintFormat(hOutput, L",%I64u ; 0x%016I64x\r\n", *(LPQWORD) cbData, *(LPQWORD) cbData);
#endif
break;
// case REG_NONE:
// case REG_BINARY:
// case REG_RESOURCE_LIST:
// case REG_FULL_RESOURCE_DESCRIPTOR:
// case REG_RESOURCE_REQUIREMENTS_LIST:
default:
DEFAULT:
for (dwBytes = 0; dwBytes < dwData; dwBytes++)
#ifdef TINY
bOutput &= PrintFormat(hOutput, L",%02x", cbData[dwBytes]);
#else
bOutput &= PrintDirect(hOutput, szBytes[cbData[dwBytes]], 3);
#endif
bOutput &= PrintString(hOutput, L"\r\n");
}
if (!bOutput)
PrintConsole(hConsole,
L"WriteFile() returned error %lu for value \'%ls\' of registry key \'%ls\'\n",
dwError = GetLastError(), szValue, szKey);
}
}
for (dwSubKeys = 0;; dwSubKeys++)
{
dwSubKey = sizeof(szKey) / sizeof(*szKey) - dwKey - 1;
#if 0
dwError = RegEnumKey(hkKey,
dwSubKeys,
lpSubKey,
dwSubKey);
#else
dwError = RegEnumKeyEx(hkKey,
dwSubKeys,
lpSubKey,
&dwSubKey,
(LPDWORD) NULL,
(LPWSTR) NULL,
(LPDWORD) NULL,
(LPFILETIME) NULL);
#endif
if (dwError != ERROR_SUCCESS)
{
if (dwError == ERROR_NO_MORE_ITEMS)
break;
PrintConsole(hConsole,
#if 0
L"RegEnumKey() returned error %lu for registry key \'%ls\'\n",
#else
L"RegEnumKeyEx() returned error %lu for registry key \'%ls\'\n",
#endif
dwError, szKey);
if (dwError == ERROR_ACCESS_DENIED)
break;
}
else
{
#ifdef SANITY
dwChars = wcslen(lpSubKey);
if (dwChars > dwSubKey)
PrintConsole(hConsole,
L"ERROR: size (%lu characters) of subkey name \'%ls\' in registry key \'%ls\' smaller than actual string length (%lu characters)\n",
dwSubKey, lpSubKey, szKey, dwChars);
else if (dwChars < dwSubKey)
PrintConsole(hConsole,
L"WARNING: size (%lu characters) of subkey name \'%ls\' in registry key \'%ls\' greater than actual string length (%lu characters)\n",
dwSubKey, lpSubKey, szKey, dwChars);
#endif
szKey[dwKey] = L'\\';
dwError = Registry(hConsole, hOutput, qwPrivileges, hkHKEY, dwKey + 1 + dwSubKey);
szKey[dwKey] = L'\0';
}
}
#ifndef SECURITY
if ((dwValues == 0) && (dwSubKeys == 0))
{
if (lpKey == NULL)
bOutput = PrintFormat(hOutput,
L"%ls,,,%%REG_KEYONLY%%\r\n",
lpHKey);
else
bOutput = PrintFormat(hOutput,
L"%ls,\"%ls\",,%%REG_KEYONLY%%\r\n",
lpHKey, lpKey);
if (!bOutput)
PrintConsole(hConsole,
L"WriteFile() returned error %lu for empty registry key \'%ls\'\n",
dwError = GetLastError(), szKey);
}
#endif
dwValue = RegCloseKey(hkKey);
if (dwValue != ERROR_SUCCESS)
PrintConsole(hConsole,
L"RegCloseKey() returned error %lu for registry key \'%ls\'\n",
dwValue, szKey);
}
return dwError;
}
__declspec(noreturn)
VOID WINAPI wmainCRTStartup(VOID)
{
SYSTEMTIME st;
INT nArgument = 1;
INT nArguments;
LPWSTR *lpArguments;
WCHAR szComputer[MAX_COMPUTERNAME_LENGTH + 1] = L"<unknown>";
DWORD dwComputer = sizeof(szComputer) / sizeof(*szComputer);
DWORD dwError = ERROR_BAD_ARGUMENTS;
DWORD dwIndex;
QWORD qwPrivileges = 0;
HKEY hkHKEY;
HANDLE hToken;
HANDLE hProcess = GetCurrentProcess();
HANDLE hOutput;
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole == INVALID_HANDLE_VALUE)
dwError = GetLastError();
else
{
lpArguments = CommandLineToArgvW(GetCommandLine(), &nArguments);
if (lpArguments == NULL)
PrintConsole(hConsole,
L"CommandLineToArgv() returned error %lu\n",
dwError = GetLastError());
else
{
if (nArguments < 2)
PrintConsole(hConsole,
L"No arguments: at least one predefined registry key name must be given!\n");
else
{
hOutput = GetStdHandle(STD_OUTPUT_HANDLE);
if (hOutput == INVALID_HANDLE_VALUE)
PrintConsole(hConsole,
L"GetStdHandle() returned error %lu\n",
dwError = GetLastError());
else
{
if (!FlushFileBuffers(hOutput))
PrintConsole(hConsole,
L"FlushFileBuffers() returned error %lu: standard output is not redirected to a file!\n",
dwError = GetLastError());
else
{
dwError = ERROR_SUCCESS;
if (!GetComputerName(szComputer, &dwComputer))
PrintConsole(hConsole,
L"GetComputerName() returned error %lu\n",
dwError = GetLastError());
GetSystemTime(&st);
if (!PrintFormat(hOutput,
L"\xFEFF" // UTF-16LE BOM
L"; Registry of \'%ls\'\r\n"
L"\r\n"
L"[Version]\r\n"
L"DriverVer = %02hu/%02hu/%04hu,%02hu.%02hu.%02hu.%03hu ; UTC\r\n"
L"Provider = \"Stefan Kanthak\"\r\n"
L"Signature = \"$Windows NT$\"\r\n"
L"\r\n"
L"[Strings]\r\n"
L"REG_SZ = 0x00000000\r\n"
L"REG_BINARY = 0x00000001\r\n"
L"REG_KEYONLY = 0x00000010\r\n"
L"REG_MULTI_SZ = 0x00010000\r\n"
L"REG_DWORD = 0x00010001\r\n"
L"REG_EXPAND_SZ = 0x00020000\r\n"
L"REG_NONE = 0x00020001\r\n"
L"REG_COMPATIBLE = 0x00030001 ; same as REG_BINARY\r\n"
L"REG_DWORD_LITTLE_ENDIAN = 0x00040001 ; same as REG_DWORD\r\n"
L"REG_DWORD_BIG_ENDIAN = 0x00050001\r\n"
L"REG_LINK = 0x00060000\r\n"
L"REG_RESOURCE_LIST = 0x00080001\r\n"
L"REG_FULL_RESOURCE_DESCRIPTOR = 0x00090001\r\n"
L"REG_RESOURCE_REQUIREMENTS_LIST = 0x000a0001\r\n"
L"REG_QWORD = 0x000b0001\r\n"
L"REG_QWORD_LITTLE_ENDIAN = 0x000b0001 ; same as REG_QWORD\r\n"
L"\r\n"
L"[DefaultInstall.NT]\r\n"
L";AddReg = AddReg.HKU,AddReg.HKLM;AddReg.HKCU,AddReg.HKCR\r\n",
szComputer,
st.wMonth, st.wDay, st.wYear, st.wHour, st.wMinute, st.wSecond, st.wMilliseconds))
PrintConsole(hConsole,
L"WriteFile() returned error %lu\n",
dwError = GetLastError());
if (!OpenProcessToken(hProcess,
TOKEN_ADJUST_PRIVILEGES,
&hToken))
PrintConsole(hConsole,
L"OpenProcessToken() returned error %lu\n",
dwError = GetLastError());
else
{
if (!AdjustTokenPrivileges(hToken,
FALSE,
&tpBackup,
sizeof(TOKEN_PRIVILEGES),
(TOKEN_PRIVILEGES *) NULL,
(LPDWORD) NULL))
PrintConsole(hConsole,
L"AdjustTokenPrivileges() returned error %lu\n",
dwError = GetLastError());
else
if (GetLastError() == ERROR_SUCCESS)
qwPrivileges |= 1ULL << SE_BACKUP_PRIVILEGE;
#ifdef SECURITY
if (!AdjustTokenPrivileges(hToken,
FALSE,
&tpSecurity,
sizeof(TOKEN_PRIVILEGES),
(TOKEN_PRIVILEGES *) NULL,
(LPDWORD) NULL))
PrintConsole(hConsole,
L"AdjustTokenPrivileges() returned error %lu\n",
dwError = GetLastError());
else
if (GetLastError() == ERROR_SUCCESS)
qwPrivileges |= 1ULL << SE_SECURITY_PRIVILEGE;
#endif
if (!CloseHandle(hToken))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
do
{
hkHKEY = HKEY_CLASSES_ROOT;
do
{
dwIndex = (DWORD) hkHKEY ^ (DWORD) HKEY_CLASSES_ROOT;
if ((wcscmp(szHKey[dwIndex], lpArguments[nArgument]) == 0)
|| (wcscmp(szHKEY[dwIndex], lpArguments[nArgument]) == 0))
{
memcpy(szKey, szHKEY[dwIndex], dwHKEY[dwIndex] * sizeof(*szKey));
if (!PrintFormat(hOutput,
L"\r\n"
L"[AddReg.%ls]\r\n",
szHKey[dwIndex]))
PrintConsole(hConsole,
L"WriteFile() returned error %lu\n",
dwError = GetLastError());
dwError = Registry(hConsole, hOutput, qwPrivileges, hkHKEY, dwHKEY[dwIndex] - 1);
break;
}
} while (++(DWORD) hkHKEY <= (DWORD) HKEY_CURRENT_USER_LOCAL_SETTINGS);
if ((DWORD) hkHKEY > (DWORD) HKEY_CURRENT_USER_LOCAL_SETTINGS)
PrintConsole(hConsole,
L"Argument \'%ls\' is not a predefined registry key name!\n",
lpArguments[nArgument]);
} while (++nArgument < nArguments);
if (!PrintString(hOutput,
L"\r\n"
L"; EOF\r\n"))
PrintConsole(hConsole,
L"WriteFile() returned error %lu\n",
dwError = GetLastError());
}
if (!CloseHandle(hOutput))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
}
if (LocalFree(lpArguments) != NULL)
PrintConsole(hConsole,
L"LocalFree() returned error %lu\n",
GetLastError());
}
if (!CloseHandle(hConsole))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
ExitProcess(dwError);
}
Note: the output format allows to detect
Registry values without data, REG_SZ
,
REG_EXPAND_SZ
and REG_MULTI_SZ
values with
empty strings, REG_LINK
, REG_SZ
,
REG_EXPAND_SZ
and REG_MULTI_SZ
values with
(invalid) odd size, and REG_DWORD_BIG_ENDIAN
,
REG_DWORD_LITTLE_ENDIAN
alias REG_DWORD
as well as REG_QWORD_LITTLE_ENDIAN
alias
REG_QWORD
values with sizes not matching their data
type.
Note: with the preprocessor macro
SANITY
defined, several consistency and sanity checks
regarding the size of key and value names as well as value data and
value data types are performed.
Note: with the preprocessor macro
SECURITY
defined, the
security descriptors
of enumerated keys are printed in
Security Descriptor Definition Language
notation.
Note: with the preprocessor macro TINY
defined, the application gets 2036 bytes smaller, but also a little
slower!
Run the following four command lines to compile the source file
REGISTRY.C
created in step 1., link the compiled
object file REGISTRY.OBJ
and cleanup afterwards:
SET CL=/GA /GF /GS /Gy /O1 /Oi /Os /Oy /W4 /Zl SET LINK=/DEFAULTLIB:ADVAPI32.LIB /DEFAULTLIB:KERNEL32.LIB /DEFAULTLIB:SHELL32.LIB /DEFAULTLIB:USER32.LIB /ENTRY:wmainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /OSVERSION:5.0 /RELEASE /SUBSYSTEM:CONSOLE /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /FeREGISTRY.COM REGISTRY.C ERASE REGISTRY.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. REGISTRY.C REGISTRY.C(587) : warning C4090: 'function' : different 'const' qualifiers REGISTRY.C(764) : warning C4090: 'function' : different 'const' qualifiers REGISTRY.C(819) : warning C4213: nonstandard extension used : cast on l-value Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Finally execute the console application
REGISTRY.COM
built in step 2. to dump the
HKCC
branch to the file
HKCC.inf
and display it afterwards:
VER .\REGISTRY.COM HKCC 1>HKCC.inf NET.EXE HelpMsg %ERRORLEVEL% TYPE HKCC.infNet services commands Ver
Microsoft Windows [Version 6.1.7601] The operation completed successfully. ; Registry of 'AMNESIAC' [Version] DriverVer = 04/27/2022,08.15.00.815 ; UTC Provider = "Stefan Kanthak" Signature = "$Windows NT$" [Strings] REG_SZ = 0x00000000 REG_BINARY = 0x00000001 REG_KEYONLY = 0x00000010 REG_MULTI_SZ = 0x00010000 REG_DWORD = 0x00010001 REG_EXPAND_SZ = 0x00020000 REG_NONE = 0x00020001 REG_COMPATIBLE = 0x00030001 ; same as REG_BINARY REG_DWORD_LITTLE_ENDIAN = 0x00040001 ; same as REG_DWORD REG_DWORD_BIG_ENDIAN = 0x00050001 REG_LINK = 0x00060000 REG_RESOURCE_LIST = 0x00080001 REG_FULL_RESOURCE_DESCRIPTOR = 0x00090001 REG_RESOURCE_REQUIREMENTS_LIST = 0x000a0001 REG_QWORD = 0x000b0001 REG_QWORD_LITTLE_ENDIAN = 0x000b0001 ; same as REG_QWORD [DefaultInstall.NT] ;AddReg = AddReg.HKU,AddReg.HKLM;AddReg.HKCU,AddReg.HKCR [AddReg.HKCC] HKCC,"Software\Fonts","LogPixels",%REG_DWORD%,96 ; 0x00000060 HKCC,"System\CurrentControlSet\Control\Print\Printers",,%REG_KEYONLY%; HKCC,"System\CurrentControlSet\Control\VIDEO",,%REG_KEYONLY%; HKCC,"System\CurrentControlSet\Enum\IDE\DISKFUJITSU_MHZ2320BJ_G2____________________0000001E\5&2223391E&0&0.0.0","CSConfigFlags",%REG_DWORD%,0 ; 0x00000000 HKCC,"System\CurrentControlSet\Enum\USBSTOR\DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07\4E0B595B&0","CSConfigFlags",%REG_DWORD%,0 ; 0x00000000 HKCC,"System\CurrentControlSet\SERVICES\TSDDD\DEVICE0","Attach.ToDesktop",%REG_DWORD%,1 ; 0x00000001 HKCC,"System\CurrentControlSet\SERVICES\VGASAVE\DEVICE0","Attach.ToDesktop",%REG_DWORD%,1 ; 0x00000001 HKCC,"System\CurrentControlSet\SERVICES\VGASAVE\DEVICE0","DefaultSettings.BitsPerPel",%REG_DWORD%,32 ; 0x00000020 HKCC,"System\CurrentControlSet\SERVICES\VGASAVE\DEVICE0","DefaultSettings.XResolution",%REG_DWORD%,1920 ; 0x00000780 HKCC,"System\CurrentControlSet\SERVICES\VGASAVE\DEVICE0","DefaultSettings.YResolution",%REG_DWORD%,1200 ; 0x000004b0 HKCC,"System\CurrentControlSet\SERVICES\VGASAVE\DEVICE0","DefaultSettings.VRefresh",%REG_DWORD%,1 ; 0x00000001 HKCC,"System\CurrentControlSet\SERVICES\VGASAVE\DEVICE0","DefaultSettings.Flags",%REG_DWORD%,0 ; 0x00000000 HKCC,"System\CurrentControlSet\SERVICES\VGASAVE\DEVICE0","DefaultSettings.XPanning",%REG_DWORD%,0 ; 0x00000000 HKCC,"System\CurrentControlSet\SERVICES\VGASAVE\DEVICE0","DefaultSettings.YPanning",%REG_DWORD%,0 ; 0x00000000 HKCC,"System\CurrentControlSet\SERVICES\VGASAVE\DEVICE0","DefaultSettings.Orientation",%REG_DWORD%,0 ; 0x00000000 HKCC,"System\CurrentControlSet\SERVICES\VGASAVE\DEVICE0","DefaultSettings.FixedOutput",%REG_DWORD%,0 ; 0x00000000 HKCC,"System\CurrentControlSet\SERVICES\VGASAVE\DEVICE0","Attach.RelativeX",%REG_DWORD%,0 ; 0x00000000 HKCC,"System\CurrentControlSet\SERVICES\VGASAVE\DEVICE0","Attach.RelativeY",%REG_DWORD%,0 ; 0x00000000 ; EOF
Create the text file REGISTRY.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 33 2c 20 53 74 65 66 61 6e 20 4b 61 -2023, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 03 00 56 4f 49 44 00 00 00 00 PE..L...VOID....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 0c 00 00 ......#.........
00 1e 00 00 00 80 14 00 a9 16 00 00 00 10 00 00 ................
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
05 00 00 00 00 00 2f 03 05 00 00 00 00 00 00 00 ....../.........
00 c0 14 00 00 02 00 00 77 06 01 00 03 00 00 85 ........w.......
00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
38 ba 14 00 64 00 00 00 00 00 00 00 00 00 00 00 8...d...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 a0 14 00 60 00 00 00 ............`...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
88 0a 00 00 00 10 00 00 00 0c 00 00 00 02 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 62 73 73 00 00 00 00 00 80 14 00 00 20 00 00 .bss......... ..
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 80 00 00 c0 2e 63 6f 6e 73 74 00 00 .........const..
80 1c 00 00 00 a0 14 00 00 1e 00 00 00 0e 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 ............@..@
55 8b ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 U........V.E.P.u
0c 8d 85 f8 f7 ff ff 50 ff 15 58 a0 54 00 8b f0 .......P..X.T...
85 f6 75 04 33 c0 eb 23 6a 00 8d 45 fc 50 56 8d ..u.3..#j..E.PV.
85 f8 f7 ff ff 50 ff 75 08 ff 15 1c a0 54 00 85 .....P.u.....T..
c0 74 e1 33 c0 39 75 fc 0f 94 c0 5e c9 c3 55 8b .t.3.9u....^..U.
ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 0c 8d .......V.E.P.u..
b5 f8 f7 ff ff 8b c6 50 ff 15 58 a0 54 00 85 c0 .......P..X.T...
74 25 57 8d 3c 00 6a 00 8d 45 fc 50 57 56 ff 75 t%W.<.j..E.PWV.u
08 ff 15 20 a0 54 00 85 c0 74 0f 03 75 fc 2b 7d ... .T...t..u.+}
fc 75 e3 33 c0 40 5f 5e c9 c3 33 c0 eb f8 55 8b .u.3.@_^..3...U.
ec 56 8b 75 10 57 8b 7d 0c 03 f6 6a 00 8d 45 10 .V.u.W.}...j..E.
50 56 57 ff 75 08 ff 15 20 a0 54 00 85 c0 74 11 PVW.u... .T...t.
03 7d 10 2b 75 10 75 e3 33 c0 40 5f 5e 5d c2 0c .}.+u.u.3.@_^]..
00 33 c0 eb f6 8b 44 24 04 0f b7 08 83 f9 22 74 .3....D$......"t
0f 83 f9 25 74 0a 83 c0 02 66 85 c9 75 eb 33 c0 ...%t....f..u.3.
c2 04 00 55 8b ec 83 ec 28 8b 45 18 35 00 00 00 ...U....(.E.5...
80 8b 0c 85 28 ab 54 00 8b 04 85 68 ab 54 00 89 ....(.T....h.T..
4d ec 39 45 1c 73 06 83 65 f8 00 eb 0a 8d 04 45 M.9E.s..e......E
00 20 40 00 89 45 f8 8b 45 10 25 00 00 02 00 33 . @..E..E.%....3
c9 0b c1 74 04 6a 0c eb 02 6a 08 58 57 8d 4d e4 ...t.j...j.XW.M.
51 68 19 01 02 00 50 ff 75 f8 ff 75 18 ff 15 08 Qh....P.u..u....
a0 54 00 8b f8 85 ff 74 10 68 00 20 40 00 57 68 .T.....t.h. @.Wh
00 af 54 00 e9 29 05 00 00 83 65 f0 00 53 56 8b ..T..)....e..SV.
75 0c bb 00 a0 44 00 8d 45 fc 50 53 8d 45 e0 50 u....D..E.PS.E.P
6a 00 8d 45 e8 50 68 00 20 44 00 ff 75 f0 c7 45 j..E.Ph. D..u..E
e8 00 40 00 00 ff 75 e4 c7 45 fc 00 00 10 00 ff ..@...u..E......
15 04 a0 54 00 8b f8 85 ff 0f 84 c1 00 00 00 81 ...T............
ff 03 01 00 00 74 24 68 00 20 40 00 57 68 e4 ae .....t$h. @.Wh..
54 00 68 80 ae 54 00 ff 75 08 e8 31 fe ff ff 83 T.h..T..u..1....
c4 14 83 ff 05 0f 85 1b 04 00 00 bb ff ff 01 00 ................
33 f6 2b 5d 1c 33 c0 50 50 50 50 8d 45 d8 50 8b 3.+].3.PPPP.E.P.
45 1c 8d 04 45 02 20 40 00 50 56 ff 75 e4 89 5d E...E. @.PV.u..]
d8 ff 15 00 a0 54 00 8b f8 85 ff 0f 84 ed 03 00 .....T..........
00 81 ff 03 01 00 00 74 24 68 00 20 40 00 57 68 .......t$h. @.Wh
60 ae 54 00 68 80 ae 54 00 ff 75 08 e8 cf fd ff `.T.h..T..u.....
ff 83 c4 14 83 ff 05 0f 85 f5 03 00 00 83 7d f0 ..............}.
00 0f 85 2e 04 00 00 85 f6 0f 85 26 04 00 00 39 ...........&...9
75 f8 0f 85 e0 03 00 00 ff 75 ec 68 30 ae 54 00 u........u.h0.T.
ff 75 0c e8 e6 fd ff ff 83 c4 0c e9 de 03 00 00 .u..............
83 7d f8 00 75 13 ff 75 ec 68 24 ae 54 00 56 e8 .}..u..u.h$.T.V.
ca fd ff ff 83 c4 0c eb 14 ff 75 f8 ff 75 ec 68 ..........u..u.h
0c ae 54 00 56 e8 b4 fd ff ff 83 c4 10 8b f8 8b ..T.V...........
45 e0 83 f8 0c 73 29 83 7d e8 00 ff 34 85 88 ab E....s).}...4...
54 00 75 10 68 f0 ad 54 00 56 e8 8f fd ff ff 83 T.u.h..T.V......
c4 0c eb 2d 68 00 20 44 00 68 cc ad 54 00 eb 18 ...-h. D.h..T...
83 7d e8 00 50 75 07 68 b8 ad 54 00 eb db 68 00 .}..Pu.h..T...h.
20 44 00 68 9c ad 54 00 56 e8 60 fd ff ff 83 c4 D.h..T.V.`.....
10 23 f8 8b 45 fc 85 c0 75 12 6a 02 68 94 ad 54 .#..E...u.j.h..T
00 56 e8 97 fd ff ff e9 be 02 00 00 8b 4d e0 85 .V...........M..
c9 0f 84 7a 02 00 00 83 f9 02 0f 86 ce 01 00 00 ...z............
83 f9 04 0f 84 b4 01 00 00 83 f9 05 0f 84 86 01 ................
00 00 83 f9 06 0f 84 4b 01 00 00 83 f9 07 74 34 .......K......t4
83 f9 0b 0f 85 48 02 00 00 83 f8 08 0f 85 3f 02 .....H........?.
00 00 a1 04 a0 44 00 8b 0d 00 a0 44 00 50 51 50 .....D.....D.PQP
51 68 68 ad 54 00 56 e8 e2 fc ff ff 83 c4 18 e9 Qhh.T.V.........
56 02 00 00 a8 01 0f 85 15 02 00 00 83 f8 02 75 V..............u
16 66 83 3d 00 a0 44 00 00 75 0c 6a 03 68 60 ad .f.=..D..u.j.h`.
54 00 e9 6a ff ff ff d1 e8 8d 0c 45 00 a0 44 00 T..j.......E..D.
8b f3 89 45 fc 89 4d dc 83 f8 01 76 19 8d 51 fe ...E..M....v..Q.
66 83 3a 00 75 10 66 83 3c 45 fc 9f 44 00 00 75 f.:.u.f.<E..D..u
05 89 55 dc eb 05 33 c0 66 89 01 66 83 3e 00 75 ..U...3.f..f.>.u
14 6a 03 68 58 ad 54 00 ff 75 0c e8 be fc ff ff .j.hX.T..u......
e9 8e 00 00 00 8b c6 8d 50 02 66 8b 08 83 c0 02 ........P.f.....
66 85 c9 75 f5 6a 02 2b c2 68 50 ad 54 00 ff 75 f..u.j.+.hP.T..u
0c d1 f8 89 45 fc e8 93 fc ff ff 56 23 f8 89 75 ....E......V#..u
f4 e8 bf fc ff ff 8b d8 8b 45 fc 8d 34 46 eb 26 .........E..4F.&
8b c3 2b 45 f4 83 c0 02 d1 f8 50 ff 75 f4 ff 75 ..+E......P.u..u
0c e8 68 fc ff ff 89 5d f4 83 c3 02 53 23 f8 e8 ..h....]....S#..
91 fc ff ff 8b d8 85 db 75 d6 8b c6 2b 45 f4 d1 ........u...+E..
f8 50 ff 75 f4 ff 75 0c e8 41 fc ff ff 6a 01 68 .P.u..u..A...j.h
4c ad 54 00 ff 75 0c 23 f8 e8 30 fc ff ff bb 00 L.T..u.#..0.....
a0 44 00 83 c6 02 23 f8 3b 75 dc 0f 82 4a ff ff .D....#.;u...J..
ff e9 32 01 00 00 a8 01 0f 85 03 01 00 00 6a 02 ..2...........j.
68 50 ad 54 00 56 e8 03 fc ff ff 23 f8 8b 45 fc hP.T.V.....#..E.
d1 e8 50 53 56 e8 f4 fb ff ff 6a 03 23 f8 68 44 ..PSV.....j.#.hD
ad 54 00 e9 49 fe ff ff 83 f8 04 0f 85 d0 00 00 .T..I...........
00 a1 00 a0 44 00 50 0f c8 50 68 20 ad 54 00 56 ....D.P..Ph .T.V
e8 79 fb ff ff 83 c4 10 e9 ed 00 00 00 83 f8 04 .y..............
0f 85 ab 00 00 00 a1 00 a0 44 00 50 eb db a8 01 .........D.P....
0f 85 9b 00 00 00 66 83 3d 00 a0 44 00 00 75 0c ......f.=..D..u.
6a 05 68 14 ad 54 00 e9 f5 fd ff ff d1 e8 33 c9 j.h..T........3.
66 89 0c 45 00 a0 44 00 8b c3 89 5d f4 8d 48 02 f..E..D....]..H.
66 8b 10 83 c0 02 66 85 d2 75 f5 6a 02 2b c1 68 f.....f..u.j.+.h
50 ad 54 00 ff 75 0c d1 f8 89 45 fc e8 5d fb ff P.T..u....E..]..
ff 53 eb 1d 8b c6 2b 45 f4 83 c0 02 d1 f8 50 ff .S....+E......P.
75 f4 ff 75 0c e8 44 fb ff ff 89 75 f4 83 c6 02 u..u..D....u....
56 23 f8 e8 6d fb ff ff 8b f0 85 f6 75 d6 8b 45 V#..m.......u..E
fc 03 c0 2b 45 f4 03 c3 d1 f8 50 ff 75 f4 ff 75 ...+E.....P.u..u
0c e8 18 fb ff ff 6a 03 23 f8 68 44 ad 54 00 eb ......j.#.hD.T..
2e 33 f6 85 c0 74 21 0f b6 86 00 a0 44 00 6a 03 .3...t!.....D.j.
8d 04 c5 28 a3 54 00 50 ff 75 0c e8 ee fa ff ff ...(.T.P.u......
23 f8 46 3b 75 fc 72 df 6a 02 68 94 ad 54 00 ff #.F;u.r.j.h..T..
75 0c e8 d7 fa ff ff 8b 75 0c 23 f8 85 ff 75 26 u.......u.#...u&
ff 15 24 a0 54 00 68 00 20 40 00 68 00 20 44 00 ..$.T.h. @.h. D.
50 68 00 ad 54 00 68 80 ac 54 00 ff 75 08 e8 0d Ph..T.h..T..u...
fa ff ff 83 c4 18 ff 45 f0 e9 79 fb ff ff 8b 7d .......E..y....}
1c 6a 5c 58 66 89 04 7d 00 20 40 00 8b 45 d8 8d .j\Xf..}. @..E..
44 38 01 50 ff 75 18 ff 75 14 ff 75 10 ff 75 0c D8.P.u..u..u..u.
ff 75 08 e8 cb fa ff ff 33 c0 66 89 04 7d 00 20 .u......3.f..}.
40 00 46 e9 ad fb ff ff ff 75 f8 ff 75 ec 68 40 @.F......u..u.h@
ac 54 00 ff 75 0c e8 03 fa ff ff 83 c4 10 85 c0 .T..u...........
75 23 ff 15 24 a0 54 00 68 00 20 40 00 8b f8 57 u#..$.T.h. @...W
68 00 ad 54 00 68 d0 ab 54 00 ff 75 08 e8 8e f9 h..T.h..T..u....
ff ff 83 c4 14 ff 75 e4 ff 15 14 a0 54 00 5e 89 ......u.....T.^.
45 e8 5b 85 c0 74 1b 68 00 20 40 00 50 68 b8 ab E.[..t.h. @.Ph..
54 00 68 80 ae 54 00 ff 75 08 e8 61 f9 ff ff 83 T.h..T..u..a....
c4 14 8b c7 5f c9 c2 18 00 55 8b ec 83 ec 60 83 ...._....U....`.
65 d0 00 53 56 57 6a 05 59 be 24 ba 54 00 8d 7d e..SVWj.Y.$.T..}
a0 f3 a5 33 c0 8d 7d b4 ab ab c7 45 ec 01 00 00 ...3..}....E....
00 ab c7 45 d8 10 00 00 00 c7 45 fc a0 00 00 00 ...E......E.....
ff 15 48 a0 54 00 8b 35 44 a0 54 00 6a f4 89 45 ..H.T..5D.T.j..E
e8 ff d6 8b f8 89 7d f4 83 ff ff 75 0e ff 15 24 ......}....u...$
a0 54 00 89 45 fc e9 ea 02 00 00 8d 45 e0 50 ff .T..E.......E.P.
15 40 a0 54 00 50 ff 15 50 a0 54 00 8b 1d 24 a0 .@.T.P..P.T...$.
54 00 89 45 dc 85 c0 75 10 ff d3 50 89 45 fc 68 T..E...u...P.E.h
00 ba 54 00 e9 8d 02 00 00 83 7d e0 02 7d 12 68 ..T.......}..}.h
70 b9 54 00 57 e8 b6 f8 ff ff 59 59 e9 60 02 00 p.T.W.....YY.`..
00 6a f5 ff d6 89 45 f0 83 f8 ff 75 10 ff d3 50 .j....E....u...P
89 45 fc 68 54 b9 54 00 e9 36 02 00 00 50 ff 15 .E.hT.T..6...P..
3c a0 54 00 85 c0 75 12 ff d3 50 68 30 b9 54 00 <.T...u...Ph0.T.
68 a0 b8 54 00 e9 f8 01 00 00 83 65 fc 00 8d 45 h..T.......e...E
d8 50 8d 45 a0 50 ff 15 38 a0 54 00 85 c0 75 1c .P.E.P..8.T...u.
ff d3 50 68 80 b8 54 00 be 4c b8 54 00 56 57 89 ..Ph..T..L.T.VW.
45 fc e8 49 f8 ff ff 83 c4 10 eb 05 be 4c b8 54 E..I.........L.T
00 8d 45 c0 50 ff 15 34 a0 54 00 0f b7 45 ce 50 ..E.P..4.T...E.P
0f b7 45 cc 50 0f b7 45 ca 50 0f b7 45 c8 50 0f ..E.P..E.P..E.P.
b7 45 c0 50 0f b7 45 c6 50 0f b7 45 c2 50 8d 45 .E.P..E.P..E.P.E
a0 50 68 40 b0 54 00 ff 75 f0 e8 4f f8 ff ff 83 .Ph@.T..u..O....
c4 28 85 c0 75 15 ff d3 50 68 00 ad 54 00 56 57 .(..u...Ph..T.VW
89 45 fc e8 e8 f7 ff ff 83 c4 10 8d 45 e4 50 6a .E..........E.Pj
20 ff 75 e8 ff 15 10 a0 54 00 85 c0 75 0d ff d3 .u.....T...u...
50 89 45 fc 68 1c b0 54 00 eb 52 33 c0 50 50 6a P.E.h..T..R3.PPj
10 68 18 a3 54 00 50 ff 75 e4 ff 15 0c a0 54 00 .h..T.P.u.....T.
85 c0 75 17 ff d3 50 68 f0 af 54 00 56 57 89 45 ..u...Ph..T.VW.E
fc e8 9a f7 ff ff 83 c4 10 eb 0d ff d3 85 c0 75 ...............u
07 c7 45 d0 00 00 02 00 ff 75 e4 ff 15 30 a0 54 ..E......u...0.T
00 85 c0 75 12 ff d3 50 68 d8 af 54 00 56 57 e8 ...u...Ph..T.VW.
6c f7 ff ff 83 c4 10 8b 45 ec 8b 4d dc 8d 04 81 l.......E..M....
c7 45 f8 00 00 00 80 89 45 e8 8b 4d f8 8b 45 e8 .E......E..M..E.
8b 10 81 f1 00 00 00 80 8b 04 8d 28 ab 54 00 66 ...........(.T.f
8b 38 66 3b 3a 75 1e 66 85 ff 74 15 66 8b 78 02 .8f;:u.f..t.f.x.
66 3b 7a 02 75 0f 83 c0 04 83 c2 04 66 85 ff 75 f;z.u.......f..u
de 33 c0 eb 05 1b c0 83 d8 ff 85 c0 0f 84 0c 01 .3..............
00 00 8b 45 e8 8b 10 8b 04 8d 48 ab 54 00 66 8b ...E......H.T.f.
38 66 3b 3a 75 1e 66 85 ff 74 15 66 8b 78 02 66 8f;:u.f..t.f.x.f
3b 7a 02 75 0f 83 c0 04 83 c2 04 66 85 ff 75 de ;z.u.......f..u.
33 c0 eb 05 1b c0 83 d8 ff 85 c0 0f 84 cd 00 00 3...............
00 ff 45 f8 81 7d f8 07 00 00 80 0f 86 69 ff ff ..E..}.......i..
ff 8b 7d f4 8b 45 e8 ff 30 68 68 af 54 00 57 e8 ..}..E..0hh.T.W.
ac f6 ff ff 83 c4 0c ff 45 ec 8b 45 ec 3b 45 e0 ........E..E.;E.
0f 8c 31 ff ff ff 6a 09 68 54 af 54 00 ff 75 f0 ..1...j.hT.T..u.
e8 29 f7 ff ff 85 c0 75 15 ff d3 50 68 00 ad 54 .).....u...Ph..T
00 56 57 89 45 fc e8 75 f6 ff ff 83 c4 10 ff 75 .VW.E..u.......u
f0 ff 15 30 a0 54 00 85 c0 75 16 ff d3 50 68 d8 ...0.T...u...Ph.
af 54 00 68 4c b8 54 00 57 e8 52 f6 ff ff 83 c4 .T.hL.T.W.R.....
10 ff 75 dc ff 15 2c a0 54 00 85 c0 74 16 ff d3 ..u...,.T...t...
50 68 40 af 54 00 68 4c b8 54 00 57 e8 2f f6 ff Ph@.T.hL.T.W./..
ff 83 c4 10 57 ff 15 30 a0 54 00 85 c0 75 16 ff ....W..0.T...u..
d3 50 68 d8 af 54 00 68 4c b8 54 00 57 e8 0e f6 .Ph..T.hL.T.W...
ff ff 83 c4 10 ff 75 fc ff 15 28 a0 54 00 8b c1 ......u...(.T...
c1 e0 02 ff b0 28 ab 54 00 8b b0 48 ab 54 00 8b .....(.T...H.T..
88 68 ab 54 00 68 1c af 54 00 ff 75 f0 bf 00 20 .h.T.h..T..u...
40 00 89 45 fc 66 f3 a5 e8 21 f6 ff ff 83 c4 0c @..E.f...!......
85 c0 75 18 ff d3 50 68 00 ad 54 00 68 4c b8 54 ..u...Ph..T.hL.T
00 ff 75 f4 e8 b7 f5 ff ff 83 c4 10 8b 45 fc 8b ..u..........E..
80 68 ab 54 00 48 50 ff 75 f8 33 c0 50 ff 75 d0 .h.T.HP.u.3.P.u.
ff 75 f0 ff 75 f4 e8 88 f6 ff ff 81 7d f8 07 00 .u..u.......}...
00 80 8b 7d f4 89 45 fc be 4c b8 54 00 0f 86 d4 ...}..E..L.T....
fe ff ff e9 bc fe ff ff 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0a bb 14 00 1a bb 14 00 2a bb 14 00 3a bb 14 00 ........*...:...
52 bb 14 00 fc ba 14 00 00 00 00 00 74 bb 14 00 R...........t...
84 bb 14 00 90 bb 14 00 a0 bb 14 00 ae bb 14 00 ................
ba bb 14 00 c8 bb 14 00 d8 bb 14 00 ec bb 14 00 ................
00 bc 14 00 12 bc 14 00 22 bc 14 00 00 00 00 00 ........".......
44 bc 14 00 00 00 00 00 66 bc 14 00 00 00 00 00 D.......f.......
51 00 57 00 4f 00 52 00 44 00 00 00 52 00 45 00 Q.W.O.R.D...R.E.
53 00 4f 00 55 00 52 00 43 00 45 00 5f 00 52 00 S.O.U.R.C.E._.R.
45 00 51 00 55 00 49 00 52 00 45 00 4d 00 45 00 E.Q.U.I.R.E.M.E.
4e 00 54 00 53 00 5f 00 4c 00 49 00 53 00 54 00 N.T.S._.L.I.S.T.
00 00 00 00 46 00 55 00 4c 00 4c 00 5f 00 52 00 ....F.U.L.L._.R.
45 00 53 00 4f 00 55 00 52 00 43 00 45 00 5f 00 E.S.O.U.R.C.E._.
44 00 45 00 53 00 43 00 52 00 49 00 50 00 54 00 D.E.S.C.R.I.P.T.
4f 00 52 00 00 00 00 00 52 00 45 00 53 00 4f 00 O.R.....R.E.S.O.
55 00 52 00 43 00 45 00 5f 00 4c 00 49 00 53 00 U.R.C.E._.L.I.S.
54 00 00 00 4d 00 55 00 4c 00 54 00 49 00 5f 00 T...M.U.L.T.I._.
53 00 5a 00 00 00 00 00 4c 00 49 00 4e 00 4b 00 S.Z.....L.I.N.K.
00 00 00 00 44 00 57 00 4f 00 52 00 44 00 5f 00 ....D.W.O.R.D._.
42 00 49 00 47 00 5f 00 45 00 4e 00 44 00 49 00 B.I.G._.E.N.D.I.
41 00 4e 00 00 00 00 00 44 00 57 00 4f 00 52 00 A.N.....D.W.O.R.
44 00 00 00 42 00 49 00 4e 00 41 00 52 00 59 00 D...B.I.N.A.R.Y.
00 00 00 00 45 00 58 00 50 00 41 00 4e 00 44 00 ....E.X.P.A.N.D.
5f 00 53 00 5a 00 00 00 53 00 5a 00 00 00 00 00 _.S.Z...S.Z.....
4e 00 4f 00 4e 00 45 00 00 00 00 00 00 00 00 00 N.O.N.E.........
48 00 4b 00 45 00 59 00 5f 00 43 00 55 00 52 00 H.K.E.Y._.C.U.R.
52 00 45 00 4e 00 54 00 5f 00 55 00 53 00 45 00 R.E.N.T._.U.S.E.
52 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 R._.L.O.C.A.L._.
53 00 45 00 54 00 54 00 49 00 4e 00 47 00 53 00 S.E.T.T.I.N.G.S.
00 00 00 00 48 00 4b 00 45 00 59 00 5f 00 44 00 ....H.K.E.Y._.D.
59 00 4e 00 5f 00 44 00 41 00 54 00 41 00 00 00 Y.N._.D.A.T.A...
48 00 4b 00 45 00 59 00 5f 00 43 00 55 00 52 00 H.K.E.Y._.C.U.R.
52 00 45 00 4e 00 54 00 5f 00 43 00 4f 00 4e 00 R.E.N.T._.C.O.N.
46 00 49 00 47 00 00 00 48 00 4b 00 45 00 59 00 F.I.G...H.K.E.Y.
5f 00 50 00 45 00 52 00 46 00 4f 00 52 00 4d 00 _.P.E.R.F.O.R.M.
41 00 4e 00 43 00 45 00 5f 00 44 00 41 00 54 00 A.N.C.E._.D.A.T.
41 00 00 00 48 00 4b 00 45 00 59 00 5f 00 55 00 A...H.K.E.Y._.U.
53 00 45 00 52 00 53 00 00 00 00 00 48 00 4b 00 S.E.R.S.....H.K.
45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 E.Y._.L.O.C.A.L.
5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 _.M.A.C.H.I.N.E.
00 00 00 00 48 00 4b 00 45 00 59 00 5f 00 43 00 ....H.K.E.Y._.C.
55 00 52 00 52 00 45 00 4e 00 54 00 5f 00 55 00 U.R.R.E.N.T._.U.
53 00 45 00 52 00 00 00 48 00 4b 00 45 00 59 00 S.E.R...H.K.E.Y.
5f 00 43 00 4c 00 41 00 53 00 53 00 45 00 53 00 _.C.L.A.S.S.E.S.
5f 00 52 00 4f 00 4f 00 54 00 00 00 48 00 4b 00 _.R.O.O.T...H.K.
4c 00 53 00 00 00 00 00 48 00 4b 00 44 00 44 00 L.S.....H.K.D.D.
00 00 00 00 48 00 4b 00 43 00 43 00 00 00 00 00 ....H.K.C.C.....
48 00 4b 00 50 00 44 00 00 00 00 00 48 00 4b 00 H.K.P.D.....H.K.
55 00 00 00 48 00 4b 00 4c 00 4d 00 00 00 00 00 U...H.K.L.M.....
48 00 4b 00 43 00 55 00 00 00 00 00 48 00 4b 00 H.K.C.U.....H.K.
43 00 52 00 00 00 00 00 01 00 00 00 11 00 00 00 C.R.............
00 00 00 00 02 00 00 00 2c 00 30 00 30 00 00 00 ........,.0.0...
2c 00 30 00 31 00 00 00 2c 00 30 00 32 00 00 00 ,.0.1...,.0.2...
2c 00 30 00 33 00 00 00 2c 00 30 00 34 00 00 00 ,.0.3...,.0.4...
2c 00 30 00 35 00 00 00 2c 00 30 00 36 00 00 00 ,.0.5...,.0.6...
2c 00 30 00 37 00 00 00 2c 00 30 00 38 00 00 00 ,.0.7...,.0.8...
2c 00 30 00 39 00 00 00 2c 00 30 00 61 00 00 00 ,.0.9...,.0.a...
2c 00 30 00 62 00 00 00 2c 00 30 00 63 00 00 00 ,.0.b...,.0.c...
2c 00 30 00 64 00 00 00 2c 00 30 00 65 00 00 00 ,.0.d...,.0.e...
2c 00 30 00 66 00 00 00 2c 00 31 00 30 00 00 00 ,.0.f...,.1.0...
2c 00 31 00 31 00 00 00 2c 00 31 00 32 00 00 00 ,.1.1...,.1.2...
2c 00 31 00 33 00 00 00 2c 00 31 00 34 00 00 00 ,.1.3...,.1.4...
2c 00 31 00 35 00 00 00 2c 00 31 00 36 00 00 00 ,.1.5...,.1.6...
2c 00 31 00 37 00 00 00 2c 00 31 00 38 00 00 00 ,.1.7...,.1.8...
2c 00 31 00 39 00 00 00 2c 00 31 00 61 00 00 00 ,.1.9...,.1.a...
2c 00 31 00 62 00 00 00 2c 00 31 00 63 00 00 00 ,.1.b...,.1.c...
2c 00 31 00 64 00 00 00 2c 00 31 00 65 00 00 00 ,.1.d...,.1.e...
2c 00 31 00 66 00 00 00 2c 00 32 00 30 00 00 00 ,.1.f...,.2.0...
2c 00 32 00 31 00 00 00 2c 00 32 00 32 00 00 00 ,.2.1...,.2.2...
2c 00 32 00 33 00 00 00 2c 00 32 00 34 00 00 00 ,.2.3...,.2.4...
2c 00 32 00 35 00 00 00 2c 00 32 00 36 00 00 00 ,.2.5...,.2.6...
2c 00 32 00 37 00 00 00 2c 00 32 00 38 00 00 00 ,.2.7...,.2.8...
2c 00 32 00 39 00 00 00 2c 00 32 00 61 00 00 00 ,.2.9...,.2.a...
2c 00 32 00 62 00 00 00 2c 00 32 00 63 00 00 00 ,.2.b...,.2.c...
2c 00 32 00 64 00 00 00 2c 00 32 00 65 00 00 00 ,.2.d...,.2.e...
2c 00 32 00 66 00 00 00 2c 00 33 00 30 00 00 00 ,.2.f...,.3.0...
2c 00 33 00 31 00 00 00 2c 00 33 00 32 00 00 00 ,.3.1...,.3.2...
2c 00 33 00 33 00 00 00 2c 00 33 00 34 00 00 00 ,.3.3...,.3.4...
2c 00 33 00 35 00 00 00 2c 00 33 00 36 00 00 00 ,.3.5...,.3.6...
2c 00 33 00 37 00 00 00 2c 00 33 00 38 00 00 00 ,.3.7...,.3.8...
2c 00 33 00 39 00 00 00 2c 00 33 00 61 00 00 00 ,.3.9...,.3.a...
2c 00 33 00 62 00 00 00 2c 00 33 00 63 00 00 00 ,.3.b...,.3.c...
2c 00 33 00 64 00 00 00 2c 00 33 00 65 00 00 00 ,.3.d...,.3.e...
2c 00 33 00 66 00 00 00 2c 00 34 00 30 00 00 00 ,.3.f...,.4.0...
2c 00 34 00 31 00 00 00 2c 00 34 00 32 00 00 00 ,.4.1...,.4.2...
2c 00 34 00 33 00 00 00 2c 00 34 00 34 00 00 00 ,.4.3...,.4.4...
2c 00 34 00 35 00 00 00 2c 00 34 00 36 00 00 00 ,.4.5...,.4.6...
2c 00 34 00 37 00 00 00 2c 00 34 00 38 00 00 00 ,.4.7...,.4.8...
2c 00 34 00 39 00 00 00 2c 00 34 00 61 00 00 00 ,.4.9...,.4.a...
2c 00 34 00 62 00 00 00 2c 00 34 00 63 00 00 00 ,.4.b...,.4.c...
2c 00 34 00 64 00 00 00 2c 00 34 00 65 00 00 00 ,.4.d...,.4.e...
2c 00 34 00 66 00 00 00 2c 00 35 00 30 00 00 00 ,.4.f...,.5.0...
2c 00 35 00 31 00 00 00 2c 00 35 00 32 00 00 00 ,.5.1...,.5.2...
2c 00 35 00 33 00 00 00 2c 00 35 00 34 00 00 00 ,.5.3...,.5.4...
2c 00 35 00 35 00 00 00 2c 00 35 00 36 00 00 00 ,.5.5...,.5.6...
2c 00 35 00 37 00 00 00 2c 00 35 00 38 00 00 00 ,.5.7...,.5.8...
2c 00 35 00 39 00 00 00 2c 00 35 00 61 00 00 00 ,.5.9...,.5.a...
2c 00 35 00 62 00 00 00 2c 00 35 00 63 00 00 00 ,.5.b...,.5.c...
2c 00 35 00 64 00 00 00 2c 00 35 00 65 00 00 00 ,.5.d...,.5.e...
2c 00 35 00 66 00 00 00 2c 00 36 00 30 00 00 00 ,.5.f...,.6.0...
2c 00 36 00 31 00 00 00 2c 00 36 00 32 00 00 00 ,.6.1...,.6.2...
2c 00 36 00 33 00 00 00 2c 00 36 00 34 00 00 00 ,.6.3...,.6.4...
2c 00 36 00 35 00 00 00 2c 00 36 00 36 00 00 00 ,.6.5...,.6.6...
2c 00 36 00 37 00 00 00 2c 00 36 00 38 00 00 00 ,.6.7...,.6.8...
2c 00 36 00 39 00 00 00 2c 00 36 00 61 00 00 00 ,.6.9...,.6.a...
2c 00 36 00 62 00 00 00 2c 00 36 00 63 00 00 00 ,.6.b...,.6.c...
2c 00 36 00 64 00 00 00 2c 00 36 00 65 00 00 00 ,.6.d...,.6.e...
2c 00 36 00 66 00 00 00 2c 00 37 00 30 00 00 00 ,.6.f...,.7.0...
2c 00 37 00 31 00 00 00 2c 00 37 00 32 00 00 00 ,.7.1...,.7.2...
2c 00 37 00 33 00 00 00 2c 00 37 00 34 00 00 00 ,.7.3...,.7.4...
2c 00 37 00 35 00 00 00 2c 00 37 00 36 00 00 00 ,.7.5...,.7.6...
2c 00 37 00 37 00 00 00 2c 00 37 00 38 00 00 00 ,.7.7...,.7.8...
2c 00 37 00 39 00 00 00 2c 00 37 00 61 00 00 00 ,.7.9...,.7.a...
2c 00 37 00 62 00 00 00 2c 00 37 00 63 00 00 00 ,.7.b...,.7.c...
2c 00 37 00 64 00 00 00 2c 00 37 00 65 00 00 00 ,.7.d...,.7.e...
2c 00 37 00 66 00 00 00 2c 00 38 00 30 00 00 00 ,.7.f...,.8.0...
2c 00 38 00 31 00 00 00 2c 00 38 00 32 00 00 00 ,.8.1...,.8.2...
2c 00 38 00 33 00 00 00 2c 00 38 00 34 00 00 00 ,.8.3...,.8.4...
2c 00 38 00 35 00 00 00 2c 00 38 00 36 00 00 00 ,.8.5...,.8.6...
2c 00 38 00 37 00 00 00 2c 00 38 00 38 00 00 00 ,.8.7...,.8.8...
2c 00 38 00 39 00 00 00 2c 00 38 00 61 00 00 00 ,.8.9...,.8.a...
2c 00 38 00 62 00 00 00 2c 00 38 00 63 00 00 00 ,.8.b...,.8.c...
2c 00 38 00 64 00 00 00 2c 00 38 00 65 00 00 00 ,.8.d...,.8.e...
2c 00 38 00 66 00 00 00 2c 00 39 00 30 00 00 00 ,.8.f...,.9.0...
2c 00 39 00 31 00 00 00 2c 00 39 00 32 00 00 00 ,.9.1...,.9.2...
2c 00 39 00 33 00 00 00 2c 00 39 00 34 00 00 00 ,.9.3...,.9.4...
2c 00 39 00 35 00 00 00 2c 00 39 00 36 00 00 00 ,.9.5...,.9.6...
2c 00 39 00 37 00 00 00 2c 00 39 00 38 00 00 00 ,.9.7...,.9.8...
2c 00 39 00 39 00 00 00 2c 00 39 00 61 00 00 00 ,.9.9...,.9.a...
2c 00 39 00 62 00 00 00 2c 00 39 00 63 00 00 00 ,.9.b...,.9.c...
2c 00 39 00 64 00 00 00 2c 00 39 00 65 00 00 00 ,.9.d...,.9.e...
2c 00 39 00 66 00 00 00 2c 00 61 00 30 00 00 00 ,.9.f...,.a.0...
2c 00 61 00 31 00 00 00 2c 00 61 00 32 00 00 00 ,.a.1...,.a.2...
2c 00 61 00 33 00 00 00 2c 00 61 00 34 00 00 00 ,.a.3...,.a.4...
2c 00 61 00 35 00 00 00 2c 00 61 00 36 00 00 00 ,.a.5...,.a.6...
2c 00 61 00 37 00 00 00 2c 00 61 00 38 00 00 00 ,.a.7...,.a.8...
2c 00 61 00 39 00 00 00 2c 00 61 00 61 00 00 00 ,.a.9...,.a.a...
2c 00 61 00 62 00 00 00 2c 00 61 00 63 00 00 00 ,.a.b...,.a.c...
2c 00 61 00 64 00 00 00 2c 00 61 00 65 00 00 00 ,.a.d...,.a.e...
2c 00 61 00 66 00 00 00 2c 00 62 00 30 00 00 00 ,.a.f...,.b.0...
2c 00 62 00 31 00 00 00 2c 00 62 00 32 00 00 00 ,.b.1...,.b.2...
2c 00 62 00 33 00 00 00 2c 00 62 00 34 00 00 00 ,.b.3...,.b.4...
2c 00 62 00 35 00 00 00 2c 00 62 00 36 00 00 00 ,.b.5...,.b.6...
2c 00 62 00 37 00 00 00 2c 00 62 00 38 00 00 00 ,.b.7...,.b.8...
2c 00 62 00 39 00 00 00 2c 00 62 00 61 00 00 00 ,.b.9...,.b.a...
2c 00 62 00 62 00 00 00 2c 00 62 00 63 00 00 00 ,.b.b...,.b.c...
2c 00 62 00 64 00 00 00 2c 00 62 00 65 00 00 00 ,.b.d...,.b.e...
2c 00 62 00 66 00 00 00 2c 00 63 00 30 00 00 00 ,.b.f...,.c.0...
2c 00 63 00 31 00 00 00 2c 00 63 00 32 00 00 00 ,.c.1...,.c.2...
2c 00 63 00 33 00 00 00 2c 00 63 00 34 00 00 00 ,.c.3...,.c.4...
2c 00 63 00 35 00 00 00 2c 00 63 00 36 00 00 00 ,.c.5...,.c.6...
2c 00 63 00 37 00 00 00 2c 00 63 00 38 00 00 00 ,.c.7...,.c.8...
2c 00 63 00 39 00 00 00 2c 00 63 00 61 00 00 00 ,.c.9...,.c.a...
2c 00 63 00 62 00 00 00 2c 00 63 00 63 00 00 00 ,.c.b...,.c.c...
2c 00 63 00 64 00 00 00 2c 00 63 00 65 00 00 00 ,.c.d...,.c.e...
2c 00 63 00 66 00 00 00 2c 00 64 00 30 00 00 00 ,.c.f...,.d.0...
2c 00 64 00 31 00 00 00 2c 00 64 00 32 00 00 00 ,.d.1...,.d.2...
2c 00 64 00 33 00 00 00 2c 00 64 00 34 00 00 00 ,.d.3...,.d.4...
2c 00 64 00 35 00 00 00 2c 00 64 00 36 00 00 00 ,.d.5...,.d.6...
2c 00 64 00 37 00 00 00 2c 00 64 00 38 00 00 00 ,.d.7...,.d.8...
2c 00 64 00 39 00 00 00 2c 00 64 00 61 00 00 00 ,.d.9...,.d.a...
2c 00 64 00 62 00 00 00 2c 00 64 00 63 00 00 00 ,.d.b...,.d.c...
2c 00 64 00 64 00 00 00 2c 00 64 00 65 00 00 00 ,.d.d...,.d.e...
2c 00 64 00 66 00 00 00 2c 00 65 00 30 00 00 00 ,.d.f...,.e.0...
2c 00 65 00 31 00 00 00 2c 00 65 00 32 00 00 00 ,.e.1...,.e.2...
2c 00 65 00 33 00 00 00 2c 00 65 00 34 00 00 00 ,.e.3...,.e.4...
2c 00 65 00 35 00 00 00 2c 00 65 00 36 00 00 00 ,.e.5...,.e.6...
2c 00 65 00 37 00 00 00 2c 00 65 00 38 00 00 00 ,.e.7...,.e.8...
2c 00 65 00 39 00 00 00 2c 00 65 00 61 00 00 00 ,.e.9...,.e.a...
2c 00 65 00 62 00 00 00 2c 00 65 00 63 00 00 00 ,.e.b...,.e.c...
2c 00 65 00 64 00 00 00 2c 00 65 00 65 00 00 00 ,.e.d...,.e.e...
2c 00 65 00 66 00 00 00 2c 00 66 00 30 00 00 00 ,.e.f...,.f.0...
2c 00 66 00 31 00 00 00 2c 00 66 00 32 00 00 00 ,.f.1...,.f.2...
2c 00 66 00 33 00 00 00 2c 00 66 00 34 00 00 00 ,.f.3...,.f.4...
2c 00 66 00 35 00 00 00 2c 00 66 00 36 00 00 00 ,.f.5...,.f.6...
2c 00 66 00 37 00 00 00 2c 00 66 00 38 00 00 00 ,.f.7...,.f.8...
2c 00 66 00 39 00 00 00 2c 00 66 00 61 00 00 00 ,.f.9...,.f.a...
2c 00 66 00 62 00 00 00 2c 00 66 00 63 00 00 00 ,.f.b...,.f.c...
2c 00 66 00 64 00 00 00 2c 00 66 00 65 00 00 00 ,.f.d...,.f.e...
2c 00 66 00 66 00 00 00 0c a3 54 00 00 a3 54 00 ,.f.f.....T...T.
f4 a2 54 00 ec a2 54 00 e0 a2 54 00 d4 a2 54 00 ..T...T...T...T.
c8 a2 54 00 bc a2 54 00 98 a2 54 00 74 a2 54 00 ..T...T...T.t.T.
4c a2 54 00 34 a2 54 00 08 a2 54 00 e0 a1 54 00 L.T.4.T...T...T.
c4 a1 54 00 80 a1 54 00 12 00 00 00 12 00 00 00 ..T...T.........
13 00 00 00 0b 00 00 00 16 00 00 00 14 00 00 00 ................
0e 00 00 00 21 00 00 00 70 a1 54 00 68 a1 54 00 ....!...p.T.h.T.
54 a1 54 00 44 a1 54 00 38 a1 54 00 14 a1 54 00 T.T.D.T.8.T...T.
08 a1 54 00 f4 a0 54 00 d8 a0 54 00 a4 a0 54 00 ..T...T...T...T.
6c a0 54 00 60 a0 54 00 52 00 65 00 67 00 43 00 l.T.`.T.R.e.g.C.
6c 00 6f 00 73 00 65 00 4b 00 65 00 79 00 00 00 l.o.s.e.K.e.y...
25 00 6c 00 73 00 28 00 29 00 20 00 72 00 65 00 %.l.s.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 65 00 t.u.r.n.e.d. .e.
72 00 72 00 6f 00 72 00 20 00 25 00 6c 00 75 00 r.r.o.r. .%.l.u.
20 00 66 00 6f 00 72 00 20 00 65 00 6d 00 70 00 .f.o.r. .e.m.p.
74 00 79 00 20 00 72 00 65 00 67 00 69 00 73 00 t.y. .r.e.g.i.s.
74 00 72 00 79 00 20 00 6b 00 65 00 79 00 20 00 t.r.y. .k.e.y. .
27 00 25 00 6c 00 73 00 27 00 0a 00 00 00 00 00 '.%.l.s.'.......
25 00 6c 00 73 00 2c 00 22 00 25 00 6c 00 73 00 %.l.s.,.".%.l.s.
22 00 2c 00 2c 00 25 00 25 00 52 00 45 00 47 00 ".,.,.%.%.R.E.G.
5f 00 4b 00 45 00 59 00 4f 00 4e 00 4c 00 59 00 _.K.E.Y.O.N.L.Y.
25 00 25 00 0d 00 0a 00 00 00 00 00 00 00 00 00 %.%.............
25 00 6c 00 73 00 28 00 29 00 20 00 72 00 65 00 %.l.s.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 65 00 t.u.r.n.e.d. .e.
72 00 72 00 6f 00 72 00 20 00 25 00 6c 00 75 00 r.r.o.r. .%.l.u.
20 00 66 00 6f 00 72 00 20 00 76 00 61 00 6c 00 .f.o.r. .v.a.l.
75 00 65 00 20 00 27 00 25 00 6c 00 73 00 27 00 u.e. .'.%.l.s.'.
20 00 6f 00 66 00 20 00 72 00 65 00 67 00 69 00 .o.f. .r.e.g.i.
73 00 74 00 72 00 79 00 20 00 6b 00 65 00 79 00 s.t.r.y. .k.e.y.
20 00 27 00 25 00 6c 00 73 00 27 00 0a 00 00 00 .'.%.l.s.'.....
57 00 72 00 69 00 74 00 65 00 46 00 69 00 6c 00 W.r.i.t.e.F.i.l.
65 00 00 00 2c 00 22 00 22 00 0d 00 0a 00 00 00 e...,.".".......
2c 00 25 00 6c 00 75 00 20 00 3b 00 20 00 30 00 ,.%.l.u. .;. .0.
78 00 25 00 30 00 38 00 6c 00 78 00 0d 00 0a 00 x.%.0.8.l.x.....
00 00 00 00 22 00 0d 00 0a 00 00 00 22 00 00 00 ...."......."...
2c 00 22 00 00 00 00 00 3b 00 22 00 22 00 00 00 ,.".....;."."...
3b 00 0d 00 0a 00 00 00 2c 00 25 00 49 00 36 00 ;.......,.%.I.6.
34 00 75 00 20 00 3b 00 20 00 30 00 78 00 25 00 4.u. .;. .0.x.%.
30 00 31 00 36 00 49 00 36 00 34 00 78 00 0d 00 0.1.6.I.6.4.x...
0a 00 00 00 0d 00 0a 00 00 00 00 00 22 00 25 00 ............".%.
6c 00 73 00 22 00 2c 00 30 00 78 00 25 00 30 00 l.s.".,.0.x.%.0.
38 00 6c 00 78 00 00 00 2c 00 30 00 78 00 25 00 8.l.x...,.0.x.%.
30 00 38 00 6c 00 78 00 00 00 00 00 22 00 25 00 0.8.l.x.....".%.
6c 00 73 00 22 00 2c 00 25 00 25 00 52 00 45 00 l.s.".,.%.%.R.E.
47 00 5f 00 25 00 6c 00 73 00 25 00 25 00 00 00 G._.%.l.s.%.%...
2c 00 25 00 25 00 52 00 45 00 47 00 5f 00 25 00 ,.%.%.R.E.G._.%.
6c 00 73 00 25 00 25 00 00 00 00 00 25 00 6c 00 l.s.%.%.....%.l.
73 00 2c 00 22 00 25 00 6c 00 73 00 22 00 2c 00 s.,.".%.l.s.".,.
00 00 00 00 25 00 6c 00 73 00 2c 00 2c 00 00 00 ....%.l.s.,.,...
25 00 6c 00 73 00 2c 00 2c 00 2c 00 25 00 25 00 %.l.s.,.,.,.%.%.
52 00 45 00 47 00 5f 00 4b 00 45 00 59 00 4f 00 R.E.G._.K.E.Y.O.
4e 00 4c 00 59 00 25 00 25 00 0d 00 0a 00 00 00 N.L.Y.%.%.......
52 00 65 00 67 00 45 00 6e 00 75 00 6d 00 4b 00 R.e.g.E.n.u.m.K.
65 00 79 00 45 00 78 00 00 00 00 00 00 00 00 00 e.y.E.x.........
25 00 6c 00 73 00 28 00 29 00 20 00 72 00 65 00 %.l.s.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 65 00 t.u.r.n.e.d. .e.
72 00 72 00 6f 00 72 00 20 00 25 00 6c 00 75 00 r.r.o.r. .%.l.u.
20 00 66 00 6f 00 72 00 20 00 72 00 65 00 67 00 .f.o.r. .r.e.g.
69 00 73 00 74 00 72 00 79 00 20 00 6b 00 65 00 i.s.t.r.y. .k.e.
79 00 20 00 27 00 25 00 6c 00 73 00 27 00 0a 00 y. .'.%.l.s.'...
00 00 00 00 52 00 65 00 67 00 45 00 6e 00 75 00 ....R.e.g.E.n.u.
6d 00 56 00 61 00 6c 00 75 00 65 00 00 00 00 00 m.V.a.l.u.e.....
52 00 65 00 67 00 4f 00 70 00 65 00 6e 00 4b 00 R.e.g.O.p.e.n.K.
65 00 79 00 45 00 78 00 00 00 00 00 0d 00 0a 00 e.y.E.x.........
5b 00 41 00 64 00 64 00 52 00 65 00 67 00 2e 00 [.A.d.d.R.e.g...
25 00 6c 00 73 00 5d 00 0d 00 0a 00 00 00 00 00 %.l.s.].........
4c 00 6f 00 63 00 61 00 6c 00 46 00 72 00 65 00 L.o.c.a.l.F.r.e.
65 00 00 00 0d 00 0a 00 3b 00 20 00 45 00 4f 00 e.......;. .E.O.
46 00 0d 00 0a 00 00 00 41 00 72 00 67 00 75 00 F.......A.r.g.u.
6d 00 65 00 6e 00 74 00 20 00 27 00 25 00 6c 00 m.e.n.t. .'.%.l.
73 00 27 00 20 00 69 00 73 00 20 00 6e 00 6f 00 s.'. .i.s. .n.o.
74 00 20 00 61 00 20 00 70 00 72 00 65 00 64 00 t. .a. .p.r.e.d.
65 00 66 00 69 00 6e 00 65 00 64 00 20 00 72 00 e.f.i.n.e.d. .r.
65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 e.g.i.s.t.r.y. .
6b 00 65 00 79 00 20 00 6e 00 61 00 6d 00 65 00 k.e.y. .n.a.m.e.
21 00 0a 00 00 00 00 00 43 00 6c 00 6f 00 73 00 !.......C.l.o.s.
65 00 48 00 61 00 6e 00 64 00 6c 00 65 00 00 00 e.H.a.n.d.l.e...
41 00 64 00 6a 00 75 00 73 00 74 00 54 00 6f 00 A.d.j.u.s.t.T.o.
6b 00 65 00 6e 00 50 00 72 00 69 00 76 00 69 00 k.e.n.P.r.i.v.i.
6c 00 65 00 67 00 65 00 73 00 00 00 4f 00 70 00 l.e.g.e.s...O.p.
65 00 6e 00 50 00 72 00 6f 00 63 00 65 00 73 00 e.n.P.r.o.c.e.s.
73 00 54 00 6f 00 6b 00 65 00 6e 00 00 00 00 00 s.T.o.k.e.n.....
ff fe 3b 00 20 00 52 00 65 00 67 00 69 00 73 00 ..;. .R.e.g.i.s.
74 00 72 00 79 00 20 00 6f 00 66 00 20 00 27 00 t.r.y. .o.f. .'.
25 00 6c 00 73 00 27 00 0d 00 0a 00 0d 00 0a 00 %.l.s.'.........
5b 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 [.V.e.r.s.i.o.n.
5d 00 0d 00 0a 00 44 00 72 00 69 00 76 00 65 00 ].....D.r.i.v.e.
72 00 56 00 65 00 72 00 20 00 3d 00 20 00 25 00 r.V.e.r. .=. .%.
30 00 32 00 68 00 75 00 2f 00 25 00 30 00 32 00 0.2.h.u./.%.0.2.
68 00 75 00 2f 00 25 00 30 00 34 00 68 00 75 00 h.u./.%.0.4.h.u.
2c 00 25 00 30 00 32 00 68 00 75 00 2e 00 25 00 ,.%.0.2.h.u...%.
30 00 32 00 68 00 75 00 2e 00 25 00 30 00 32 00 0.2.h.u...%.0.2.
68 00 75 00 2e 00 25 00 30 00 33 00 68 00 75 00 h.u...%.0.3.h.u.
20 00 3b 00 20 00 55 00 54 00 43 00 0d 00 0a 00 .;. .U.T.C.....
50 00 72 00 6f 00 76 00 69 00 64 00 65 00 72 00 P.r.o.v.i.d.e.r.
20 00 20 00 3d 00 20 00 22 00 53 00 74 00 65 00 . .=. .".S.t.e.
66 00 61 00 6e 00 20 00 4b 00 61 00 6e 00 74 00 f.a.n. .K.a.n.t.
68 00 61 00 6b 00 22 00 0d 00 0a 00 53 00 69 00 h.a.k.".....S.i.
67 00 6e 00 61 00 74 00 75 00 72 00 65 00 20 00 g.n.a.t.u.r.e. .
3d 00 20 00 22 00 24 00 57 00 69 00 6e 00 64 00 =. .".$.W.i.n.d.
6f 00 77 00 73 00 20 00 4e 00 54 00 24 00 22 00 o.w.s. .N.T.$.".
0d 00 0a 00 0d 00 0a 00 5b 00 53 00 74 00 72 00 ........[.S.t.r.
69 00 6e 00 67 00 73 00 5d 00 0d 00 0a 00 52 00 i.n.g.s.].....R.
45 00 47 00 5f 00 53 00 5a 00 20 00 20 00 20 00 E.G._.S.Z. . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 3d 00 20 00 . . . . . .=. .
30 00 78 00 30 00 30 00 30 00 30 00 30 00 30 00 0.x.0.0.0.0.0.0.
30 00 30 00 0d 00 0a 00 52 00 45 00 47 00 5f 00 0.0.....R.E.G._.
42 00 49 00 4e 00 41 00 52 00 59 00 20 00 20 00 B.I.N.A.R.Y. . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 3d 00 20 00 30 00 78 00 30 00 . . .=. .0.x.0.
30 00 30 00 30 00 30 00 30 00 30 00 31 00 0d 00 0.0.0.0.0.0.1...
0a 00 52 00 45 00 47 00 5f 00 4b 00 45 00 59 00 ..R.E.G._.K.E.Y.
4f 00 4e 00 4c 00 59 00 20 00 20 00 20 00 20 00 O.N.L.Y. . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
3d 00 20 00 30 00 78 00 30 00 30 00 30 00 30 00 =. .0.x.0.0.0.0.
30 00 30 00 31 00 30 00 0d 00 0a 00 52 00 45 00 0.0.1.0.....R.E.
47 00 5f 00 4d 00 55 00 4c 00 54 00 49 00 5f 00 G._.M.U.L.T.I._.
53 00 5a 00 20 00 20 00 20 00 20 00 20 00 20 00 S.Z. . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 3d 00 20 00 30 00 . . . . .=. .0.
78 00 30 00 30 00 30 00 31 00 30 00 30 00 30 00 x.0.0.0.1.0.0.0.
30 00 0d 00 0a 00 52 00 45 00 47 00 5f 00 44 00 0.....R.E.G._.D.
57 00 4f 00 52 00 44 00 20 00 20 00 20 00 20 00 W.O.R.D. . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 3d 00 20 00 30 00 78 00 30 00 30 00 . .=. .0.x.0.0.
30 00 31 00 30 00 30 00 30 00 31 00 0d 00 0a 00 0.1.0.0.0.1.....
52 00 45 00 47 00 5f 00 45 00 58 00 50 00 41 00 R.E.G._.E.X.P.A.
4e 00 44 00 5f 00 53 00 5a 00 20 00 20 00 20 00 N.D._.S.Z. . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 3d 00 . . . . . . .=.
20 00 30 00 78 00 30 00 30 00 30 00 32 00 30 00 .0.x.0.0.0.2.0.
30 00 30 00 30 00 0d 00 0a 00 52 00 45 00 47 00 0.0.0.....R.E.G.
5f 00 4e 00 4f 00 4e 00 45 00 20 00 20 00 20 00 _.N.O.N.E. . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 3d 00 20 00 30 00 78 00 . . . .=. .0.x.
30 00 30 00 30 00 32 00 30 00 30 00 30 00 31 00 0.0.0.2.0.0.0.1.
0d 00 0a 00 52 00 45 00 47 00 5f 00 43 00 4f 00 ....R.E.G._.C.O.
4d 00 50 00 41 00 54 00 49 00 42 00 4c 00 45 00 M.P.A.T.I.B.L.E.
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 3d 00 20 00 30 00 78 00 30 00 30 00 30 00 .=. .0.x.0.0.0.
33 00 30 00 30 00 30 00 31 00 20 00 3b 00 20 00 3.0.0.0.1. .;. .
73 00 61 00 6d 00 65 00 20 00 61 00 73 00 20 00 s.a.m.e. .a.s. .
52 00 45 00 47 00 5f 00 42 00 49 00 4e 00 41 00 R.E.G._.B.I.N.A.
52 00 59 00 0d 00 0a 00 52 00 45 00 47 00 5f 00 R.Y.....R.E.G._.
44 00 57 00 4f 00 52 00 44 00 5f 00 4c 00 49 00 D.W.O.R.D._.L.I.
54 00 54 00 4c 00 45 00 5f 00 45 00 4e 00 44 00 T.T.L.E._.E.N.D.
49 00 41 00 4e 00 20 00 20 00 20 00 20 00 20 00 I.A.N. . . . . .
20 00 20 00 20 00 3d 00 20 00 30 00 78 00 30 00 . . .=. .0.x.0.
30 00 30 00 34 00 30 00 30 00 30 00 31 00 20 00 0.0.4.0.0.0.1. .
3b 00 20 00 73 00 61 00 6d 00 65 00 20 00 61 00 ;. .s.a.m.e. .a.
73 00 20 00 52 00 45 00 47 00 5f 00 44 00 57 00 s. .R.E.G._.D.W.
4f 00 52 00 44 00 0d 00 0a 00 52 00 45 00 47 00 O.R.D.....R.E.G.
5f 00 44 00 57 00 4f 00 52 00 44 00 5f 00 42 00 _.D.W.O.R.D._.B.
49 00 47 00 5f 00 45 00 4e 00 44 00 49 00 41 00 I.G._.E.N.D.I.A.
4e 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 N. . . . . . . .
20 00 20 00 20 00 20 00 3d 00 20 00 30 00 78 00 . . . .=. .0.x.
30 00 30 00 30 00 35 00 30 00 30 00 30 00 31 00 0.0.0.5.0.0.0.1.
0d 00 0a 00 52 00 45 00 47 00 5f 00 4c 00 49 00 ....R.E.G._.L.I.
4e 00 4b 00 20 00 20 00 20 00 20 00 20 00 20 00 N.K. . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 3d 00 20 00 30 00 78 00 30 00 30 00 30 00 .=. .0.x.0.0.0.
36 00 30 00 30 00 30 00 30 00 0d 00 0a 00 52 00 6.0.0.0.0.....R.
45 00 47 00 5f 00 52 00 45 00 53 00 4f 00 55 00 E.G._.R.E.S.O.U.
52 00 43 00 45 00 5f 00 4c 00 49 00 53 00 54 00 R.C.E._.L.I.S.T.
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 3d 00 20 00 . . . . . .=. .
30 00 78 00 30 00 30 00 30 00 38 00 30 00 30 00 0.x.0.0.0.8.0.0.
30 00 31 00 0d 00 0a 00 52 00 45 00 47 00 5f 00 0.1.....R.E.G._.
46 00 55 00 4c 00 4c 00 5f 00 52 00 45 00 53 00 F.U.L.L._.R.E.S.
4f 00 55 00 52 00 43 00 45 00 5f 00 44 00 45 00 O.U.R.C.E._.D.E.
53 00 43 00 52 00 49 00 50 00 54 00 4f 00 52 00 S.C.R.I.P.T.O.R.
20 00 20 00 20 00 3d 00 20 00 30 00 78 00 30 00 . . .=. .0.x.0.
30 00 30 00 39 00 30 00 30 00 30 00 31 00 0d 00 0.0.9.0.0.0.1...
0a 00 52 00 45 00 47 00 5f 00 52 00 45 00 53 00 ..R.E.G._.R.E.S.
4f 00 55 00 52 00 43 00 45 00 5f 00 52 00 45 00 O.U.R.C.E._.R.E.
51 00 55 00 49 00 52 00 45 00 4d 00 45 00 4e 00 Q.U.I.R.E.M.E.N.
54 00 53 00 5f 00 4c 00 49 00 53 00 54 00 20 00 T.S._.L.I.S.T. .
3d 00 20 00 30 00 78 00 30 00 30 00 30 00 61 00 =. .0.x.0.0.0.a.
30 00 30 00 30 00 31 00 0d 00 0a 00 52 00 45 00 0.0.0.1.....R.E.
47 00 5f 00 51 00 57 00 4f 00 52 00 44 00 20 00 G._.Q.W.O.R.D. .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 20 00 3d 00 20 00 30 00 . . . . .=. .0.
78 00 30 00 30 00 30 00 62 00 30 00 30 00 30 00 x.0.0.0.b.0.0.0.
31 00 0d 00 0a 00 52 00 45 00 47 00 5f 00 51 00 1.....R.E.G._.Q.
57 00 4f 00 52 00 44 00 5f 00 4c 00 49 00 54 00 W.O.R.D._.L.I.T.
54 00 4c 00 45 00 5f 00 45 00 4e 00 44 00 49 00 T.L.E._.E.N.D.I.
41 00 4e 00 20 00 20 00 20 00 20 00 20 00 20 00 A.N. . . . . . .
20 00 20 00 3d 00 20 00 30 00 78 00 30 00 30 00 . .=. .0.x.0.0.
30 00 62 00 30 00 30 00 30 00 31 00 20 00 3b 00 0.b.0.0.0.1. .;.
20 00 73 00 61 00 6d 00 65 00 20 00 61 00 73 00 .s.a.m.e. .a.s.
20 00 52 00 45 00 47 00 5f 00 51 00 57 00 4f 00 .R.E.G._.Q.W.O.
52 00 44 00 0d 00 0a 00 0d 00 0a 00 5b 00 44 00 R.D.........[.D.
65 00 66 00 61 00 75 00 6c 00 74 00 49 00 6e 00 e.f.a.u.l.t.I.n.
73 00 74 00 61 00 6c 00 6c 00 2e 00 4e 00 54 00 s.t.a.l.l...N.T.
5d 00 0d 00 0a 00 3b 00 41 00 64 00 64 00 52 00 ].....;.A.d.d.R.
65 00 67 00 20 00 3d 00 20 00 41 00 64 00 64 00 e.g. .=. .A.d.d.
52 00 65 00 67 00 2e 00 48 00 4b 00 55 00 2c 00 R.e.g...H.K.U.,.
41 00 64 00 64 00 52 00 65 00 67 00 2e 00 48 00 A.d.d.R.e.g...H.
4b 00 4c 00 4d 00 3b 00 41 00 64 00 64 00 52 00 K.L.M.;.A.d.d.R.
65 00 67 00 2e 00 48 00 4b 00 43 00 55 00 2c 00 e.g...H.K.C.U.,.
41 00 64 00 64 00 52 00 65 00 67 00 2e 00 48 00 A.d.d.R.e.g...H.
4b 00 43 00 52 00 0d 00 0a 00 00 00 25 00 6c 00 K.C.R.......%.l.
73 00 28 00 29 00 20 00 72 00 65 00 74 00 75 00 s.(.). .r.e.t.u.
72 00 6e 00 65 00 64 00 20 00 65 00 72 00 72 00 r.n.e.d. .e.r.r.
6f 00 72 00 20 00 25 00 6c 00 75 00 0a 00 00 00 o.r. .%.l.u.....
47 00 65 00 74 00 43 00 6f 00 6d 00 70 00 75 00 G.e.t.C.o.m.p.u.
74 00 65 00 72 00 4e 00 61 00 6d 00 65 00 00 00 t.e.r.N.a.m.e...
25 00 6c 00 73 00 28 00 29 00 20 00 72 00 65 00 %.l.s.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 65 00 t.u.r.n.e.d. .e.
72 00 72 00 6f 00 72 00 20 00 25 00 6c 00 75 00 r.r.o.r. .%.l.u.
3a 00 20 00 73 00 74 00 61 00 6e 00 64 00 61 00 :. .s.t.a.n.d.a.
72 00 64 00 20 00 6f 00 75 00 74 00 70 00 75 00 r.d. .o.u.t.p.u.
74 00 20 00 69 00 73 00 20 00 6e 00 6f 00 74 00 t. .i.s. .n.o.t.
20 00 72 00 65 00 64 00 69 00 72 00 65 00 63 00 .r.e.d.i.r.e.c.
74 00 65 00 64 00 20 00 74 00 6f 00 20 00 61 00 t.e.d. .t.o. .a.
20 00 66 00 69 00 6c 00 65 00 21 00 0a 00 00 00 .f.i.l.e.!.....
46 00 6c 00 75 00 73 00 68 00 46 00 69 00 6c 00 F.l.u.s.h.F.i.l.
65 00 42 00 75 00 66 00 66 00 65 00 72 00 73 00 e.B.u.f.f.e.r.s.
00 00 00 00 47 00 65 00 74 00 53 00 74 00 64 00 ....G.e.t.S.t.d.
48 00 61 00 6e 00 64 00 6c 00 65 00 00 00 00 00 H.a.n.d.l.e.....
4e 00 6f 00 20 00 61 00 72 00 67 00 75 00 6d 00 N.o. .a.r.g.u.m.
65 00 6e 00 74 00 73 00 3a 00 20 00 61 00 74 00 e.n.t.s.:. .a.t.
20 00 6c 00 65 00 61 00 73 00 74 00 20 00 6f 00 .l.e.a.s.t. .o.
6e 00 65 00 20 00 70 00 72 00 65 00 64 00 65 00 n.e. .p.r.e.d.e.
66 00 69 00 6e 00 65 00 64 00 20 00 72 00 65 00 f.i.n.e.d. .r.e.
67 00 69 00 73 00 74 00 72 00 79 00 20 00 6b 00 g.i.s.t.r.y. .k.
65 00 79 00 20 00 6e 00 61 00 6d 00 65 00 20 00 e.y. .n.a.m.e. .
6d 00 75 00 73 00 74 00 20 00 62 00 65 00 20 00 m.u.s.t. .b.e. .
67 00 69 00 76 00 65 00 6e 00 21 00 0a 00 00 00 g.i.v.e.n.!.....
43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 4c 00 C.o.m.m.a.n.d.L.
69 00 6e 00 65 00 54 00 6f 00 41 00 72 00 67 00 i.n.e.T.o.A.r.g.
76 00 00 00 3c 00 75 00 6e 00 6b 00 6e 00 6f 00 v...<.u.n.k.n.o.
77 00 6e 00 3e 00 00 00 9c ba 14 00 00 00 00 00 w.n.>...........
00 00 00 00 66 bb 14 00 00 a0 14 00 b8 ba 14 00 ....f...........
00 00 00 00 00 00 00 00 36 bc 14 00 1c a0 14 00 ........6.......
ec ba 14 00 00 00 00 00 00 00 00 00 5a bc 14 00 ............Z...
50 a0 14 00 f4 ba 14 00 00 00 00 00 00 00 00 00 P...............
74 bc 14 00 58 a0 14 00 00 00 00 00 00 00 00 00 t...X...........
00 00 00 00 00 00 00 00 00 00 00 00 0a bb 14 00 ................
1a bb 14 00 2a bb 14 00 3a bb 14 00 52 bb 14 00 ....*...:...R...
fc ba 14 00 00 00 00 00 74 bb 14 00 84 bb 14 00 ........t.......
90 bb 14 00 a0 bb 14 00 ae bb 14 00 ba bb 14 00 ................
c8 bb 14 00 d8 bb 14 00 ec bb 14 00 00 bc 14 00 ................
12 bc 14 00 22 bc 14 00 00 00 00 00 44 bc 14 00 ....".......D...
00 00 00 00 66 bc 14 00 00 00 00 00 30 02 52 65 ....f.......0.Re
67 43 6c 6f 73 65 4b 65 79 00 4f 02 52 65 67 45 gCloseKey.O.RegE
6e 75 6d 4b 65 79 45 78 57 00 52 02 52 65 67 45 numKeyExW.R.RegE
6e 75 6d 56 61 6c 75 65 57 00 61 02 52 65 67 4f numValueW.a.RegO
70 65 6e 4b 65 79 45 78 57 00 1f 00 41 64 6a 75 penKeyExW...Adju
73 74 54 6f 6b 65 6e 50 72 69 76 69 6c 65 67 65 stTokenPrivilege
73 00 f7 01 4f 70 65 6e 50 72 6f 63 65 73 73 54 s...OpenProcessT
6f 6b 65 6e 00 00 41 44 56 41 50 49 33 32 2e 64 oken..ADVAPI32.d
6c 6c 00 00 24 05 57 72 69 74 65 43 6f 6e 73 6f ll..$.WriteConso
6c 65 57 00 25 05 57 72 69 74 65 46 69 6c 65 00 leW.%.WriteFile.
02 02 47 65 74 4c 61 73 74 45 72 72 6f 72 00 00 ..GetLastError..
19 01 45 78 69 74 50 72 6f 63 65 73 73 00 48 03 ..ExitProcess.H.
4c 6f 63 61 6c 46 72 65 65 00 52 00 43 6c 6f 73 LocalFree.R.Clos
65 48 61 6e 64 6c 65 00 77 02 47 65 74 53 79 73 eHandle.w.GetSys
74 65 6d 54 69 6d 65 00 8f 01 47 65 74 43 6f 6d temTime...GetCom
70 75 74 65 72 4e 61 6d 65 57 00 00 57 01 46 6c puterNameW..W.Fl
75 73 68 46 69 6c 65 42 75 66 66 65 72 73 00 00 ushFileBuffers..
87 01 47 65 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 ..GetCommandLine
57 00 64 02 47 65 74 53 74 64 48 61 6e 64 6c 65 W.d.GetStdHandle
00 00 c0 01 47 65 74 43 75 72 72 65 6e 74 50 72 ....GetCurrentPr
6f 63 65 73 73 00 4b 45 52 4e 45 4c 33 32 2e 64 ocess.KERNEL32.d
6c 6c 00 00 06 00 43 6f 6d 6d 61 6e 64 4c 69 6e ll....CommandLin
65 54 6f 41 72 67 76 57 00 00 53 48 45 4c 4c 33 eToArgvW..SHELL3
32 2e 64 6c 6c 00 35 03 77 76 73 70 72 69 6e 74 2.dll.5.wvsprint
66 57 00 00 55 53 45 52 33 32 2e 64 6c 6c 00 00 fW..USER32.dll..
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file REGISTRY.TXT
created in
step 3. to recreate the console application
Registry INF Dumper:
CERTUTIL.EXE /DecodeHex /V REGISTRY.TXT REGISTRY.COM
Input Length = 47872 Output Length = 11264 CertUtil: -decodehex command completed successfully.
portable executableimage files, i.e. applications and DLLs, print their metadata and information representable as text in UTF-16LE encoding on
standard output(which must be redirected to a file or piped into an application that reads from
standard input, like Clip or More).
RESOURCE.COM ‹image file name› >‹output file name› RESOURCE.COM ‹image file name› | MORE.COMNote: the image file is located via DLL search order!
Note: due to the design and implementation of
Windows’ (classic alias legacy) console, the
Win32 function
WriteConsole()
can only write to a console, not to a file nor a pipe, i.e.
redirection of standard error
is not supported!
The MSDN article Console Handles provides background information.
canonicalvariant uses the Win32 function
LoadLibraryEx()
to load an arbitrary portable executablemodule into memory, then either the functions
EnumResourceTypes()
,
EnumResourceNames()
and
EnumResourceLanguages()
or the functions
EnumResourceTypesEx()
,
EnumResourceNamesEx()
and
EnumResourceLanguagesEx()
to enumerate all
resources,
followed by
FindResourceEx()
,
SizeofResource()
,
LoadResource()
and
LockResource()
to provide access to them, and finally
FreeLibrary()
to unload the module.
EnumResTypeProc()
EnumResNameProc()
EnumResLangProc()
FreeResource()
customvariant uses the Win32 functions
CreateFile()
,
CreateFileMapping()
and
MapViewOfFile()
to open an arbitrary file for reading and map it into memory,
accesses the structures IMAGE_DOS_HEADER
,
IMAGE_FILE_HEADER
,
IMAGE_NT_HEADERS
,
IMAGE_OPTIONAL_HEADER
plus
IMAGE_SECTION_HEADER
which describe portable executableimage files to locate the
.rsrc
section, then calls its customfunction
Resource()
to enumerate and access all
resources;
finally it uses the Win32 functions
UnmapViewOfFile()
and
CloseHandle()
to unmap the file from memory and close it.
The
MSDN articles
PE Format,
Peering Inside the PE: A Tour of the Win32 Portable Executable File Format,
An In-Depth Look into the Win32 Portable Executable File Format
and
An In-Depth Look into the Win32 Portable Executable File Format, Part 2
document and explain the layout and the structures of
portable executable
image files.
Create the text file RESOURCE.C
with the following
content in an arbitrary, preferable empty directory:
// Copyright © 2004-2023, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <shellapi.h>
#define memcpy __movsb
#define wmemcpy __movsw
#ifndef MESSAGE_RESOURCE_ANSI
#define MESSAGE_RESOURCE_ANSI 0
#endif
#ifndef RT_MENUEX
#define RT_MENUEX MAKEINTRESOURCE(13)
#endif
#ifndef RT_NAMETABLE
#define RT_NAMETABLE MAKEINTRESOURCE(15)
#endif
#ifndef RT_DIALOGEX
#define RT_DIALOGEX MAKEINTRESOURCE(18)
#endif
#ifndef RT_DLGINIT
#define RT_DLGINIT MAKEINTRESOURCE(240)
#endif
#ifndef RT_TOOLBAR
#define RT_TOOLBAR MAKEINTRESOURCE(241)
#endif
#ifndef RT_LOCALE
#define RT_LOCALE MAKEINTRESOURCE(255)
#endif
#define VS_BINARY 0U
#define VS_TEXT 1U
typedef struct _VS_VERSIONINFO
{
WORD wSize; // size of 'VERSION' resource
WORD wCount; // = sizeof(VS_FIXEDFILEINFO)
// (number of bytes in binary value)
WORD wType; // = VS_BINARY
WCHAR szKey[16]; // = L"VS_VERSION_INFO"
WORD wPadding; // = 0 (alignment to DWORD)
VS_FIXEDFILEINFO vsFFI;
} VS_VERSIONINFO;
typedef struct _MUI_RESOURCE
{
DWORD dwSignature; // = 0xFECDFECD
DWORD dwSize; // size of "MUI" resource configuration data
DWORD dwVersion; // = 0x00010000
DWORD dwUnknown;
DWORD dwFileType; // = 0x00000011: LN, language-neutral main file
// = 0x00000012: MUI, language-specific satellite file
DWORD dwSystemAttributes;
DWORD dwFallbackLocation; // = 0x00000000: none
// = 0x00000001: internal
// = 0x00000002: external
BYTE bServiceChecksum[16];
BYTE bMainChecksum[16];
DWORD dwReserved[6];
DWORD dwTypeNameMainOffset; // offset and size of named resource types
DWORD dwTypeNameMainSize; // in main file (MULTI_SZ list)
DWORD dwTypeIDMainOffset; // offset and size of unnamed resource types
DWORD dwTypeIDMainSize; // in main file (DWORD array)
DWORD dwTypeNameMUIOffset; // offset and size of named resource types
DWORD dwTypeNameMUISize; // in satellite file (MULTI_SZ list)
DWORD dwTypeIDMUIOffset; // offset and size of unnamed resource types
DWORD dwTypeIDMUISize; // in satellite file (DWORD array)
DWORD dwLanguageNameOffset; // offset and size of language string
DWORD dwLanguageNameSize;
DWORD dwFallbackNameOffset; // offset and size of (ultimate) fallback
DWORD dwFallbackNameSize; // language string
DWORD dwPadding;
// DWORD dwData[0];
} MUI_RESOURCE;
#define MUI_RESOURCE_SIGNATURE 0xFECDFECDUL
#define MUI_RESOURCE_FILETYPE_MAIN 0x00000011UL
#define MUI_RESOURCE_FILETYPE_SATELLITE 0x00000012UL
#define MUI_RESOURCE_FALLBACK_NONE 0x00000000UL
#define MUI_RESOURCE_FALLBACK_INTERNAL 0x00000001UL
#define MUI_RESOURCE_FALLBACK_EXTERNAL 0x00000002UL
__declspec(safebuffers)
BOOL PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
DWORD dwBuffer;
DWORD dwConsole;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
if (!WriteConsole(hConsole, szBuffer, dwBuffer, &dwConsole, NULL))
return FALSE;
return dwConsole == dwBuffer;
}
__declspec(safebuffers)
BOOL PrintFormat(HANDLE hFile, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
LPBYTE lpBuffer = (LPBYTE) szBuffer;
DWORD dwBuffer;
DWORD dwFile;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
dwBuffer *= sizeof(*szBuffer);
do
{
if (!WriteFile(hFile, lpBuffer, dwBuffer, &dwFile, (LPOVERLAPPED) NULL))
return FALSE;
lpBuffer += dwFile;
dwBuffer -= dwFile;
} while (dwBuffer > 0);
return TRUE;
}
#define PrintString(HANDLE, LITERAL) PrintDirect(HANDLE, LITERAL, sizeof(LITERAL) / sizeof(*LITERAL) - 1UL)
__inline
BOOL WINAPI PrintDirect(HANDLE hFile, LPCWSTR lpString, DWORD dwString)
{
DWORD dwFile;
dwString *= sizeof(*lpString);
do
{
if (!WriteFile(hFile, lpString, dwString, &dwFile, (LPOVERLAPPED) NULL))
return FALSE;
lpString = (LPCWSTR) ((LPBYTE) lpString + dwFile);
dwString -= dwFile;
} while (dwString > 0);
return TRUE;
}
const LPCWSTR szDayOfWeek[7] = {L"Sunday",
L"Monday",
L"Tuesday",
L"Wednesday",
L"Thursday",
L"Friday",
L"Saturday"};
const LPCWSTR szFileOSHigh[] = {L"Unknown", // VOS_UNKNOWN
L"MS-DOS", // VOS_DOS
L"OS/2 (16-bit)", // VOS_OS216
L"OS/2 (32-bit)", // VOS_OS232
L"Windows NT", // VOS_NT
L"Windows CE"}; // VOS_WINCE
const LPCWSTR szFileOSLow[] = {L"Base", // VOS__BASE
L"Windows (16-bit)", // VOS__WINDOWS16
L"Presentation Manager (16-bit)", // VOS__PM16
L"Presentation Manager (32-bit)", // VOS__PM32
L"Windows (32-bit)"}; // VOS__WINDOWS32
const LPCWSTR szFileType[] = {L"Unknown", // VFT_UNKNOWN
L"Application", // VFT_APP
L"DLL", // VFT_DLL
L"Driver", // VFT_DRV
L"Font", // VFT_FONT
L"Virtual Device", // VFT_VXD
L"Undefined",
L"Static Library"}; // VFT_STATIC_LIB
const LPCWSTR szFileDriverType[] = {L"Unknown", // VFT2_UNKNOWN
L"Printer", // VFT2_DRV_PRINTER
L"Keyboard", // VFT2_DRV_KEYBOARD
L"Language", // VFT2_DRV_LANGUAGE
L"Display", // VFT2_DRV_DISPLAY
L"Mouse", // VFT2_DRV_MOUSE
L"Network", // VFT2_DRV_NETWORK
L"System", // VFT2_DRV_SYSTEM
L"Installable", // VFT2_DRV_INSTALLABLE
L"Sound", // VFT2_DRV_SOUND
L"Communications", // VFT2_DRV_COMM
L"Input Method", // VFT2_DRV_INPUTMETHOD
L"Versioned Printer"}; // VFT2_DRV_VERSIONED_PRINTER
const LPCWSTR szFileFontType[] = {L"Unknown", // VFT2_UNKNOWN
L"Raster", // VFT2_FONT_RASTER
L"Vector", // VFT2_FONT_VECTOR
L"TrueType"}; // VFT2_FONT_TRUETYPE
__inline
LPCWSTR WINAPI MUIFileType(DWORD dwFileType)
{
switch (dwFileType)
{
case MUI_RESOURCE_FILETYPE_MAIN:
return L"LN: language-neutral main file";
case MUI_RESOURCE_FILETYPE_SATELLITE:
return L"MUI: language-specific satellite file";
default:
return NULL;
}
}
__inline
LPCWSTR WINAPI MUIFallbackLocation(DWORD dwFallbackLocation)
{
switch (dwFallbackLocation)
{
case MUI_RESOURCE_FALLBACK_NONE:
return L"none";
case MUI_RESOURCE_FALLBACK_INTERNAL:
return L"internal";
case MUI_RESOURCE_FALLBACK_EXTERNAL:
return L"external";
default:
return NULL;
}
}
LPCWSTR WINAPI ResourceTypeName(WORD wResType)
{
switch (wResType)
{
case RT_CURSOR: // MAKEINTRESOURCE(1)
return L"RT_CURSOR";
case RT_BITMAP: // MAKEINTRESOURCE(2)
return L"RT_BITMAP";
case RT_ICON: // MAKEINTRESOURCE(3)
return L"RT_ICON";
case RT_MENU: // MAKEINTRESOURCE(4)
return L"RT_MENU";
case RT_DIALOG: // MAKEINTRESOURCE(5)
return L"RT_DIALOG";
case RT_STRING: // MAKEINTRESOURCE(6)
#if 1
return L"RT_STRING";
#else
return L"RT_STRINGTABLE";
#endif
case RT_FONTDIR: // MAKEINTRESOURCE(7)
return L"RT_FONTDIR";
case RT_FONT: // MAKEINTRESOURCE(8)
return L"RT_FONT";
case RT_ACCELERATOR: // MAKEINTRESOURCE(9)
return L"RT_ACCELERATOR";
case RT_RCDATA: // MAKEINTRESOURCE(10)
return L"RT_RCDATA";
case RT_MESSAGETABLE: // MAKEINTRESOURCE(11)
return L"RT_MESSAGETABLE";
case RT_GROUP_CURSOR: // MAKEINTRESOURCE(12)
return L"RT_GROUP_CURSOR";
case RT_MENUEX: // MAKEINTRESOURCE(13)
return L"RT_MENUEX";
case RT_GROUP_ICON: // MAKEINTRESOURCE(14)
return L"RT_GROUP_ICON";
case RT_NAMETABLE: // MAKEINTRESOURCE(15)
return L"RT_NAMETABLE";
case RT_VERSION: // MAKEINTRESOURCE(16)
return L"RT_VERSION";
case RT_DLGINCLUDE: // MAKEINTRESOURCE(17)
return L"RT_DLGINCLUDE";
case RT_DIALOGEX: // MAKEINTRESOURCE(18)
return L"RT_DIALOGEX";
case RT_PLUGPLAY: // MAKEINTRESOURCE(19)
return L"RT_PLUGPLAY";
case RT_VXD: // MAKEINTRESOURCE(20)
return L"RT_VXD";
case RT_ANICURSOR: // MAKEINTRESOURCE(21)
return L"RT_ANICURSOR";
case RT_ANIICON: // MAKEINTRESOURCE(22)
return L"RT_ANIICON";
case RT_HTML: // MAKEINTRESOURCE(23)
return L"RT_HTML";
case RT_MANIFEST: // MAKEINTRESOURCE(24)
return L"RT_MANIFEST";
case RT_DLGINIT: // MAKEINTRESOURCE(240)
return L"RT_DLGINIT";
case RT_TOOLBAR: // MAKEINTRESOURCE(241)
return L"RT_TOOLBAR";
case RT_LOCALE: // MAKEINTRESOURCE(255)
return L"RT_LOCALE";
default:
return NULL;
}
}
__declspec(safebuffers)
BOOL WINAPI EnumResLangProc(HMODULE hModule,
LPCWSTR lpType,
LPCWSTR lpName,
WORD wIDLanguage,
LPARAM lParam)
{
BOOL bOutput;
HANDLE hOutput = ((HANDLE *) lParam)[1];
HANDLE hConsole = ((HANDLE *) lParam)[2];
HRSRC hResInfo; // address of an IMAGE_RESOURCE_DATA_ENTRY structure
HGLOBAL hResData;
DWORD dwResource;
LPVOID lpResource;
LPCWSTR lpUnicode;
DWORD dwUnicode;
DWORD dwBlock;
DWORD dwEntry;
WCHAR szLanguage[123];
#ifdef LOCALE
WCHAR szCountry[123];
#endif
WCHAR szFileFlags[sizeof(", Debug, Inferred, Patched, Pre-Release, Private Build, Special Build")];
LPWSTR lpFileFlags;
LPCWSTR lpFileOSLow, lpFileOSHigh;
LPCWSTR lpFileType, lpFileSubtype;
LPCWSTR lpValue;
DWORD dwValue;
DWORD dwSize;
DWORD dwKey;
DWORD dw;
LPVOID lp;
FILETIME ft;
SYSTEMTIME st;
VS_VERSIONINFO *lpVersionInfo;
MUI_RESOURCE *lpMUI;
MESSAGE_RESOURCE_DATA *lpTable;
MESSAGE_RESOURCE_BLOCK *lpBlock;
MESSAGE_RESOURCE_ENTRY *lpEntry;
hResInfo = FindResourceEx(hModule, lpType, lpName, wIDLanguage);
if (hResInfo == NULL)
PrintConsole(hConsole,
L"FindResourceEx() returned error %lu\n",
GetLastError());
else
{
#ifdef LOCALE
if (wIDLanguage == 0)
bOutput = PrintString(hOutput,
L"\t\tLanguageID: 0 = 0x0000 ; Neutral\r\n");
else
if ((GetLocaleInfo(MAKELCID(wIDLanguage, SORT_DEFAULT), LOCALE_SENGLANGUAGE, szLanguage, sizeof(szLanguage) / sizeof(*szLanguage)) == 0)
|| (GetLocaleInfo(MAKELCID(wIDLanguage, SORT_DEFAULT), LOCALE_SENGCOUNTRY, szCountry, sizeof(szCountry) / sizeof(*szCountry)) == 0))
{
PrintConsole(hConsole,
L"GetLocaleInfo() returned error %lu\n",
GetLastError());
bOutput = PrintFormat(hOutput,
L"\t\tLanguageID: %hu = 0x%04hX\r\n",
wIDLanguage, wIDLanguage);
}
else
bOutput = PrintFormat(hOutput,
L"\t\tLanguageID: %hu = 0x%04hX ; %ls, %ls\r\n",
wIDLanguage, wIDLanguage, szLanguage, szCountry);
#else
if (VerLanguageName(wIDLanguage, szLanguage, sizeof(szLanguage) / sizeof(*szLanguage)) == 0)
{
PrintConsole(hConsole,
L"VerLanguageName() returned 0\n");
bOutput = PrintFormat(hOutput,
L"\t\tLanguageID: %hu = 0x%04hX\r\n",
wIDLanguage, wIDLanguage);
}
else
bOutput = PrintFormat(hOutput,
L"\t\tLanguageID: %hu = 0x%04hX ; %ls\r\n",
wIDLanguage, wIDLanguage, szLanguage);
#endif
dwResource = SizeofResource(hModule, hResInfo);
if (dwResource == 0)
PrintConsole(hConsole,
L"SizeofResource() returned error %lu\n",
GetLastError());
bOutput &= PrintFormat(hOutput,
L"\t\t\tInfo Handle = 0x%p: Length = %lu\r\n",
hResInfo, dwResource);
hResData = LoadResource(hModule, hResInfo);
if (hResData == NULL)
PrintConsole(hConsole,
L"LoadResource() returned error %lu\n",
GetLastError());
else
{
lpResource = LockResource(hResData);
if (lpResource == NULL)
PrintConsole(hConsole,
L"LockResource() returned NULL\n");
else
{
bOutput &= PrintFormat(hOutput,
L"\t\t\tData Handle = 0x%p: Offset = 0x%08lX\r\n",
hResData,
(DWORD) ((BYTE *) lpResource - (BYTE *) hModule) + ((DWORD) ((BYTE *) lpResource - (BYTE *) hModule) & 1));
if (IS_INTRESOURCE(lpType))
switch ((WORD) lpType)
{
case RT_STRING:
// NOTE: every RT_STRING resource, a STRINGTABLE, holds 16 UNICODE strings
// IMAGE_RESOURCE_DIR_STRING_U of up to 65535 characters each, which
// need not be L'\0' terminated and may contain L'\0', with their
// character count (including the terminating L'\0' if present)
// stored in front of them.
for (lpUnicode = lpResource,
dwUnicode = 16; dwUnicode > 0; dwUnicode--,
lpUnicode += 1 + lpUnicode[0])
{
dw = lpUnicode[0];
if (dw == 0)
continue;
bOutput &= PrintFormat(hOutput,
L"\t\t\t%6lu:\tLength = %lu\r\n"
L"\t\t\t\tString = ",
IS_INTRESOURCE(lpName) ? (WORD) lpName * 16 - dwUnicode : 16 - dwUnicode, dw);
while (lpUnicode[dw] == L'\0')
dw--;
bOutput &= PrintDirect(hOutput, lpUnicode + 1, dw);
bOutput &= PrintString(hOutput, L"\r\n");
}
break;
case RT_MESSAGETABLE:
for (lpTable = lpResource,
lpBlock = lpTable->Blocks,
dwBlock = 0; dwBlock < lpTable->NumberOfBlocks; dwBlock++)
{
if (lpBlock[dwBlock].LowId == lpBlock[dwBlock].HighId)
bOutput &= PrintFormat(hOutput,
L"\t\t\t%6lu:\tMessage ID 0x%08lX\r\n",
dwBlock, lpBlock[dwBlock].LowId);
else
bOutput &= PrintFormat(hOutput,
L"\t\t\t%6lu:\tMessage IDs 0x%08lX to 0x%08lX\r\n",
dwBlock, lpBlock[dwBlock].LowId, lpBlock[dwBlock].HighId);
for (lpEntry = (MESSAGE_RESOURCE_ENTRY *) ((BYTE *) lpTable + lpBlock[dwBlock].OffsetToEntries),
dwEntry = lpBlock[dwBlock].LowId; dwEntry <= lpBlock[dwBlock].HighId; dwEntry++,
lpEntry = (MESSAGE_RESOURCE_ENTRY *) ((BYTE *) lpEntry + lpEntry->Length))
if (lpEntry->Flags == MESSAGE_RESOURCE_UNICODE)
bOutput &= PrintFormat(hOutput,
L"\t\t\t\t0x%08lX:\tSize = %hu\r\n"
L"\t\t\t\t\t\tText = %.999ls\r\n",
dwEntry, lpEntry->Length, lpEntry->Text);
else if (lpEntry->Flags == MESSAGE_RESOURCE_ANSI)
bOutput &= PrintFormat(hOutput,
L"\t\t\t\t0x%08lX:\tSize = %hu\r\n"
L"\t\t\t\t\t\tText = %.999hs\r\n",
dwEntry, lpEntry->Length, lpEntry->Text);
else
PrintConsole(hConsole,
L"Text type %hu of message 0x%08lX neither UNICODE nor ANSI!\n",
lpEntry->Flags, dwEntry);
}
break;
case RT_VERSION:
lpVersionInfo = lpResource;
if (lpVersionInfo->wSize != dwResource)
PrintConsole(hConsole,
L"Size %hu in \'VERSIONINFO\' differs from size of \'VERSION\' resource!\n",
lpVersionInfo->wSize);
if (lpVersionInfo->wCount != sizeof(VS_FIXEDFILEINFO))
PrintConsole(hConsole,
L"Size %hu of value in \'VERSIONINFO\' differs from size %lu of \'VS_FIXEDFILEINFO\'!\n",
lpVersionInfo->wCount, sizeof(VS_FIXEDFILEINFO));
if (lpVersionInfo->wType != VS_BINARY)
PrintConsole(hConsole,
L"Type %hu of value in \'VERSIONINFO\' not \'VS_BINARY\'!\n",
lpVersionInfo->wType);
if (wcscmp(lpVersionInfo->szKey, L"VS_VERSION_INFO") != 0)
PrintConsole(hConsole,
L"Key string \"%ls\" in \'VERSIONINFO\' not \"VS_VERSION_INFO\"!\n",
lpVersionInfo->szKey);
if (lpVersionInfo->wPadding != 0)
PrintConsole(hConsole,
L"Padding %hu in \'VERSIONINFO\' not 0!\n",
lpVersionInfo->wPadding);
if (lpVersionInfo->vsFFI.dwSignature != VS_FFI_SIGNATURE)
PrintConsole(hConsole,
L"Signature 0x%08lX in \'FIXEDFILEINFO\' not 0x%08lX!\n",
lpVersionInfo->vsFFI.dwSignature, VS_FFI_SIGNATURE);
if (lpVersionInfo->vsFFI.dwStrucVersion != VS_FFI_STRUCVERSION)
PrintConsole(hConsole,
L"Structure version 0x%08lX in \'FIXEDFILEINFO\' not 0x%08lX!\n",
lpVersionInfo->vsFFI.dwStrucVersion, VS_FFI_STRUCVERSION);
if ((lpVersionInfo->vsFFI.dwFileFlags & lpVersionInfo->vsFFI.dwFileFlagsMask) == 0)
#ifdef _CRT_SECURE_NO_WARNINGS
wcscpy(szFileFlags, L", None");
#elif 0
wmemcpy(szFileFlags, L", None", sizeof(", None"));
#else
memcpy(szFileFlags, L", None", sizeof(L", None"));
#endif
else
{
#ifdef _CRT_SECURE_NO_WARNINGS
*szFileFlags = L'\0';
if ((lpVersionInfo->vsFFI.dwFileFlags & VS_FF_DEBUG) == VS_FF_DEBUG)
wcscat(szFileFlags, L", Debug");
if ((lpVersionInfo->vsFFI.dwFileFlags & VS_FF_INFOINFERRED) == VS_FF_INFOINFERRED)
wcscat(szFileFlags, L", Inferred");
if ((lpVersionInfo->vsFFI.dwFileFlags & VS_FF_PATCHED) == VS_FF_PATCHED)
wcscat(szFileFlags, L", Patched");
if ((lpVersionInfo->vsFFI.dwFileFlags & VS_FF_PRERELEASE) == VS_FF_PRERELEASE)
wcscat(szFileFlags, L", Pre-Release");
if ((lpVersionInfo->vsFFI.dwFileFlags & VS_FF_PRIVATEBUILD) == VS_FF_PRIVATEBUILD)
wcscat(szFileFlags, L", Private Build");
if ((lpVersionInfo->vsFFI.dwFileFlags & VS_FF_SPECIALBUILD) == VS_FF_SPECIALBUILD)
wcscat(szFileFlags, L", Special Build");
#else
lpFileFlags = szFileFlags;
if ((lpVersionInfo->vsFFI.dwFileFlags & VS_FF_DEBUG) == VS_FF_DEBUG)
{
memcpy(lpFileFlags, L", Debug", sizeof(L", Debug"));
lpFileFlags += sizeof(" Debug");
}
if ((lpVersionInfo->vsFFI.dwFileFlags & VS_FF_INFOINFERRED) == VS_FF_INFOINFERRED)
{
memcpy(lpFileFlags, L", Inferred", sizeof(L", Inferred"));
lpFileFlags += sizeof(" Inferred");
}
if ((lpVersionInfo->vsFFI.dwFileFlags & VS_FF_PATCHED) == VS_FF_PATCHED)
{
memcpy(lpFileFlags, L", Patched", sizeof(L", Patched"));
lpFileFlags += sizeof(" Patched");
}
if ((lpVersionInfo->vsFFI.dwFileFlags & VS_FF_PRERELEASE) == VS_FF_PRERELEASE)
{
memcpy(lpFileFlags, L", Pre-Release", sizeof(L", Pre-Release"));
lpFileFlags += sizeof(" Pre-Release");
}
if ((lpVersionInfo->vsFFI.dwFileFlags & VS_FF_PRIVATEBUILD) == VS_FF_PRIVATEBUILD)
{
memcpy(lpFileFlags, L", Private Build", sizeof(L", Private Build"));
lpFileFlags += sizeof(" Private Build");
}
if ((lpVersionInfo->vsFFI.dwFileFlags & VS_FF_SPECIALBUILD) == VS_FF_SPECIALBUILD)
{
memcpy(lpFileFlags, L", Special Build", sizeof(L", Special Build"));
lpFileFlags += sizeof(" Special Build");
}
#endif
}
if (lpVersionInfo->vsFFI.dwFileType < sizeof(szFileType) / sizeof(*szFileType))
lpFileType = szFileType[lpVersionInfo->vsFFI.dwFileType];
else
lpFileType = L"Undefined";
if ((lpVersionInfo->vsFFI.dwFileType == VFT_DRV)
&& (lpVersionInfo->vsFFI.dwFileSubtype < sizeof(szFileDriverType) / sizeof(*szFileDriverType)))
lpFileSubtype = szFileDriverType[lpVersionInfo->vsFFI.dwFileSubtype];
else if ((lpVersionInfo->vsFFI.dwFileType == VFT_FONT)
&& (lpVersionInfo->vsFFI.dwFileSubtype < sizeof(szFileFontType) / sizeof(*szFileFontType)))
lpFileSubtype = szFileFontType[lpVersionInfo->vsFFI.dwFileSubtype];
else
lpFileSubtype = L"Undefined";
if (HIWORD(lpVersionInfo->vsFFI.dwFileOS) < sizeof(szFileOSHigh) / sizeof(*szFileOSHigh))
lpFileOSHigh = szFileOSHigh[HIWORD(lpVersionInfo->vsFFI.dwFileOS)];
else
lpFileOSHigh = L"Undefined";
if (LOWORD(lpVersionInfo->vsFFI.dwFileOS) < sizeof(szFileOSLow) / sizeof(*szFileOSLow))
lpFileOSLow = szFileOSLow[LOWORD(lpVersionInfo->vsFFI.dwFileOS)];
else
lpFileOSLow = L"Undefined";
bOutput &= PrintFormat(hOutput,
L"\t\t\tFixedFileInfo:\r\n"
L"\t\t\t\tProduct Version = %hu.%hu:%hu.%hu\r\n"
L"\t\t\t\tModule Version = %hu.%hu:%hu.%hu\r\n"
L"\t\t\t\tModule Flags = %ls\r\n"
L"\t\t\t\tModule Type = %ls\r\n"
L"\t\t\t\tModule Subtype = %ls\r\n",
HIWORD(lpVersionInfo->vsFFI.dwProductVersionMS), LOWORD(lpVersionInfo->vsFFI.dwProductVersionMS),
HIWORD(lpVersionInfo->vsFFI.dwProductVersionLS), LOWORD(lpVersionInfo->vsFFI.dwProductVersionLS),
HIWORD(lpVersionInfo->vsFFI.dwFileVersionMS), LOWORD(lpVersionInfo->vsFFI.dwFileVersionMS),
HIWORD(lpVersionInfo->vsFFI.dwFileVersionLS), LOWORD(lpVersionInfo->vsFFI.dwFileVersionLS),
szFileFlags + 2,
lpFileType,
lpFileSubtype);
if ((lpVersionInfo->vsFFI.dwFileDateMS == 0)
&& (lpVersionInfo->vsFFI.dwFileDateLS == 0))
bOutput &= PrintString(hOutput, L"\t\t\t\tModule Time Stamp = None\r\n");
else
{
ft.dwHighDateTime = lpVersionInfo->vsFFI.dwFileDateMS;
ft.dwLowDateTime = lpVersionInfo->vsFFI.dwFileDateLS;
if (!FileTimeToSystemTime(&ft, &st))
PrintConsole(hConsole,
L"FileTimeToSystemTime() returned error %lu\n",
GetLastError());
else
bOutput &= PrintFormat(hOutput,
L"\t\t\t\tModule Time Stamp = %ls, %04hu-%02hu-%02hu %02hu:%02hu:%02hu.%03hu UTC\r\n",
szDayOfWeek[st.wDayOfWeek],
st.wYear, st.wMonth, st.wDay, st.wHour, st.wMinute, st.wSecond, st.wMilliseconds);
}
bOutput &= PrintFormat(hOutput,
L"\t\t\t\tTarget OS = %ls, %ls\r\n",
lpFileOSHigh, lpFileOSLow);
for (lp = (LPBYTE) lpVersionInfo + lpVersionInfo->wSize,
lpVersionInfo += 1;
lpVersionInfo < (VS_VERSIONINFO *) lp;
lpVersionInfo = (VS_VERSIONINFO *) ((LPBYTE) lpVersionInfo + dwSize))
{
dwKey = wcslen(lpVersionInfo->szKey);
lpValue = lpVersionInfo->szKey + (dwKey + dwKey % 2 + 1);
dwSize = lpValue - (LPWSTR) lpVersionInfo;
if ((lpVersionInfo->wCount == 0)
&& (lpVersionInfo->wSize > dwSize))
bOutput &= PrintFormat(hOutput,
L"\t\t\t\t%ls:\r\n" + (dwKey != 8),
lpVersionInfo->szKey);
else
{
dwSize = lpVersionInfo->wSize + lpVersionInfo->wSize % sizeof(DWORD);
if (lpVersionInfo->wType == VS_TEXT)
bOutput &= PrintFormat(hOutput,
lpVersionInfo->wCount == 0 ? L"\t\t\t\t\t%-16ls =\r\n" : L"\t\t\t\t\t%-16ls = %ls\r\n",
lpVersionInfo->szKey, lpValue);
else
{
bOutput &= PrintFormat(hOutput,
L"\t\t\t\t%ls =",
lpVersionInfo->szKey);
for (dwValue = 0; dwValue < lpVersionInfo->wCount / 2; dwValue++)
bOutput &= PrintFormat(hOutput,
dwValue & 1 ? L":%hu" : L" 0x%04hX",
lpValue[dwValue]);
bOutput &= PrintString(hOutput, L"\r\n");
}
}
}
break;
case RT_HTML:
case RT_MANIFEST:
if (*(DWORD *) lpResource == 0xFFFE0000)
bOutput &= PrintString(hOutput, L"\t\t\tUTF-32BE\r\n");
else if (*(DWORD *) lpResource == 0x0000FEFF)
bOutput &= PrintString(hOutput, L"\t\t\tUTF-32LE\r\n");
else if (*(WORD *) lpResource == 0xFFFE)
bOutput &= PrintString(hOutput, L"\t\t\tUTF-16BE\r\n");
else if (*(WORD *) lpResource == 0xFEFF)
bOutput &= PrintFormat(hOutput,
L"\t\t\tUTF-16LE = %.999ls\r\n",
(WCHAR *) lpResource + 1);
else if ((*(DWORD *) lpResource & 0x00FFFFFF) == 0x00BFBBEF)
bOutput &= PrintFormat(hOutput,
L"\t\t\tUTF-8 = %.999hs\r\n",
(CHAR *) lpResource + 3);
else if ((*(DWORD *) lpResource == 0x2B762F2B)
|| (*(DWORD *) lpResource == 0x2F762F2B)
|| (*(DWORD *) lpResource == 0x38762F2B)
|| (*(DWORD *) lpResource == 0x39762F2B))
bOutput &= PrintString(hOutput, L"\t\t\tUTF-7\r\n");
else
bOutput &= PrintFormat(hOutput,
L"\t\t\tASCII = %.999hs\r\n",
(CHAR *) lpResource);
break;
case RT_LOCALE:
if (dwResource == sizeof(DWORD))
bOutput &= PrintFormat(hOutput,
L"\t\t\t%lu = 0x%04lX\r\n",
*(DWORD *) lpResource, *(DWORD *) lpResource);
break;
// default:
}
else
#if 0
if (wcscmp(lpType, L"MUI") == 0)
#elif 0
if (wmemcmp(lpType, L"MUI", sizeof("MUI")) == 0)
#else
if (memcmp(lpType, L"MUI", sizeof(L"MUI")) == 0)
#endif
{
lpMUI = (MUI_RESOURCE *) lpResource;
if (lpMUI->dwSignature != MUI_RESOURCE_SIGNATURE)
PrintConsole(hConsole,
L"Signature 0x%08lX of resource configuration data not 0x%08lX!\n",
lpMUI->dwSignature, MUI_RESOURCE_SIGNATURE);
else
bOutput &= PrintFormat(hOutput,
L"\t\t\tResource Configuration Data:\r\n"
L"\t\t\t\tVersion = %hu.%hu\r\n"
L"\t\t\t\tType = %lu (%ls)\r\n"
L"\t\t\t\tLanguage = %ls\r\n"
L"\t\t\t\tFallback Language = %ls\r\n"
L"\t\t\t\tFallback Location = %lu (%ls)\r\n"
L"\t\t\t\tSystem Attributes = 0x%08lX\r\n"
L"\t\t\t\tMain Checksum = %08lX %08lX %08lX %08lX\r\n"
L"\t\t\t\tService Checksum = %08lX %08lX %08lX %08lX\r\n",
HIWORD(lpMUI->dwVersion), LOWORD(lpMUI->dwVersion),
lpMUI->dwFileType, MUIFileType(lpMUI->dwFileType),
lpMUI->dwLanguageNameOffset == 0 ? NULL : (BYTE *) lpMUI + lpMUI->dwLanguageNameOffset,
lpMUI->dwFallbackNameOffset == 0 ? NULL : (BYTE *) lpMUI + lpMUI->dwFallbackNameOffset,
lpMUI->dwFallbackLocation, MUIFallbackLocation(lpMUI->dwFallbackLocation),
lpMUI->dwSystemAttributes,
_byteswap_ulong(((DWORD *) lpMUI->bMainChecksum)[0]),
_byteswap_ulong(((DWORD *) lpMUI->bMainChecksum)[1]),
_byteswap_ulong(((DWORD *) lpMUI->bMainChecksum)[2]),
_byteswap_ulong(((DWORD *) lpMUI->bMainChecksum)[3]),
_byteswap_ulong(((DWORD *) lpMUI->bServiceChecksum)[0]),
_byteswap_ulong(((DWORD *) lpMUI->bServiceChecksum)[1]),
_byteswap_ulong(((DWORD *) lpMUI->bServiceChecksum)[2]),
_byteswap_ulong(((DWORD *) lpMUI->bServiceChecksum)[3]));
}
#if 0 // OBSOLETE!
if (!UnlockResource(lpResource))
PrintConsole(hConsole,
L"UnlockResource() returned FALSE\n");
#endif
}
#if 0 // OBSOLETE!
if (!FreeResource(hResData))
PrintConsole(hConsole,
L"FreeResource() returned FALSE\n");
#endif
}
if (!bOutput)
PrintConsole(hConsole,
L"WriteFile() returned error %lu\n",
GetLastError());
}
return TRUE;
}
BOOL WINAPI EnumResNameProc(HMODULE hModule,
LPCWSTR lpType,
LPWSTR lpName,
LPARAM lParam)
{
BOOL bOutput;
HANDLE hOutput = ((HANDLE *) lParam)[1];
HANDLE hConsole = ((HANDLE *) lParam)[2];
if (IS_INTRESOURCE(lpName))
bOutput = PrintFormat(hOutput,
L"\tID: %hu\r\n",
(WORD) lpName);
else
bOutput = PrintFormat(hOutput,
L"\tName: %ls\r\n",
lpName);
if (!bOutput)
PrintConsole(hConsole,
L"WriteFile() returned error %lu\n",
GetLastError());
#ifdef NEUTRAL
if (!EnumResourceLanguagesEx(hModule,
lpType,
lpName,
EnumResLangProc,
lParam,
RESOURCE_ENUM_LN,
MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL)))
PrintConsole(hConsole,
L"EnumResourceLanguagesEx() returned error %lu\n",
GetLastError());
#else
if (!EnumResourceLanguages(hModule,
lpType,
lpName,
EnumResLangProc,
lParam))
PrintConsole(hConsole,
L"EnumResourceLanguages() returned error %lu\n",
GetLastError());
#endif
return TRUE;
}
BOOL WINAPI EnumResTypeProc(HMODULE hModule,
LPWSTR lpType,
LPARAM lParam)
{
BOOL bOutput;
HANDLE hOutput = ((HANDLE *) lParam)[1];
HANDLE hConsole = ((HANDLE *) lParam)[2];
if (IS_INTRESOURCE(lpType))
bOutput = PrintFormat(hOutput,
L"Type: %hu ; %ls\r\n",
(WORD) lpType, ResourceTypeName((WORD) lpType));
else
bOutput = PrintFormat(hOutput,
L"Name: %ls\r\n",
lpType);
if (!bOutput)
PrintConsole(hConsole,
L"WriteFile() returned error %lu\n",
GetLastError());
#ifdef NEUTRAL
if (!EnumResourceNamesEx(hModule,
lpType,
EnumResNameProc,
lParam,
RESOURCE_ENUM_LN,
MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL)))
PrintConsole(hConsole,
L"EnumResourceNamesEx() returned error %lu\n",
GetLastError());
#else
if (!EnumResourceNames(hModule,
lpType,
EnumResNameProc,
lParam))
PrintConsole(hConsole,
L"EnumResourceNames() returned error %lu\n",
GetLastError());
#endif
return TRUE;
}
__declspec(noreturn)
VOID WINAPI wmainCRTStartup(VOID)
{
HANDLE *hHandles[3];
LPWSTR *lpArguments;
INT nArguments;
DWORD dwError = ERROR_BAD_ARGUMENTS;
HMODULE hModule;
HANDLE hOutput;
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole == INVALID_HANDLE_VALUE)
dwError = GetLastError();
else
{
lpArguments = CommandLineToArgvW(GetCommandLine(), &nArguments);
if (lpArguments == NULL)
PrintConsole(hConsole,
L"CommandLineToArgv() returned error %lu\n",
dwError = GetLastError());
else
{
if (nArguments != 2)
PrintConsole(hConsole,
L"No argument: a single (absolute or relative) path name of a binary module\n"
L" (eventually located per DLL search order) must be given!\n");
else
{
hOutput = GetStdHandle(STD_OUTPUT_HANDLE);
if (hOutput == INVALID_HANDLE_VALUE)
PrintConsole(hConsole,
L"GetStdHandle() returned error %lu\n",
dwError = GetLastError());
else
{
if (!FlushFileBuffers(hOutput))
PrintConsole(hConsole,
L"FlushFileBuffers() returned error %lu: standard output is not redirected to a file!\n",
dwError = GetLastError());
else
{
hModule = LoadLibraryEx(lpArguments[1],
(HANDLE) NULL,
LOAD_LIBRARY_AS_DATAFILE);
if (hModule == NULL)
PrintConsole(hConsole,
L"LoadLibraryEx() returned error %lu\n",
dwError = GetLastError());
else
{
PrintConsole(hConsole,
L"Module \'%ls\' loaded at address 0x%p\n",
lpArguments[1], hModule);
if (!PrintFormat(hOutput,
L"\xFEFF" // UTF-16LE BOM
L"Module \'%ls\'\r\n"
L"\r\n",
lpArguments[1]))
PrintConsole(hConsole,
L"WriteFile() returned error %lu\n",
dwError = GetLastError());
hHandles[0] = NULL;
hHandles[1] = hOutput;
hHandles[2] = hConsole;
#ifdef NEUTRAL
if (!EnumResourceTypesEx(hModule,
EnumResTypeProc,
(LPARAM) hHandles,
RESOURCE_ENUM_LN,
MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL)))
PrintConsole(hConsole,
L"EnumResourceTypesEx() returned error %lu\n",
dwError = GetLastError());
#else
if (!EnumResourceTypes(hModule,
EnumResTypeProc,
(LPARAM) hHandles))
PrintConsole(hConsole,
L"EnumResourceTypes() returned error %lu\n",
dwError = GetLastError());
#endif
else
dwError = ERROR_SUCCESS;
if (!FreeLibrary(hModule))
PrintConsole(hConsole,
L"FreeLibrary() returned error %lu\n",
GetLastError());
else
PrintConsole(hConsole,
L"Module \'%ls\' unloaded\n",
lpArguments[1]);
}
}
}
}
if (LocalFree(lpArguments) != NULL)
PrintConsole(hConsole,
L"LocalFree() returned error %lu\n",
GetLastError());
}
if (!CloseHandle(hConsole))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
ExitProcess(dwError);
}
Run the following four command lines to compile the source file
RESOURCE.C
created in step 1., link the compiled
object file RESOURCE.OBJ
and cleanup afterwards:
SET CL=/DLOCALE /DNEUTRAL /GA /GF /GS /Gy /O1 /Oi /Os /Oy /W4 /Zl SET LINK=/DEFAULTLIB:KERNEL32.LIB /DEFAULTLIB:SHELL32.LIB /DEFAULTLIB:USER32.LIB /ENTRY:wmainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /OSVERSION:6.0 /RELEASE /SUBSYSTEM:CONSOLE /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /FeRESOURCE.COM RESOURCE.C ERASE RESOURCE.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. RESOURCE.C RESOURCE.C(476) : warning C4305: 'type cast' : truncation from 'LPWSTR' to 'WORD' RESOURCE.C(498) : warning C4305: 'type cast' : truncation from 'LPWSTR' to 'WORD' RESOURCE.C(751) : warning C4018: '<' : signed/unsigned mismatch RESOURCE.C(876) : warning C4305: 'type cast' : truncation from 'LPWSTR' to 'WORD' RESOURCE.C(921) : warning C4305: 'type cast' : truncation from 'LPWSTR' to 'WORD' RESOURCE.C(921) : warning C4305: 'type cast' : truncation from 'LPWSTR' to 'WORD' Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Create the text file RESOURCE.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 32 2c 20 53 74 65 66 61 6e 20 4b 61 -2023, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 02 00 56 4f 49 44 00 00 00 00 PE..L...VOID....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 10 00 00 ......#.........
00 20 00 00 00 00 00 00 af 1c 00 00 00 10 00 00 . ..............
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
06 00 00 00 00 00 2f 03 06 00 00 00 00 00 00 00 ....../.........
00 40 00 00 00 02 00 00 dc 40 00 00 03 00 00 85 .@.......@......
00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
10 3c 00 00 50 00 00 00 00 00 00 00 00 00 00 00 .<..P...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 20 00 00 64 00 00 00 ......... ..d...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
8a 0e 00 00 00 10 00 00 00 10 00 00 00 02 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 63 6f 6e 73 74 00 00 72 1e 00 00 00 20 00 00 .const..r.... ..
00 20 00 00 00 12 00 00 00 00 00 00 00 00 00 00 . ..............
00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 ....@..@........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
55 8b ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 U........V.E.P.u
0c 8d 85 f8 f7 ff ff 50 ff 15 5c 20 40 00 8b f0 .......P..\ @...
85 f6 75 04 33 c0 eb 23 6a 00 8d 45 fc 50 56 8d ..u.3..#j..E.PV.
85 f8 f7 ff ff 50 ff 75 08 ff 15 00 20 40 00 85 .....P.u.... @..
c0 74 e1 33 c0 39 75 fc 0f 94 c0 5e c9 c3 55 8b .t.3.9u....^..U.
ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 0c 8d .......V.E.P.u..
b5 f8 f7 ff ff 8b c6 50 ff 15 5c 20 40 00 85 c0 .......P..\ @...
74 25 57 8d 3c 00 6a 00 8d 45 fc 50 57 56 ff 75 t%W.<.j..E.PWV.u
08 ff 15 04 20 40 00 85 c0 74 0f 03 75 fc 2b 7d .... @...t..u.+}
fc 75 e3 33 c0 40 5f 5e c9 c3 33 c0 eb f8 55 8b .u.3.@_^..3...U.
ec 56 8b 75 10 57 8b 7d 0c 03 f6 6a 00 8d 45 10 .V.u.W.}...j..E.
50 56 57 ff 75 08 ff 15 04 20 40 00 85 c0 74 11 PVW.u.... @...t.
03 7d 10 2b 75 10 75 e3 33 c0 40 5f 5e 5d c2 0c .}.+u.u.3.@_^]..
00 33 c0 eb f6 8b 44 24 04 83 e8 11 74 0e 48 74 .3....D$....t.Ht
04 33 c0 eb 0c b8 b8 24 40 00 eb 05 b8 78 24 40 .3.....$@....x$@
00 c2 04 00 8b 44 24 04 83 e8 00 74 18 48 74 0e .....D$....t.Ht.
48 74 04 33 c0 eb 13 b8 24 25 40 00 eb 0c b8 10 Ht.3....$%@.....
25 40 00 eb 05 b8 04 25 40 00 c2 04 00 0f b7 44 %@.....%@......D
24 04 b9 f0 00 00 00 3b c1 0f 8f e4 00 00 00 0f $......;........
84 d7 00 00 00 48 83 f8 17 0f 87 e0 00 00 00 ff .....H..........
24 85 35 12 40 00 b8 90 27 40 00 e9 df 00 00 00 $.5.@...'@......
b8 7c 27 40 00 e9 d5 00 00 00 b8 6c 27 40 00 e9 .|'@.......l'@..
cb 00 00 00 b8 5c 27 40 00 e9 c1 00 00 00 b8 48 .....\'@.......H
27 40 00 e9 b7 00 00 00 b8 34 27 40 00 e9 ad 00 '@.......4'@....
00 00 b8 1c 27 40 00 e9 a3 00 00 00 b8 0c 27 40 ....'@........'@
00 e9 99 00 00 00 b8 ec 26 40 00 e9 8f 00 00 00 ........&@......
b8 d8 26 40 00 e9 85 00 00 00 b8 b8 26 40 00 eb ..&@........&@..
7e b8 98 26 40 00 eb 77 b8 84 26 40 00 eb 70 b8 ~..&@..w..&@..p.
68 26 40 00 eb 69 b8 4c 26 40 00 eb 62 b8 34 26 h&@..i.L&@..b.4&
40 00 eb 5b b8 18 26 40 00 eb 54 b8 00 26 40 00 @..[..&@..T..&@.
eb 4d b8 e8 25 40 00 eb 46 b8 d8 25 40 00 eb 3f .M..%@..F..%@..?
b8 bc 25 40 00 eb 38 b8 a4 25 40 00 eb 31 b8 94 ..%@..8..%@..1..
25 40 00 eb 2a b8 7c 25 40 00 eb 23 b8 64 25 40 %@..*.|%@..#.d%@
00 eb 1c 2d f1 00 00 00 74 10 83 e8 0e 74 04 33 ...-....t....t.3
c0 eb 0c b8 50 25 40 00 eb 05 b8 38 25 40 00 c2 ....P%@....8%@..
04 00 8d 49 00 46 11 40 00 50 11 40 00 5a 11 40 ...I.F.@.P.@.Z.@
00 64 11 40 00 6e 11 40 00 78 11 40 00 82 11 40 .d.@.n.@.x.@...@
00 8c 11 40 00 96 11 40 00 a0 11 40 00 aa 11 40 ...@...@...@...@
00 b1 11 40 00 b8 11 40 00 bf 11 40 00 c6 11 40 ...@...@...@...@
00 cd 11 40 00 d4 11 40 00 db 11 40 00 e2 11 40 ...@...@...@...@
00 e9 11 40 00 f0 11 40 00 f7 11 40 00 fe 11 40 ...@...@...@...@
00 05 12 40 00 55 8d 6c 24 9c 81 ec 04 02 00 00 ...@.U.l$.......
8b 45 7c 53 8b 58 04 56 57 ff 75 78 8b 78 08 ff .E|S.X.VW.ux.x..
75 74 89 5d 7c ff 75 70 89 7d 60 ff 75 6c ff 15 ut.]|.up.}`.ul..
20 20 40 00 8b f0 85 f6 75 17 ff 15 1c 20 40 00 @.....u.... @.
50 68 e0 37 40 00 68 ac 37 40 00 57 e9 82 08 00 Ph.7@.h.7@.W....
00 66 83 7d 78 00 75 12 6a 24 68 60 37 40 00 53 .f.}x.u.j$h`7@.S
e8 a9 fd ff ff e9 81 00 00 00 0f b7 7d 78 8b 1d ............}x..
18 20 40 00 6a 55 8d 85 60 fe ff ff 50 68 01 10 . @.jU..`...Ph..
00 00 57 ff d3 85 c0 74 37 6a 55 8d 85 0c ff ff ..W....t7jU.....
ff 50 68 02 10 00 00 57 ff d3 85 c0 74 22 8d 85 .Ph....W....t"..
0c ff ff ff 50 8d 85 60 fe ff ff 50 57 57 68 08 ....P..`...PWWh.
37 40 00 ff 75 7c e8 03 fd ff ff 83 c4 18 eb 2b 7@..u|.........+
ff 15 1c 20 40 00 50 68 e8 36 40 00 68 ac 37 40 ... @.Ph.6@.h.7@
00 ff 75 60 e8 97 fc ff ff 57 57 68 ac 36 40 00 ..u`.....WWh.6@.
ff 75 7c e8 d6 fc ff ff 83 c4 20 56 ff 75 6c 89 .u|....... V.ul.
45 78 ff 15 14 20 40 00 89 45 5c 85 c0 75 1c ff Ex... @..E\..u..
15 1c 20 40 00 50 68 8c 36 40 00 68 ac 37 40 00 .. @.Ph.6@.h.7@.
ff 75 60 e8 58 fc ff ff 83 c4 10 ff 75 5c 56 68 .u`.X.......u\Vh
40 36 40 00 ff 75 7c e8 92 fc ff ff 21 45 78 83 @6@..u|.....!Ex.
c4 10 56 ff 75 6c ff 15 10 20 40 00 8b f8 85 ff ..V.ul... @.....
75 16 ff 15 1c 20 40 00 50 68 20 36 40 00 68 ac u.... @.Ph 6@.h.
37 40 00 e9 c3 06 00 00 57 ff 15 0c 20 40 00 8b 7@......W... @..
d8 85 db 75 14 68 e4 35 40 00 ff 75 60 e8 fe fb ...u.h.5@..u`...
ff ff 59 59 e9 40 07 00 00 8b c3 2b 45 6c 83 e0 ..YY.@.....+El..
01 2b 45 6c 03 c3 50 57 68 90 35 40 00 ff 75 7c .+El..PWh.5@..u|
e8 29 fc ff ff 21 45 78 bf 00 00 ff ff 83 c4 10 .)...!Ex........
85 7d 70 0f 85 4b 06 00 00 0f b7 45 70 83 f8 06 .}p..K.....Ep...
0f 84 ca 05 00 00 83 f8 0b 0f 84 f5 04 00 00 83 ................
f8 10 0f 84 ed 00 00 00 83 f8 16 0f 8e e8 06 00 ................
00 83 f8 18 7e 2e 3d ff 00 00 00 0f 85 d8 06 00 ....~.=.........
00 83 7d 5c 04 0f 85 ce 06 00 00 8b 1b 53 53 68 ..}\.........SSh
64 35 40 00 ff 75 7c e8 c2 fb ff ff 83 c4 10 e9 d5@..u|.........
b2 06 00 00 8b 0b 81 f9 00 00 fe ff 75 14 6a 0d ............u.j.
68 48 35 40 00 ff 75 7c e8 f1 fb ff ff e9 94 06 hH5@..u|........
00 00 b8 ff fe 00 00 3b c8 75 09 6a 0d 68 2c 35 .......;.u.j.h,5
40 00 eb e1 0f b7 13 be fe ff 00 00 66 3b d6 75 @...........f;.u
09 6a 0d 68 10 35 40 00 eb cb 66 3b d0 75 19 83 .j.h.5@...f;.u..
c3 02 53 68 e0 34 40 00 ff 75 7c e8 5e fb ff ff ..Sh.4@..u|.^...
83 c4 0c e9 4e 06 00 00 8b c1 25 ff ff ff 00 3d ....N.....%....=
ef bb bf 00 75 0b 83 c3 03 53 68 b4 34 40 00 eb ....u....Sh.4@..
d7 81 f9 2b 2f 76 2b 74 20 81 f9 2b 2f 76 2f 74 ...+/v+t ..+/v/t
18 81 f9 2b 2f 76 38 74 10 81 f9 2b 2f 76 39 74 ...+/v8t...+/v9t
08 53 68 88 34 40 00 eb af 6a 0a 68 70 34 40 00 .Sh.4@...j.hp4@.
e9 60 ff ff ff 0f b7 03 3b 45 5c 74 11 50 68 e8 .`......;E\t.Ph.
33 40 00 ff 75 60 e8 a5 fa ff ff 83 c4 0c 0f b7 3@..u`..........
43 02 83 f8 34 74 13 6a 34 50 68 40 33 40 00 ff C...4t.j4Ph@3@..
75 60 e8 89 fa ff ff 83 c4 10 0f b7 43 04 66 85 u`..........C.f.
c0 74 11 50 68 d0 32 40 00 ff 75 60 e8 6f fa ff .t.Ph.2@..u`.o..
ff 83 c4 0c 8d 73 06 b9 ac 32 40 00 8b c6 66 8b .....s...2@...f.
10 66 3b 11 75 1e 66 85 d2 74 15 66 8b 50 02 66 .f;.u.f..t.f.P.f
3b 51 02 75 0f 83 c0 04 83 c1 04 66 85 d2 75 de ;Q.u.......f..u.
33 c0 eb 05 1b c0 83 d8 ff 85 c0 74 11 56 68 38 3..........t.Vh8
32 40 00 ff 75 60 e8 25 fa ff ff 83 c4 0c 0f b7 2@..u`.%........
43 26 66 85 c0 74 11 50 68 e8 31 40 00 ff 75 60 C&f..t.Ph.1@..u`
e8 0b fa ff ff 83 c4 0c 8b 4b 28 b8 bd 04 ef fe .........K(.....
3b c8 74 12 50 51 68 80 31 40 00 ff 75 60 e8 ed ;.t.PQh.1@..u`..
f9 ff ff 83 c4 10 8b 4b 2c b8 00 00 01 00 3b c8 .......K,.....;.
74 12 50 51 68 08 31 40 00 ff 75 60 e8 cf f9 ff t.PQh.1@..u`....
ff 83 c4 10 8b 43 44 85 43 40 75 0c 8d 7d b8 be .....CD.C@u..}..
f4 30 40 00 6a 0e eb 79 8d 55 b8 a8 01 74 0f 6a .0@.j..y.U...t.j
10 8b fa be e4 30 40 00 59 f3 a4 8d 55 c6 f6 43 .....0@.Y...U..C
44 10 74 0f 6a 16 8b fa be cc 30 40 00 59 f3 a4 D.t.j.....0@.Y..
83 c2 14 f6 43 44 04 74 0f 6a 14 8b fa be b8 30 ....CD.t.j.....0
40 00 59 f3 a4 83 c2 12 f6 43 44 02 74 0f 6a 1c @.Y......CD.t.j.
8b fa be 9c 30 40 00 59 f3 a4 83 c2 1a f6 43 44 ....0@.Y......CD
08 74 0f 6a 20 8b fa be 7c 30 40 00 59 f3 a4 83 .t.j ...|0@.Y...
c2 1e f6 43 44 20 74 0c 8b fa be 5c 30 40 00 6a ...CD t....\0@.j
20 59 f3 a4 8b 43 4c ba dc 22 40 00 83 f8 08 73 Y...CL.."@....s
0c 8b 0c 85 14 24 40 00 89 4d 6c eb 03 89 55 6c .....$@..Ml...Ul
83 f8 03 75 11 8b 4b 50 83 f9 0d 73 09 8b 04 8d ...u..KP...s....
34 24 40 00 eb 18 83 f8 04 75 11 8b 43 50 83 f8 4$@......u..CP..
04 73 09 8b 04 85 68 24 40 00 eb 02 8b c2 0f b7 .s....h$@.......
4b 4a 83 f9 07 73 09 8b 3c 8d e0 23 40 00 eb 02 KJ...s..<..#@...
8b fa 0f b7 4b 48 83 f9 06 73 09 8b 34 8d fc 23 ....KH...s..4..#
40 00 eb 02 8b f2 50 ff 75 6c 8d 45 bc 50 0f b7 @.....P.ul.E.P..
43 34 50 0f b7 43 36 50 0f b7 43 30 50 0f b7 43 C4P..C6P..C0P..C
32 50 0f b7 43 3c 50 0f b7 43 3e 50 0f b7 43 38 2P..C<P..C>P..C8
50 0f b7 43 3a 50 68 e0 2e 40 00 ff 75 7c e8 db P..C:Ph..@..u|..
f8 ff ff 21 45 78 8b 43 54 83 c4 34 85 c0 75 16 ...!Ex.CT..4..u.
39 43 58 75 11 6a 1e 68 9c 2e 40 00 ff 75 7c e8 9CXu.j.h..@..u|.
0a f9 ff ff eb 77 89 45 48 8b 43 58 89 45 44 8d .....w.EH.CX.ED.
45 4c 50 8d 45 44 50 ff 15 08 20 40 00 85 c0 75 ELP.EDP... @...u
1e ff 15 1c 20 40 00 50 68 70 2e 40 00 68 ac 37 .... @.Php.@.h.7
40 00 ff 75 60 e8 36 f8 ff ff 83 c4 10 eb 41 0f @..u`.6.......A.
b7 45 5a 50 0f b7 45 58 50 0f b7 45 56 50 0f b7 .EZP..EXP..EVP..
45 54 50 0f b7 45 52 50 0f b7 45 4e 50 0f b7 45 ETP..ERP..ENP..E
4c 50 0f b7 45 50 ff 34 85 c4 23 40 00 68 d0 2d LP..EP.4..#@.h.-
40 00 ff 75 7c e8 44 f8 ff ff 83 c4 28 21 45 78 @..u|.D.....(!Ex
56 57 68 88 2d 40 00 ff 75 7c e8 2f f8 ff ff 21 VWh.-@..u|./...!
45 78 0f b7 03 03 c3 8d 73 5c 83 c4 10 89 45 70 Ex......s\....Ep
3b f0 0f 83 11 03 00 00 8d 46 06 8d 48 02 66 8b ;........F..H.f.
10 83 c0 02 66 85 d2 75 f5 2b c1 d1 f8 8b c8 83 ....f..u.+......
e1 01 03 c8 8d 7c 4e 08 0f b7 4e 02 8b df 2b de .....|N...N...+.
d1 fb 66 85 c9 75 2b 0f b7 16 3b d3 76 24 8d 4e ..f..u+...;.v$.N
06 51 33 c9 83 f8 08 0f 95 c1 8d 04 4d 6c 2d 40 .Q3.........Ml-@
00 50 ff 75 7c e8 c4 f7 ff ff 83 c4 0c e9 9c 00 .P.u|...........
00 00 0f b7 06 8b d8 83 e3 03 03 d8 66 83 7e 04 ............f.~.
01 75 22 66 85 c9 b9 4c 2d 40 00 74 05 b9 24 2d .u"f...L-@.t..$-
40 00 57 8d 46 06 50 51 ff 75 7c e8 8e f7 ff ff @.W.F.PQ.u|.....
83 c4 10 eb 69 8d 46 06 50 68 10 2d 40 00 ff 75 ....i.F.Ph.-@..u
7c e8 78 f7 ff ff 21 45 78 0f b7 46 02 83 65 6c |.x...!Ex..F..el
00 83 c4 0c a9 fe ff ff ff 76 34 8b 4d 6c b8 04 .........v4.Ml..
2d 40 00 f6 c1 01 75 05 b8 f0 2c 40 00 0f b7 0c -@....u...,@....
4f 51 50 ff 75 7c e8 43 f7 ff ff 21 45 78 0f b7 OQP.u|.C...!Ex..
46 02 83 c4 0c ff 45 6c d1 e8 39 45 6c 72 cc 6a F.....El..9Elr.j
02 68 e8 2c 40 00 ff 75 7c e8 70 f7 ff ff 21 45 .h.,@..u|.p...!E
78 6b db 5c 03 f3 3b 75 70 0f 82 f9 fe ff ff e9 xk.\..;up.......
05 02 00 00 83 65 70 00 83 3b 00 0f 86 f8 01 00 .....ep..;......
00 8d 7b 08 8b 47 fc 3b 07 75 16 50 ff 75 70 68 ..{..G.;.u.P.uph
ac 2c 40 00 ff 75 7c e8 e2 f6 ff ff 83 c4 10 eb .,@..u|.........
16 ff 37 50 ff 75 70 68 58 2c 40 00 ff 75 7c e8 ..7P.uphX,@..u|.
ca f6 ff ff 83 c4 14 21 45 78 8b 77 04 8b 47 fc .......!Ex.w..G.
03 f3 89 45 6c eb 5f 0f b7 46 02 83 f8 01 75 12 ...El._..F....u.
8d 46 04 50 0f b7 06 50 ff 75 6c 68 f8 2b 40 00 .F.P...P.ulh.+@.
eb 15 66 85 c0 75 20 8d 46 04 50 0f b7 06 50 ff ..f..u .F.P...P.
75 6c 68 98 2b 40 00 ff 75 7c e8 7f f6 ff ff 83 ulh.+@..u|......
c4 14 21 45 78 eb 14 ff 75 6c 50 68 20 2b 40 00 ..!Ex...ulPh +@.
ff 75 60 e8 18 f6 ff ff 83 c4 10 0f b7 06 ff 45 .u`............E
6c 03 f0 8b 45 6c 3b 07 76 9d ff 45 70 8b 45 70 l...El;.v..Ep.Ep
83 c7 0c 3b 03 0f 82 49 ff ff ff e9 39 01 00 00 ...;...I....9...
c7 45 6c 10 00 00 00 0f b7 33 85 f6 74 55 85 7d .El......3..tU.}
74 75 09 0f b7 45 74 c1 e0 04 eb 03 6a 10 58 2b tu...Et.....j.X+
45 6c 56 50 68 d0 2a 40 00 ff 75 7c e8 0d f6 ff ElVPh.*@..u|....
ff 83 c4 10 21 45 78 eb 01 4e 66 83 3c 73 00 74 ....!Ex..Nf.<s.t
f8 56 8d 43 02 50 ff 75 7c e8 40 f6 ff ff 21 45 .V.C.P.u|.@...!E
78 6a 02 68 e8 2c 40 00 ff 75 7c e8 2e f6 ff ff xj.h.,@..u|.....
21 45 78 ff 4d 6c 0f b7 03 8d 5c 43 02 75 98 e9 !Ex.Ml....\C.u..
c5 00 00 00 8b 75 70 6a 02 59 bf c8 2a 40 00 33 .....upj.Y..*@.3
c0 f3 a7 0f 85 b0 00 00 00 8b 0b b8 cd fe cd fe ................
3b c8 74 17 50 51 68 48 2a 40 00 ff 75 60 e8 4d ;.t.PQhH*@..u`.M
f5 ff ff 83 c4 10 e9 8e 00 00 00 8b 43 7c 85 c0 ............C|..
75 05 21 45 6c eb 05 03 c3 89 45 6c 8b 43 74 85 u.!El.....El.Ct.
c0 75 05 21 45 70 eb 05 03 c3 89 45 70 8b 43 28 .u.!Ep.....Ep.C(
0f c8 50 8b 43 24 0f c8 50 8b 43 20 0f c8 50 8b ..P.C$..P.C ..P.
43 1c 0f c8 50 8b 43 38 8b 73 18 8b 7b 10 0f c8 C...P.C8.s..{...
50 8b 43 34 0f c8 50 8b 43 30 0f c8 50 8b 43 2c P.C4..P.C0..P.C,
0f c8 50 ff 73 14 56 e8 d8 f5 ff ff 50 56 ff 75 ..P.s.V.....PV.u
6c ff 75 70 57 e8 ab f5 ff ff 50 0f b7 43 08 57 l.upW.....P..C.W
50 0f b7 43 0a 50 68 b8 27 40 00 ff 75 7c e8 0b P..C.Ph.'@..u|..
f5 ff ff 83 c4 4c 21 45 78 83 7d 78 00 75 1c ff .....L!Ex.}x.u..
15 1c 20 40 00 50 68 a4 27 40 00 68 ac 37 40 00 .. @.Ph.'@.h.7@.
ff 75 60 e8 98 f4 ff ff 83 c4 10 5f 33 c0 5e 40 .u`........_3.^@
5b 83 c5 64 c9 c2 14 00 55 8b ec f7 45 10 00 00 [..d....U...E...
ff ff 53 8b 5d 14 8b 4b 08 8b 43 04 56 57 89 4d ..S.]..K..C.VW.M
14 75 0c 0f b7 4d 10 51 68 4c 38 40 00 eb 08 ff .u...M.QhL8@....
75 10 68 30 38 40 00 50 e8 a1 f4 ff ff 8b 35 1c u.h08@.P......5.
20 40 00 83 c4 0c bf ac 37 40 00 85 c0 75 14 ff @......7@...u..
d6 50 68 a4 27 40 00 57 ff 75 14 e8 30 f4 ff ff .Ph.'@.W.u..0...
83 c4 10 6a 00 6a 01 53 68 95 12 40 00 ff 75 10 ...j.j.Sh..@..u.
ff 75 0c ff 75 08 ff 15 24 20 40 00 85 c0 75 14 .u..u...$ @...u.
ff d6 50 68 00 38 40 00 57 ff 75 14 e8 ff f3 ff ..Ph.8@.W.u.....
ff 83 c4 10 5f 33 c0 5e 40 5b 5d c2 10 00 55 8b ...._3.^@[]...U.
ec 53 8b 5d 10 8b 43 08 8b 53 04 56 8b 75 0c 57 .S.]..C..S.V.u.W
89 45 10 56 f7 c6 00 00 ff ff 75 1a e8 ec f4 ff .E.V......u.....
ff 50 0f b7 c6 50 68 a4 38 40 00 52 e8 0d f4 ff .P...Ph.8@.R....
ff 83 c4 10 eb 0e 68 8c 38 40 00 52 e8 fd f3 ff ......h.8@.R....
ff 83 c4 0c 8b 35 1c 20 40 00 bf ac 37 40 00 85 .....5. @...7@..
c0 75 14 ff d6 50 68 a4 27 40 00 57 ff 75 10 e8 .u...Ph.'@.W.u..
8c f3 ff ff 83 c4 10 6a 00 6a 01 53 68 78 1b 40 .......j.j.Shx.@
00 ff 75 0c ff 75 08 ff 15 28 20 40 00 85 c0 75 ..u..u...( @...u
14 ff d6 50 68 64 38 40 00 57 ff 75 10 e8 5e f3 ...Phd8@.W.u..^.
ff ff 83 c4 10 5f 33 c0 5e 40 5b 5d c2 0c 00 83 ....._3.^@[]....
ec 1c 55 57 6a f4 bd a0 00 00 00 ff 15 4c 20 40 ..UWj........L @
00 8b f8 83 ff ff 75 0d ff 15 1c 20 40 00 8b e8 ......u.... @...
e9 ac 01 00 00 53 56 8d 44 24 18 50 ff 15 48 20 .....SV.D$.P..H
40 00 50 ff 15 54 20 40 00 8b 35 1c 20 40 00 89 @.P..T @..5. @..
44 24 10 85 c0 75 14 ff d6 8b e8 55 68 ec 3b 40 D$...u.....Uh.;@
00 bb ac 37 40 00 e9 4d 01 00 00 83 7c 24 18 02 ...7@..M....|$..
bb ac 37 40 00 74 12 68 c8 3a 40 00 57 e8 de f2 ..7@.t.h.:@.W...
ff ff 59 59 e9 19 01 00 00 6a f5 ff 15 4c 20 40 ..YY.....j...L @
00 89 44 24 1c 83 f8 ff 75 0f ff d6 8b e8 55 68 ..D$....u.....Uh
ac 3a 40 00 e9 d8 00 00 00 50 ff 15 44 20 40 00 .:@......P..D @.
85 c0 75 14 ff d6 8b e8 55 68 88 3a 40 00 68 f8 ..u.....Uh.:@.h.
39 40 00 e9 ba 00 00 00 8b 6c 24 10 6a 02 6a 00 9@.......l$.j.j.
ff 75 04 ff 15 40 20 40 00 89 44 24 14 85 c0 75 .u...@ @..D$...u
0f ff d6 8b e8 55 68 dc 39 40 00 e9 91 00 00 00 .....Uh.9@......
50 ff 75 04 68 90 39 40 00 57 e8 61 f2 ff ff ff P.u.h.9@.W.a....
75 04 8b 6c 24 30 68 68 39 40 00 55 e8 9d f2 ff u..l$0hh9@.U....
ff 83 c4 1c 85 c0 75 12 ff d6 50 68 a4 27 40 00 ......u...Ph.'@.
53 57 e8 39 f2 ff ff 83 c4 10 83 64 24 20 00 6a SW.9.......d$ .j
00 6a 01 8d 44 24 28 50 68 0e 1c 40 00 ff 74 24 .j..D$(Ph..@..t$
24 89 6c 24 38 89 7c 24 3c ff 15 3c 20 40 00 85 $.l$8.|$<..< @..
c0 75 16 ff d6 8b e8 55 68 40 39 40 00 53 57 e8 .u.....Uh@9@.SW.
fc f1 ff ff 83 c4 10 eb 02 33 ed ff 74 24 14 ff .........3..t$..
15 38 20 40 00 85 c0 75 14 ff d6 50 68 28 39 40 .8 @...u...Ph(9@
00 53 57 e8 d8 f1 ff ff 83 c4 10 eb 15 8b 44 24 .SW...........D$
10 ff 70 04 68 f8 38 40 00 57 e8 c1 f1 ff ff 83 ..p.h.8@.W......
c4 0c ff 74 24 10 ff 15 34 20 40 00 85 c0 74 12 ...t$...4 @...t.
ff d6 50 68 e4 38 40 00 53 57 e8 a1 f1 ff ff 83 ..Ph.8@.SW......
c4 10 57 ff 15 30 20 40 00 85 c0 75 12 ff d6 50 ..W..0 @...u...P
68 c8 38 40 00 53 57 e8 84 f1 ff ff 83 c4 10 5e h.8@.SW........^
5b 55 ff 15 2c 20 40 00 5f 5d 00 00 00 00 00 00 [U.., @._]......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
c4 3c 00 00 d4 3c 00 00 e0 3c 00 00 f8 3c 00 00 .<...<...<...<..
08 3d 00 00 18 3d 00 00 2a 3d 00 00 3c 3d 00 00 .=...=..*=..<=..
4c 3d 00 00 5e 3d 00 00 7a 3d 00 00 92 3d 00 00 L=..^=..z=...=..
a0 3d 00 00 ae 3d 00 00 ba 3d 00 00 c8 3d 00 00 .=...=...=...=..
e0 3d 00 00 f2 3d 00 00 06 3e 00 00 18 3e 00 00 .=...=...>...>..
00 00 00 00 36 3e 00 00 00 00 00 00 58 3e 00 00 ....6>......X>..
00 00 00 00 00 00 00 00 54 00 72 00 75 00 65 00 ........T.r.u.e.
54 00 79 00 70 00 65 00 00 00 00 00 56 00 65 00 T.y.p.e.....V.e.
63 00 74 00 6f 00 72 00 00 00 00 00 52 00 61 00 c.t.o.r.....R.a.
73 00 74 00 65 00 72 00 00 00 00 00 56 00 65 00 s.t.e.r.....V.e.
72 00 73 00 69 00 6f 00 6e 00 65 00 64 00 20 00 r.s.i.o.n.e.d. .
50 00 72 00 69 00 6e 00 74 00 65 00 72 00 00 00 P.r.i.n.t.e.r...
49 00 6e 00 70 00 75 00 74 00 20 00 4d 00 65 00 I.n.p.u.t. .M.e.
74 00 68 00 6f 00 64 00 00 00 00 00 43 00 6f 00 t.h.o.d.....C.o.
6d 00 6d 00 75 00 6e 00 69 00 63 00 61 00 74 00 m.m.u.n.i.c.a.t.
69 00 6f 00 6e 00 73 00 00 00 00 00 53 00 6f 00 i.o.n.s.....S.o.
75 00 6e 00 64 00 00 00 49 00 6e 00 73 00 74 00 u.n.d...I.n.s.t.
61 00 6c 00 6c 00 61 00 62 00 6c 00 65 00 00 00 a.l.l.a.b.l.e...
53 00 79 00 73 00 74 00 65 00 6d 00 00 00 00 00 S.y.s.t.e.m.....
4e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 00 00 N.e.t.w.o.r.k...
4d 00 6f 00 75 00 73 00 65 00 00 00 44 00 69 00 M.o.u.s.e...D.i.
73 00 70 00 6c 00 61 00 79 00 00 00 4c 00 61 00 s.p.l.a.y...L.a.
6e 00 67 00 75 00 61 00 67 00 65 00 00 00 00 00 n.g.u.a.g.e.....
4b 00 65 00 79 00 62 00 6f 00 61 00 72 00 64 00 K.e.y.b.o.a.r.d.
00 00 00 00 50 00 72 00 69 00 6e 00 74 00 65 00 ....P.r.i.n.t.e.
72 00 00 00 53 00 74 00 61 00 74 00 69 00 63 00 r...S.t.a.t.i.c.
20 00 4c 00 69 00 62 00 72 00 61 00 72 00 79 00 .L.i.b.r.a.r.y.
00 00 00 00 56 00 69 00 72 00 74 00 75 00 61 00 ....V.i.r.t.u.a.
6c 00 20 00 44 00 65 00 76 00 69 00 63 00 65 00 l. .D.e.v.i.c.e.
00 00 00 00 46 00 6f 00 6e 00 74 00 00 00 00 00 ....F.o.n.t.....
44 00 72 00 69 00 76 00 65 00 72 00 00 00 00 00 D.r.i.v.e.r.....
44 00 4c 00 4c 00 00 00 41 00 70 00 70 00 6c 00 D.L.L...A.p.p.l.
69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 00 00 i.c.a.t.i.o.n...
57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 W.i.n.d.o.w.s. .
28 00 33 00 32 00 2d 00 62 00 69 00 74 00 29 00 (.3.2.-.b.i.t.).
00 00 00 00 50 00 72 00 65 00 73 00 65 00 6e 00 ....P.r.e.s.e.n.
74 00 61 00 74 00 69 00 6f 00 6e 00 20 00 4d 00 t.a.t.i.o.n. .M.
61 00 6e 00 61 00 67 00 65 00 72 00 20 00 28 00 a.n.a.g.e.r. .(.
33 00 32 00 2d 00 62 00 69 00 74 00 29 00 00 00 3.2.-.b.i.t.)...
50 00 72 00 65 00 73 00 65 00 6e 00 74 00 61 00 P.r.e.s.e.n.t.a.
74 00 69 00 6f 00 6e 00 20 00 4d 00 61 00 6e 00 t.i.o.n. .M.a.n.
61 00 67 00 65 00 72 00 20 00 28 00 31 00 36 00 a.g.e.r. .(.1.6.
2d 00 62 00 69 00 74 00 29 00 00 00 57 00 69 00 -.b.i.t.)...W.i.
6e 00 64 00 6f 00 77 00 73 00 20 00 28 00 31 00 n.d.o.w.s. .(.1.
36 00 2d 00 62 00 69 00 74 00 29 00 00 00 00 00 6.-.b.i.t.).....
42 00 61 00 73 00 65 00 00 00 00 00 55 00 6e 00 B.a.s.e.....U.n.
64 00 65 00 66 00 69 00 6e 00 65 00 64 00 00 00 d.e.f.i.n.e.d...
57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 W.i.n.d.o.w.s. .
43 00 45 00 00 00 00 00 57 00 69 00 6e 00 64 00 C.E.....W.i.n.d.
6f 00 77 00 73 00 20 00 4e 00 54 00 00 00 00 00 o.w.s. .N.T.....
4f 00 53 00 2f 00 32 00 20 00 28 00 33 00 32 00 O.S./.2. .(.3.2.
2d 00 62 00 69 00 74 00 29 00 00 00 4f 00 53 00 -.b.i.t.)...O.S.
2f 00 32 00 20 00 28 00 31 00 36 00 2d 00 62 00 /.2. .(.1.6.-.b.
69 00 74 00 29 00 00 00 4d 00 53 00 2d 00 44 00 i.t.)...M.S.-.D.
4f 00 53 00 00 00 00 00 55 00 6e 00 6b 00 6e 00 O.S.....U.n.k.n.
6f 00 77 00 6e 00 00 00 53 00 61 00 74 00 75 00 o.w.n...S.a.t.u.
72 00 00 00 46 00 72 00 69 00 00 00 54 00 68 00 r...F.r.i...T.h.
75 00 72 00 73 00 00 00 57 00 65 00 64 00 6e 00 u.r.s...W.e.d.n.
65 00 73 00 00 00 00 00 54 00 75 00 65 00 73 00 e.s.....T.u.e.s.
00 00 00 00 4d 00 6f 00 6e 00 00 00 53 00 75 00 ....M.o.n...S.u.
6e 00 00 00 bc 23 40 00 b4 23 40 00 a8 23 40 00 n....#@..#@..#@.
98 23 40 00 8c 23 40 00 84 23 40 00 78 23 40 00 .#@..#@..#@.x#@.
68 23 40 00 58 23 40 00 3c 23 40 00 20 23 40 00 h#@.X#@.<#@. #@.
08 23 40 00 f0 22 40 00 dc 22 40 00 d0 22 40 00 .#@.."@.."@.."@.
ac 22 40 00 70 22 40 00 34 22 40 00 10 22 40 00 ."@.p"@.4"@.."@.
dc 22 40 00 68 23 40 00 f8 21 40 00 f0 21 40 00 ."@.h#@..!@..!@.
e0 21 40 00 d4 21 40 00 b4 21 40 00 dc 22 40 00 .!@..!@..!@.."@.
94 21 40 00 68 23 40 00 84 21 40 00 70 21 40 00 .!@.h#@..!@.p!@.
5c 21 40 00 4c 21 40 00 40 21 40 00 30 21 40 00 \!@.L!@.@!@.0!@.
20 21 40 00 08 21 40 00 fc 20 40 00 dc 20 40 00 !@..!@.. @.. @.
c0 20 40 00 9c 20 40 00 68 23 40 00 8c 20 40 00 . @.. @.h#@.. @.
7c 20 40 00 68 20 40 00 4c 00 4e 00 3a 00 20 00 | @.h @.L.N.:. .
6c 00 61 00 6e 00 67 00 75 00 61 00 67 00 65 00 l.a.n.g.u.a.g.e.
2d 00 6e 00 65 00 75 00 74 00 72 00 61 00 6c 00 -.n.e.u.t.r.a.l.
20 00 6d 00 61 00 69 00 6e 00 20 00 66 00 69 00 .m.a.i.n. .f.i.
6c 00 65 00 00 00 00 00 4d 00 55 00 49 00 3a 00 l.e.....M.U.I.:.
20 00 6c 00 61 00 6e 00 67 00 75 00 61 00 67 00 .l.a.n.g.u.a.g.
65 00 2d 00 73 00 70 00 65 00 63 00 69 00 66 00 e.-.s.p.e.c.i.f.
69 00 63 00 20 00 73 00 61 00 74 00 65 00 6c 00 i.c. .s.a.t.e.l.
6c 00 69 00 74 00 65 00 20 00 66 00 69 00 6c 00 l.i.t.e. .f.i.l.
65 00 00 00 6e 00 6f 00 6e 00 65 00 00 00 00 00 e...n.o.n.e.....
69 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 i.n.t.e.r.n.a.l.
00 00 00 00 65 00 78 00 74 00 65 00 72 00 6e 00 ....e.x.t.e.r.n.
61 00 6c 00 00 00 00 00 52 00 54 00 5f 00 54 00 a.l.....R.T._.T.
4f 00 4f 00 4c 00 42 00 41 00 52 00 00 00 00 00 O.O.L.B.A.R.....
52 00 54 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 R.T._.L.O.C.A.L.
45 00 00 00 52 00 54 00 5f 00 44 00 4c 00 47 00 E...R.T._.D.L.G.
49 00 4e 00 49 00 54 00 00 00 00 00 52 00 54 00 I.N.I.T.....R.T.
5f 00 4d 00 41 00 4e 00 49 00 46 00 45 00 53 00 _.M.A.N.I.F.E.S.
54 00 00 00 52 00 54 00 5f 00 48 00 54 00 4d 00 T...R.T._.H.T.M.
4c 00 00 00 52 00 54 00 5f 00 41 00 4e 00 49 00 L...R.T._.A.N.I.
49 00 43 00 4f 00 4e 00 00 00 00 00 52 00 54 00 I.C.O.N.....R.T.
5f 00 41 00 4e 00 49 00 43 00 55 00 52 00 53 00 _.A.N.I.C.U.R.S.
4f 00 52 00 00 00 00 00 52 00 54 00 5f 00 56 00 O.R.....R.T._.V.
58 00 44 00 00 00 00 00 52 00 54 00 5f 00 50 00 X.D.....R.T._.P.
4c 00 55 00 47 00 50 00 4c 00 41 00 59 00 00 00 L.U.G.P.L.A.Y...
52 00 54 00 5f 00 44 00 49 00 41 00 4c 00 4f 00 R.T._.D.I.A.L.O.
47 00 45 00 58 00 00 00 52 00 54 00 5f 00 44 00 G.E.X...R.T._.D.
4c 00 47 00 49 00 4e 00 43 00 4c 00 55 00 44 00 L.G.I.N.C.L.U.D.
45 00 00 00 52 00 54 00 5f 00 56 00 45 00 52 00 E...R.T._.V.E.R.
53 00 49 00 4f 00 4e 00 00 00 00 00 52 00 54 00 S.I.O.N.....R.T.
5f 00 4e 00 41 00 4d 00 45 00 54 00 41 00 42 00 _.N.A.M.E.T.A.B.
4c 00 45 00 00 00 00 00 52 00 54 00 5f 00 47 00 L.E.....R.T._.G.
52 00 4f 00 55 00 50 00 5f 00 49 00 43 00 4f 00 R.O.U.P._.I.C.O.
4e 00 00 00 52 00 54 00 5f 00 4d 00 45 00 4e 00 N...R.T._.M.E.N.
55 00 45 00 58 00 00 00 52 00 54 00 5f 00 47 00 U.E.X...R.T._.G.
52 00 4f 00 55 00 50 00 5f 00 43 00 55 00 52 00 R.O.U.P._.C.U.R.
53 00 4f 00 52 00 00 00 52 00 54 00 5f 00 4d 00 S.O.R...R.T._.M.
45 00 53 00 53 00 41 00 47 00 45 00 54 00 41 00 E.S.S.A.G.E.T.A.
42 00 4c 00 45 00 00 00 52 00 54 00 5f 00 52 00 B.L.E...R.T._.R.
43 00 44 00 41 00 54 00 41 00 00 00 52 00 54 00 C.D.A.T.A...R.T.
5f 00 41 00 43 00 43 00 45 00 4c 00 45 00 52 00 _.A.C.C.E.L.E.R.
41 00 54 00 4f 00 52 00 00 00 00 00 52 00 54 00 A.T.O.R.....R.T.
5f 00 46 00 4f 00 4e 00 54 00 00 00 52 00 54 00 _.F.O.N.T...R.T.
5f 00 46 00 4f 00 4e 00 54 00 44 00 49 00 52 00 _.F.O.N.T.D.I.R.
00 00 00 00 52 00 54 00 5f 00 53 00 54 00 52 00 ....R.T._.S.T.R.
49 00 4e 00 47 00 00 00 52 00 54 00 5f 00 44 00 I.N.G...R.T._.D.
49 00 41 00 4c 00 4f 00 47 00 00 00 52 00 54 00 I.A.L.O.G...R.T.
5f 00 4d 00 45 00 4e 00 55 00 00 00 52 00 54 00 _.M.E.N.U...R.T.
5f 00 49 00 43 00 4f 00 4e 00 00 00 52 00 54 00 _.I.C.O.N...R.T.
5f 00 42 00 49 00 54 00 4d 00 41 00 50 00 00 00 _.B.I.T.M.A.P...
52 00 54 00 5f 00 43 00 55 00 52 00 53 00 4f 00 R.T._.C.U.R.S.O.
52 00 00 00 57 00 72 00 69 00 74 00 65 00 46 00 R...W.r.i.t.e.F.
69 00 6c 00 65 00 00 00 09 00 09 00 09 00 52 00 i.l.e.........R.
65 00 73 00 6f 00 75 00 72 00 63 00 65 00 20 00 e.s.o.u.r.c.e. .
43 00 6f 00 6e 00 66 00 69 00 67 00 75 00 72 00 C.o.n.f.i.g.u.r.
61 00 74 00 69 00 6f 00 6e 00 20 00 44 00 61 00 a.t.i.o.n. .D.a.
74 00 61 00 3a 00 0d 00 0a 00 09 00 09 00 09 00 t.a.:...........
09 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 ..V.e.r.s.i.o.n.
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 3d 00 20 00 25 00 68 00 75 00 . . .=. .%.h.u.
2e 00 25 00 68 00 75 00 0d 00 0a 00 09 00 09 00 ..%.h.u.........
09 00 09 00 54 00 79 00 70 00 65 00 20 00 20 00 ....T.y.p.e. . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 20 00 3d 00 20 00 25 00 6c 00 . . . .=. .%.l.
75 00 20 00 28 00 25 00 6c 00 73 00 29 00 0d 00 u. .(.%.l.s.)...
0a 00 09 00 09 00 09 00 09 00 4c 00 61 00 6e 00 ..........L.a.n.
67 00 75 00 61 00 67 00 65 00 20 00 20 00 20 00 g.u.a.g.e. . . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 3d 00 . . . . . . .=.
20 00 25 00 6c 00 73 00 0d 00 0a 00 09 00 09 00 .%.l.s.........
09 00 09 00 46 00 61 00 6c 00 6c 00 62 00 61 00 ....F.a.l.l.b.a.
63 00 6b 00 20 00 4c 00 61 00 6e 00 67 00 75 00 c.k. .L.a.n.g.u.
61 00 67 00 65 00 20 00 3d 00 20 00 25 00 6c 00 a.g.e. .=. .%.l.
73 00 0d 00 0a 00 09 00 09 00 09 00 09 00 46 00 s.............F.
61 00 6c 00 6c 00 62 00 61 00 63 00 6b 00 20 00 a.l.l.b.a.c.k. .
4c 00 6f 00 63 00 61 00 74 00 69 00 6f 00 6e 00 L.o.c.a.t.i.o.n.
20 00 3d 00 20 00 25 00 6c 00 75 00 20 00 28 00 .=. .%.l.u. .(.
25 00 6c 00 73 00 29 00 0d 00 0a 00 09 00 09 00 %.l.s.).........
09 00 09 00 53 00 79 00 73 00 74 00 65 00 6d 00 ....S.y.s.t.e.m.
20 00 41 00 74 00 74 00 72 00 69 00 62 00 75 00 .A.t.t.r.i.b.u.
74 00 65 00 73 00 20 00 3d 00 20 00 30 00 78 00 t.e.s. .=. .0.x.
25 00 30 00 38 00 6c 00 58 00 0d 00 0a 00 09 00 %.0.8.l.X.......
09 00 09 00 09 00 4d 00 61 00 69 00 6e 00 20 00 ......M.a.i.n. .
43 00 68 00 65 00 63 00 6b 00 73 00 75 00 6d 00 C.h.e.c.k.s.u.m.
20 00 20 00 20 00 20 00 20 00 3d 00 20 00 25 00 . . . . .=. .%.
30 00 38 00 6c 00 58 00 20 00 25 00 30 00 38 00 0.8.l.X. .%.0.8.
6c 00 58 00 20 00 25 00 30 00 38 00 6c 00 58 00 l.X. .%.0.8.l.X.
20 00 25 00 30 00 38 00 6c 00 58 00 0d 00 0a 00 .%.0.8.l.X.....
09 00 09 00 09 00 09 00 53 00 65 00 72 00 76 00 ........S.e.r.v.
69 00 63 00 65 00 20 00 43 00 68 00 65 00 63 00 i.c.e. .C.h.e.c.
6b 00 73 00 75 00 6d 00 20 00 20 00 3d 00 20 00 k.s.u.m. . .=. .
25 00 30 00 38 00 6c 00 58 00 20 00 25 00 30 00 %.0.8.l.X. .%.0.
38 00 6c 00 58 00 20 00 25 00 30 00 38 00 6c 00 8.l.X. .%.0.8.l.
58 00 20 00 25 00 30 00 38 00 6c 00 58 00 0d 00 X. .%.0.8.l.X...
0a 00 00 00 00 00 00 00 53 00 69 00 67 00 6e 00 ........S.i.g.n.
61 00 74 00 75 00 72 00 65 00 20 00 30 00 78 00 a.t.u.r.e. .0.x.
25 00 30 00 38 00 6c 00 58 00 20 00 6f 00 66 00 %.0.8.l.X. .o.f.
20 00 72 00 65 00 73 00 6f 00 75 00 72 00 63 00 .r.e.s.o.u.r.c.
65 00 20 00 63 00 6f 00 6e 00 66 00 69 00 67 00 e. .c.o.n.f.i.g.
75 00 72 00 61 00 74 00 69 00 6f 00 6e 00 20 00 u.r.a.t.i.o.n. .
64 00 61 00 74 00 61 00 20 00 6e 00 6f 00 74 00 d.a.t.a. .n.o.t.
20 00 30 00 78 00 25 00 30 00 38 00 6c 00 58 00 .0.x.%.0.8.l.X.
21 00 0a 00 00 00 00 00 4d 00 55 00 49 00 00 00 !.......M.U.I...
09 00 09 00 09 00 25 00 36 00 6c 00 75 00 3a 00 ......%.6.l.u.:.
09 00 4c 00 65 00 6e 00 67 00 74 00 68 00 20 00 ..L.e.n.g.t.h. .
3d 00 20 00 25 00 6c 00 75 00 0d 00 0a 00 09 00 =. .%.l.u.......
09 00 09 00 09 00 53 00 74 00 72 00 69 00 6e 00 ......S.t.r.i.n.
67 00 20 00 3d 00 20 00 00 00 00 00 00 00 00 00 g. .=. .........
54 00 65 00 78 00 74 00 20 00 74 00 79 00 70 00 T.e.x.t. .t.y.p.
65 00 20 00 25 00 68 00 75 00 20 00 6f 00 66 00 e. .%.h.u. .o.f.
20 00 6d 00 65 00 73 00 73 00 61 00 67 00 65 00 .m.e.s.s.a.g.e.
20 00 30 00 78 00 25 00 30 00 38 00 6c 00 58 00 .0.x.%.0.8.l.X.
20 00 6e 00 65 00 69 00 74 00 68 00 65 00 72 00 .n.e.i.t.h.e.r.
20 00 41 00 4e 00 53 00 49 00 20 00 6e 00 6f 00 .A.N.S.I. .n.o.
72 00 20 00 55 00 4e 00 49 00 43 00 4f 00 44 00 r. .U.N.I.C.O.D.
45 00 21 00 0a 00 00 00 09 00 09 00 09 00 09 00 E.!.............
30 00 78 00 25 00 30 00 38 00 6c 00 58 00 3a 00 0.x.%.0.8.l.X.:.
09 00 53 00 69 00 7a 00 65 00 20 00 3d 00 20 00 ..S.i.z.e. .=. .
25 00 68 00 75 00 0d 00 0a 00 09 00 09 00 09 00 %.h.u...........
09 00 09 00 09 00 54 00 65 00 78 00 74 00 20 00 ......T.e.x.t. .
3d 00 20 00 25 00 2e 00 39 00 39 00 39 00 68 00 =. .%...9.9.9.h.
73 00 0d 00 0a 00 00 00 09 00 09 00 09 00 09 00 s...............
30 00 78 00 25 00 30 00 38 00 6c 00 58 00 3a 00 0.x.%.0.8.l.X.:.
09 00 53 00 69 00 7a 00 65 00 20 00 3d 00 20 00 ..S.i.z.e. .=. .
25 00 68 00 75 00 0d 00 0a 00 09 00 09 00 09 00 %.h.u...........
09 00 09 00 09 00 54 00 65 00 78 00 74 00 20 00 ......T.e.x.t. .
3d 00 20 00 25 00 2e 00 39 00 39 00 39 00 6c 00 =. .%...9.9.9.l.
73 00 0d 00 0a 00 00 00 09 00 09 00 09 00 25 00 s.............%.
36 00 6c 00 75 00 3a 00 09 00 4d 00 65 00 73 00 6.l.u.:...M.e.s.
73 00 61 00 67 00 65 00 20 00 49 00 44 00 73 00 s.a.g.e. .I.D.s.
20 00 30 00 78 00 25 00 30 00 38 00 6c 00 58 00 .0.x.%.0.8.l.X.
20 00 74 00 6f 00 20 00 30 00 78 00 25 00 30 00 .t.o. .0.x.%.0.
38 00 6c 00 58 00 0d 00 0a 00 00 00 09 00 09 00 8.l.X...........
09 00 25 00 36 00 6c 00 75 00 3a 00 09 00 4d 00 ..%.6.l.u.:...M.
65 00 73 00 73 00 61 00 67 00 65 00 20 00 49 00 e.s.s.a.g.e. .I.
44 00 20 00 30 00 78 00 25 00 30 00 38 00 6c 00 D. .0.x.%.0.8.l.
58 00 0d 00 0a 00 00 00 0d 00 0a 00 00 00 00 00 X...............
20 00 30 00 78 00 25 00 30 00 34 00 68 00 58 00 .0.x.%.0.4.h.X.
00 00 00 00 3a 00 25 00 68 00 75 00 00 00 00 00 ....:.%.h.u.....
09 00 09 00 09 00 09 00 25 00 6c 00 73 00 20 00 ........%.l.s. .
3d 00 00 00 09 00 09 00 09 00 09 00 09 00 25 00 =.............%.
2d 00 31 00 36 00 6c 00 73 00 20 00 3d 00 20 00 -.1.6.l.s. .=. .
25 00 6c 00 73 00 0d 00 0a 00 00 00 09 00 09 00 %.l.s...........
09 00 09 00 09 00 25 00 2d 00 31 00 36 00 6c 00 ......%.-.1.6.l.
73 00 20 00 3d 00 0d 00 0a 00 00 00 09 00 09 00 s. .=...........
09 00 09 00 25 00 6c 00 73 00 3a 00 0d 00 0a 00 ....%.l.s.:.....
00 00 00 00 00 00 00 00 09 00 09 00 09 00 09 00 ................
54 00 61 00 72 00 67 00 65 00 74 00 20 00 4f 00 T.a.r.g.e.t. .O.
53 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 S. . . . . . . .
20 00 20 00 3d 00 20 00 25 00 6c 00 73 00 2c 00 . .=. .%.l.s.,.
20 00 25 00 6c 00 73 00 0d 00 0a 00 00 00 00 00 .%.l.s.........
09 00 09 00 09 00 09 00 4d 00 6f 00 64 00 75 00 ........M.o.d.u.
6c 00 65 00 20 00 54 00 69 00 6d 00 65 00 20 00 l.e. .T.i.m.e. .
53 00 74 00 61 00 6d 00 70 00 20 00 3d 00 20 00 S.t.a.m.p. .=. .
25 00 6c 00 73 00 64 00 61 00 79 00 2c 00 20 00 %.l.s.d.a.y.,. .
25 00 30 00 34 00 68 00 75 00 2d 00 25 00 30 00 %.0.4.h.u.-.%.0.
32 00 68 00 75 00 2d 00 25 00 30 00 32 00 68 00 2.h.u.-.%.0.2.h.
75 00 20 00 25 00 30 00 32 00 68 00 75 00 3a 00 u. .%.0.2.h.u.:.
25 00 30 00 32 00 68 00 75 00 3a 00 25 00 30 00 %.0.2.h.u.:.%.0.
32 00 68 00 75 00 2e 00 25 00 30 00 33 00 68 00 2.h.u...%.0.3.h.
75 00 20 00 55 00 54 00 43 00 0d 00 0a 00 00 00 u. .U.T.C.......
46 00 69 00 6c 00 65 00 54 00 69 00 6d 00 65 00 F.i.l.e.T.i.m.e.
54 00 6f 00 53 00 79 00 73 00 74 00 65 00 6d 00 T.o.S.y.s.t.e.m.
54 00 69 00 6d 00 65 00 00 00 00 00 09 00 09 00 T.i.m.e.........
09 00 09 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 ....M.o.d.u.l.e.
20 00 54 00 69 00 6d 00 65 00 20 00 53 00 74 00 .T.i.m.e. .S.t.
61 00 6d 00 70 00 20 00 3d 00 20 00 4e 00 6f 00 a.m.p. .=. .N.o.
6e 00 65 00 0d 00 0a 00 00 00 00 00 00 00 00 00 n.e.............
09 00 09 00 09 00 46 00 69 00 78 00 65 00 64 00 ......F.i.x.e.d.
46 00 69 00 6c 00 65 00 49 00 6e 00 66 00 6f 00 F.i.l.e.I.n.f.o.
3a 00 0d 00 0a 00 09 00 09 00 09 00 09 00 50 00 :.............P.
72 00 6f 00 64 00 75 00 63 00 74 00 20 00 56 00 r.o.d.u.c.t. .V.
65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 20 00 e.r.s.i.o.n. . .
20 00 3d 00 20 00 25 00 68 00 75 00 2e 00 25 00 .=. .%.h.u...%.
68 00 75 00 3a 00 25 00 68 00 75 00 2e 00 25 00 h.u.:.%.h.u...%.
68 00 75 00 0d 00 0a 00 09 00 09 00 09 00 09 00 h.u.............
4d 00 6f 00 64 00 75 00 6c 00 65 00 20 00 56 00 M.o.d.u.l.e. .V.
65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 20 00 e.r.s.i.o.n. . .
20 00 20 00 3d 00 20 00 25 00 68 00 75 00 2e 00 . .=. .%.h.u...
25 00 68 00 75 00 3a 00 25 00 68 00 75 00 2e 00 %.h.u.:.%.h.u...
25 00 68 00 75 00 0d 00 0a 00 09 00 09 00 09 00 %.h.u...........
09 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 20 00 ..M.o.d.u.l.e. .
46 00 6c 00 61 00 67 00 73 00 20 00 20 00 20 00 F.l.a.g.s. . . .
20 00 20 00 20 00 3d 00 20 00 25 00 6c 00 73 00 . . .=. .%.l.s.
0d 00 0a 00 09 00 09 00 09 00 09 00 4d 00 6f 00 ............M.o.
64 00 75 00 6c 00 65 00 20 00 54 00 79 00 70 00 d.u.l.e. .T.y.p.
65 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 e. . . . . . . .
3d 00 20 00 25 00 6c 00 73 00 0d 00 0a 00 09 00 =. .%.l.s.......
09 00 09 00 09 00 4d 00 6f 00 64 00 75 00 6c 00 ......M.o.d.u.l.
65 00 20 00 53 00 75 00 62 00 74 00 79 00 70 00 e. .S.u.b.t.y.p.
65 00 20 00 20 00 20 00 20 00 3d 00 20 00 25 00 e. . . . .=. .%.
6c 00 73 00 0d 00 0a 00 00 00 00 00 2c 00 20 00 l.s.........,. .
53 00 70 00 65 00 63 00 69 00 61 00 6c 00 20 00 S.p.e.c.i.a.l. .
42 00 75 00 69 00 6c 00 64 00 00 00 2c 00 20 00 B.u.i.l.d...,. .
50 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 P.r.i.v.a.t.e. .
42 00 75 00 69 00 6c 00 64 00 00 00 2c 00 20 00 B.u.i.l.d...,. .
50 00 72 00 65 00 2d 00 52 00 65 00 6c 00 65 00 P.r.e.-.R.e.l.e.
61 00 73 00 65 00 00 00 2c 00 20 00 50 00 61 00 a.s.e...,. .P.a.
74 00 63 00 68 00 65 00 64 00 00 00 2c 00 20 00 t.c.h.e.d...,. .
49 00 6e 00 66 00 65 00 72 00 72 00 65 00 64 00 I.n.f.e.r.r.e.d.
00 00 00 00 2c 00 20 00 44 00 65 00 62 00 75 00 ....,. .D.e.b.u.
67 00 00 00 2c 00 20 00 4e 00 6f 00 6e 00 65 00 g...,. .N.o.n.e.
00 00 00 00 00 00 00 00 53 00 74 00 72 00 75 00 ........S.t.r.u.
63 00 74 00 75 00 72 00 65 00 20 00 76 00 65 00 c.t.u.r.e. .v.e.
72 00 73 00 69 00 6f 00 6e 00 20 00 30 00 78 00 r.s.i.o.n. .0.x.
25 00 30 00 38 00 6c 00 58 00 20 00 69 00 6e 00 %.0.8.l.X. .i.n.
20 00 27 00 46 00 49 00 58 00 45 00 44 00 46 00 .'.F.I.X.E.D.F.
49 00 4c 00 45 00 49 00 4e 00 46 00 4f 00 27 00 I.L.E.I.N.F.O.'.
20 00 6e 00 6f 00 74 00 20 00 30 00 78 00 25 00 .n.o.t. .0.x.%.
30 00 38 00 6c 00 58 00 21 00 0a 00 00 00 00 00 0.8.l.X.!.......
53 00 69 00 67 00 6e 00 61 00 74 00 75 00 72 00 S.i.g.n.a.t.u.r.
65 00 20 00 30 00 78 00 25 00 30 00 38 00 6c 00 e. .0.x.%.0.8.l.
58 00 20 00 69 00 6e 00 20 00 27 00 46 00 49 00 X. .i.n. .'.F.I.
58 00 45 00 44 00 46 00 49 00 4c 00 45 00 49 00 X.E.D.F.I.L.E.I.
4e 00 46 00 4f 00 27 00 20 00 6e 00 6f 00 74 00 N.F.O.'. .n.o.t.
20 00 30 00 78 00 25 00 30 00 38 00 6c 00 58 00 .0.x.%.0.8.l.X.
21 00 0a 00 00 00 00 00 50 00 61 00 64 00 64 00 !.......P.a.d.d.
69 00 6e 00 67 00 20 00 25 00 68 00 75 00 20 00 i.n.g. .%.h.u. .
69 00 6e 00 20 00 27 00 56 00 45 00 52 00 53 00 i.n. .'.V.E.R.S.
49 00 4f 00 4e 00 49 00 4e 00 46 00 4f 00 27 00 I.O.N.I.N.F.O.'.
20 00 6e 00 6f 00 74 00 20 00 30 00 21 00 0a 00 .n.o.t. .0.!...
00 00 00 00 00 00 00 00 4b 00 65 00 79 00 20 00 ........K.e.y. .
73 00 74 00 72 00 69 00 6e 00 67 00 20 00 22 00 s.t.r.i.n.g. .".
25 00 6c 00 73 00 22 00 20 00 69 00 6e 00 20 00 %.l.s.". .i.n. .
27 00 56 00 45 00 52 00 53 00 49 00 4f 00 4e 00 '.V.E.R.S.I.O.N.
49 00 4e 00 46 00 4f 00 27 00 20 00 6e 00 6f 00 I.N.F.O.'. .n.o.
74 00 20 00 22 00 56 00 53 00 5f 00 56 00 45 00 t. .".V.S._.V.E.
52 00 53 00 49 00 4f 00 4e 00 5f 00 49 00 4e 00 R.S.I.O.N._.I.N.
46 00 4f 00 22 00 21 00 0a 00 00 00 56 00 53 00 F.O.".!.....V.S.
5f 00 56 00 45 00 52 00 53 00 49 00 4f 00 4e 00 _.V.E.R.S.I.O.N.
5f 00 49 00 4e 00 46 00 4f 00 00 00 00 00 00 00 _.I.N.F.O.......
54 00 79 00 70 00 65 00 20 00 25 00 68 00 75 00 T.y.p.e. .%.h.u.
20 00 6f 00 66 00 20 00 76 00 61 00 6c 00 75 00 .o.f. .v.a.l.u.
65 00 20 00 69 00 6e 00 20 00 27 00 56 00 45 00 e. .i.n. .'.V.E.
52 00 53 00 49 00 4f 00 4e 00 49 00 4e 00 46 00 R.S.I.O.N.I.N.F.
4f 00 27 00 20 00 6e 00 6f 00 74 00 20 00 27 00 O.'. .n.o.t. .'.
56 00 53 00 5f 00 42 00 49 00 4e 00 41 00 52 00 V.S._.B.I.N.A.R.
59 00 27 00 21 00 0a 00 00 00 00 00 00 00 00 00 Y.'.!...........
53 00 69 00 7a 00 65 00 20 00 25 00 68 00 75 00 S.i.z.e. .%.h.u.
20 00 6f 00 66 00 20 00 76 00 61 00 6c 00 75 00 .o.f. .v.a.l.u.
65 00 20 00 69 00 6e 00 20 00 27 00 56 00 45 00 e. .i.n. .'.V.E.
52 00 53 00 49 00 4f 00 4e 00 49 00 4e 00 46 00 R.S.I.O.N.I.N.F.
4f 00 27 00 20 00 64 00 69 00 66 00 66 00 65 00 O.'. .d.i.f.f.e.
72 00 73 00 20 00 66 00 72 00 6f 00 6d 00 20 00 r.s. .f.r.o.m. .
73 00 69 00 7a 00 65 00 20 00 25 00 6c 00 75 00 s.i.z.e. .%.l.u.
20 00 6f 00 66 00 20 00 27 00 56 00 53 00 5f 00 .o.f. .'.V.S._.
46 00 49 00 58 00 45 00 44 00 46 00 49 00 4c 00 F.I.X.E.D.F.I.L.
45 00 49 00 4e 00 46 00 4f 00 27 00 21 00 0a 00 E.I.N.F.O.'.!...
00 00 00 00 00 00 00 00 53 00 69 00 7a 00 65 00 ........S.i.z.e.
20 00 25 00 68 00 75 00 20 00 69 00 6e 00 20 00 .%.h.u. .i.n. .
27 00 56 00 45 00 52 00 53 00 49 00 4f 00 4e 00 '.V.E.R.S.I.O.N.
49 00 4e 00 46 00 4f 00 27 00 20 00 64 00 69 00 I.N.F.O.'. .d.i.
66 00 66 00 65 00 72 00 73 00 20 00 66 00 72 00 f.f.e.r.s. .f.r.
6f 00 6d 00 20 00 73 00 69 00 7a 00 65 00 20 00 o.m. .s.i.z.e. .
6f 00 66 00 20 00 27 00 56 00 45 00 52 00 53 00 o.f. .'.V.E.R.S.
49 00 4f 00 4e 00 27 00 20 00 72 00 65 00 73 00 I.O.N.'. .r.e.s.
6f 00 75 00 72 00 63 00 65 00 21 00 0a 00 00 00 o.u.r.c.e.!.....
09 00 09 00 09 00 55 00 54 00 46 00 2d 00 37 00 ......U.T.F.-.7.
0d 00 0a 00 00 00 00 00 09 00 09 00 09 00 41 00 ..............A.
53 00 43 00 49 00 49 00 20 00 3d 00 20 00 25 00 S.C.I.I. .=. .%.
2e 00 39 00 39 00 39 00 68 00 73 00 0d 00 0a 00 ..9.9.9.h.s.....
00 00 00 00 09 00 09 00 09 00 55 00 54 00 46 00 ..........U.T.F.
2d 00 38 00 20 00 3d 00 20 00 25 00 2e 00 39 00 -.8. .=. .%...9.
39 00 39 00 68 00 73 00 0d 00 0a 00 00 00 00 00 9.9.h.s.........
09 00 09 00 09 00 55 00 54 00 46 00 2d 00 31 00 ......U.T.F.-.1.
36 00 4c 00 45 00 20 00 3d 00 20 00 25 00 2e 00 6.L.E. .=. .%...
39 00 39 00 39 00 6c 00 73 00 0d 00 0a 00 00 00 9.9.9.l.s.......
09 00 09 00 09 00 55 00 54 00 46 00 2d 00 31 00 ......U.T.F.-.1.
36 00 42 00 45 00 0d 00 0a 00 00 00 09 00 09 00 6.B.E...........
09 00 55 00 54 00 46 00 2d 00 33 00 32 00 4c 00 ..U.T.F.-.3.2.L.
45 00 0d 00 0a 00 00 00 09 00 09 00 09 00 55 00 E.............U.
54 00 46 00 2d 00 33 00 32 00 42 00 45 00 0d 00 T.F.-.3.2.B.E...
0a 00 00 00 09 00 09 00 09 00 25 00 6c 00 75 00 ..........%.l.u.
20 00 3d 00 20 00 30 00 78 00 25 00 30 00 34 00 .=. .0.x.%.0.4.
6c 00 58 00 0d 00 0a 00 00 00 00 00 00 00 00 00 l.X.............
09 00 09 00 09 00 44 00 61 00 74 00 61 00 20 00 ......D.a.t.a. .
48 00 61 00 6e 00 64 00 6c 00 65 00 20 00 3d 00 H.a.n.d.l.e. .=.
20 00 30 00 78 00 25 00 70 00 3a 00 20 00 4f 00 .0.x.%.p.:. .O.
66 00 66 00 73 00 65 00 74 00 20 00 3d 00 20 00 f.f.s.e.t. .=. .
30 00 78 00 25 00 30 00 38 00 6c 00 58 00 0d 00 0.x.%.0.8.l.X...
0a 00 00 00 4c 00 6f 00 63 00 6b 00 52 00 65 00 ....L.o.c.k.R.e.
73 00 6f 00 75 00 72 00 63 00 65 00 28 00 29 00 s.o.u.r.c.e.(.).
20 00 72 00 65 00 74 00 75 00 72 00 6e 00 65 00 .r.e.t.u.r.n.e.
64 00 20 00 4e 00 55 00 4c 00 4c 00 0a 00 00 00 d. .N.U.L.L.....
4c 00 6f 00 61 00 64 00 52 00 65 00 73 00 6f 00 L.o.a.d.R.e.s.o.
75 00 72 00 63 00 65 00 00 00 00 00 00 00 00 00 u.r.c.e.........
09 00 09 00 09 00 49 00 6e 00 66 00 6f 00 20 00 ......I.n.f.o. .
48 00 61 00 6e 00 64 00 6c 00 65 00 20 00 3d 00 H.a.n.d.l.e. .=.
20 00 30 00 78 00 25 00 70 00 3a 00 20 00 4c 00 .0.x.%.p.:. .L.
65 00 6e 00 67 00 74 00 68 00 20 00 3d 00 20 00 e.n.g.t.h. .=. .
25 00 6c 00 75 00 0d 00 0a 00 00 00 53 00 69 00 %.l.u.......S.i.
7a 00 65 00 6f 00 66 00 52 00 65 00 73 00 6f 00 z.e.o.f.R.e.s.o.
75 00 72 00 63 00 65 00 00 00 00 00 09 00 09 00 u.r.c.e.........
4c 00 61 00 6e 00 67 00 75 00 61 00 67 00 65 00 L.a.n.g.u.a.g.e.
49 00 44 00 3a 00 20 00 25 00 68 00 75 00 20 00 I.D.:. .%.h.u. .
3d 00 20 00 30 00 78 00 25 00 30 00 34 00 68 00 =. .0.x.%.0.4.h.
58 00 0d 00 0a 00 00 00 47 00 65 00 74 00 4c 00 X.......G.e.t.L.
6f 00 63 00 61 00 6c 00 65 00 49 00 6e 00 66 00 o.c.a.l.e.I.n.f.
6f 00 00 00 00 00 00 00 09 00 09 00 4c 00 61 00 o...........L.a.
6e 00 67 00 75 00 61 00 67 00 65 00 49 00 44 00 n.g.u.a.g.e.I.D.
3a 00 20 00 25 00 68 00 75 00 20 00 3d 00 20 00 :. .%.h.u. .=. .
30 00 78 00 25 00 30 00 34 00 68 00 58 00 20 00 0.x.%.0.4.h.X. .
3b 00 20 00 25 00 6c 00 73 00 2c 00 20 00 25 00 ;. .%.l.s.,. .%.
6c 00 73 00 0d 00 0a 00 00 00 00 00 00 00 00 00 l.s.............
09 00 09 00 4c 00 61 00 6e 00 67 00 75 00 61 00 ....L.a.n.g.u.a.
67 00 65 00 49 00 44 00 3a 00 20 00 30 00 20 00 g.e.I.D.:. .0. .
3d 00 20 00 30 00 78 00 30 00 30 00 30 00 30 00 =. .0.x.0.0.0.0.
20 00 3b 00 20 00 4e 00 65 00 75 00 74 00 72 00 .;. .N.e.u.t.r.
61 00 6c 00 0d 00 0a 00 00 00 00 00 25 00 6c 00 a.l.........%.l.
73 00 28 00 29 00 20 00 72 00 65 00 74 00 75 00 s.(.). .r.e.t.u.
72 00 6e 00 65 00 64 00 20 00 65 00 72 00 72 00 r.n.e.d. .e.r.r.
6f 00 72 00 20 00 25 00 6c 00 75 00 0a 00 00 00 o.r. .%.l.u.....
46 00 69 00 6e 00 64 00 52 00 65 00 73 00 6f 00 F.i.n.d.R.e.s.o.
75 00 72 00 63 00 65 00 45 00 78 00 00 00 00 00 u.r.c.e.E.x.....
45 00 6e 00 75 00 6d 00 52 00 65 00 73 00 6f 00 E.n.u.m.R.e.s.o.
75 00 72 00 63 00 65 00 4c 00 61 00 6e 00 67 00 u.r.c.e.L.a.n.g.
75 00 61 00 67 00 65 00 73 00 45 00 78 00 00 00 u.a.g.e.s.E.x...
09 00 4e 00 61 00 6d 00 65 00 3a 00 20 00 25 00 ..N.a.m.e.:. .%.
6c 00 73 00 0d 00 0a 00 00 00 00 00 09 00 49 00 l.s...........I.
44 00 3a 00 20 00 25 00 68 00 75 00 0d 00 0a 00 D.:. .%.h.u.....
00 00 00 00 45 00 6e 00 75 00 6d 00 52 00 65 00 ....E.n.u.m.R.e.
73 00 6f 00 75 00 72 00 63 00 65 00 4e 00 61 00 s.o.u.r.c.e.N.a.
6d 00 65 00 73 00 45 00 78 00 00 00 4e 00 61 00 m.e.s.E.x...N.a.
6d 00 65 00 3a 00 20 00 25 00 6c 00 73 00 0d 00 m.e.:. .%.l.s...
0a 00 00 00 54 00 79 00 70 00 65 00 3a 00 20 00 ....T.y.p.e.:. .
25 00 68 00 75 00 20 00 3b 00 20 00 25 00 6c 00 %.h.u. .;. .%.l.
73 00 0d 00 0a 00 00 00 43 00 6c 00 6f 00 73 00 s.......C.l.o.s.
65 00 48 00 61 00 6e 00 64 00 6c 00 65 00 28 00 e.H.a.n.d.l.e.(.
29 00 00 00 4c 00 6f 00 63 00 61 00 6c 00 46 00 )...L.o.c.a.l.F.
72 00 65 00 65 00 00 00 4d 00 6f 00 64 00 75 00 r.e.e...M.o.d.u.
6c 00 65 00 20 00 27 00 25 00 6c 00 73 00 27 00 l.e. .'.%.l.s.'.
20 00 75 00 6e 00 6c 00 6f 00 61 00 64 00 65 00 .u.n.l.o.a.d.e.
64 00 0a 00 00 00 00 00 46 00 72 00 65 00 65 00 d.......F.r.e.e.
4c 00 69 00 62 00 72 00 61 00 72 00 79 00 00 00 L.i.b.r.a.r.y...
45 00 6e 00 75 00 6d 00 52 00 65 00 73 00 6f 00 E.n.u.m.R.e.s.o.
75 00 72 00 63 00 65 00 54 00 79 00 70 00 65 00 u.r.c.e.T.y.p.e.
73 00 45 00 78 00 00 00 ff fe 4d 00 6f 00 64 00 s.E.x.....M.o.d.
75 00 6c 00 65 00 20 00 27 00 25 00 6c 00 73 00 u.l.e. .'.%.l.s.
27 00 0d 00 0a 00 0d 00 0a 00 00 00 00 00 00 00 '...............
4d 00 6f 00 64 00 75 00 6c 00 65 00 20 00 27 00 M.o.d.u.l.e. .'.
25 00 6c 00 73 00 27 00 20 00 6c 00 6f 00 61 00 %.l.s.'. .l.o.a.
64 00 65 00 64 00 20 00 61 00 74 00 20 00 61 00 d.e.d. .a.t. .a.
64 00 64 00 72 00 65 00 73 00 73 00 20 00 30 00 d.d.r.e.s.s. .0.
78 00 25 00 70 00 0a 00 00 00 00 00 4c 00 6f 00 x.%.p.......L.o.
61 00 64 00 4c 00 69 00 62 00 72 00 61 00 72 00 a.d.L.i.b.r.a.r.
79 00 45 00 78 00 00 00 25 00 6c 00 73 00 28 00 y.E.x...%.l.s.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 3a 00 20 00 73 00 74 00 .%.l.u.:. .s.t.
61 00 6e 00 64 00 61 00 72 00 64 00 20 00 6f 00 a.n.d.a.r.d. .o.
75 00 74 00 70 00 75 00 74 00 20 00 69 00 73 00 u.t.p.u.t. .i.s.
20 00 6e 00 6f 00 74 00 20 00 72 00 65 00 64 00 .n.o.t. .r.e.d.
69 00 72 00 65 00 63 00 74 00 65 00 64 00 20 00 i.r.e.c.t.e.d. .
74 00 6f 00 20 00 61 00 20 00 66 00 69 00 6c 00 t.o. .a. .f.i.l.
65 00 21 00 0a 00 00 00 46 00 6c 00 75 00 73 00 e.!.....F.l.u.s.
68 00 46 00 69 00 6c 00 65 00 42 00 75 00 66 00 h.F.i.l.e.B.u.f.
66 00 65 00 72 00 73 00 00 00 00 00 47 00 65 00 f.e.r.s.....G.e.
74 00 53 00 74 00 64 00 48 00 61 00 6e 00 64 00 t.S.t.d.H.a.n.d.
6c 00 65 00 00 00 00 00 4e 00 6f 00 20 00 61 00 l.e.....N.o. .a.
72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 3a 00 r.g.u.m.e.n.t.:.
20 00 61 00 20 00 73 00 69 00 6e 00 67 00 6c 00 .a. .s.i.n.g.l.
65 00 20 00 28 00 61 00 62 00 73 00 6f 00 6c 00 e. .(.a.b.s.o.l.
75 00 74 00 65 00 20 00 6f 00 72 00 20 00 72 00 u.t.e. .o.r. .r.
65 00 6c 00 61 00 74 00 69 00 76 00 65 00 29 00 e.l.a.t.i.v.e.).
20 00 70 00 61 00 74 00 68 00 20 00 6e 00 61 00 .p.a.t.h. .n.a.
6d 00 65 00 20 00 6f 00 66 00 20 00 61 00 20 00 m.e. .o.f. .a. .
62 00 69 00 6e 00 61 00 72 00 79 00 20 00 6d 00 b.i.n.a.r.y. .m.
6f 00 64 00 75 00 6c 00 65 00 0a 00 20 00 20 00 o.d.u.l.e... . .
20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 . . . . . . . .
20 00 20 00 20 00 28 00 65 00 76 00 65 00 6e 00 . . .(.e.v.e.n.
74 00 75 00 61 00 6c 00 6c 00 79 00 20 00 6c 00 t.u.a.l.l.y. .l.
6f 00 63 00 61 00 74 00 65 00 64 00 20 00 70 00 o.c.a.t.e.d. .p.
65 00 72 00 20 00 44 00 4c 00 4c 00 20 00 73 00 e.r. .D.L.L. .s.
65 00 61 00 72 00 63 00 68 00 20 00 6f 00 72 00 e.a.r.c.h. .o.r.
64 00 65 00 72 00 29 00 20 00 6d 00 75 00 73 00 d.e.r.). .m.u.s.
74 00 20 00 62 00 65 00 20 00 67 00 69 00 76 00 t. .b.e. .g.i.v.
65 00 6e 00 21 00 0a 00 00 00 00 00 43 00 6f 00 e.n.!.......C.o.
6d 00 6d 00 61 00 6e 00 64 00 4c 00 69 00 6e 00 m.m.a.n.d.L.i.n.
65 00 54 00 6f 00 41 00 72 00 67 00 76 00 00 00 e.T.o.A.r.g.v...
60 3c 00 00 00 00 00 00 00 00 00 00 28 3e 00 00 `<..........(>..
00 20 00 00 b4 3c 00 00 00 00 00 00 00 00 00 00 . ...<..........
4c 3e 00 00 54 20 00 00 bc 3c 00 00 00 00 00 00 L>..T ...<......
00 00 00 00 66 3e 00 00 5c 20 00 00 00 00 00 00 ....f>..\ ......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
c4 3c 00 00 d4 3c 00 00 e0 3c 00 00 f8 3c 00 00 .<...<...<...<..
08 3d 00 00 18 3d 00 00 2a 3d 00 00 3c 3d 00 00 .=...=..*=..<=..
4c 3d 00 00 5e 3d 00 00 7a 3d 00 00 92 3d 00 00 L=..^=..z=...=..
a0 3d 00 00 ae 3d 00 00 ba 3d 00 00 c8 3d 00 00 .=...=...=...=..
e0 3d 00 00 f2 3d 00 00 06 3e 00 00 18 3e 00 00 .=...=...>...>..
00 00 00 00 36 3e 00 00 00 00 00 00 58 3e 00 00 ....6>......X>..
00 00 00 00 24 05 57 72 69 74 65 43 6f 6e 73 6f ....$.WriteConso
6c 65 57 00 25 05 57 72 69 74 65 46 69 6c 65 00 leW.%.WriteFile.
25 01 46 69 6c 65 54 69 6d 65 54 6f 53 79 73 74 %.FileTimeToSyst
65 6d 54 69 6d 65 00 00 54 03 4c 6f 63 6b 52 65 emTime..T.LockRe
73 6f 75 72 63 65 00 00 41 03 4c 6f 61 64 52 65 source..A.LoadRe
73 6f 75 72 63 65 00 00 b1 04 53 69 7a 65 6f 66 source....Sizeof
52 65 73 6f 75 72 63 65 00 00 06 02 47 65 74 4c Resource....GetL
6f 63 61 6c 65 49 6e 66 6f 57 00 00 02 02 47 65 ocaleInfoW....Ge
74 4c 61 73 74 45 72 72 6f 72 00 00 4d 01 46 69 tLastError..M.Fi
6e 64 52 65 73 6f 75 72 63 65 45 78 57 00 fd 00 ndResourceExW...
45 6e 75 6d 52 65 73 6f 75 72 63 65 4c 61 6e 67 EnumResourceLang
75 61 67 65 73 45 78 57 00 00 01 01 45 6e 75 6d uagesExW....Enum
52 65 73 6f 75 72 63 65 4e 61 6d 65 73 45 78 57 ResourceNamesExW
00 00 19 01 45 78 69 74 50 72 6f 63 65 73 73 00 ....ExitProcess.
52 00 43 6c 6f 73 65 48 61 6e 64 6c 65 00 48 03 R.CloseHandle.H.
4c 6f 63 61 6c 46 72 65 65 00 62 01 46 72 65 65 LocalFree.b.Free
4c 69 62 72 61 72 79 00 05 01 45 6e 75 6d 52 65 Library...EnumRe
73 6f 75 72 63 65 54 79 70 65 73 45 78 57 00 00 sourceTypesExW..
3e 03 4c 6f 61 64 4c 69 62 72 61 72 79 45 78 57 >.LoadLibraryExW
00 00 57 01 46 6c 75 73 68 46 69 6c 65 42 75 66 ..W.FlushFileBuf
66 65 72 73 00 00 87 01 47 65 74 43 6f 6d 6d 61 fers....GetComma
6e 64 4c 69 6e 65 57 00 64 02 47 65 74 53 74 64 ndLineW.d.GetStd
48 61 6e 64 6c 65 00 00 4b 45 52 4e 45 4c 33 32 Handle..KERNEL32
2e 64 6c 6c 00 00 06 00 43 6f 6d 6d 61 6e 64 4c .dll....CommandL
69 6e 65 54 6f 41 72 67 76 57 00 00 53 48 45 4c ineToArgvW..SHEL
4c 33 32 2e 64 6c 6c 00 35 03 77 76 73 70 72 69 L32.dll.5.wvspri
6e 74 66 57 00 00 55 53 45 52 33 32 2e 64 6c 6c ntfW..USER32.dll
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file RESOURCE.TXT
created in
step 3. to recreate the console application
Portable Executable Resource Enumerator:
CERTUTIL.EXE /DecodeHex /V RESOURCE.TXT RESOURCE.COM
Input Length = 54400 Output Length = 12800 CertUtil: -decodehex command completed successfully.
Overwrite the text file RESOURCE.C
with the following
content:
// Copyright © 2004-2023, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <shellapi.h>
#ifndef MESSAGE_RESOURCE_ANSI
#define MESSAGE_RESOURCE_ANSI 0
#endif
#ifndef RT_MENUEX
#define RT_MENUEX MAKEINTRESOURCE(13)
#endif
#ifndef RT_NAMETABLE
#define RT_NAMETABLE MAKEINTRESOURCE(15)
#endif
#ifndef RT_DIALOGEX
#define RT_DIALOGEX MAKEINTRESOURCE(18)
#endif
#ifndef RT_DLGINIT
#define RT_DLGINIT MAKEINTRESOURCE(240)
#endif
#ifndef RT_TOOLBAR
#define RT_TOOLBAR MAKEINTRESOURCE(241)
#endif
#ifndef RT_LOCALE
#define RT_LOCALE MAKEINTRESOURCE(255)
#endif
typedef struct _VS_VERSIONINFO
{
WORD wSize; // size of 'VERSION' resource
WORD wCount; // = sizeof(VS_FIXEDFILEINFO)
// (number of bytes in binary value)
WORD wType; // = VS_BINARY
WCHAR szKey[16]; // = L"VS_VERSION_INFO"
WORD wPadding; // = 0 (alignment to DWORD)
#if 0
DWORD dwValue[13];
#else
VS_FIXEDFILEINFO vsFFI;
#endif
} VS_VERSIONINFO;
typedef struct _MUI_RESOURCE
{
DWORD dwSignature; // = 0xFECDFECD
DWORD dwSize; // size of "MUI" resource configuration data
DWORD dwVersion; // = 0x00010000
DWORD dwUnknown;
DWORD dwFileType; // = 0x00000011: LN, language-neutral main file
// = 0x00000012: MUI, language-specific satellite file
DWORD dwSystemAttributes;
DWORD dwFallbackLocation; // = 0x00000000: none
// = 0x00000001: internal
// = 0x00000002: external
BYTE bServiceChecksum[16];
BYTE bMainChecksum[16];
DWORD dwReserved[6];
DWORD dwTypeNameMainOffset; // offset and size of named resource types
DWORD dwTypeNameMainSize; // in main file (MULTI_SZ list)
DWORD dwTypeIDMainOffset; // offset and size of unnamed resource types
DWORD dwTypeIDMainSize; // in main file (DWORD array)
DWORD dwTypeNameMUIOffset; // offset and size of named resource types
DWORD dwTypeNameMUISize; // in satellite file (MULTI_SZ list)
DWORD dwTypeIDMUIOffset; // offset and size of unnamed resource types
DWORD dwTypeIDMUISize; // in satellite file (DWORD array)
DWORD dwLanguageNameOffset; // offset and size of language string
DWORD dwLanguageNameSize;
DWORD dwFallbackNameOffset; // offset and size of (ultimate) fallback
DWORD dwFallbackNameSize; // language string
DWORD dwPadding;
// DWORD dwData[0];
} MUI_RESOURCE;
#define MUI_RESOURCE_SIGNATURE 0xFECDFECDUL
#define MUI_RESOURCE_FILETYPE_MAIN 0x00000011UL
#define MUI_RESOURCE_FILETYPE_SATELLITE 0x00000012UL
#define MUI_RESOURCE_FALLBACK_NONE 0x00000000UL
#define MUI_RESOURCE_FALLBACK_INTERNAL 0x00000001UL
#define MUI_RESOURCE_FALLBACK_EXTERNAL 0x00000002UL
__declspec(safebuffers)
BOOL PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
DWORD dwBuffer;
DWORD dwConsole;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
if (!WriteConsole(hConsole, szBuffer, dwBuffer, &dwConsole, NULL))
return FALSE;
return dwConsole == dwBuffer;
}
__declspec(safebuffers)
BOOL PrintFormat(HANDLE hFile, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
LPBYTE lpBuffer = (LPBYTE) szBuffer;
DWORD dwBuffer;
DWORD dwFile;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
dwBuffer *= sizeof(*szBuffer);
do
{
if (!WriteFile(hFile, lpBuffer, dwBuffer, &dwFile, (LPOVERLAPPED) NULL))
return FALSE;
lpBuffer += dwFile;
dwBuffer -= dwFile;
} while (dwBuffer > 0);
return TRUE;
}
#define PrintString(HANDLE, LITERAL) PrintDirect(HANDLE, LITERAL, sizeof(LITERAL) / sizeof(*LITERAL) - 1UL)
__inline
BOOL WINAPI PrintDirect(HANDLE hFile, LPCWSTR lpString, DWORD dwString)
{
DWORD dwFile;
dwString *= sizeof(*lpString);
do
{
if (!WriteFile(hFile, lpString, dwString, &dwFile, (LPOVERLAPPED) NULL))
return FALSE;
lpString = (LPCWSTR) ((LPBYTE) lpString + dwFile);
dwString -= dwFile;
} while (dwString > 0);
return TRUE;
}
__inline
LPCWSTR WINAPI MUIFileType(DWORD dwFileType)
{
switch (dwFileType)
{
case MUI_RESOURCE_FILETYPE_MAIN:
return L"LN: language-neutral main file";
case MUI_RESOURCE_FILETYPE_SATELLITE:
return L"MUI: language-specific satellite file";
default:
return NULL;
}
}
__inline
LPCWSTR WINAPI MUIFallbackLocation(DWORD dwFallbackLocation)
{
switch (dwFallbackLocation)
{
case MUI_RESOURCE_FALLBACK_NONE:
return L"none";
case MUI_RESOURCE_FALLBACK_INTERNAL:
return L"internal";
case MUI_RESOURCE_FALLBACK_EXTERNAL:
return L"external";
default:
return NULL;
}
}
LPCWSTR WINAPI ResourceTypeName(WORD wResType)
{
switch (wResType)
{
case RT_CURSOR: // MAKEINTRESOURCE(1)
return L"RT_CURSOR";
case RT_BITMAP: // MAKEINTRESOURCE(2)
return L"RT_BITMAP";
case RT_ICON: // MAKEINTRESOURCE(3)
return L"RT_ICON";
case RT_MENU: // MAKEINTRESOURCE(4)
return L"RT_MENU";
case RT_DIALOG: // MAKEINTRESOURCE(5)
return L"RT_DIALOG";
case RT_STRING: // MAKEINTRESOURCE(6)
#if 1
return L"RT_STRING";
#else
return L"RT_STRINGTABLE";
#endif
case RT_FONTDIR: // MAKEINTRESOURCE(7)
return L"RT_FONTDIR";
case RT_FONT: // MAKEINTRESOURCE(8)
return L"RT_FONT";
case RT_ACCELERATOR: // MAKEINTRESOURCE(9)
return L"RT_ACCELERATOR";
case RT_RCDATA: // MAKEINTRESOURCE(10)
return L"RT_RCDATA";
case RT_MESSAGETABLE: // MAKEINTRESOURCE(11)
return L"RT_MESSAGETABLE";
case RT_GROUP_CURSOR: // MAKEINTRESOURCE(12)
return L"RT_GROUP_CURSOR";
case RT_MENUEX: // MAKEINTRESOURCE(13)
return L"RT_MENUEX";
case RT_GROUP_ICON: // MAKEINTRESOURCE(14)
return L"RT_GROUP_ICON";
case RT_NAMETABLE: // MAKEINTRESOURCE(15)
return L"RT_NAMETABLE";
case RT_VERSION: // MAKEINTRESOURCE(16)
return L"RT_VERSION";
case RT_DLGINCLUDE: // MAKEINTRESOURCE(17)
return L"RT_DLGINCLUDE";
case RT_DIALOGEX: // MAKEINTRESOURCE(18)
return L"RT_DIALOGEX";
case RT_PLUGPLAY: // MAKEINTRESOURCE(19)
return L"RT_PLUGPLAY";
case RT_VXD: // MAKEINTRESOURCE(20)
return L"RT_VXD";
case RT_ANICURSOR: // MAKEINTRESOURCE(21)
return L"RT_ANICURSOR";
case RT_ANIICON: // MAKEINTRESOURCE(22)
return L"RT_ANIICON";
case RT_HTML: // MAKEINTRESOURCE(23)
return L"RT_HTML";
case RT_MANIFEST: // MAKEINTRESOURCE(24)
return L"RT_MANIFEST";
case RT_DLGINIT: // MAKEINTRESOURCE(240)
return L"RT_DLGINIT";
case RT_TOOLBAR: // MAKEINTRESOURCE(241)
return L"RT_TOOLBAR";
case RT_LOCALE: // MAKEINTRESOURCE(255)
return L"RT_LOCALE";
default:
return NULL;
}
}
LPCWSTR WINAPI ResourceLanguageName(WORD wLanguageID, BOOL bSymbolic)
{
switch (wLanguageID)
{
case 0x0000: // = MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_NEUTRAL, SUBLANG_NEUTRAL"
: L"Neutral locale language, neutral sublanguage";
case 0x0400: // = MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT) = LANG_USER_DEFAULT
return bSymbolic ? L"LANG_NEUTRAL, SUBLANG_DEFAULT"
: L"User default locale language, user default sublanguage";
case 0x0800: // = MAKELANGID(LANG_NEUTRAL, SUBLANG_SYS_DEFAULT) = LANG_SYSTEM_DEFAULT
return bSymbolic ? L"LANG_NEUTRAL, SUBLANG_SYS_DEFAULT"
: L"System default locale language, system default sublanguage";
case 0x0C00: // = MAKELANGID(LANG_NEUTRAL, SUBLANG_CUSTOM_DEFAULT)
return bSymbolic ? L"LANG_NEUTRAL, SUBLANG_CUSTOM_DEFAULT"
: L"Default custom locale language, default custom sublanguage";
case 0x1000: // = MAKELANGID(LANG_NEUTRAL, SUBLANG_CUSTOM_UNSPECIFIED)
return bSymbolic ? L"LANG_NEUTRAL, SUBLANG_CUSTOM_UNSPECIFIED"
: L"Unspecified custom locale language, unspecified custom sublanguage";
case 0x1400: // = MAKELANGID(LANG_NEUTRAL, SUBLANG_UI_CUSTOM_DEFAULT)
return bSymbolic ? L"LANG_NEUTRAL, SUBLANG_UI_CUSTOM_DEFAULT"
: L"Default custom MUI locale language, default custom MUI sublanguage";
case 0x0001: // = MAKELANGID(LANG_ARABIC, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_NEUTRAL"
: L"Arabic (ar)";
case 0x0401: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_SAUDI_ARABIA)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_SAUDI_ARABIA"
: L"Arabic (ar), Saudi Arabia (SA)";
case 0x0801: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_IRAQ)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_IRAQ"
: L"Arabic (ar), Iraq (IQ)";
case 0x0C01: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_EGYPT)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_EGYPT"
: L"Arabic (ar), Egypt (EG)";
case 0x1001: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_LIBYA)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_LIBYA"
: L"Arabic (ar), Libya (LY)";
case 0x1401: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_ALGERIA)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_ALGERIA"
: L"Arabic (ar), Algeria (DZ)";
case 0x1801: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_MOROCCO)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_MOROCCO"
: L"Arabic (ar), Morocco (MA)";
case 0x1C01: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_TUNISIA)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_TUNISIA"
: L"Arabic (ar), Tunisia (TN)";
case 0x2001: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_OMAN)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_OMAN"
: L"Arabic (ar), Oman (OM)";
case 0x2401: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_YEMEN)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_YEMEN"
: L"Arabic (ar), Yemen (YE)";
case 0x2801: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_SYRIA)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_SYRIA"
: L"Arabic (ar), Syria (SY)";
case 0x2C01: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_JORDAN)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_JORDAN"
: L"Arabic (ar), Jordan (JO)";
case 0x3001: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_LEBANON)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_LEBANON"
: L"Arabic (ar), Lebanon (LB)";
case 0x3401: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_KUWAIT)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_KUWAIT"
: L"Arabic (ar), Kuwait (KW)";
case 0x3801: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_UAE)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_UAE"
: L"Arabic (ar), United Arab Emirates (AE)";
case 0x3C01: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_BAHRAIN)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_BAHRAIN"
: L"Arabic (ar), Bahrain (BH)";
case 0x4001: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_QATAR)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_QATAR"
: L"Arabic (ar), Qatar (QA)";
case 0x4401: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_PSEUDO_SAUDI_ARABIA)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_PSEUDO_SAUDI_ARABIA"
: L"Arabic (ar), Pseudo locale (Ploc), Saudi Arabia (SA)";
case 0x4801: // = MAKELANGID(LANG_ARABIC, SUBLANG_ARABIC_PALESTINE)
return bSymbolic ? L"LANG_ARABIC, SUBLANG_ARABIC_PALESTINE"
: L"Arabic (ar), Occupied Palestinian Territory (145)";
case 0x0002: // = MAKELANGID(LANG_BULGARIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_BULGARIAN, SUBLANG_NEUTRAL"
: L"Bulgarian (bg)";
case 0x0402: // = MAKELANGID(LANG_BULGARIAN, SUBLANG_BULGARIAN_BULGARIA)
return bSymbolic ? L"LANG_BULGARIAN, SUBLANG_BULGARIAN_BULGARIA"
: L"Bulgarian (bg), Bulgaria (BG)";
case 0x0003: // = MAKELANGID(LANG_CATALAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_CATALAN, SUBLANG_NEUTRAL"
: L"Catalan (ca)";
case 0x0403: // = MAKELANGID(LANG_CATALAN, SUBLANG_CATALAN_CATALAN)
return bSymbolic ? L"LANG_CATALAN, SUBLANG_CATALAN_CATALAN"
: L"Catalan (ca), Spain (ES)";
case 0x0803: // = MAKELANGID(LANG_VALENCIAN, SUBLANG_VALENCIAN_VALENCIA)
return bSymbolic ? L"LANG_VALENCIAN, SUBLANG_VALENCIAN_VALENCIA"
: L"Valencian (ca), Valencia (ES-Valencia)";
case 0x0004: // = MAKELANGID(LANG_CHINESE, SUBLANG_CHINESE_SIMPLIFIED)
return bSymbolic ? L"LANG_CHINESE, SUBLANG_CHINESE_SIMPLIFIED"
: L"Chinese (zh), Simplified (Hans)";
case 0x0404: // = MAKELANGID(LANG_CHINESE, SUBLANG_CHINESE_TAIWAN)
return bSymbolic ? L"LANG_CHINESE, SUBLANG_CHINESE_TAIWAN"
: L"Chinese (zh), Taiwan (TW)";
case 0x0804: // = MAKELANGID(LANG_CHINESE, SUBLANG_CHINESE_PRC)
return bSymbolic ? L"LANG_CHINESE, SUBLANG_CHINESE_PRC"
: L"Chinese (zh), People\'s Republic of China (CN)";
case 0x0C04: // = MAKELANGID(LANG_CHINESE, SUBLANG_CHINESE_HONGKONG)
return bSymbolic ? L"LANG_CHINESE, SUBLANG_CHINESE_HONGKONG"
: L"Chinese (zh), Hongkong S.A.R. (HK)";
case 0x1004: // = MAKELANGID(LANG_CHINESE, SUBLANG_CHINESE_SINGAPORE)
return bSymbolic ? L"LANG_CHINESE, SUBLANG_CHINESE_SINGAPORE"
: L"Chinese (zh), Singapore (SG)";
case 0x1404: // = MAKELANGID(LANG_CHINESE, SUBLANG_CHINESE_MACAU)
return bSymbolic ? L"LANG_CHINESE, SUBLANG_CHINESE_MACAU"
: L"Chinese (zh), Macao S.A.R. (MO)";
case 0x7804: // = MAKELANGID(LANG_CHINESE, SUBLANG_CHINESE)
return bSymbolic ? L"LANG_CHINESE, SUBLANG_CHINESE"
: L"Chinese (zh)";
case 0x7C04: // = MAKELANGID(LANG_CHINESE, SUBLANG_CHINESE_TRADITIONAL) = LANG_CHINESE_TRADITIONAL
return bSymbolic ? L"LANG_CHINESE, SUBLANG_CHINESE_TRADITIONAL"
: L"Chinese (zh), Traditional (Hant)";
case 0x0005: // = MAKELANGID(LANG_CZECH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_CZECH, SUBLANG_NEUTRAL"
: L"Czech (cs)";
case 0x0405: // = MAKELANGID(LANG_CZECH, SUBLANG_CZECH_CZECH_REPUBLIC)
return bSymbolic ? L"LANG_CZECH, SUBLANG_CZECH_CZECH_REPUBLIC"
: L"Czech (cs), Czech Republic (CZ)";
case 0x0006: // = MAKELANGID(LANG_DANISH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_DANISH, SUBLANG_NEUTRAL"
: L"Danish (da)";
case 0x0406: // = MAKELANGID(LANG_DANISH, SUBLANG_DANISH_DENMARK)
return bSymbolic ? L"LANG_DANISH, SUBLANG_DANISH_DENMARK"
: L"Danish (da), Denmark (DK)";
case 0x0007: // = MAKELANGID(LANG_GERMAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_GERMAN, SUBLANG_NEUTRAL"
: L"German (de)";
#if 0
case 0x0407: // = MAKELANGID(LANG_GERMAN, SUBLANG_GERMAN)
return bSymbolic ? L"LANG_GERMAN, SUBLANG_GERMAN"
: L"German (de), Germany (DE)";
#else
case 0x0407: // = MAKELANGID(LANG_GERMAN, SUBLANG_GERMAN_GERMANY)
return bSymbolic ? L"LANG_GERMAN, SUBLANG_GERMAN_GERMANY"
: L"German (de), Germany (DE)";
#endif
case 0x0807: // = MAKELANGID(LANG_GERMAN, SUBLANG_GERMAN_SWISS)
return bSymbolic ? L"LANG_GERMAN, SUBLANG_GERMAN_SWISS"
: L"German (de), Switzerland (CH)";
case 0x0C07: // = MAKELANGID(LANG_GERMAN, SUBLANG_GERMAN_AUSTRIAN)
return bSymbolic ? L"LANG_GERMAN, SUBLANG_GERMAN_AUSTRIAN"
: L"German (de), Austria (AT)";
case 0x1007: // = MAKELANGID(LANG_GERMAN, SUBLANG_GERMAN_LUXEMBOURG)
return bSymbolic ? L"LANG_GERMAN, SUBLANG_GERMAN_LUXEMBOURG"
: L"German (de), Luxembourg (LU)";
case 0x1407: // = MAKELANGID(LANG_GERMAN, SUBLANG_GERMAN_LIECHTENSTEIN)
return bSymbolic ? L"LANG_GERMAN, SUBLANG_GERMAN_LIECHTENSTEIN"
: L"German (de), Liechtenstein (LI)";
case 0x0008: // = MAKELANGID(LANG_GREEK, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_GREEK, SUBLANG_NEUTRAL"
: L"Greek (el)";
case 0x0408: // = MAKELANGID(LANG_GREEK, SUBLANG_GREEK_GREECE)
return bSymbolic ? L"LANG_GREEK, SUBLANG_GREEK_GREECE"
: L"Greek (el), Greece (GR)";
case 0x0009: // = MAKELANGID(LANG_ENGLISH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_NEUTRAL"
: L"English (en)";
case 0x0409: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_US)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_US"
: L"English (en), United States (US)";
case 0x0809: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_UK)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_UK"
: L"English (en), United Kingdom (GB)";
case 0x0C09: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_AUS)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_AUS"
: L"English (en), Australia (AU)";
case 0x1009: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_CAN)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_CAN"
: L"English (en), Canada (CA)";
case 0x1409: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_NZ)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_NZ"
: L"English (en), New Zealand (NZ)";
#if 0
case 0x1809: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_EIRE)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_EIRE"
: L"English (en), Ireland (IE)";
#else
case 0x1809: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_IRELAND)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_IRELAND"
: L"English (en), Ireland (IE)";
#endif
case 0x1C09: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_SOUTH_AFRICA)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_SOUTH_AFRICA"
: L"English (en), South Africa (ZA)";
case 0x2009: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_JAMAICA)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_JAMAICA"
: L"English (en), Jamaica (JM)";
case 0x2409: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_CARIBBEAN)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_CARIBBEAN"
: L"English (en), Caribbean (029)";
case 0x2809: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_BELIZE)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_BELIZE"
: L"English (en), Belize (BZ)";
case 0x2C09: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_TRINIDAD)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_TRINIDAD"
: L"English (en), Trinidad and Tobago (TT)";
case 0x3009: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_ZIMBABWE)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_ZIMBABWE"
: L"English (en), Zimbabwe (ZW)";
case 0x3409: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_PHILIPPINES)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_PHILIPPINES"
: L"English (en), Philippines (PH)";
case 0x3809: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_INDONESIA)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_INDONESIO"
: L"English (en), Indonesia (ID)";
case 0x3C09: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_HONGKONG)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_HONGKONG"
: L"English (en), Hongkong S.A.R. (HK)";
case 0x4009: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_INDIA)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_INDIA"
: L"English (en), India (IN)";
case 0x4409: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_MALAYSIA)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_MALAYSIA"
: L"English (en), Malaysia (MY)";
case 0x4809: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_SINGAPORE)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_SINGAPORE"
: L"English (en), Singapore (SG)";
case 0x4C09: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_UAE)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_UAE"
: L"English (en), United Arab Emirates (AE)";
case 0x5009: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_BAHRAIN)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_BAHRAIN"
: L"English (en), Bahrain (BH)";
case 0x5409: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_EGYPT)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_EGYPT"
: L"English (en), Egypt (EG)";
case 0x5809: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_JORDAN)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_JORDAN"
: L"English (en), Jordan (JO)";
case 0x5C09: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_KUWAIT)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_KUWAIT"
: L"English (en), Kuwait (KW)";
case 0x6009: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_TURKEY)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_TURKEY"
: L"English (en), Turkey (TR)";
case 0x6409: // = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_YEMEN)
return bSymbolic ? L"LANG_ENGLISH, SUBLANG_ENGLISH_YEMEN"
: L"English (en), Yemen (YE)";
case 0x000A: // = MAKELANGID(LANG_SPANISH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_NEUTRAL"
: L"Spanish (es)";
#if 0
case 0x040A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH"
: L"Spanish (es), Spain (ES), Traditional Sort";
#else
case 0x040A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_SPAIN)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_SPAIN"
: L"Spanish (es), Spain (ES), Traditional Sort";
#endif
case 0x080A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_MEXICAN)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_MEXICAN"
: L"Spanish (es), Mexico (MX)";
case 0x0C0A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_MODERN)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_MODERN"
: L"Spanish (es), Spain (ES), Modern Sort";
case 0x100A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_GUATEMALA)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_GUATEMALA"
: L"Spanish (es), Guatemala (GT)";
case 0x140A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_COSTA_RICA)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_COSTA_RICA"
: L"Spanish (es), Costa Rica (CR)";
case 0x180A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_PANAMA)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_PANAMA"
: L"Spanish (es), Panama (PA)";
case 0x1C0A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_DOMINICAN_REPUBLIC)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_DOMINICAN_REPUBLIC"
: L"Spanish (es), Dominican Republic (DO)";
case 0x200A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_VENEZUELA)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_VENEZUELA"
: L"Spanish (es), Venezuela (VE)";
case 0x240A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_COLOMBIA)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_COLOMBIA"
: L"Spanish (es), Colombia (CO)";
case 0x280A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_PERU)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_PERU"
: L"Spanish (es), Peru (PE)";
case 0x2C0A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_ARGENTINA)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_ARGENTINA"
: L"Spanish (es), Argentina (AR)";
case 0x300A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_ECUADOR)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_ECUADOR"
: L"Spanish (es), Ecuador (EC)";
case 0x340A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_CHILE)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_CHILE"
: L"Spanish (es), Chile (CL)";
case 0x380A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_URUGUAY)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_URUGUAY"
: L"Spanish (es), Uruguay (UY)";
case 0x3C0A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_PARAGUAY)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_PARAGUAY"
: L"Spanish (es), Paraguay (PY)";
case 0x400A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_BOLIVIA)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_BOLIVIA"
: L"Spanish (es), Bolivia (BO)";
case 0x440A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_EL_SALVADOR)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_EL_SALVADOR"
: L"Spanish (es), El Salvador (SV)";
case 0x480A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_HONDURAS)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_HONDURAS"
: L"Spanish (es), Honduras (HN)";
case 0x4C0A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_NICARAGUA)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_NICARAGUA"
: L"Spanish (es), Nicaragua (NI)";
case 0x500A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_PUERTO_RICO)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_PUERTO_RICO"
: L"Spanish (es), Puerto Rico (PR)";
case 0x540A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_US)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_US"
: L"Spanish (es), United States (US)";
case 0x580A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_LATIN_AMERICA)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_LATIN_AMERICA"
: L"Spanish (es), Latin America (419)";
case 0x5C0A: // = MAKELANGID(LANG_SPANISH, SUBLANG_SPANISH_CUBA)
return bSymbolic ? L"LANG_SPANISH, SUBLANG_SPANISH_CUBA"
: L"Spanish (es), Cuba (CU)";
case 0x000B: // = MAKELANGID(LANG_FINNISH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_FINNISH, SUBLANG_NEUTRAL"
: L"Finnish (fi)";
case 0x040B: // = MAKELANGID(LANG_FINNISH, SUBLANG_FINNISH_FINLAND)
return bSymbolic ? L"LANG_FINNISH, SUBLANG_FINNISH_FINLAND"
: L"Finnish (fi), Finland (FI)";
case 0x000C: // = MAKELANGID(LANG_FRENCH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_NEUTRAL"
: L"French (fr)";
#if 0
case 0x040C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH"
: L"French (fr), France (FR)";
#else
case 0x040C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_FRANCE)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_FRANCE"
: L"French (fr), France (FR)";
#endif
case 0x080C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_BELGIAN)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_BELGIAN"
: L"French (fr), Belgium (BE)";
case 0x0C0C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_CANADIAN)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_CANADIAN"
: L"French (fr), Canada (CA)";
case 0x100C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_SWISS)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_SWISS"
: L"French (fr), Switzerland (CH)";
case 0x140C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_LUXEMBOURG)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_LUXEMBOURG"
: L"French (fr), Luxembourg (LU)";
case 0x180C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_MONACO)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_MONACO"
: L"French (fr), Monaco (MC)";
#if 0
case 0x1C0C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_WEST_INDIES)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_WEST_INDIES"
: L"French (fr), West Indies (WI)";
#else
case 0x1C0C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_CARIBBEAN)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_CARIBBEAN"
: L"French (fr), Caribbean (029)";
#endif
case 0x200C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_REUNION)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_REUNION"
: L"French (fr), Reunion (RE)";
case 0x240C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_CONGO)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_CONGO"
: L"French (fr), Congo (CD)";
case 0x280C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_SENEGAL)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_SENEGAL"
: L"French (fr), Senegal (SN)";
case 0x2C0C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_CAMEROON)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_CAMEROON"
: L"French (fr), Cameroon (CM)";
case 0x300C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_COTE_DE_IVOIRE)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_COTE_DE_IVOIRE"
: L"French (fr), Côte d’Ivoire (CI)";
case 0x340C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_MALI)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_MALI"
: L"French (fr), Mali (ML)";
case 0x380C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_MOROCCO)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_MORROCO"
: L"French (fr), Morroco (MA)";
case 0x3C0C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_HAITI)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_HAITI"
: L"French (fr), Haiti (HT)";
#if 0
case 0xE40C: // = MAKELANGID(LANG_FRENCH, SUBLANG_FRENCH_NORTH_AFRICA)
return bSymbolic ? L"LANG_FRENCH, SUBLANG_FRENCH_NORTH_AFRICA"
: L"French (fr), North Africa (015)";
#endif
case 0x000D: // = MAKELANGID(LANG_HEBREW, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_HEBREW, SUBLANG_NEUTRAL"
: L"Hebrew (he)";
case 0x040D: // = MAKELANGID(LANG_HEBREW, SUBLANG_HEBREW_ISRAEL)
return bSymbolic ? L"LANG_HEBREW, SUBLANG_HEBREW_ISRAEL"
: L"Hebrew (he), Israel (IL)";
case 0x000E: // = MAKELANGID(LANG_HUNGARIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_HUNGARIAN, SUBLANG_NEUTRAL"
: L"Hungarian (hu)";
case 0x040E: // = MAKELANGID(LANG_HUNGARIAN, SUBLANG_HUNGARIAN_HUNGARY)
return bSymbolic ? L"LANG_HUNGARIAN, SUBLANG_HUNGARIAN_HUNGARY"
: L"Hungarian (hu), Hungary (HU)";
case 0x000F: // = MAKELANGID(LANG_ICELANDIC, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_ICELANDIC, SUBLANG_NEUTRAL"
: L"Icelandic (is)";
case 0x040F: // = MAKELANGID(LANG_ICELANDIC, SUBLANG_ICELANDIC_ICELAND)
return bSymbolic ? L"LANG_ICELANDIC, SUBLANG_ICELANDIC_ICELAND"
: L"Icelandic (is), Iceland (IS)";
case 0x0010: // = MAKELANGID(LANG_ITALIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_ITALIAN, SUBLANG_NEUTRAL"
: L"Italian (it)";
#if 0
case 0x0410: // = MAKELANGID(LANG_ITALIAN, SUBLANG_ITALIAN)
return bSymbolic ? L"LANG_ITALIAN, SUBLANG_ITALIAN"
: L"Italian (it), Italy (IT)";
#else
case 0x0410: // = MAKELANGID(LANG_ITALIAN, SUBLANG_ITALIAN_ITALY)
return bSymbolic ? L"LANG_ITALIAN, SUBLANG_ITALIAN_ITALY"
: L"Italian (it), Italy (IT)";
#endif
case 0x0810: // = MAKELANGID(LANG_ITALIAN, SUBLANG_ITALIAN_SWISS)
return bSymbolic ? L"LANG_ITALIAN, SUBLANG_ITALIAN_SWISS"
: L"Italian (it), Switzerland (CH)";
case 0x0011: // = MAKELANGID(LANG_JAPANESE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_JAPANESE, SUBLANG_NEUTRAL"
: L"Japanese (ja)";
case 0x0411: // = MAKELANGID(LANG_JAPANESE, SUBLANG_JAPANESE_JAPAN)
return bSymbolic ? L"LANG_JAPANESE, SUBLANG_JAPANESE_JAPAN"
: L"Japanese (ja), Japan (JP)";
case 0x0811: // = MAKELANGID(LANG_JAPANESE, SUBLANG_JAPANESE_PSEUDO_JAPAN)
return bSymbolic ? L"LANG_JAPANESE, SUBLANG_JAPANESE_PSEUDO_JAPAN"
: L"Japanese (ja), Pseudo locale (Ploc), Japan (JP)";
case 0x0012: // = MAKELANGID(LANG_KOREAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_KOREAN, SUBLANG_NEUTRAL"
: L"Korean (ko)";
#if 0
case 0x0412: // = MAKELANGID(LANG_KOREAN, SUBLANG_KOREAN)
return bSymbolic ? L"LANG_KOREAN, SUBLANG_KOREAN"
: L"Korean (ko), Korea (KR)";
#else
case 0x0412: // = MAKELANGID(LANG_KOREAN, SUBLANG_KOREAN_KOREA)
return bSymbolic ? L"LANG_KOREAN, SUBLANG_KOREAN_KOREA"
: L"Korean (ko), Korea (KR)";
#endif
case 0x0013: // = MAKELANGID(LANG_DUTCH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_DUTCH, SUBLANG_NEUTRAL"
: L"Dutch (nl)";
#if 0
case 0x0413: // = MAKELANGID(LANG_DUTCH, SUBLANG_DUTCH)
return bSymbolic ? L"LANG_DUTCH, SUBLANG_DUTCH"
: L"Dutch (nl), Netherlands (NL)";
#else
case 0x0413: // = MAKELANGID(LANG_DUTCH, SUBLANG_DUTCH_NETHERLANDS)
return bSymbolic ? L"LANG_DUTCH, SUBLANG_DUTCH_NETHERLANDS"
: L"Dutch (nl), Netherlands (NL)";
#endif
case 0x0813: // = MAKELANGID(LANG_DUTCH, SUBLANG_DUTCH_BELGIAN)
return bSymbolic ? L"LANG_DUTCH, SUBLANG_DUTCH_BELGIAN"
: L"Dutch (nl), Belgium (BE)";
case 0x0014: // = MAKELANGID(LANG_NORWEGIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_NORWEGIAN, SUBLANG_NEUTRAL"
: L"Norwegian (no)";
case 0x0414: // = MAKELANGID(LANG_NORWEGIAN, SUBLANG_NORWEGIAN_BOKMAL)
return bSymbolic ? L"LANG_NORWEGIAN, SUBLANG_NORWEGIAN_BOKMAL"
: L"Bokmål (nb), Norway (NO)";
case 0x0814: // = MAKELANGID(LANG_NORWEGIAN, SUBLANG_NORWEGIAN_NYNORSK)
return bSymbolic ? L"LANG_NORWEGIAN, SUBLANG_NORWEGIAN_NYNORSK"
: L"Nynorsk (nn), Norway (NO)";
case 0x7814: // = MAKELANGID(LANG_NORWEGIAN, SUBLANG_NYNORSK)
return bSymbolic ? L"LANG_NORWEGIAN, SUBLANG_NYNORSK"
: L"Nynorsk (nn)";
case 0x7C14: // = MAKELANGID(LANG_NORWEGIAN, SUBLANG_BOKMAL)
return bSymbolic ? L"LANG_NORWEGIAN, SUBLANG_BOKMAL"
: L"Bokmål (nb)";
case 0x0015: // = MAKELANGID(LANG_POLISH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_POLISH, SUBLANG_NEUTRAL"
: L"Polish (pl)";
case 0x0415: // = MAKELANGID(LANG_POLISH, SUBLANG_POLISH_POLAND)
return bSymbolic ? L"LANG_POLISH, SUBLANG_POLISH_POLAND"
: L"Polish (pl), Poland (PL)";
case 0x0016: // = MAKELANGID(LANG_PORTUGUESE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_PORTUGUESE, SUBLANG_NEUTRAL"
: L"Portuguese (pt)";
case 0x0416: // = MAKELANGID(LANG_PORTUGUESE, SUBLANG_PORTUGUESE_BRAZILIAN)
return bSymbolic ? L"LANG_PORTUGUESE, SUBLANG_PORTUGUESE_BRAZILIAN"
: L"Portuguese (pt), Brazil (BR)";
#if 0
case 0x0816: // = MAKELANGID(LANG_PORTUGUESE, SUBLANG_PORTUGUESE)
return bSymbolic ? L"LANG_PORTUGUESE, SUBLANG_PORTUGUESE"
: L"Portuguese (pt), Portugal (PT)";
#else
case 0x0816: // = MAKELANGID(LANG_PORTUGUESE, SUBLANG_PORTUGUESE_PORTUGAL)
return bSymbolic ? L"LANG_PORTUGUESE, SUBLANG_PORTUGUESE_PORTUGAL"
: L"Portuguese (pt), Portugal (PT)";
#endif
case 0x0017: // = MAKELANGID(LANG_ROMANSH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_ROMANSH, SUBLANG_NEUTRAL"
: L"Romansh (rm)";
case 0x0417: // = MAKELANGID(LANG_ROMANSH, SUBLANG_ROMANSH_SWITZERLAND)
return bSymbolic ? L"LANG_ROMANSH, SUBLANG_ROMANSH_SWITZERLAND"
: L"Romansh (rm), Switzerland (CH)";
case 0x0018: // = MAKELANGID(LANG_ROMANIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_ROMANIAN, SUBLANG_NEUTRAL"
: L"Romanian (ro)";
case 0x0418: // = MAKELANGID(LANG_ROMANIAN, SUBLANG_ROMANIAN_ROMANIA)
return bSymbolic ? L"LANG_ROMANIAN, SUBLANG_ROMANIAN_ROMANIA"
: L"Romanian (ro), Romania (RO)";
case 0x0818: // = MAKELANGID(LANG_ROMANIAN, SUBLANG_ROMANIAN_MOLDAVIA)
return bSymbolic ? L"LANG_ROMANIAN, SUBLANG_ROMANIAN_MOLDAVIA"
: L"Romanian (ro), Moldova (MD)";
case 0x0019: // = MAKELANGID(LANG_RUSSIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_RUSSIAN, SUBLANG_NEUTRAL"
: L"Russian (ru)";
case 0x0419: // = MAKELANGID(LANG_RUSSIAN, SUBLANG_RUSSIAN_RUSSIA)
return bSymbolic ? L"LANG_RUSSIAN, SUBLANG_RUSSIAN_RUSSIA"
: L"Russian (ru), Russia (RU)";
case 0x0819: // = MAKELANGID(LANG_RUSSIAN, SUBLANG_RUSSIAN_MOLDAVIA)
return bSymbolic ? L"LANG_RUSSIAN, SUBLANG_RUSSIAN_MOLDAVIA"
: L"Russian (ru), Moldova (MD)";
case 0x001A: // = MAKELANGID(LANG_CROATIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_CROATIAN, SUBLANG_NEUTRAL"
: L"Croatian (hr)";
case 0x041A: // = MAKELANGID(LANG_CROATIAN, SUBLANG_CROATIAN_CROATIA)
return bSymbolic ? L"LANG_CROATIAN, SUBLANG_CROATIAN_CROATIA"
: L"Croatian (hr), Croatia (HR)";
case 0x081A: // = MAKELANGID(LANG_SERBIAN, SUBLANG_SERBIAN_LATIN)
return bSymbolic ? L"LANG_SERBIAN, SUBLANG_SERBIAN_LATIN"
: L"Serbian (sr), Latin (Latn), Serbia and Montenegro, Former (CS)";
case 0x0C1A: // = MAKELANGID(LANG_SERBIAN, SUBLANG_SERBIAN_CYRILLIC)
return bSymbolic ? L"LANG_SERBIAN, SUBLANG_SERBIAN_CYRILLIC"
: L"Serbian (sr), Cyrillic (Cyrl), Serbia and Montenegro, Former (CS)";
case 0x101A: // = MAKELANGID(LANG_CROATIAN, SUBLANG_CROATIAN_BOSNIA_HERZEGOVINA_LATIN)
return bSymbolic ? L"LANG_CROATIAN, SUBLANG_CROATIAN_BOSNIA_HERZEGOVINA_LATIN"
: L"Croatian (hr), Latin (Latn), Bosnia and Herzegovina (BA)";
case 0x141A: // = MAKELANGID(LANG_BOSNIAN, SUBLANG_BOSNIAN_BOSNIA_HERZEGOVINA_LATIN)
return bSymbolic ? L"LANG_BOSNIAN, SUBLANG_BOSNIAN_BOSNIA_HERZEGOVINA_LATIN"
: L"Bosnian (bs), Latin (Latn), Bosnia and Herzegovina (BA)";
case 0x181A: // = MAKELANGID(LANG_SERBIAN, SUBLANG_SERBIAN_BOSNIA_HERZEGOVINA_LATIN)
return bSymbolic ? L"LANG_SERBIAN, SUBLANG_SERBIAN_BOSNIA_HERZEGOVINA_LATIN"
: L"Serbian (sr), Latin (Latn), Bosnia and Herzegovina (BA)";
case 0x1C1A: // = MAKELANGID(LANG_SERBIAN, SUBLANG_SERBIAN_BOSNIA_HERZEGOVINA_CYRILLIC)
return bSymbolic ? L"LANG_SERBIAN, SUBLANG_SERBIAN_BOSNIA_HERZEGOVINA_CYRILLIC"
: L"Serbian (sr), Cyrillic (Cyrl), Bosnia and Herzegovina (BA)";
case 0x201A: // = MAKELANGID(LANG_BOSNIAN, SUBLANG_BOSNIAN_BOSNIA_HERZEGOVINA_CYRILLIC)
return bSymbolic ? L"LANG_BOSNIAN, SUBLANG_BOSNIAN_BOSNIA_HERZEGOVINA_CYRILLIC"
: L"Bosnian (bs), Cyrillic (Cyrl), Bosnia and Herzegovina (BA)";
case 0x241A: // = MAKELANGID(LANG_SERBIAN, SUBLANG_SERBIAN_SERBIA_LATIN)
return bSymbolic ? L"LANG_SERBIAN, SUBLANG_SERBIAN_SERBIA_LATIN"
: L"Serbian (sr), Latin (Latn), Serbia (RS)";
case 0x281A: // = MAKELANGID(LANG_SERBIAN, SUBLANG_SERBIAN_SERBIA_CYRILLIC)
return bSymbolic ? L"LANG_SERBIAN, SUBLANG_SERBIAN_SERBIA_CYRILLIC"
: L"Serbian (sr), Cyrillic (Cyrl), Serbia (RS)";
case 0x2C1A: // = MAKELANGID(LANG_SERBIAN, SUBLANG_SERBIAN_MONTENEGRO_LATIN)
return bSymbolic ? L"LANG_SERBIAN, SUBLANG_SERBIAN_MONTENEGRO_LATIN"
: L"Serbian (sr), Latin (Latn), Montenegro (ME)";
case 0x301A: // = MAKELANGID(LANG_SERBIAN, SUBLANG_SERBIAN_MONTENEGRO_CYRILLIC)
return bSymbolic ? L"LANG_SERBIAN, SUBLANG_SERBIAN_MONTENEGRO_CYRILLIC"
: L"Serbian (sr), Cyrillic (Cyrl), Montenegro (ME)";
case 0x641A: // = MAKELANGID(LANG_BOSNIAN, SUBLANG_BOSNIAN_CYRILLIC)
return bSymbolic ? L"LANG_BOSNIAN, SUBLANG_BOSNIAN_CYRILLIC"
: L"Bosnian (bs), Cyrillic (Cyrl)";
case 0x681A: // = MAKELANGID(LANG_BOSNIAN, SUBLANG_BOSNIAN_LATIN)
return bSymbolic ? L"LANG_BOSNIAN, SUBLANG_BOSNIAN_LATIN"
: L"Bosnian (bs), Latin (Latn)";
case 0x6C1A: // = MAKELANGID(LANG_SERBIAN, SUBLANG_SERBIAN_CYRILLIC)
return bSymbolic ? L"LANG_SERBIAN, SUBLANG_SERBIAN_CYRILLIC"
: L"Serbian (sr), Cyrillic (Cyrl)";
case 0x701A: // = MAKELANGID(LANG_SERBIAN, SUBLANG_SERBIAN_LATIN)
return bSymbolic ? L"LANG_SERBIAN, SUBLANG_SERBIAN_LATIN"
: L"Serbian (sr), Latin (Latn)";
case 0x741A: // = MAKELANGID(LANG_SERBIAN, SUBLANG_SERBIAN_CROATIA)
return bSymbolic ? L"LANG_SERBIAN, SUBLANG_SERBIAN_CROATIA"
: L"Serbian (sr), Croatia (HR)";
case 0x781A: // = MAKELANGID(LANG_BOSNIAN, SUBLANG_BOSNIAN) = LANG_BOSNIAN_NEUTRAL
return bSymbolic ? L"LANG_BOSNIAN, SUBLANG_BOSNIAN"
: L"Bosnian (bs)";
case 0x7C1A: // = MAKELANGID(LANG_SERBIAN, SUBLANG_SERBIAN) = LANG_SERBIAN_NEUTRAL
return bSymbolic ? L"LANG_SERBIAN, SUBLANG_SERBIAN"
: L"Serbian (sr)";
case 0x001B: // = MAKELANGID(LANG_SLOVAK, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SLOVAK, SUBLANG_NEUTRAL"
: L"Slovak (sk)";
case 0x041B: // = MAKELANGID(LANG_SLOVAK, SUBLANG_SLOVAK_SLOVAKIA)
return bSymbolic ? L"LANG_SLOVAK, SUBLANG_SLOVAK_SLOVAKIA"
: L"Slovak (sk), Slovakia (SK)";
case 0x001C: // = MAKELANGID(LANG_ALBANIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_ALBANIAN, SUBLANG_NEUTRAL"
: L"Albanian (sq)";
case 0x041C: // = MAKELANGID(LANG_ALBANIAN, SUBLANG_ALBANIAN_ALBANIA)
return bSymbolic ? L"LANG_ALBANIAN, SUBLANG_ALBANIAN_ALBANIA"
: L"Albanian (sq), Albania (AL)";
case 0x001D: // = MAKELANGID(LANG_SWEDISH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SWEDISH, SUBLANG_NEUTRAL"
: L"Swedish (sv)";
#if 0
case 0x041D: // = MAKELANGID(LANG_SWEDISH, SUBLANG_SWEDISH)
return bSymbolic ? L"LANG_SWEDISH, SUBLANG_SWEDISH"
: L"Swedish (sv), Sweden (SE)";
#else
case 0x041D: // = MAKELANGID(LANG_SWEDISH, SUBLANG_SWEDISH_SWEDEN)
return bSymbolic ? L"LANG_SWEDISH, SUBLANG_SWEDISH_SWEDEN"
: L"Swedish (sv), Sweden (SE)";
#endif
case 0x081D: // = MAKELANGID(LANG_SWEDISH, SUBLANG_SWEDISH_FINLAND)
return bSymbolic ? L"LANG_SWEDISH, SUBLANG_SWEDISH_FINLAND"
: L"Swedish (sv), Finland (FI)";
case 0x001E: // = MAKELANGID(LANG_THAI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_THAI, SUBLANG_NEUTRAL"
: L"Thai (th)";
case 0x041E: // = MAKELANGID(LANG_THAI, SUBLANG_THAI_THAILAND)
return bSymbolic ? L"LANG_THAI, SUBLANG_THAI_THAILAND"
: L"Thai (th), Thailand (TH)";
case 0x001F: // = MAKELANGID(LANG_TURKISH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_TURKISH, SUBLANG_NEUTRAL"
: L"Turkish (tr)";
case 0x041F: // = MAKELANGID(LANG_TURKISH, SUBLANG_TURKISH_TURKEY)
return bSymbolic ? L"LANG_TURKISH, SUBLANG_TURKISH_TURKEY"
: L"Turkish (tr), Turkey (TR)";
case 0x0020: // = MAKELANGID(LANG_URDU, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_URDU, SUBLANG_NEUTRAL"
: L"Urdu (ur)";
case 0x0420: // = MAKELANGID(LANG_URDU, SUBLANG_URDU_PAKISTAN)
return bSymbolic ? L"LANG_URDU, SUBLANG_URDU_PAKISTAN"
: L"Urdu (ur), Pakistan (PK)";
case 0x0820: // = MAKELANGID(LANG_URDU, SUBLANG_URDU_INDIA)
return bSymbolic ? L"LANG_URDU, SUBLANG_URDU_INDIA"
: L"Urdu (ur), India (IN)";
case 0x0021: // = MAKELANGID(LANG_INDONESIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_INDONESIAN, SUBLANG_NEUTRAL"
: L"Indonesian (id)";
case 0x0421: // = MAKELANGID(LANG_INDONESIAN, SUBLANG_INDONESIAN_INDONESIA)
return bSymbolic ? L"LANG_INDONESIAN, SUBLANG_INDONESIAN_INDONESIA"
: L"Indonesian (id), Indonesia (ID)";
case 0x0022: // = MAKELANGID(LANG_UKRAINIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_UKRAINIAN, SUBLANG_NEUTRAL"
: L"Ukrainian (uk)";
case 0x0422: // = MAKELANGID(LANG_UKRAINIAN, SUBLANG_UKRAINIAN_UKRAINE)
return bSymbolic ? L"LANG_UKRAINIAN, SUBLANG_UKRAINIAN_UKRAINE"
: L"Ukrainian (uk), Ukraine (UA)";
case 0x0023: // = MAKELANGID(LANG_BELARUSIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_BELARUSIAN, SUBLANG_NEUTRAL"
: L"Belarusian (be)";
case 0x0423: // = MAKELANGID(LANG_BELARUSIAN, SUBLANG_BELARUSIAN_BELARUS)
return bSymbolic ? L"LANG_BELARUSIAN, SUBLANG_BELARUSIAN_BELARUS"
: L"Belarusian (be), Belarus (BY)";
case 0x0024: // = MAKELANGID(LANG_SLOVENIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SLOVENIAN, SUBLANG_NEUTRAL"
: L"Slovenian (sl)";
case 0x0424: // = MAKELANGID(LANG_SLOVENIAN, SUBLANG_SLOVENIAN_SLOVENIA)
return bSymbolic ? L"LANG_SLOVENIAN, SUBLANG_SLOVENIAN_SLOVENIA"
: L"Slovenian (sl), Slovenia (SI)";
case 0x0025: // = MAKELANGID(LANG_ESTONIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_ESTONIAN, SUBLANG_NEUTRAL"
: L"Estonian (et)";
case 0x0425: // = MAKELANGID(LANG_ESTONIAN, SUBLANG_ESTONIAN_ESTONIA)
return bSymbolic ? L"LANG_ESTONIAN, SUBLANG_ESTONIAN_ESTONIA"
: L"Estonian (et), Estonia (EE)";
case 0x0026: // = MAKELANGID(LANG_LATVIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_LATVIAN, SUBLANG_NEUTRAL"
: L"Latvian (lv)";
case 0x0426: // = MAKELANGID(LANG_LATVIAN, SUBLANG_LATVIAN_LATVIA)
return bSymbolic ? L"LANG_LATVIAN, SUBLANG_LATVIAN_LATVIA"
: L"Latvian (lv), Latvia (LV)";
case 0x0027: // = MAKELANGID(LANG_LITHUANIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_LITHUANIAN, SUBLANG_NEUTRAL"
: L"Lithuanian (lt)";
case 0x0427: // = MAKELANGID(LANG_LITHUANIAN, SUBLANG_LITHUANIAN_LITHUANIA)
return bSymbolic ? L"LANG_LITHUANIAN, SUBLANG_LITHUANIAN_LITHUANIA"
: L"Lithuanian (lt), Lithuania (LT)";
case 0x0028: // = MAKELANGID(LANG_TAJIK, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_TAJIK, SUBLANG_NEUTRAL"
: L"Tajik (tg)";
case 0x0428: // = MAKELANGID(LANG_TAJIK, SUBLANG_TAJIK_TAJIKISTAN)
return bSymbolic ? L"LANG_TAJIK, SUBLANG_TAJIK_TAJIKISTAN"
: L"Tajik (tg), Cyrillic (Cyrl), Tajikistan (TJ)";
case 0x7C28: // = MAKELANGID(LANG_TAJIK, SUBLANG_TAJIK_CYRILLIC)
return bSymbolic ? L"LANG_TAJIK, SUBLANG_TAJIK_CYRILLIC"
: L"Tajik (tg), Cyrillic (Cyrl)";
#if 0
case 0x0029: // = MAKELANGID(LANG_FARSI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_FARSI, SUBLANG_NEUTRAL"
: L"Farsi (fa)";
case 0x0429: // = MAKELANGID(LANG_FARSI, SUBLANG_FARSI_IRAN)
return bSymbolic ? L"LANG_FARSI, SUBLANG_FARSI_IRAN"
: L"Farsi (fa), Iran (IR)";
#else
case 0x0029: // = MAKELANGID(LANG_PERSIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_PERSIAN, SUBLANG_NEUTRAL"
: L"Persian (fa)";
case 0x0429: // = MAKELANGID(LANG_PERSIAN, SUBLANG_PERSIAN_IRAN)
return bSymbolic ? L"LANG_PERSIAN, SUBLANG_PERSIAN_IRAN"
: L"Persian (fa), Iran (IR)";
#endif
case 0x002A: // = MAKELANGID(LANG_VIETNAMESE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_VIETNAMESE, SUBLANG_NEUTRAL"
: L"Vietnamese (vi)";
case 0x042A: // = MAKELANGID(LANG_VIETNAMESE, SUBLANG_VIETNAMESE_VIETNAM)
return bSymbolic ? L"LANG_VIETNAMESE, SUBLANG_VIETNAMESE_VIETNAM"
: L"Vietnamese (vi), Vietnam (VN)";
case 0x002B: // = MAKELANGID(LANG_ARMENIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_ARMENIAN, SUBLANG_NEUTRAL"
: L"Armenian (hy)";
case 0x042B: // = MAKELANGID(LANG_ARMENIAN, SUBLANG_ARMENIAN_ARMENIA)
return bSymbolic ? L"LANG_ARMENIAN, SUBLANG_ARMENIAN_ARMENIA"
: L"Armenian (hy), Armenia (AM)";
#if 0
case 0x002C: // = MAKELANGID(LANG_AZERI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_AZERI, SUBLANG_NEUTRAL"
: L"Azeri (az)";
case 0x042C: // = MAKELANGID(LANG_AZERI, SUBLANG_AZERI_AZERBAIJAN_LATIN)
return bSymbolic ? L"LANG_AZERI, SUBLANG_AZERI_AZERBAIJAN_LATIN"
: L"Azeri (az), Latin (Latn), Azerbaijan (AZ)";
case 0x082C: // = MAKELANGID(LANG_AZERI, SUBLANG_AZERI_AZERBAIJAN_CYRILLIC)
return bSymbolic ? L"LANG_AZERI, SUBLANG_AZERI_AZERBAIJAN_CYRILLIC"
: L"Azeri (az), Cyrillic (Cyrl), Azerbaijan (AZ)";
case 0x742C: // = MAKELANGID(LANG_AZERI, SUBLANG_AZERI_CYRILLIC)
return bSymbolic ? L"LANG_AZERI, SUBLANG_AZERI_CYRILLIC"
: L"Azeri (az), Cyrillic (Cyrl)";
case 0x782C: // = MAKELANGID(LANG_AZERI, SUBLANG_AZERI_LATIN)
return bSymbolic ? L"LANG_AZERI, SUBLANG_AZERI_LATIN"
: L"Azeri (az), Latin (Latn)";
#else
case 0x002C: // = MAKELANGID(LANG_AZERBAIJANI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_AZERBAIJANI, SUBLANG_NEUTRAL"
: L"Azerbaijani (az)";
case 0x042C: // = MAKELANGID(LANG_AZERBAIJANI, SUBLANG_AZERBAIJANI_AZERBAIJAN_LATIN)
return bSymbolic ? L"LANG_AZERBAIJANI, SUBLANG_AZERBAIJANI_AZERBAIJAN_LATIN"
: L"Azerbaijani (az), Latin (Latn), Azerbaijan (AZ)";
case 0x082C: // = MAKELANGID(LANG_AZERBAIJANI, SUBLANG_AZERBAIJANI_AZERBAIJAN_CYRILLIC)
return bSymbolic ? L"LANG_AZERBAIJANI, SUBLANG_AZERBAIJANI_AZERBAIJAN_CYRILLIC"
: L"Azerbaijani (az), Cyrillic (Cyrl), Azerbaijan (AZ)";
case 0x742C: // = MAKELANGID(LANG_AZERBAIJANI, SUBLANG_AZERBAIJANI_CYRILLIC)
return bSymbolic ? L"LANG_AZERBAIJANI, SUBLANG_AZERBAIJANI_CYRILLIC"
: L"Azerbaijani (az), Cyrillic (Cyrl)";
case 0x782C: // = MAKELANGID(LANG_AZERBAIJANI, SUBLANG_AZERBAIJANI_LATIN)
return bSymbolic ? L"LANG_AZERBAIJANI, SUBLANG_AZERBAIJANI_LATIN"
: L"Azerbaijani (az), Latin (Latn)";
#endif
case 0x002D: // = MAKELANGID(LANG_BASQUE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_BASQUE, SUBLANG_NEUTRAL"
: L"Basque (eu)";
#if 0
case 0x042D: // = MAKELANGID(LANG_BASQUE, SUBLANG_BASQUE_BASQUE)
return bSymbolic ? L"LANG_BASQUE, SUBLANG_BASQUE_BASQUE"
: L"Basque (eu), Basque (ES)";
#else
case 0x042D: // = MAKELANGID(LANG_BASQUE, SUBLANG_BASQUE_SPAIN)
return bSymbolic ? L"LANG_BASQUE, SUBLANG_BASQUE_SPAIN"
: L"Basque (eu), Spain (ES)";
#endif
case 0x002E: // = MAKELANGID(LANG_UPPER_SORBIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_UPPER_SORBIAN, SUBLANG_NEUTRAL"
: L"Upper Sorbian (hsb)";
case 0x042E: // = MAKELANGID(LANG_UPPER_SORBIAN, SUBLANG_UPPER_SORBIAN_GERMANY)
return bSymbolic ? L"LANG_UPPER_SORBIAN, SUBLANG_UPPER_SORBIAN_GERMANY"
: L"Upper Sorbian (hsb), Germany (DE)";
case 0x082E: // = MAKELANGID(LANG_LOWER_SORBIAN, SUBLANG_LOWER_SORBIAN_GERMANY)
return bSymbolic ? L"LANG_LOWER_SORBIAN, SUBLANG_LOWER_SORBIAN_GERMANY"
: L"Lower Sorbian (dsb), Germany (DE)";
case 0x7C2E: // = MAKELANGID(LANG_LOWER_SORBIAN, SUBLANG_LOWER_SORBIAN)
return bSymbolic ? L"LANG_LOWER_SORBIAN, SUBLANG_LOWER_SORBIAN"
: L"Lower Sorbian (dsb)";
case 0x002F: // = MAKELANGID(LANG_MACEDONIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_MACEDONIAN, SUBLANG_NEUTRAL"
: L"Macedonian (mk)";
case 0x042F: // = MAKELANGID(LANG_MACEDONIAN, SUBLANG_MACEDONIAN_MACEDONIA)
return bSymbolic ? L"LANG_MACEDONIAN, SUBLANG_MACEDONIAN_MACEDONIA"
: L"Macedonian (mk), Macedonia, FYROM (MK)";
#if 0
case 0x0030: // = MAKELANGID(LANG_SUTU, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SUTU, SUBLANG_NEUTRAL"
: L"Sutu (st)";
case 0x0430: // = MAKELANGID(LANG_SUTU, SUBLANG_SUTU_SOUTH_AFRICA)
return bSymbolic ? L"LANG_SUTU, SUBLANG_SUTU_SOUTH_AFRICA"
: L"Sutu (st), South Africa (ZA)";
case 0x0830: // = MAKELANGID(LANG_SUTU, SUBLANG_SUTU_BOTSWANA)
return bSymbolic ? L"LANG_SUTU, SUBLANG_SUTU_BOTSWANA"
: L"Sutu (st), Botswana (BW)";
#else
case 0x0030: // = MAKELANGID(LANG_SESOTHO, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SESOTHO, SUBLANG_NEUTRAL"
: L"Sesotho (st)";
case 0x0430: // = MAKELANGID(LANG_SESOTHO, SUBLANG_SESOTHO_SOUTH_AFRICA)
return bSymbolic ? L"LANG_SESOTHO, SUBLANG_SESOTHO_SOUTH_AFRICA"
: L"Sesotho (st), South Africa (ZA)";
case 0x0830: // = MAKELANGID(LANG_SESOTHO, SUBLANG_SESOTHO_BOTSWANA)
return bSymbolic ? L"LANG_SESOTHO, SUBLANG_SESOTHO_BOTSWANA"
: L"Sesotho (st), Botswana (BW)";
#endif
case 0x0031: // = MAKELANGID(LANG_TSONGA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_TSONGA, SUBLANG_NEUTRAL"
: L"Tsonga (ts)";
case 0x0431: // = MAKELANGID(LANG_TSONGA, SUBLANG_TSONGA_SOUTH_AFRICA)
return bSymbolic ? L"LANG_TSONGA, SUBLANG_TSONGA_SOUTH_AFRICA"
: L"Tsonga (ts), South Africa (ZA)";
case 0x0831: // = MAKELANGID(LANG_TSONGA, SUBLANG_TSONGA_BOTSWANA)
return bSymbolic ? L"LANG_TSONGA, SUBLANG_TSONGA_BOTSWANA"
: L"Tsonga (ts), Botswana (BW)";
#if 0
case 0x0032: // = MAKELANGID(LANG_TSWANA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_TSWANA, SUBLANG_NEUTRAL"
: L"Tswana (tn)";
case 0x0432: // = MAKELANGID(LANG_TSWANA, SUBLANG_TSWANA_SOUTH_AFRICA)
return bSymbolic ? L"LANG_TSWANA, SUBLANG_TSWANA_SOUTH_AFRICA"
: L"Tswana (tn), South Africa (ZA)";
case 0x0832: // = MAKELANGID(LANG_TSWANA, SUBLANG_TSWANA_BOTSWANA)
return bSymbolic ? L"LANG_TSWANA, SUBLANG_TSWANA_BOTSWANA"
: L"Tswana (tn), Botswana (BW)";
#else
case 0x0032: // = MAKELANGID(LANG_SETSWANA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SETSWANA, SUBLANG_NEUTRAL"
: L"Setswana (tn)";
case 0x0432: // = MAKELANGID(LANG_SETSWANA, SUBLANG_SETSWANA_SOUTH_AFRICA)
return bSymbolic ? L"LANG_SETSWANA, SUBLANG_SETSWANA_SOUTH_AFRICA"
: L"Setswana (tn), South Africa (ZA)";
case 0x0832: // = MAKELANGID(LANG_SETSWANA, SUBLANG_SETSWANA_BOTSWANA)
return bSymbolic ? L"LANG_SETSWANA, SUBLANG_SETSWANA_BOTSWANA"
: L"Setswana (tn), Botswana (BW)";
#endif
case 0x0033: // = MAKELANGID(LANG_VENDA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_VENDA, SUBLANG_NEUTRAL"
: L"Venda (ve)";
case 0x0433: // = MAKELANGID(LANG_VENDA, SUBLANG_VENDA_SOUTH_AFRICA)
return bSymbolic ? L"LANG_VENDA, SUBLANG_VENDA_SOUTH_AFRICA"
: L"Venda (ve), South Africa (ZA)";
case 0x0034: // = MAKELANGID(LANG_XHOSA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_XHOSA, SUBLANG_NEUTRAL"
: L"Xhosa (xh)";
case 0x0434: // = MAKELANGID(LANG_XHOSA, SUBLANG_XHOSA_SOUTH_AFRICA)
return bSymbolic ? L"LANG_XHOSA, SUBLANG_XHOSA_SOUTH_AFRICA"
: L"Xhosa (xh), South Africa (ZA)";
case 0x0035: // = MAKELANGID(LANG_ZULU, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_ZULU, SUBLANG_NEUTRAL"
: L"Zulu (zu)";
case 0x0435: // = MAKELANGID(LANG_ZULU, SUBLANG_ZULU_SOUTH_AFRICA)
return bSymbolic ? L"LANG_ZULU, SUBLANG_ZULU_SOUTH_AFRICA"
: L"Zulu (zu), South Africa (ZA)";
case 0x0036: // = MAKELANGID(LANG_AFRIKAANS, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_AFRIKAANS, SUBLANG_NEUTRAL"
: L"Afrikaans (af)";
case 0x0436: // = MAKELANGID(LANG_AFRIKAANS, SUBLANG_AFRIKAANS_SOUTH_AFRICA)
return bSymbolic ? L"LANG_AFRIKAANS, SUBLANG_AFRIKAANS_SOUTH_AFRICA"
: L"Afrikaans (af), South Africa (ZA)";
case 0x0037: // = MAKELANGID(LANG_GEORGIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_GEORGIAN, SUBLANG_NEUTRAL"
: L"Georgian (ka)";
case 0x0437: // = MAKELANGID(LANG_GEORGIAN, SUBLANG_GEORGIAN_GEORGIA)
return bSymbolic ? L"LANG_GEORGIAN, SUBLANG_GEORGIAN_GEORGIA"
: L"Georgian (ka), Georgia (GE)";
case 0x0038: // = MAKELANGID(LANG_FAEROESE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_FAEROESE, SUBLANG_NEUTRAL"
: L"Faroese (fo)";
case 0x0438: // = MAKELANGID(LANG_FAEROESE, SUBLANG_FAEROESE_FAROE_ISLANDS)
return bSymbolic ? L"LANG_FAEROESE, SUBLANG_FAEROESE_FAROE_ISLANDS"
: L"Faroese (fo), Faroe Islands (FO)";
case 0x0039: // = MAKELANGID(LANG_HINDI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_HINDI, SUBLANG_NEUTRAL"
: L"Hindi (hi)";
case 0x0439: // = MAKELANGID(LANG_HINDI, SUBLANG_HINDI_INDIA)
return bSymbolic ? L"LANG_HINDI, SUBLANG_HINDI_INDIA"
: L"Hindi (hi), India (IN)";
case 0x003A: // = MAKELANGID(LANG_MALTESE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_MALTESE, SUBLANG_NEUTRAL"
: L"Maltese (mt)";
case 0x043A: // = MAKELANGID(LANG_MALTESE, SUBLANG_MALTESE_MALTA)
return bSymbolic ? L"LANG_MALTESE, SUBLANG_MALTESE_MALTA"
: L"Maltese (mt), Malta (MT)";
case 0x003B: // = MAKELANGID(LANG_SAMI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SAMI, SUBLANG_NEUTRAL"
: L"Sami (se)";
case 0x043B: // = MAKELANGID(LANG_SAMI, SUBLANG_SAMI_NORTHERN_NORWAY)
return bSymbolic ? L"LANG_SAMI, SUBLANG_SAMI_NORTHERN_NORWAY"
: L"Sami (se), Northern, Norway (NO)";
case 0x083B: // = MAKELANGID(LANG_SAMI, SUBLANG_SAMI_NORTHERN_SWEDEN)
return bSymbolic ? L"LANG_SAMI, SUBLANG_SAMI_NORTHERN_SWEDEN"
: L"Sami (se), Northern, Sweden (SE)";
case 0x0C3B: // = MAKELANGID(LANG_SAMI, SUBLANG_SAMI_NORTHERN_FINLAND)
return bSymbolic ? L"LANG_SAMI, SUBLANG_SAMI_NORTHERN_FINLAND"
: L"Sami (se), Northern, Finland (FI)";
case 0x103B: // = MAKELANGID(LANG_SAMI, SUBLANG_SAMI_LULE_NORWAY)
return bSymbolic ? L"LANG_SAMI, SUBLANG_SAMI_LULE_NORWAY"
: L"Sami (smj), Lule, Norway (NO)";
case 0x143B: // = MAKELANGID(LANG_SAMI, SUBLANG_SAMI_LULE_SWEDEN)
return bSymbolic ? L"LANG_SAMI, SUBLANG_SAMI_LULE_SWEDEN"
: L"Sami (smj), Lule, Sweden (SE)";
case 0x183B: // = MAKELANGID(LANG_SAMI, SUBLANG_SAMI_SOUTHERN_NORWAY)
return bSymbolic ? L"LANG_SAMI, SUBLANG_SAMI_SOUTHERN_NORWAY"
: L"Sami (sma), Southern, Norway (NO)";
case 0x1C3B: // = MAKELANGID(LANG_SAMI, SUBLANG_SAMI_SOUTHERN_SWEDEN)
return bSymbolic ? L"LANG_SAMI, SUBLANG_SAMI_SOUTHERN_SWEDEN"
: L"Sami (sma), Southern, Sweden (SE)";
case 0x203B: // = MAKELANGID(LANG_SAMI, SUBLANG_SAMI_SKOLT_FINLAND)
return bSymbolic ? L"LANG_SAMI, SUBLANG_SAMI_SKOLT_FINLAND"
: L"Sami (sms), Skolt, Finland (FI)";
case 0x243B: // = MAKELANGID(LANG_SAMI, SUBLANG_SAMI_INARI_FINLAND)
return bSymbolic ? L"LANG_SAMI, SUBLANG_SAMI_INARI_FINLAND"
: L"Sami (smn), Inari, Finland (FI)";
case 0x703B: // = MAKELANGID(LANG_SAMI, SUBLANG_SAMI_INARI)
return bSymbolic ? L"LANG_SAMI, SUBLANG_SAMI_INARI"
: L"Sami (smn), Inari";
case 0x743B: // = MAKELANGID(LANG_SAMI, SUBLANG_SAMI_SKOLT)
return bSymbolic ? L"LANG_SAMI, SUBLANG_SAMI_SKOLT"
: L"Sami (sms), Skolt";
case 0x783B: // = MAKELANGID(LANG_SAMI, SUBLANG_SAMI)
return bSymbolic ? L"LANG_SAMI, SUBLANG_SAMI"
: L"Sami (sma)";
case 0x7C3B: // = MAKELANGID(LANG_SAMI, SUBLANG_SAMI_LULE)
return bSymbolic ? L"LANG_SAMI, SUBLANG_SAMI_LULE"
: L"Sami (smj), Lule";
case 0x003C: // = MAKELANGID(LANG_IRISH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_IRISH, SUBLANG_NEUTRAL"
: L"Irish (ga)";
case 0x083C: // = MAKELANGID(LANG_IRISH, SUBLANG_IRISH_IRELAND)
return bSymbolic ? L"LANG_IRISH, SUBLANG_IRISH_IRELAND"
: L"Irish (ga), Ireland (IE)";
case 0x003D: // = MAKELANGID(LANG_YIDDISH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_YIDDISH, SUBLANG_NEUTRAL"
: L"Yiddish (yi)";
case 0x043D: // = MAKELANGID(LANG_YIDDISH, SUBLANG_YIDDISH_HEBREW)
return bSymbolic ? L"LANG_YIDDISH, SUBLANG_YIDDISH_HEBREW"
: L"Yiddish (yi), Hebrew (Hebr)";
case 0x003E: // = MAKELANGID(LANG_MALAY, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_MALAY, SUBLANG_NEUTRAL"
: L"Malay (ms)";
case 0x043E: // = MAKELANGID(LANG_MALAY, SUBLANG_MALAY_MALAYSIA)
return bSymbolic ? L"LANG_MALAY, SUBLANG_MALAY_MALAYSIA"
: L"Malay (ms), Malaysia (MY)";
case 0x083E: // = MAKELANGID(LANG_MALAY, SUBLANG_MALAY_BRUNEI_DARUSSALAM)
return bSymbolic ? L"LANG_MALAY, SUBLANG_MALAY_BRUNEI_DARUSSALAM"
: L"Malay (ms), Brunei Darussalam (BN)";
case 0x003F: // = MAKELANGID(LANG_KAZAK, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_KAZAK, SUBLANG_NEUTRAL"
: L"Kazakh (kk)";
case 0x043F: // = MAKELANGID(LANG_KAZAK, SUBLANG_KAZAK_KAZAKHSTAN)
return bSymbolic ? L"LANG_KAZAK, SUBLANG_KAZAK_KAZAKHSTAN"
: L"Kazakh (kk), Kazakhstan (KZ)";
case 0x0040: // = MAKELANGID(LANG_KYRGYZ, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_KYRGYZ, SUBLANG_NEUTRAL"
: L"Kyrgyz (ky)";
case 0x0440: // = MAKELANGID(LANG_KYRGYZ, SUBLANG_KYRGYZ_KYRGYZSTAN)
return bSymbolic ? L"LANG_KYRGYZ, SUBLANG_KYRGYZ_KYRGYZSTAN"
: L"Kyrgyz (ky), Kyrgyzstan (KG)";
case 0x0041: // = MAKELANGID(LANG_SWAHILI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SWAHILI, SUBLANG_NEUTRAL"
: L"Kiswahili (sw)";
#if 0
case 0x0441: // = MAKELANGID(LANG_SWAHILI, SUBLANG_SWAHILI)
return bSymbolic ? L"LANG_SWAHILI, SUBLANG_SWAHILI"
: L"Kiswahili (sw), Kenya (KE)";
#else
case 0x0441: // = MAKELANGID(LANG_SWAHILI, SUBLANG_SWAHILI_KENYA)
return bSymbolic ? L"LANG_SWAHILI, SUBLANG_SWAHILI_KENYA"
: L"Kiswahili (sw), Kenya (KE)";
#endif
case 0x0042: // = MAKELANGID(LANG_TURKMEN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_TURKMEN, SUBLANG_NEUTRAL"
: L"Turkmen (tk)";
case 0x0442: // = MAKELANGID(LANG_TURKMEN, SUBLANG_TURKMEN_TURKMENISTAN)
return bSymbolic ? L"LANG_TURKMEN, SUBLANG_TURKMEN_TURKMENISTAN"
: L"Turkmen (tk), Turkmenistan (TM)";
case 0x0043: // = MAKELANGID(LANG_UZBEK, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_UZBEK, SUBLANG_NEUTRAL"
: L"Uzbek (uz)";
case 0x0443: // = MAKELANGID(LANG_UZBEK, SUBLANG_UZBEK_UZBEKISTAN_LATIN)
return bSymbolic ? L"LANG_UZBEK, SUBLANG_UZBEK_UZBEKISTAN_LATIN"
: L"Uzbek (uz), Latin (Latn), Uzbekistan (UZ)";
case 0x0843: // = MAKELANGID(LANG_UZBEK, SUBLANG_UZBEK_UZBEKISTAN_CYRILLIC)
return bSymbolic ? L"LANG_UZBEK, SUBLANG_UZBEK_UZBEKISTAN_CYRILLIC"
: L"Uzbek (uz), Cyrillic (Cyrl), Uzbekistan (UZ)";
case 0x7843: // = MAKELANGID(LANG_UZBEK, SUBLANG_UZBEK_CYRILLIC)
return bSymbolic ? L"LANG_UZBEK, SUBLANG_UZBEK_CYRILLIC"
: L"Uzbek (uz), Cyrillic (Cyrl)";
case 0x7C43: // = MAKELANGID(LANG_UZBEK, SUBLANG_UZBEK_LATIN)
return bSymbolic ? L"LANG_UZBEK, SUBLANG_UZBEK_LATIN"
: L"Uzbek (uz), Latin (Latn)";
case 0x0044: // = MAKELANGID(LANG_TATAR, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_TATAR, SUBLANG_NEUTRAL"
: L"Tatar (tt)";
case 0x0444: // = MAKELANGID(LANG_TATAR, SUBLANG_TATAR_RUSSIA)
return bSymbolic ? L"LANG_TATAR, SUBLANG_TATAR_RUSSIA"
: L"Tatar (tt), Russia (RU)";
case 0x0844: // = MAKELANGID(LANG_TATAR, SUBLANG_TATAR_MONGOLIA)
return bSymbolic ? L"LANG_TATAR, SUBLANG_TATAR_MONGOLIA"
: L"Tatar (tt), Mongolia (MN)";
#if 0
case 0x0045: // = MAKELANGID(LANG_BENGALI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_BENGALI, SUBLANG_NEUTRAL"
: L"Bengali (bn)";
case 0x0445: // = MAKELANGID(LANG_BENGALI, SUBLANG_BENGALI_INDIA)
return bSymbolic ? L"LANG_BENGALI, SUBLANG_BENGALI_INDIA"
: L"Bengali (bn), India (IN)";
case 0x0845: // = MAKELANGID(LANG_BENGALI, SUBLANG_BENGALI_BANGLADESH)
return bSymbolic ? L"LANG_BENGALI, SUBLANG_BENGALI_BANGLADESH"
: L"Bengali (bn), Bangladesh (BD)";
#else
case 0x0045: // = MAKELANGID(LANG_BANGLA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_BANGLA, SUBLANG_NEUTRAL"
: L"Bangla (bn)";
case 0x0445: // = MAKELANGID(LANG_BANGLA, SUBLANG_BANGLA_INDIA)
return bSymbolic ? L"LANG_BANGLA, SUBLANG_BANGLA_INDIA"
: L"Bangla (bn), India (IN)";
case 0x0845: // = MAKELANGID(LANG_BANGLA, SUBLANG_BANGLA_BANGLADESH)
return bSymbolic ? L"LANG_BANGLA, SUBLANG_BANGLA_BANGLADESH"
: L"Bangla (bn), Bangladesh (BD)";
#endif
case 0x0046: // = MAKELANGID(LANG_PUNJABI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_PUNJABI, SUBLANG_NEUTRAL"
: L"Punjabi (pa)";
case 0x0446: // = MAKELANGID(LANG_PUNJABI, SUBLANG_PUNJABI_INDIA)
return bSymbolic ? L"LANG_PUNJABI, SUBLANG_PUNJABI_INDIA"
: L"Punjabi (pa), Gurmukhi script, India (IN)";
case 0x0846: // = MAKELANGID(LANG_PUNJABI, SUBLANG_PUNJABI_PAKISTAN)
return bSymbolic ? L"LANG_PUNJABI, SUBLANG_PUNJABI_PAKISTAN"
: L"Punjabi (pa), Arabic (Arab), Pakistan (PK)";
case 0x7C46: // = MAKELANGID(LANG_PUNJABI, SUBLANG_PUNJABI_ARABIC)
return bSymbolic ? L"LANG_PUNJABI, SUBLANG_PUNJABI_ARABIC"
: L"Punjabi (pa), Arabic (Arab)";
case 0x0047: // = MAKELANGID(LANG_GUJARATI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_GUJARATI, SUBLANG_NEUTRAL"
: L"Gujarati (gu)";
case 0x0447: // = MAKELANGID(LANG_GUJARATI, SUBLANG_GUJARATI_INDIA)
return bSymbolic ? L"LANG_GUJARATI, SUBLANG_GUJARATI_INDIA"
: L"Gujarati (gu), India (IN)";
#if 0
case 0x0048: // = MAKELANGID(LANG_ORIYA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_ORIYA, SUBLANG_NEUTRAL"
: L"Oriya (or)";
case 0x0448: // = MAKELANGID(LANG_ORIYA, SUBLANG_ORIYA_INDIA)
return bSymbolic ? L"LANG_ORIYA, SUBLANG_ORIYA_INDIA"
: L"Oriya (or), India (IN)";
#else
case 0x0048: // = MAKELANGID(LANG_ODIA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_ODIA, SUBLANG_NEUTRAL"
: L"Odia (or)";
case 0x0448: // = MAKELANGID(LANG_ODIA, SUBLANG_ODIA_INDIA)
return bSymbolic ? L"LANG_ODIA, SUBLANG_ODIA_INDIA"
: L"Odia (or), India (IN)";
#endif
case 0x0049: // = MAKELANGID(LANG_TAMIL, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_TAMIL, SUBLANG_NEUTRAL"
: L"Tamil (ta)";
case 0x0449: // = MAKELANGID(LANG_TAMIL, SUBLANG_TAMIL_INDIA)
return bSymbolic ? L"LANG_TAMIL, SUBLANG_TAMIL_INDIA"
: L"Tamil (ta), India (IN)";
case 0x0849: // = MAKELANGID(LANG_TAMIL, SUBLANG_TAMIL_SRI_LANKA)
return bSymbolic ? L"LANG_TAMIL, SUBLANG_TAMIL_SRI_LANKA"
: L"Tamil (ta), Sri Lanka (LK)";
case 0x004A: // = MAKELANGID(LANG_TELUGU, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_TELUGU, SUBLANG_NEUTRAL"
: L"Telugu (te)";
case 0x044A: // = MAKELANGID(LANG_TELUGU, SUBLANG_TELUGU_INDIA)
return bSymbolic ? L"LANG_TELUGU, SUBLANG_TELUGU_INDIA"
: L"Telugu (te), India (IN)";
case 0x004B: // = MAKELANGID(LANG_KANNADA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_KANNADA, SUBLANG_NEUTRAL"
: L"Kannada (kn)";
case 0x044B: // = MAKELANGID(LANG_KANNADA, SUBLANG_KANNADA_INDIA)
return bSymbolic ? L"LANG_KANNADA, SUBLANG_KANNADA_INDIA"
: L"Kannada (kn), India (IN)";
case 0x004C: // = MAKELANGID(LANG_MALAYALAM, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_MALAYALAM, SUBLANG_NEUTRAL"
: L"Malayalam (ml)";
case 0x044C: // = MAKELANGID(LANG_MALAYALAM, SUBLANG_MALAYALAM_INDIA)
return bSymbolic ? L"LANG_MALAYALAM, SUBLANG_MALAYALAM_INDIA"
: L"Malayalam (ml), India (IN)";
case 0x004D: // = MAKELANGID(LANG_ASSAMESE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_ASSAMESE, SUBLANG_NEUTRAL"
: L"Assamese (as)";
case 0x044D: // = MAKELANGID(LANG_ASSAMESE, SUBLANG_ASSAMESE_INDIA)
return bSymbolic ? L"LANG_ASSAMESE, SUBLANG_ASSAMESE_INDIA"
: L"Assamese (as), India (IN)";
case 0x004E: // = MAKELANGID(LANG_MARATHI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_MARATHI, SUBLANG_NEUTRAL"
: L"Marathi (mr)";
case 0x044E: // = MAKELANGID(LANG_MARATHI, SUBLANG_MARATHI_INDIA)
return bSymbolic ? L"LANG_MARATHI, SUBLANG_MARATHI_INDIA"
: L"Marathi (mr), India (IN)";
case 0x004F: // = MAKELANGID(LANG_SANSKRIT, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SANSKRIT, SUBLANG_NEUTRAL"
: L"Sanskrit (sa)";
case 0x044F: // = MAKELANGID(LANG_SANSKRIT, SUBLANG_SANSKRIT_INDIA)
return bSymbolic ? L"LANG_SANSKRIT, SUBLANG_SANSKRIT_INDIA"
: L"Sanskrit (sa), India (IN)";
case 0x0050: // = MAKELANGID(LANG_MONGOLIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_MONGOLIAN, SUBLANG_NEUTRAL"
: L"Mongolian (mn)";
case 0x0450: // = MAKELANGID(LANG_MONGOLIAN, SUBLANG_MONGOLIAN_CYRILLIC_MONGOLIA)
return bSymbolic ? L"LANG_MONGOLIAN, SUBLANG_MONGOLIAN_CYRILLIC_MONGOLIA"
: L"Mongolian (mn), Cyrillic (Cyrl), Mongolia (MN)";
case 0x0850: // = MAKELANGID(LANG_MONGOLIAN, SUBLANG_MONGOLIAN_PRC)
return bSymbolic ? L"LANG_MONGOLIAN, SUBLANG_MONGOLIAN_PRC"
: L"Mongolian (mn), Mongolian (Mong), People\'s Republic of China (CN)";
case 0x0C50: // = MAKELANGID(LANG_MONGOLIAN, SUBLANG_MONGOLIAN_MONGOLIAN_MONGOLIA)
return bSymbolic ? L"LANG_MONGOLIAN, SUBLANG_MONGOLIAN_MONGOLIAN_MONGOLIA"
: L"Mongolian (mn), Mongolian (Mong), Mongolia (MN)";
case 0x7850: // = MAKELANGID(LANG_MONGOLIAN, SUBLANG_MONGOLIAN_CYRILLIC)
return bSymbolic ? L"LANG_MONGOLIAN, SUBLANG_MONGOLIAN_CYRILLIC"
: L"Mongolian (mn), Cyrillic (Cyrl)";
case 0x7C50: // = MAKELANGID(LANG_MONGOLIAN, SUBLANG_MONGOLIAN_MONGOLIAN)
return bSymbolic ? L"LANG_MONGOLIAN, SUBLANG_MONGOLIAN_MONGOLIAN"
: L"Mongolian (mn), Mongolian (Mong)";
case 0x0051: // = MAKELANGID(LANG_TIBETAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_TIBETAN, SUBLANG_NEUTRAL"
: L"Tibetan (bo)";
case 0x0451: // = MAKELANGID(LANG_TIBETAN, SUBLANG_TIBETAN_PRC)
return bSymbolic ? L"LANG_TIBETAN, SUBLANG_TIBETAN_PRC"
: L"Tibetan (bo), People\'s Republic of China (CN)";
case 0x0851: // = MAKELANGID(LANG_TIBETAN, SUBLANG_TIBETAN_BHUTAN)
return bSymbolic ? L"LANG_TIBETAN, SUBLANG_TIBETAN_BHUTAN"
: L"Tibetan (bo), Bhutan (BT)";
case 0x0C51: // = MAKELANGID(LANG_DZONGKHA, SUBLANG_DZONGKHA_BHUTAN)
return bSymbolic ? L"LANG_DZONGKHA, SUBLANG_DZONGKHA_BHUTAN"
: L"Dzongkha (dz), Bhutan (BT)";
case 0x0052: // = MAKELANGID(LANG_WELSH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_WELSH, SUBLANG_NEUTRAL"
: L"Welsh (cy)";
case 0x0452: // = MAKELANGID(LANG_WELSH, SUBLANG_WELSH_UNITED_KINGDOM)
return bSymbolic ? L"LANG_WELSH, SUBLANG_WELSH_UNITED_KINGDOM"
: L"Welsh (cy), United Kingdom (GB)";
case 0x0053: // = MAKELANGID(LANG_KHMER, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_KHMER, SUBLANG_NEUTRAL"
: L"Khmer (kh)";
case 0x0453: // = MAKELANGID(LANG_KHMER, SUBLANG_KHMER_CAMBODIA)
return bSymbolic ? L"LANG_KHMER, SUBLANG_KHMER_CAMBODIA"
: L"Khmer (kh), Cambodia (KH)";
case 0x0054: // = MAKELANGID(LANG_LAO, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_LAO, SUBLANG_NEUTRAL"
: L"Lao (lo)";
case 0x0454: // = MAKELANGID(LANG_LAO, SUBLANG_LAO_LAO)
return bSymbolic ? L"LANG_LAO, SUBLANG_LAO_LAO"
: L"Lao (lo), Lao P.D.R. (LA)";
#if 0
case 0x0055: // = MAKELANGID(LANG_BIRMESE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_BIRMESE, SUBLANG_NEUTRAL"
: L"Birmese (my)";
case 0x0455: // = MAKELANGID(LANG_BIRMESE, SUBLANG_BIRMESE_MYANMAR)
return bSymbolic ? L"LANG_BIRMESE, SUBLANG_BIRMESE_MYANMAR"
: L"Birmese (my), Myanmar (MM)";
#else
case 0x0055: // = MAKELANGID(LANG_BURMESE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_BURMESE, SUBLANG_NEUTRAL"
: L"Burmese (my)";
case 0x0455: // = MAKELANGID(LANG_BURMESE, SUBLANG_BURMESE_MYANMAR)
return bSymbolic ? L"LANG_BURMESE, SUBLANG_BURMESE_MYANMAR"
: L"Burmese (my), Myanmar (MM)";
#endif
case 0x0056: // = MAKELANGID(LANG_GALICIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_GALICIAN, SUBLANG_NEUTRAL"
: L"Galician (gl)";
case 0x0456: // = MAKELANGID(LANG_GALICIAN, SUBLANG_GALICIAN_GALICIAN)
return bSymbolic ? L"LANG_GALICIAN, SUBLANG_GALICIAN_GALICIAN"
: L"Galician (gl), Spain (ES)";
case 0x0057: // = MAKELANGID(LANG_KONKANI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_KONKANI, SUBLANG_NEUTRAL"
: L"Konkani (kok)";
case 0x0457: // = MAKELANGID(LANG_KONKANI, SUBLANG_KONKANI_INDIA)
return bSymbolic ? L"LANG_KONKANI, SUBLANG_KONKANI_INDIA"
: L"Konkani (kok), India (IN)";
case 0x0058: // = MAKELANGID(LANG_MANIPURI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_MANIPURI, SUBLANG_NEUTRAL"
: L"Manipuri (mni)";
case 0x0458: // = MAKELANGID(LANG_MANIPURI, SUBLANG_MANIPURI_INDIA)
return bSymbolic ? L"LANG_MANIPURI, SUBLANG_MANIPURI_INDIA"
: L"Manipuri (mni), India (IN)";
case 0x0059: // = MAKELANGID(LANG_SINDHI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SINDHI, SUBLANG_NEUTRAL"
: L"Sindhi (sd)";
case 0x0459: // = MAKELANGID(LANG_SINDHI, SUBLANG_SINDHI_INDIA_DEVANAGARI)
return bSymbolic ? L"LANG_SINDHI, SUBLANG_SINDHI_INDIA_DEVANAGARI"
: L"Sindhi (sd), Devanagari (Deva), India (IN)";
case 0x0859: // = MAKELANGID(LANG_SINDHI, SUBLANG_SINDHI_PAKISTAN)
return bSymbolic ? L"LANG_SINDHI, SUBLANG_SINDHI_PAKISTAN"
: L"Sindhi (sd), Arabic (Arab), Pakistan (PK)";
case 0x0C59: // = MAKELANGID(LANG_SINDHI, SUBLANG_SINDHI_AFGHANISTAN)
return bSymbolic ? L"LANG_SINDHI, SUBLANG_SINDHI_AFGHANISTAN"
: L"Sindhi (sd), Afghanistan (AF)";
case 0x7C59: // = MAKELANGID(LANG_SINDHI, SUBLANG_SINDHI_ARABIC)
return bSymbolic ? L"LANG_SINDHI, SUBLANG_SINDHI_ARABIC"
: L"Sindhi (sd), Arabic (Arab)";
case 0x005A: // = MAKELANGID(LANG_SYRIAC, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SYRIAC, SUBLANG_NEUTRAL"
: L"Syriac (syr)";
#if 0
case 0x045A: // = MAKELANGID(LANG_SYRIAC, SUBLANG_SYRIAC)
return bSymbolic ? L"LANG_SYRIAC, SUBLANG_SYRIAC"
: L"Syriac (syr), Syria (SY)";
#else
case 0x045A: // = MAKELANGID(LANG_SYRIAC, SUBLANG_SYRIAC_SYRIA)
return bSymbolic ? L"LANG_SYRIAC, SUBLANG_SYRIAC_SYRIA"
: L"Syriac (syr), Syria (SY)";
#endif
case 0x005B: // = MAKELANGID(LANG_SINHALESE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SINHALESE, SUBLANG_NEUTRAL"
: L"Sinhala (si)";
case 0x045B: // = MAKELANGID(LANG_SINHALESE, SUBLANG_SINHALESE_SRI_LANKA)
return bSymbolic ? L"LANG_SINHALESE, SUBLANG_SINHALESE_SRI_LANKA"
: L"Sinhala (si), Sri Lanka (LK)";
case 0x005C: // = MAKELANGID(LANG_CHEROKEE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_CHEROKEE, SUBLANG_NEUTRAL"
: L"Cherokee (chr)";
case 0x045C: // = MAKELANGID(LANG_CHEROKEE, SUBLANG_CHEROKEE_US)
return bSymbolic ? L"LANG_CHEROKEE, SUBLANG_CHEROKEE_US"
: L"Cherokee (chr), Cherokee (Cher), United States (US)";
case 0x7C5C: // = MAKELANGID(LANG_CHEROKEE, SUBLANG_CHEROKEE_CHEROKEE)
return bSymbolic ? L"LANG_CHEROKEE, SUBLANG_CHEROKEE_CHEROKEE"
: L"Cherokee (chr), Cherokee (Cher)";
case 0x005D: // = MAKELANGID(LANG_INUKTITUT, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_INUKTITUT, SUBLANG_NEUTRAL"
: L"Inuktitut (iu)";
case 0x045D: // = MAKELANGID(LANG_INUKTITUT, SUBLANG_INUKTITUT_CANADA)
return bSymbolic ? L"LANG_INUKTITUT, SUBLANG_INUKTITUT_CANADA"
: L"Inuktitut (iu), Syllabic (Cans), Canada (CA)";
case 0x085D: // = MAKELANGID(LANG_INUKTITUT, SUBLANG_INUKTITUT_CANADA_LATIN)
return bSymbolic ? L"LANG_INUKTITUT, SUBLANG_INUKTITUT_CANADA_LATIN"
: L"Inuktitut (iu), Latin (Latn), Canada (CA)";
case 0x785D: // = MAKELANGID(LANG_INUKTITUT, SUBLANG_INUKTITUT)
return bSymbolic ? L"LANG_INUKTITUT, SUBLANG_INUKTITUT"
: L"Inuktitut (iu), Syllabic (Cans)";
case 0x7C5D: // = MAKELANGID(LANG_INUKTITUT, SUBLANG_INUKTITUT_LATIN)
return bSymbolic ? L"LANG_INUKTITUT, SUBLANG_INUKTITUT_LATIN"
: L"Inuktitut (iu), Latin (Latn)";
case 0x005E: // = MAKELANGID(LANG_AMHARIC, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_AMHARIC, SUBLANG_NEUTRAL"
: L"Amharic (am)";
case 0x045E: // = MAKELANGID(LANG_AMHARIC, SUBLANG_AMHARIC_ETHIOPIA)
return bSymbolic ? L"LANG_AMHARIC, SUBLANG_AMHARIC_ETHIOPIA"
: L"Amharic (am), Ethiopia (ET)";
case 0x005F: // = MAKELANGID(LANG_TAMAZIGHT, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_TAMAZIGHT, SUBLANG_NEUTRAL"
: L"Tamazight (tzm)";
case 0x045F: // = MAKELANGID(LANG_TAMAZIGHT, SUBLANG_TAMAZIGHT_MOROCCO_ARABIC)
return bSymbolic ? L"LANG_TAMAZIGHT, SUBLANG_TAMAZIGHT_MOROCCO_ARABIC"
: L"Tamazight (tmz), Arabic (Arab), Morocco (MA)";
case 0x085F: // = MAKELANGID(LANG_TAMAZIGHT, SUBLANG_TAMAZIGHT_ALGERIA_LATIN)
return bSymbolic ? L"LANG_TAMAZIGHT, SUBLANG_TAMAZIGHT_ALGERIA_LATIN"
: L"Tamazight (tzm), Latin (Latn), Algeria (DZ)";
case 0x0C5F: // = MAKELANGID(LANG_TAMANAKU, SUBLANG_TAMANAKU_MOROCCO)
return bSymbolic ? L"LANG_TAMANAKU, SUBLANG_TAMANAKU_MOROCCO"
: L"Tamanaku (tmz), Morocco (MA)";
case 0x105F: // = MAKELANGID(LANG_TAMAZIGHT, SUBLANG_TAMAZIGHT_MOROCCO_TIFINAGH)
return bSymbolic ? L"LANG_TAMAZIGHT, SUBLANG_TAMAZIGHT_MOROCCO_TIFINAGH"
: L"Tamazight (tzm), Tifinagh (Tfng), Morocco (MA)";
case 0x785F: // = MAKELANGID(LANG_TAMAZIGHT, SUBLANG_TAMAZIGHT_TIFINAGH)
return bSymbolic ? L"LANG_TAMAZIGHT, SUBLANG_TAMAZIGHT_TIFINAGH"
: L"Tamazight (tzm), Tifinagh (Tfng)";
case 0x7C5F: // = MAKELANGID(LANG_TAMAZIGHT, SUBLANG_TAMAZIGHT_LATIN)
return bSymbolic ? L"LANG_TAMAZIGHT, SUBLANG_TAMAZIGHT_LATIN"
: L"Tamazight (tzm), Latin (Latn)";
case 0x0060: // = MAKELANGID(LANG_KASHMIRI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_KASHMIRI, SUBLANG_NEUTRAL"
: L"Kashmiri (ks)";
case 0x0460: // = MAKELANGID(LANG_KASHMIRI, SUBLANG_KASHMIRI_ARABIC)
return bSymbolic ? L"LANG_KASHMIRI, SUBLANG_KASHMIRI_ARABIC"
: L"Kashmiri (ks), Arabic (Arab)";
#if 0
case 0x0860: // = MAKELANGID(LANG_KASHMIRI, SUBLANG_KASHMIRI_INDIA)
return bSymbolic ? L"LANG_KASHMIRI, SUBLANG_KASHMIRI_INDIA"
: L"Kashmiri (ks), India (IN)";
#elif 0
case 0x0860: // = MAKELANGID(LANG_KASHMIRI, SUBLANG_KASHMIRI_SASIA)
return bSymbolic ? L"LANG_KASHMIRI, SUBLANG_KASHMIRI_SASIA"
: L"Kashmiri (ks), South Asia";
#else
case 0x0860: // = MAKELANGID(LANG_KASHMIRI, SUBLANG_KASHMIRI_DEVANAGARI)
return bSymbolic ? L"LANG_KASHMIRI, SUBLANG_KASHMIRI_DEVANAGARI"
: L"Kashmiri (ks), Devanagari (Deva)";
#endif
case 0x0061: // = MAKELANGID(LANG_NEPALI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_NEPALI, SUBLANG_NEUTRAL"
: L"Nepali (ne)";
case 0x0461: // = MAKELANGID(LANG_NEPALI, SUBLANG_NEPALI_NEPAL)
return bSymbolic ? L"LANG_NEPALI, SUBLANG_NEPALI_NEPAL"
: L"Nepali (ne), Nepal (NP)";
case 0x0861: // = MAKELANGID(LANG_NEPALI, SUBLANG_NEPALI_INDIA)
return bSymbolic ? L"LANG_NEPALI, SUBLANG_NEPALI_INDIA"
: L"Nepali (ne), India (IN)";
case 0x0062: // = MAKELANGID(LANG_FRISIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_FRISIAN, SUBLANG_NEUTRAL"
: L"Frisian (fy)";
case 0x0462: // = MAKELANGID(LANG_FRISIAN, SUBLANG_FRISIAN_NETHERLANDS)
return bSymbolic ? L"LANG_FRISIAN, SUBLANG_FRISIAN_NETHERLANDS"
: L"Frisian (fy), Netherlands (NL)";
case 0x0063: // = MAKELANGID(LANG_PASHTO, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_PASHTO, SUBLANG_NEUTRAL"
: L"Pashto (ps)";
case 0x0463: // = MAKELANGID(LANG_PASHTO, SUBLANG_PASHTO_AFGHANISTAN)
return bSymbolic ? L"LANG_PASHTO, SUBLANG_PASHTO_AFGHANISTAN"
: L"Pashto (ps), Afghanistan (AF)";
case 0x0064: // = MAKELANGID(LANG_FILIPINO, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_FILIPINO, SUBLANG_NEUTRAL"
: L"Filipino (fil)";
case 0x0464: // = MAKELANGID(LANG_FILIPINO, SUBLANG_FILIPINO_PHILIPPINES)
return bSymbolic ? L"LANG_FILIPINO, SUBLANG_FILIPINO_PHILIPPINES"
: L"Filipino (fil), Philippines (PH)";
case 0x0065: // = MAKELANGID(LANG_DIVEHI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_DIVEHI, SUBLANG_NEUTRAL"
: L"Divehi (div)";
case 0x0465: // = MAKELANGID(LANG_DIVEHI, SUBLANG_DIVEHI_MALDIVES)
return bSymbolic ? L"LANG_DIVEHI, SUBLANG_DIVEHI_MALDIVES"
: L"Divehi (div), Maldives (MV)";
case 0x0066: // = MAKELANGID(LANG_EDO, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_EDO, SUBLANG_NEUTRAL"
: L"Bini / Edo (bin)";
case 0x0466: // = MAKELANGID(LANG_EDO, SUBLANG_EDO_NIGERIA)
return bSymbolic ? L"LANG_EDO, SUBLANG_EDO_NIGERIA"
: L"Bini / Edo (bin), Nigeria (NG)";
case 0x0067: // = MAKELANGID(LANG_FULAH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_FULAH, SUBLANG_NEUTRAL"
: L"Fulah (ff)";
case 0x0467: // = MAKELANGID(LANG_FULAH, SUBLANG_FULAH_NIGERIA)
return bSymbolic ? L"LANG_FULAH, SUBLANG_FULAH_NIGERIA"
: L"Fulah (ff), Nigeria (NG)";
case 0x0867: // = MAKELANGID(LANG_FULAH, SUBLANG_FULAH_SENEGAL)
return bSymbolic ? L"LANG_FULAH, SUBLANG_FULAH_SENEGAL"
: L"Fulah (ff), Latin (Latn), Senegal (SN)";
case 0x7C67: // = MAKELANGID(LANG_FULAH, SUBLANG_FULAH_LATIN)
return bSymbolic ? L"LANG_FULAH, SUBLANG_FULAH_LATIN"
: L"Fulah (ff), Latin (Latn)";
case 0x0068: // = MAKELANGID(LANG_HAUSA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_HAUSA, SUBLANG_NEUTRAL"
: L"Hausa (ha)";
case 0x0468: // = MAKELANGID(LANG_HAUSA, SUBLANG_HAUSA_NIGERIA_LATIN)
return bSymbolic ? L"LANG_HAUSA, SUBLANG_HAUSA_NIGERIA_LATIN"
: L"Hausa (ha), Latin (Latn), Nigeria (NG)";
case 0x7C68: // = MAKELANGID(LANG_HAUSA, SUBLANG_HAUSA_LATIN)
return bSymbolic ? L"LANG_HAUSA, SUBLANG_HAUSA_LATIN"
: L"Hausa (ha), Latin (Latn)";
case 0x0069: // = MAKELANGID(LANG_IBIBIO, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_IBIBIO, SUBLANG_NEUTRAL"
: L"Ibibio (ibb)";
case 0x0469: // = MAKELANGID(LANG_IBIBIO, SUBLANG_IBIBIO_NIGERIA)
return bSymbolic ? L"LANG_IBIBIO, SUBLANG_IBIBIO_NIGERIA"
: L"Ibibio (ibb), Nigeria (NG)";
case 0x006A: // = MAKELANGID(LANG_YORUBA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_YORUBA, SUBLANG_NEUTRAL"
: L"Yoruba (yo)";
case 0x046A: // = MAKELANGID(LANG_YORUBA, SUBLANG_YORUBA_NIGERIA)
return bSymbolic ? L"LANG_YORUBA, SUBLANG_YORUBA_NIGERIA"
: L"Yoruba (yo), Nigeria (NG)";
case 0x006B: // = MAKELANGID(LANG_QUECHUA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_QUECHUA, SUBLANG_NEUTRAL"
: L"Quechua (quz)";
case 0x046B: // = MAKELANGID(LANG_QUECHUA, SUBLANG_QUECHUA_BOLIVIA)
return bSymbolic ? L"LANG_QUECHUA, SUBLANG_QUECHUA_BOLIVIA"
: L"Quechua (quz), Bolivia (BO)";
case 0x086B: // = MAKELANGID(LANG_QUECHUA, SUBLANG_QUECHUA_ECUADOR)
return bSymbolic ? L"LANG_QUECHUA, SUBLANG_QUECHUA_ECUADOR"
: L"Quechua (quz), Ecuador (EC)";
case 0x0C6B: // = MAKELANGID(LANG_QUECHUA, SUBLANG_QUECHUA_PERU)
return bSymbolic ? L"LANG_QUECHUA, SUBLANG_QUECHUA_PERU"
: L"Quechua (quz), Peru (PE)";
#if 0
case 0x006C: // = MAKELANGID(LANG_SOTHO, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SOTHO, SUBLANG_NEUTRAL"
: L"Sesotho sa Leboa (nso)";
case 0x046C: // = MAKELANGID(LANG_SOTHO, SUBLANG_SOTHO_NORTHERN_SOUTH_AFRICA)
return bSymbolic ? L"LANG_SOTHO, SUBLANG_SOTHO_NORTHERN_SOUTH_AFRICA"
: L"Sesotho sa Leboa (nso), South Africa (ZA)";
#else
case 0x006C: // = MAKELANGID(LANG_SESOTHO, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SESOTHO, SUBLANG_NEUTRAL"
: L"Sesotho sa Leboa (nso)";
case 0x046C: // = MAKELANGID(LANG_SESOTHO, SUBLANG_SESOTHO_NORTHERN_SOUTH_AFRICA)
return bSymbolic ? L"LANG_SESOTHO, SUBLANG_SESOTHO_NORTHERN_SOUTH_AFRICA"
: L"Sesotho sa Leboa (nso), South Africa (ZA)";
#endif
case 0x006D: // = MAKELANGID(LANG_BASHKIR, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_BASHKIR, SUBLANG_NEUTRAL"
: L"Bashkir (ba)";
case 0x046D: // = MAKELANGID(LANG_BASHKIR, SUBLANG_BASHKIR_RUSSIA)
return bSymbolic ? L"LANG_BASHKIR, SUBLANG_BASHKIR_RUSSIA"
: L"Bashkir (ba), Russia (RU)";
case 0x006E: // = MAKELANGID(LANG_LUXEMBOURGISH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_LUXEMBOURGISH, SUBLANG_NEUTRAL"
: L"Luxembourgish (lb)";
case 0x046E: // = MAKELANGID(LANG_LUXEMBOURGISH, SUBLANG_LUXEMBOURGISH_LUXEMBOURG)
return bSymbolic ? L"LANG_LUXEMBOURGISH, SUBLANG_LUXEMBOURGISH_LUXEMBOURG"
: L"Luxembourgish (lb), Luxembourg (LU)";
#if 0
case 0x006F: // = MAKELANGID(LANG_GREENLANDIC, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_GREENLANDIC, SUBLANG_NEUTRAL"
: L"Greenlandic (kl)";
case 0x046F: // = MAKELANGID(LANG_GREENLANDIC, SUBLANG_GREENLANDIC_GREENLAND)
return bSymbolic ? L"LANG_GREENLANDIC, SUBLANG_GREENLANDIC_GREENLAND"
: L"Greenlandic (kl), Greenland (GL)";
#else
case 0x006F: // = MAKELANGID(LANG_KALAALLISUT, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_KALAALLISUT, SUBLANG_NEUTRAL"
: L"Kalaallisut (kl)";
case 0x046F: // = MAKELANGID(LANG_KALAALLISUT, SUBLANG_KALAALLISUT_GREENLAND)
return bSymbolic ? L"LANG_KALAALLISUT, SUBLANG_KALAALLISUT_GREENLAND"
: L"Kalaallisut (kl), Greenland (GL)";
#endif
case 0x0070: // = MAKELANGID(LANG_IGBO, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_IGBO, SUBLANG_NEUTRAL"
: L"Igbo (ig)";
case 0x0470: // = MAKELANGID(LANG_IGBO, SUBLANG_IGBO_NIGERIA)
return bSymbolic ? L"LANG_IGBO, SUBLANG_IGBO_NIGERIA"
: L"Igbo (ig), Nigeria (NG)";
case 0x0071: // = MAKELANGID(LANG_KANURI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_KANURI, SUBLANG_NEUTRAL"
: L"Kanuri (kr)";
case 0x0471: // = MAKELANGID(LANG_KANURI, SUBLANG_KANURI_NIGERIA)
return bSymbolic ? L"LANG_KANURI, SUBLANG_KANURI_NIGERIA"
: L"Kanuri (kr), Nigeria (NG)";
case 0x0072: // = MAKELANGID(LANG_OROMO, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_OROMO, SUBLANG_NEUTRAL"
: L"Oromo (om)";
case 0x0472: // = MAKELANGID(LANG_OROMO, SUBLANG_OROMO_ETHIOPIA)
return bSymbolic ? L"LANG_OROMO, SUBLANG_OROMO_ETHIOPIA"
: L"Oromo (om), Ethiopia (ET)";
#if 0
case 0x0073: // = MAKELANGID(LANG_TIGRIGNA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_TIGRIGNA, SUBLANG_NEUTRAL"
: L"Tigrigna (ti)";
case 0x0473: // = MAKELANGID(LANG_TIGRIGNA, SUBLANG_TIGRIGNA_ETHIOPIA)
return bSymbolic ? L"LANG_TIGRIGNA, SUBLANG_TIGRIGNA_ETHIOPIA"
: L"Tigrigna (ti), Ethiopia (ET)";
case 0x0873: // = MAKELANGID(LANG_TIGRIGNA, SUBLANG_TIGRIGNA_ERITREA)
return bSymbolic ? L"LANG_TIGRIGNA, SUBLANG_TIGRIGNA_ERITREA"
: L"Tigrigna (ti), Eritrea (ER)";
#else
case 0x0073: // = MAKELANGID(LANG_TIGRINYA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_TIGRINYA, SUBLANG_NEUTRAL"
: L"Tigrinya (ti)";
case 0x0473: // = MAKELANGID(LANG_TIGRINYA, SUBLANG_TIGRINYA_ETHIOPIA)
return bSymbolic ? L"LANG_TIGRINYA, SUBLANG_TIGRINYA_ETHIOPIA"
: L"Tigrinya (ti), Ethiopia (ET)";
case 0x0873: // = MAKELANGID(LANG_TIGRINYA, SUBLANG_TIGRINYA_ERITREA)
return bSymbolic ? L"LANG_TIGRINYA, SUBLANG_TIGRINYA_ERITREA"
: L"Tigrinya (ti), Eritrea (ER)";
#endif
case 0x0074: // = MAKELANGID(LANG_GUARANI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_GUARANI, SUBLANG_NEUTRAL"
: L"Guarani (gn)";
case 0x0474: // = MAKELANGID(LANG_GUARANI, SUBLANG_GUARANI_PARAGUAY)
return bSymbolic ? L"LANG_GUARANI, SUBLANG_GUARANI_PARAGUAY"
: L"Guarani (gn), Paraguay (PY)";
case 0x0075: // = MAKELANGID(LANG_HAWAIIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_HAWAIIAN, SUBLANG_NEUTRAL"
: L"Hawaiian (haw)";
case 0x0475: // = MAKELANGID(LANG_HAWAIIAN, SUBLANG_HAWAIIAN_US)
return bSymbolic ? L"LANG_HAWAIIAN, SUBLANG_HAWAIIAN_US"
: L"Hawaiian (haw), United States (US)";
case 0x0076: // = MAKELANGID(LANG_LATIN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_LATIN, SUBLANG_NEUTRAL"
: L"Latin (la)";
case 0x0476: // = MAKELANGID(LANG_LATIN, SUBLANG_LATIN_VATICAN)
return bSymbolic ? L"LANG_LATIN, SUBLANG_LATIN_VATICAN"
: L"Latin (la), Vatican (VA)";
case 0x0077: // = MAKELANGID(LANG_SOMALI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SOMALI, SUBLANG_NEUTRAL"
: L"Somali (so)";
case 0x0477: // = MAKELANGID(LANG_SOMALI, SUBLANG_SOMALI_SOMALIA)
return bSymbolic ? L"LANG_SOMALI, SUBLANG_SOMALI_SOMALIA"
: L"Somali (so), Somalia (SO)";
case 0x0078: // = MAKELANGID(LANG_YI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_YI, SUBLANG_NEUTRAL"
: L"Yi (ii)";
case 0x0478: // = MAKELANGID(LANG_YI, SUBLANG_YI_PRC)
return bSymbolic ? L"LANG_YI, SUBLANG_YI_PRC"
: L"Yi (ii), People\'s Republic of China (CN)";
case 0x0079: // = MAKELANGID(LANG_PAPIAMENTU, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_PAPIAMENTU, SUBLANG_NEUTRAL"
: L"Papiamentu (pap)";
case 0x0479: // = MAKELANGID(LANG_PAPIAMENTU, SUBLANG_PAPIAMENTU_ANTILLES)
return bSymbolic ? L"LANG_PAPIAMENTU, SUBLANG_PAPIAMENTU_ANTILLES"
: L"Papiamentu (pap), Netherlands Antilles (AN)";
case 0x0879: // = MAKELANGID(LANG_PAPIAMENTU, SUBLANG_PAPIAMENTU_ARUBA)
return bSymbolic ? L"LANG_PAPIAMENTU, SUBLANG_PAPIAMENTU_ARUBA"
: L"Papiamentu (pap), Aruba (AW)";
#if 0
case 0x007A: // = MAKELANGID(LANG_MAPUDUNGUN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_MAPUDUNGUN, SUBLANG_NEUTRAL"
: L"Mapudungun (arn)";
case 0x047A: // = MAKELANGID(LANG_MAPUDUNGUN, SUBLANG_MAPUDUNGUN_CHILE)
return bSymbolic ? L"LANG_MAPUDUNGUN, SUBLANG_MAPUDUNGUN_CHILE"
: L"Mapudungun (arn), Chile (CL)";
#else
case 0x007A: // = MAKELANGID(LANG_MAPUCHE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_MAPUCHE, SUBLANG_NEUTRAL"
: L"Mapuche (arn)";
case 0x047A: // = MAKELANGID(LANG_MAPUCHE, SUBLANG_MAPUCHE_CHILE)
return bSymbolic ? L"LANG_MAPUCHE, SUBLANG_MAPUCHE_CHILE"
: L"Mapuche (arn), Chile (CL)";
#endif
case 0x007C: // = MAKELANGID(LANG_MOHAWK, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_MOHAWK, SUBLANG_NEUTRAL"
: L"Mohawk (moh)";
case 0x047C: // = MAKELANGID(LANG_MOHAWK, SUBLANG_MOHAWK_MOHAWK)
return bSymbolic ? L"LANG_MOHAWK, SUBLANG_MOHAWK_MOHAWK"
: L"Mohawk (moh), Canada (CA)";
case 0x007E: // = MAKELANGID(LANG_BRETON, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_BRETON, SUBLANG_NEUTRAL"
: L"Breton (br)";
case 0x047E: // = MAKELANGID(LANG_BRETON, SUBLANG_BRETON_FRANCE)
return bSymbolic ? L"LANG_BRETON, SUBLANG_BRETON_FRANCE"
: L"Breton (br), France (FR)";
case 0x007F: // = MAKELANGID(LANG_INVARIANT, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_INVARIANT, SUBLANG_NEUTRAL"
: L"Invariant Language, Invariant Country";
case 0x0080: // = MAKELANGID(LANG_UIGHUR, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_UIGHUR, SUBLANG_NEUTRAL"
: L"Uyghur (ug)";
case 0x0480: // = MAKELANGID(LANG_UIGHUR, SUBLANG_UIGHUR_PRC)
return bSymbolic ? L"LANG_UIGHUR, SUBLANG_UIGHUR_PRC"
: L"Uyghur (ug), People\'s Republic of China (CN)";
case 0x0081: // = MAKELANGID(LANG_MAORI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_MAORI, SUBLANG_NEUTRAL"
: L"Maori (mi)";
case 0x0481: // = MAKELANGID(LANG_MAORI, SUBLANG_MAORI_NEW_ZEALAND)
return bSymbolic ? L"LANG_MAORI, SUBLANG_MAORI_NEW_ZEALAND"
: L"Maori (mi), New Zealand (NZ)";
case 0x0082: // = MAKELANGID(LANG_OCCITAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_OCCITAN, SUBLANG_NEUTRAL"
: L"Occitan (oc)";
case 0x0482: // = MAKELANGID(LANG_OCCITAN, SUBLANG_OCCITAN_FRANCE)
return bSymbolic ? L"LANG_OCCITAN, SUBLANG_OCCITAN_FRANCE"
: L"Occitan (oc), France (FR)";
case 0x0083: // = MAKELANGID(LANG_CORSICAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_CORSICAN, SUBLANG_NEUTRAL"
: L"Corsican (co)";
case 0x0483: // = MAKELANGID(LANG_CORSICAN, SUBLANG_CORSICAN_FRANCE)
return bSymbolic ? L"LANG_CORSICAN, SUBLANG_CORSICAN_FRANCE"
: L"Corsican (co), France (FR)";
case 0x0084: // = MAKELANGID(LANG_ALSATIAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_ALSATIAN, SUBLANG_NEUTRAL"
: L"Alsatian (gsw)";
case 0x0484: // = MAKELANGID(LANG_ALSATIAN, SUBLANG_ALSATIAN_FRANCE)
return bSymbolic ? L"LANG_ALSATIAN, SUBLANG_ALSATIAN_FRANCE"
: L"Alsatian (gsw), France (FR)";
#if 0
case 0x0085: // = MAKELANGID(LANG_YAKUT, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_YAKUT, SUBLANG_NEUTRAL"
: L"Yakut (sah)";
case 0x0485: // = MAKELANGID(LANG_YAKUT, SUBLANG_YAKUT_RUSSIA)
return bSymbolic ? L"LANG_YAKUT, SUBLANG_YAKUT_RUSSIA"
: L"Yakut (sah), Russia (RU)";
#else
case 0x0085: // = MAKELANGID(LANG_SAKHA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SAKHA, SUBLANG_NEUTRAL"
: L"Sakha (sah)";
case 0x0485: // = MAKELANGID(LANG_SAKHA, SUBLANG_SAKHA_RUSSIA)
return bSymbolic ? L"LANG_SAKHA, SUBLANG_SAKHA_RUSSIA"
: L"Sakha (sah), Russia (RU)";
#endif
case 0x0086: // = MAKELANGID(LANG_KICHE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_KICHE, SUBLANG_NEUTRAL"
: L"K\'iche (qut)";
case 0x0486: // = MAKELANGID(LANG_KICHE, SUBLANG_KICHE_GUATEMALA)
return bSymbolic ? L"LANG_KICHE, SUBLANG_KICHE_GUATEMALA"
: L"K\'iche (qut), Guatemala (GT)";
case 0x7C86: // = MAKELANGID(LANG_KICHE, SUBLANG_KICHE_GUATEMALA)
return bSymbolic ? L"LANG_KICHE, SUBLANG_KICHE_GUATEMALA"
: L"K\'iche (qut), Guatemala (GT)";
case 0x0087: // = MAKELANGID(LANG_KINYARWANDA, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_KINYARWANDA, SUBLANG_NEUTRAL"
: L"Kinyarwanda (rw)";
case 0x0487: // = MAKELANGID(LANG_KINYARWANDA, SUBLANG_KINYARWANDA_RWANDA)
return bSymbolic ? L"LANG_KINYARWANDA, SUBLANG_KINYARWANDA_RWANDA"
: L"Kinyarwanda (rw), Rwanda (RW)";
case 0x0088: // = MAKELANGID(LANG_WOLOF, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_WOLOF, SUBLANG_NEUTRAL"
: L"Wolof (wo)";
case 0x0488: // = MAKELANGID(LANG_WOLOF, SUBLANG_WOLOF_SENEGAL)
return bSymbolic ? L"LANG_WOLOF, SUBLANG_WOLOF_SENEGAL"
: L"Wolof (wo), Senegal (SN)";
case 0x008C: // = MAKELANGID(LANG_DARI, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_DARI, SUBLANG_NEUTRAL"
: L"Dari (prs)";
case 0x048C: // = MAKELANGID(LANG_DARI, SUBLANG_DARI_AFGHANISTAN)
return bSymbolic ? L"LANG_DARI, SUBLANG_DARI_AFGHANISTAN"
: L"Dari (prs), Afghanistan (AF)";
case 0x008D: // = MAKELANGID(LANG_MALAGASY, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_MALAGASY, SUBLANG_NEUTRAL"
: L"Plateau Malagasy (plt)";
case 0x048D: // = MAKELANGID(LANG_MALAGASY, SUBLANG_MALAGASY_MADAGASCAR)
return bSymbolic ? L"LANG_MALAGASY, SUBLANG_MALAGASY_MADAGASCAR"
: L"Plateau Malagasy (plt), Madagascar (MG)";
case 0x008E: // = MAKELANGID(LANG_YUE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_YUE, SUBLANG_NEUTRAL"
: L"Yue (yue)";
case 0x048E: // = MAKELANGID(LANG_YUE, SUBLANG_YUE_HONGKONG)
return bSymbolic ? L"LANG_YUE, SUBLANG_YUE_HONGKONG"
: L"Yue (yue), Hongkong S.A.R. (HK)";
case 0x008F: // = MAKELANGID(LANG_SHAN, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SHAN, SUBLANG_NEUTRAL"
: L"Tai Nüa (tdd)";
case 0x048F: // = MAKELANGID(LANG_SHAN, SUBLANG_SHAN_PRC)
return bSymbolic ? L"LANG_SHAN, SUBLANG_SHAN_PRC"
: L"Tai Nüa (tdd), People\'s Republic of China (CN)";
case 0x0090: // = MAKELANGID(LANG_TAILUE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_TAILUE, SUBLANG_NEUTRAL"
: L"Tai Lü (khb)";
case 0x0490: // = MAKELANGID(LANG_TAILUE, SUBLANG_TAILUE_PRC)
return bSymbolic ? L"LANG_TAILUE, SUBLANG_TAILUE_PRC"
: L"Tai Lü (khb), People\'s Republic of China (CN)";
case 0x0091: // = MAKELANGID(LANG_SCOTTISH_GAELIC, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_SCOTTISH_GAELIC, SUBLANG_NEUTRAL"
: L"Scottish Gaelic (gd)";
case 0x0491: // = MAKELANGID(LANG_SCOTTISH_GAELIC, SUBLANG_SCOTTISH_GAELIC)
return bSymbolic ? L"LANG_SCOTTISH_GAELIC, SUBLANG_SCOTTISH_GAELIC"
: L"Scottish Gaelic (gd), Great Britain (GB)";
case 0x0092: // = MAKELANGID(LANG_CENTRAL_KURDISH, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_CENTRAL_KURDISH, SUBLANG_NEUTRAL"
: L"Central Kurdish (ku)";
case 0x0492: // = MAKELANGID(LANG_CENTRAL_KURDISH, SUBLANG_CENTRAL_KURDISH_IRAQ)
return bSymbolic ? L"LANG_CENTRAL_KURDISH, SUBLANG_CENTRAL_KURDISH_IRAQ"
: L"Central Kurdish (ku), Arabic (Arab), Iraq (IQ)";
case 0x7C92: // = MAKELANGID(LANG_CENTRAL_KURDISH, SUBLANG_CENTRAL_KURDISH_ARABIC)
return bSymbolic ? L"LANG_CENTRAL_KURDISH, SUBLANG_CENTRAL_KURDISH_ARABIC"
: L"Central Kurdish (ku), Arabic (Arab)";
case 0x0093: // = MAKELANGID(LANG_QUICHE, SUBLANG_NEUTRAL)
return bSymbolic ? L"LANG_QUICHE, SUBLANG_NEUTRAL"
: L"Quiche (quc)";
case 0x0493: // = MAKELANGID(LANG_QUICHE, SUBLANG_QUICHE_COLOMBIA)
return bSymbolic ? L"LANG_QUICHE, SUBLANG_QUICHE_COLOMBIA"
: L"Quiche (quc), Colombia (CO)";
case 0x0501: // = MAKELANGID(LANG_PSEUDO_BASE, SUBLANG_DEFAULT)
return bSymbolic ? L"LANG_PSEUDO_BASE, SUBLANG_DEFAULT"
: L"Pseudo locale language (qps), Base (ploc)";
case 0x0901: // = MAKELANGID(LANG_PSEUDO_SELFHOST, SUBLANG_DEFAULT)
return bSymbolic ? L"LANG_PSEUDO_SELFHOST, SUBLANG_DEFAULT"
: L"Pseudo locale language (qps), Latin (Latn)";
case 0x05FE: // = MAKELANGID(LANG_PSEUDO_EAST_ASIA, SUBLANG_DEFAULT)
return bSymbolic ? L"LANG_PSEUDO_EAST_ASIA, SUBLANG_DEFAULT"
: L"Pseudo locale language (qps), East Asian (ploca)";
case 0x09FF: // = MAKELANGID(LANG_PSEUDO_MIRRORED, SUBLANG_PSEUDO_MIRRORED)
return bSymbolic ? L"LANG_PSEUDO_MIRRORED, SUBLANG_PSEUDO_MIRRORED"
: L"Pseudo locale language (qps), Mirrored (plocm)";
default:
return NULL;
}
}
const LPCWSTR szFileOSHigh[] = {L"Unknown", // VOS_UNKNOWN
L"MS-DOS", // VOS_DOS
L"OS/2 (16-bit)", // VOS_OS216
L"OS/2 (32-bit)", // VOS_OS232
L"Windows NT", // VOS_NT
L"Windows CE"}; // VOS_WINCE
const LPCWSTR szFileOSLow[] = {L"Base", // VOS__BASE
L"Windows (16-bit)", // VOS__WINDOWS16
L"Presentation Manager (16-bit)", // VOS__PM16
L"Presentation Manager (32-bit)", // VOS__PM32
L"Windows (32-bit)"}; // VOS__WINDOWS32
const LPCWSTR szFileType[] = {L"Unknown", // VFT_UNKNOWN
L"Application", // VFT_APP
L"DLL", // VFT_DLL
L"Driver", // VFT_DRV
L"Font", // VFT_FONT
L"Virtual Device", // VFT_VXD
L"Undefined",
L"Static Library"}; // VFT_STATIC_LIB
const LPCWSTR szFileDriverType[] = {L"Unknown", // VFT2_UNKNOWN
L"Printer", // VFT2_DRV_PRINTER
L"Keyboard", // VFT2_DRV_KEYBOARD
L"Language", // VFT2_DRV_LANGUAGE
L"Display", // VFT2_DRV_DISPLAY
L"Mouse", // VFT2_DRV_MOUSE
L"Network", // VFT2_DRV_NETWORK
L"System", // VFT2_DRV_SYSTEM
L"Installable", // VFT2_DRV_INSTALLABLE
L"Sound", // VFT2_DRV_SOUND
L"Communications", // VFT2_DRV_COMM
L"Input Method", // VFT2_DRV_INPUTMETHOD
L"Versioned Printer"}; // VFT2_DRV_VERSIONED_PRINTER
const LPCWSTR szFileFontType[] = {L"Unknown", // VFT2_UNKNOWN
L"Raster", // VFT2_FONT_RASTER
L"Vector", // VFT2_FONT_VECTOR
L"TrueType"}; // VFT2_FONT_TRUETYPE
BOOL WINAPI Resource(HANDLE hConsole,
HANDLE hOutput,
BYTE *lpAddress,
IMAGE_RESOURCE_DIRECTORY *lpRoot,
IMAGE_RESOURCE_DIRECTORY *lpLevel,
LPCWSTR lpType,
LPCWSTR lpName,
DWORD dwLevel) // 0, 1, 2
{
BOOL bOutput = TRUE;
DWORD dwUnicode;
DWORD dwMessage;
DWORD dwBlock;
DWORD dwEntry;
DWORD dw;
LPVOID lpManifest;
VS_VERSIONINFO *lpVersion;
MUI_RESOURCE *lpMUI;
MESSAGE_RESOURCE_DATA *lpTable;
MESSAGE_RESOURCE_BLOCK *lpBlock;
MESSAGE_RESOURCE_ENTRY *lpMessage;
IMAGE_RESOURCE_DATA_ENTRY *lpData;
IMAGE_RESOURCE_DIR_STRING_U *lpUnicode;
IMAGE_RESOURCE_DIRECTORY_ENTRY *lpEntry;
for (lpEntry = (IMAGE_RESOURCE_DIRECTORY_ENTRY *) (lpLevel + 1),
dwEntry = 0;
dwEntry < lpLevel->NumberOfNamedEntries + lpLevel->NumberOfIdEntries;
dwEntry++)
{
if ((lpEntry[dwEntry].Name & IMAGE_RESOURCE_NAME_IS_STRING) == IMAGE_RESOURCE_NAME_IS_STRING)
{
lpUnicode = (IMAGE_RESOURCE_DIR_STRING_U *) ((BYTE *) lpRoot + (lpEntry[dwEntry].Name ^ IMAGE_RESOURCE_NAME_IS_STRING));
bOutput &= PrintDirect(hOutput, L"\t\t\t\tName = " + 2 - dwLevel, dwLevel + 11);
bOutput &= PrintDirect(hOutput, lpUnicode->NameString, lpUnicode->Length);
bOutput &= PrintString(hOutput, L"\r\n");
bOutput &= PrintFormat(hOutput, L"\t\t\t\tOffset = 0x%08lX\r\n" + 2 - dwLevel, lpEntry[dwEntry].OffsetToData);
if (dwLevel == 1)
lpName = lpEntry[dwEntry].Id;
else if (dwLevel == 0)
lpType = lpEntry[dwEntry].Id;
}
else
if (dwLevel > 1)
bOutput &= PrintFormat(hOutput,
L"\t\t\t\tLanguage = %hu (%ls)\r\n"
L"\t\t\t\tOffset = 0x%08lX\r\n",
lpEntry[dwEntry].Id, ResourceLanguageName(lpEntry[dwEntry].Id, TRUE),
lpEntry[dwEntry].OffsetToData);
else if (dwLevel > 0)
{
bOutput &= PrintFormat(hOutput,
L"\t\t\tId = %hu\r\n"
L"\t\t\tOffset = 0x%08lX\r\n",
lpEntry[dwEntry].Id,
lpEntry[dwEntry].OffsetToData);
lpName = MAKEINTRESOURCE(lpEntry[dwEntry].Id);
}
else
{
bOutput &= PrintFormat(hOutput,
L"\t\tType = %hu (%ls)\r\n"
L"\t\tOffset = 0x%08lX\r\n",
lpEntry[dwEntry].Id, ResourceTypeName(lpEntry[dwEntry].Id),
lpEntry[dwEntry].OffsetToData);
lpType = MAKEINTRESOURCE(lpEntry[dwEntry].Id);
}
if ((lpEntry[dwEntry].OffsetToData & IMAGE_RESOURCE_DATA_IS_DIRECTORY) == IMAGE_RESOURCE_DATA_IS_DIRECTORY)
bOutput &= Resource(hConsole,
hOutput,
lpAddress,
lpRoot,
(IMAGE_RESOURCE_DIRECTORY *) ((BYTE *) lpRoot + (lpEntry[dwEntry].OffsetToData ^ IMAGE_RESOURCE_DATA_IS_DIRECTORY)),
lpType,
lpName,
dwLevel + 1);
else
{
lpData = (IMAGE_RESOURCE_DATA_ENTRY *) ((BYTE *) lpRoot + lpEntry[dwEntry].OffsetToData);
bOutput &= PrintFormat(hOutput,
L"\t\t\t\t\tAddress = 0x%08lX\r\n"
L"\t\t\t\t\tSize = %lu\r\n"
L"\t\t\t\t\tCode Page = %lu\r\n"
L"\t\t\t\t\tReserved = 0x%08lX\r\n",
lpData->OffsetToData,
lpData->Size,
lpData->CodePage,
lpData->Reserved);
if (IS_INTRESOURCE(lpType))
switch ((WORD) lpType)
{
case RT_STRING:
// NOTE: every RT_STRING resource, a STRINGTABLE, holds 16 UNICODE strings
// IMAGE_RESOURCE_DIR_STRING_U of up to 65535 characters each, which
// need not be L'\0' terminated and may contain L'\0', with their
// character count (including the terminating L'\0' if present)
// stored in front of them.
for (lpUnicode = (IMAGE_RESOURCE_DIR_STRING_U *) (lpAddress + lpData->OffsetToData),
dwUnicode = 16; dwUnicode > 0; dwUnicode--,
lpUnicode = (IMAGE_RESOURCE_DIR_STRING_U *) (lpUnicode->NameString + lpUnicode->Length))
{
dw = lpUnicode->Length;
if (dw == 0)
continue;
bOutput &= PrintFormat(hOutput,
L"\t\t\t\t\t%6lu:\tLength = %lu\r\n"
L"\t\t\t\t\t\tString = ",
IS_INTRESOURCE(lpName) ? (WORD) lpName * 16 - dwUnicode : 16 - dwUnicode, dw);
while (dw-- > 0)
if (lpUnicode->NameString[dw] < L' ')
lpUnicode->NameString[dw] += L'\x2400';
bOutput &= PrintDirect(hOutput, lpUnicode->NameString, lpUnicode->Length);
bOutput &= PrintString(hOutput, L"\r\n");
}
break;
case RT_MESSAGETABLE:
for (lpTable = (MESSAGE_RESOURCE_DATA *) (lpAddress + lpData->OffsetToData),
lpBlock = lpTable->Blocks,
dwBlock = 0; dwBlock < lpTable->NumberOfBlocks; dwBlock++)
{
if (lpBlock[dwBlock].LowId == lpBlock[dwBlock].HighId)
bOutput &= PrintFormat(hOutput,
L"\t\t\t%6lu:\tMessage ID 0x%08lX\r\n",
dwBlock, lpBlock[dwBlock].LowId);
else
bOutput &= PrintFormat(hOutput,
L"\t\t\t%6lu:\tMessage IDs 0x%08lX to 0x%08lX\r\n",
dwBlock, lpBlock[dwBlock].LowId, lpBlock[dwBlock].HighId);
for (lpMessage = (MESSAGE_RESOURCE_ENTRY *) ((BYTE *) lpTable + lpBlock[dwBlock].OffsetToEntries),
dwMessage = lpBlock[dwBlock].LowId; dwMessage <= lpBlock[dwBlock].HighId; dwMessage++,
lpMessage = (MESSAGE_RESOURCE_ENTRY *) ((BYTE *) lpMessage + lpMessage->Length))
if (lpMessage->Flags == MESSAGE_RESOURCE_UNICODE)
{
bOutput &= PrintFormat(hOutput,
L"\t\t\t\t0x%08lX:\tSize = %hu\r\n"
L"\t\t\t\t\t\tText = ",
dwMessage, lpMessage->Length);
for (dw = 0; dw < ((BYTE *) lpMessage + lpMessage->Length - lpMessage->Text) / sizeof(L'\0'); dw++)
if (((LPWSTR) lpMessage->Text)[dw] < L' ')
((LPWSTR) lpMessage->Text)[dw] += L'\x2400';
bOutput &= PrintDirect(hOutput, lpMessage->Text, dw);
bOutput &= PrintString(hOutput, L"\r\n");
}
else if (lpMessage->Flags == MESSAGE_RESOURCE_ANSI)
bOutput &= PrintFormat(hOutput,
L"\t\t\t\t0x%08lX:\tSize = %hu\r\n"
L"\t\t\t\t\t\tText = %.999hs\r\n",
dwMessage, lpMessage->Length, lpMessage->Text);
else
PrintConsole(hConsole,
L"Text type %hu of message 0x%08lX neither UNICODE nor ANSI!\n",
lpMessage->Flags, dwMessage);
}
break;
case RT_VERSION:
lpVersion = (VS_VERSIONINFO *) (lpAddress + lpData->OffsetToData);
bOutput &= PrintFormat(hOutput,
L"\t\t\t\t\tFixedFileInfo:\r\n"
L"\t\t\t\t\t\tProduct Version = %hu.%hu:%hu.%hu\r\n"
L"\t\t\t\t\t\tModule Version = %hu.%hu:%hu.%hu\r\n"
L"\t\t\t\t\t\tModule Flags = 0x%08lX\r\n"
L"\t\t\t\t\t\tModule Type = 0x%08lX (%ls)\r\n"
L"\t\t\t\t\t\tModule Subtype = 0x%08lX (%ls)\r\n"
L"\t\t\t\t\t\tModule Time Stamp = 0x%08lX:%08lX\r\n"
L"\t\t\t\t\t\tTarget OS = %hu:%hu (%ls, %ls)\r\n",
HIWORD(lpVersion->vsFFI.dwProductVersionMS), LOWORD(lpVersion->vsFFI.dwProductVersionMS),
HIWORD(lpVersion->vsFFI.dwProductVersionLS), LOWORD(lpVersion->vsFFI.dwProductVersionLS),
HIWORD(lpVersion->vsFFI.dwFileVersionMS), LOWORD(lpVersion->vsFFI.dwFileVersionMS),
HIWORD(lpVersion->vsFFI.dwFileVersionLS), LOWORD(lpVersion->vsFFI.dwFileVersionLS),
lpVersion->vsFFI.dwFileFlags,
lpVersion->vsFFI.dwFileType,
lpVersion->vsFFI.dwFileType < sizeof(szFileType) / sizeof(*szFileType) ? szFileType[lpVersion->vsFFI.dwFileType] : L"Undefined",
lpVersion->vsFFI.dwFileSubtype,
lpVersion->vsFFI.dwFileType == VFT_DRV ? (lpVersion->vsFFI.dwFileSubtype < sizeof(szFileDriverType) / sizeof(*szFileDriverType) ? szFileDriverType[lpVersion->vsFFI.dwFileSubtype] : L"Undefined") :
lpVersion->vsFFI.dwFileType == VFT_FONT ? (lpVersion->vsFFI.dwFileSubtype < sizeof(szFileFontType) / sizeof(*szFileFontType) ? szFileFontType[lpVersion->vsFFI.dwFileSubtype] : L"Undefined") : L"Undefined",
lpVersion->vsFFI.dwFileDateMS,
lpVersion->vsFFI.dwFileDateLS,
HIWORD(lpVersion->vsFFI.dwFileOS), LOWORD(lpVersion->vsFFI.dwFileOS),
HIWORD(lpVersion->vsFFI.dwFileOS) < sizeof(szFileOSHigh) / sizeof(*szFileOSHigh) ? szFileOSHigh[HIWORD(lpVersion->vsFFI.dwFileOS)] : L"Undefined",
LOWORD(lpVersion->vsFFI.dwFileOS) < sizeof(szFileOSLow) / sizeof(*szFileOSLow) ? szFileOSLow[LOWORD(lpVersion->vsFFI.dwFileOS)] : L"Undefined");
break;
case RT_HTML:
case RT_MANIFEST:
lpManifest = lpAddress + lpData->OffsetToData;
if (*(DWORD *) lpManifest == 0xFFFE0000)
bOutput &= PrintString(hOutput, L"\t\t\t\t\tUTF-32BE\r\n");
else if (*(DWORD *) lpManifest == 0x0000FEFF)
bOutput &= PrintString(hOutput, L"\t\t\t\t\tUTF-32LE\r\n");
else if (*(WCHAR *) lpManifest == L'\xFFFE')
bOutput &= PrintString(hOutput, L"\t\t\t\t\tUTF-16BE\r\n");
else if (*(WCHAR *) lpManifest == L'\xFEFF')
bOutput &= PrintFormat(hOutput,
L"\t\t\t\t\tUTF-16LE = %.999ls\r\n",
(WCHAR *) lpManifest + 1);
else if ((*(DWORD *) lpManifest & 0x00FFFFFF) == 0x00BFBBEF)
bOutput &= PrintFormat(hOutput,
L"\t\t\t\t\tUTF-8 = %.999hs\r\n",
(CHAR *) lpManifest + 3);
else if ((*(DWORD *) lpManifest == 0x2B762F2B)
|| (*(DWORD *) lpManifest == 0x2F762F2B)
|| (*(DWORD *) lpManifest == 0x38762F2B)
|| (*(DWORD *) lpManifest == 0x39762F2B))
bOutput &= PrintString(hOutput, L"\t\t\t\t\tUTF-7\r\n");
else
bOutput &= PrintFormat(hOutput,
L"\t\t\t\t\tASCII = %.999hs\r\n",
(CHAR *) lpManifest);
break;
// NOTE: insert code to handle other RT_* resource types here!
default:
break;
}
else
#if 0
if (wcscmp(lpType, L"MUI") == 0)
#elif 0
if (wmemcmp(lpType, L"MUI", sizeof("MUI")) == 0)
#else
if (memcmp(lpType, L"MUI", sizeof(L"MUI")) == 0)
#endif
{
lpMUI = (MUI_RESOURCE *) (lpAddress + lpData->OffsetToData);
if (lpMUI->dwSignature != MUI_RESOURCE_SIGNATURE)
PrintConsole(hConsole,
L"Signature 0x%08lX of resource configuration data not 0x%08lX!\n",
lpMUI->dwSignature, MUI_RESOURCE_SIGNATURE);
else
bOutput &= PrintFormat(hOutput,
L"\t\t\t\t\tResource Configuration Data:\r\n"
L"\t\t\t\t\t\tVersion = %hu.%hu\r\n"
L"\t\t\t\t\t\tType = %lu (%ls)\r\n"
L"\t\t\t\t\t\tLanguage = %ls\r\n"
L"\t\t\t\t\t\tFallback Language = %ls\r\n"
L"\t\t\t\t\t\tFallback Location = %lu (%ls)\r\n"
L"\t\t\t\t\t\tSystem Attributes = 0x%08lX\r\n"
L"\t\t\t\t\t\tMain Checksum = %08lX %08lX %08lX %08lX\r\n"
L"\t\t\t\t\t\tService Checksum = %08lX %08lX %08lX %08lX\r\n",
HIWORD(lpMUI->dwVersion), LOWORD(lpMUI->dwVersion),
lpMUI->dwFileType, MUIFileType(lpMUI->dwFileType),
lpMUI->dwLanguageNameOffset == 0 ? NULL : (BYTE *) lpMUI + lpMUI->dwLanguageNameOffset,
lpMUI->dwFallbackNameOffset == 0 ? NULL : (BYTE *) lpMUI + lpMUI->dwFallbackNameOffset,
lpMUI->dwFallbackLocation, MUIFallbackLocation(lpMUI->dwFallbackLocation),
lpMUI->dwSystemAttributes,
_byteswap_ulong(((DWORD *) lpMUI->bMainChecksum)[0]),
_byteswap_ulong(((DWORD *) lpMUI->bMainChecksum)[1]),
_byteswap_ulong(((DWORD *) lpMUI->bMainChecksum)[2]),
_byteswap_ulong(((DWORD *) lpMUI->bMainChecksum)[3]),
_byteswap_ulong(((DWORD *) lpMUI->bServiceChecksum)[0]),
_byteswap_ulong(((DWORD *) lpMUI->bServiceChecksum)[1]),
_byteswap_ulong(((DWORD *) lpMUI->bServiceChecksum)[2]),
_byteswap_ulong(((DWORD *) lpMUI->bServiceChecksum)[3]));
}
}
}
return bOutput;
}
__declspec(noreturn)
VOID WINAPI wmainCRTStartup(VOID)
{
IMAGE_DOS_HEADER *lpMZ;
IMAGE_NT_HEADERS *lpPE;
IMAGE_NT_HEADERS32 *lpPE32;
IMAGE_NT_HEADERS64 *lpPE64;
IMAGE_DATA_DIRECTORY *lpDirectory;
IMAGE_SECTION_HEADER *lpSection;
IMAGE_RESOURCE_DIRECTORY *lpResource;
LPWSTR *lpArguments;
INT nArguments;
HANDLE hOutput;
HANDLE hInput;
DWORD dwInput;
DWORD dwError = ERROR_BAD_ARGUMENTS;
DWORD dwSection;
DWORD dwResource;
LPBYTE lpImage;
HANDLE hImage;
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole == INVALID_HANDLE_VALUE)
dwError = GetLastError();
else
{
lpArguments = CommandLineToArgvW(GetCommandLine(), &nArguments);
if (lpArguments == NULL)
PrintConsole(hConsole,
L"CommandLineToArgv() returned error %lu\n",
dwError = GetLastError());
else
{
if (nArguments != 2)
PrintConsole(hConsole,
L"No argument: a single file or path name of an image file must be given!\n");
else
{
hOutput = GetStdHandle(STD_OUTPUT_HANDLE);
if (hOutput == INVALID_HANDLE_VALUE)
PrintConsole(hConsole,
L"GetStdHandle() returned error %lu\n",
dwError = GetLastError());
else
{
if (!FlushFileBuffers(hOutput))
PrintConsole(hConsole,
L"FlushFileBuffers() returned error %lu: standard output is not redirected to a file!\n",
dwError = GetLastError());
else
{
hInput = CreateFile(lpArguments[1],
FILE_READ_DATA,
FILE_SHARE_READ,
(SECURITY_ATTRIBUTES *) NULL,
OPEN_EXISTING,
FILE_FLAG_SEQUENTIAL_SCAN,
(HANDLE) NULL);
if (hInput == INVALID_HANDLE_VALUE)
PrintConsole(hConsole,
L"CreateFile() returned error %lu\n",
dwError = GetLastError());
else
{
dwInput = GetFileSize(hInput, (DWORD *) NULL);
if (dwInput == INVALID_FILE_SIZE)
PrintConsole(hConsole,
L"GetFileSize() returned error %lu\n",
dwError = GetLastError());
else
{
hImage = CreateFileMapping(hInput,
(LPSECURITY_ATTRIBUTES) NULL,
PAGE_WRITECOPY,
0, 0,
(LPCWSTR) NULL);
if (hImage == NULL)
PrintConsole(hConsole,
L"CreateFileMapping() returned error %lu\n",
dwError = GetLastError());
else
{
lpImage = MapViewOfFile(hImage,
FILE_MAP_COPY,
0, 0,
0);
if (lpImage == NULL)
PrintConsole(hConsole,
L"MapViewOfFile() returned error %lu\n",
dwError = GetLastError());
else
{
dwError = ERROR_INVALID_EXE_SIGNATURE;
lpMZ = (IMAGE_DOS_HEADER *) lpImage;
if (lpMZ->e_magic != IMAGE_DOS_SIGNATURE)
PrintConsole(hConsole,
L"No signature \'%ls\' at offset 0x%08lX in file \'%ls\'!\n",
L"MZ", 0, lpArguments[1]);
else
{
lpPE = (IMAGE_NT_HEADERS *) ((BYTE *) lpMZ + lpMZ->e_lfanew);
if (((DWORD) lpMZ->e_lfanew > dwInput)
|| (lpPE->Signature != IMAGE_NT_SIGNATURE))
PrintConsole(hConsole,
L"No signature \'%ls\' at offset 0x%08lX in file \'%ls\'!\n",
L"PE\\0\\0", lpMZ->e_lfanew, lpArguments[1]);
else
{
dwError = ERROR_BAD_EXE_FORMAT;
if (lpPE->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
{
lpPE64 = (IMAGE_NT_HEADERS64 *) lpPE;
lpDirectory = (IMAGE_DATA_DIRECTORY *) lpPE64->OptionalHeader.DataDirectory;
lpSection = (IMAGE_SECTION_HEADER *) (lpPE64 + 1);
}
else if (lpPE->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC)
{
lpPE32 = (IMAGE_NT_HEADERS32 *) lpPE;
lpDirectory = (IMAGE_DATA_DIRECTORY *) lpPE32->OptionalHeader.DataDirectory;
lpSection = (IMAGE_SECTION_HEADER *) (lpPE32 + 1);
}
else
lpSection = NULL;
if (lpSection == NULL)
PrintConsole(hConsole,
L"Invalid \'PE\' image format 0x%04hX in file \'%ls\'!\n",
lpPE->OptionalHeader.Magic, lpArguments[1]);
else
{
dwError = ERROR_RESOURCE_DATA_NOT_FOUND;
for (dwSection = 0;
dwSection < lpPE->FileHeader.NumberOfSections;
dwSection++)
if (memcmp(lpSection[dwSection].Name, ".rsrc", sizeof(".rsrc")) == 0)
break;
if (dwSection == lpPE->FileHeader.NumberOfSections)
PrintConsole(hConsole,
L"No section \'.rsrc\' in file \'%ls\'!\n",
lpArguments[1]);
else if ((lpSection[dwSection].VirtualAddress != lpDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress)
|| (lpSection[dwSection].Misc.VirtualSize != lpDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size))
PrintConsole(hConsole,
L"Address/size in \'IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_RESOURCE]\' differ from address/size of section \'.rsrc\' in file \'%ls\'!\n",
lpArguments[1]);
else
{
lpResource = (IMAGE_RESOURCE_DIRECTORY *) (lpImage + lpSection[dwSection].PointerToRawData);
dwResource = lpSection[dwSection].VirtualAddress - lpSection[dwSection].PointerToRawData;
if (!PrintFormat(hOutput,
L"\xFEFF" // UTF-16LE BOM
L"Image File = %ls\r\n"
L"Image Size = %lu\r\n"
L"\r\n"
L"Section \'.rsrc\':\r\n"
L"\tOffset = 0x%08lX\r\n"
L"\tSize = 0x%08lX\r\n"
L"\tAddress = 0x%08lX\r\n"
L"\tData = 0x%08lX\r\n"
L"\r\n"
L"Resource Directory:\r\n"
L"\tCharacteristics = 0x%08lX\r\n"
L"\tTime/Date Stamp = 0x%08lX\r\n"
L"\tVersion = %hu.%hu\r\n"
L"\tNamed Entries = %hu\r\n"
L"\tUnnamed Entries = %hu\r\n"
L"\tEntries:\r\n",
lpArguments[1],
dwInput,
lpSection[dwSection].PointerToRawData,
lpSection[dwSection].SizeOfRawData,
lpSection[dwSection].VirtualAddress,
lpSection[dwSection].Misc.VirtualSize,
lpResource->Characteristics,
lpResource->TimeDateStamp,
lpResource->MajorVersion,
lpResource->MinorVersion,
lpResource->NumberOfNamedEntries,
lpResource->NumberOfIdEntries)
|| !Resource(hConsole, hOutput,
lpImage - dwResource,
lpResource, lpResource,
MAKEINTRESOURCE(0), MAKEINTRESOURCE(0), 0))
PrintConsole(hConsole,
L"WriteFile() returned error %lu\n",
dwError = GetLastError());
else
dwError = ERROR_SUCCESS;
}
}
}
}
if (!UnmapViewOfFile(lpImage))
PrintConsole(hConsole,
L"UnmapViewOfFile() returned error %lu\n",
GetLastError());
}
if (!CloseHandle(hImage))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
}
if (!CloseHandle(hInput))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
}
}
}
if (LocalFree(lpArguments) != NULL)
PrintConsole(hConsole,
L"LocalFree() returned error %lu\n",
GetLastError());
}
if (!CloseHandle(hConsole))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
ExitProcess(dwError);
}
Note: this variant prints control characters within
Unicode
strings of RT_MESSAGETABLE
and RT_STRING
resources, especially the formatting
L'\a'
,
L'\b'
,
L'\t'
,
L'\n'
,
L'\v'
,
L'\f'
and
L'\r'
characters plus the
terminating L'\0'
character, as
␀,
␁,
␂,
␃,
␄,
␅,
␆,
␇,
␈,
␉,
␊,
␋,
␌,
␍,
␎,
␏,
␐,
␑,
␒,
␓,
␔,
␕,
␖,
␗,
␘,
␙,
␚,
␛,
␜,
␝,
␞ and
␟ respectively.
Run the following four command lines to compile the source file
RESOURCE.C
created in step 1., link the compiled
object file RESOURCE.OBJ
and cleanup afterwards:
SET CL=/GA /GF /GS /Gy /O1 /Oi /Os /Oy /W4 /Zl SET LINK=/DEFAULTLIB:KERNEL32.LIB /DEFAULTLIB:SHELL32.LIB /DEFAULTLIB:USER32.LIB /ENTRY:wmainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /OSVERSION:6.0 /RELEASE /SUBSYSTEM:CONSOLE /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /FeRESOURCE.COM RESOURCE.C ERASE RESOURCE.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. RESOURCE.C RESOURCE.C(2115) : warning C4018: '<' : signed/unsigned mismatch RESOURCE.C(2128) : warning C4047: '=' : 'LPCWSTR' differs in levels of indirection from 'WORD' RESOURCE.C(2130) : warning C4047: '=' : 'LPCWSTR' differs in levels of indirection from 'WORD' RESOURCE.C(2184) : warning C4305: 'type cast' : truncation from 'LPCWSTR' to 'WORD' RESOURCE.C(2206) : warning C4305: 'type cast' : truncation from 'LPCWSTR' to 'WORD' RESOURCE.C(2247) : warning C4133: 'function' : incompatible types - from 'BYTE [1]' to 'LPCWSTR' RESOURCE.C(2530) : warning C4701: potentially uninitialized local variable 'lpDirectory' used Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Create the text file RESOURCE.TXT
with the following
content in an arbitrary, preferable empty directory:
###
Decode the dump file RESOURCE.TXT
created in
step 3. to recreate the console application
Portable Executable Resource Enumerator:
CERTUTIL.EXE /DecodeHex /V RESOURCE.TXT RESOURCE.COM
Input Length = ### Output Length = ### CertUtil: -decodehex command completed successfully.
SDDL.COM ‹SDDL string› …
Note: due to the design and implementation of
Windows’ (classic alias legacy) console, the
Win32 function
WriteConsole()
can only write to a console, not to a file nor a pipe, i.e.
redirection of standard error
or standard output
is
not supported!
The MSDN article Console Handles provides background information.
Create the text file SDDL.C
with the following
content in an arbitrary, preferable empty directory:
// Copyright © 2004-2023, Stefan Kanthak <stefan.kanthak@nexgo.de>
// * The software is provided "as is" without any warranty, neither express
// nor implied.
// * In no event will the author be held liable for any damage(s) arising
// from the use of the software.
// * Redistribution of the software is allowed only in unmodified form.
// * Permission is granted to use the software solely for personal private
// and non-commercial purposes.
// * An individuals use of the software in his or her capacity or function
// as an agent, (independent) contractor, employee, member or officer of
// a business, corporation or organization (commercial or non-commercial)
// does not qualify as personal private and non-commercial purpose.
// * Without written approval from the author the software must not be used
// for a business, for commercial, corporate, governmental, military or
// organizational purposes of any kind, or in a commercial, corporate,
// governmental, military or organizational environment of any kind.
#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <shellapi.h>
#include <sddl.h>
#include <lmcons.h>
#include <aclapi.h>
#ifndef LABEL_SECURITY_INFORMATION
#define LABEL_SECURITY_INFORMATION 0x00000010UL
#endif
#ifndef ATTRIBUTE_SECURITY_INFORMATION
#define ATTRIBUTE_SECURITY_INFORMATION 0x00000020UL
#endif
#ifndef SCOPE_SECURITY_INFORMATION
#define SCOPE_SECURITY_INFORMATION 0x00000040UL
#endif
#ifndef PROCESS_TRUST_LABEL_SECURITY_INFORMATION
#define PROCESS_TRUST_LABEL_SECURITY_INFORMATION 0x00000080UL
#endif
#ifndef BACKUP_SECURITY_INFORMATION
#define BACKUP_SECURITY_INFORMATION 0x00010000UL
#endif
#ifndef CRITICAL_ACE_FLAG
#define CRITICAL_ACE_FLAG 0x20
#endif
#ifndef SYSTEM_MANDATORY_LABEL_ACE_TYPE
#define SYSTEM_MANDATORY_LABEL_ACE_TYPE 0x11
typedef struct _SYSTEM_MANDATORY_LABEL_ACE
{
ACE_HEADER Header;
ACCESS_MASK Mask;
DWORD SidStart;
} SYSTEM_MANDATORY_LABEL_ACE;
#endif
#ifndef SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE
#define SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE 0x12
typedef struct _SYSTEM_RESOURCE_ATTRIBUTE_ACE
{
ACE_HEADER Header;
ACCESS_MASK Mask;
DWORD SidStart;
} SYSTEM_RESOURCE_ATTRIBUTE_ACE;
#endif
#ifndef SYSTEM_SCOPED_POLICY_ID_ACE_TYPE
#define SYSTEM_SCOPED_POLICY_ID_ACE_TYPE 0x13
typedef struct _SYSTEM_SCOPED_POLICY_ID_ACE
{
ACE_HEADER Header;
ACCESS_MASK Mask;
DWORD SidStart;
} SYSTEM_SCOPED_POLICY_ID_ACE;
#endif
#ifndef SYSTEM_PROCESS_TRUST_LABEL_ACE_TYPE
#define SYSTEM_PROCESS_TRUST_LABEL_ACE_TYPE 0x14
typedef struct _SYSTEM_PROCESS_TRUST_LABEL_ACE
{
ACE_HEADER Header;
ACCESS_MASK Mask;
DWORD SidStart;
} SYSTEM_PROCESS_TRUST_LABEL_ACE;
#endif
#ifndef SYSTEM_ACCESS_FILTER_ACE_TYPE
#define SYSTEM_ACCESS_FILTER_ACE_TYPE 0x15
typedef struct _SYSTEM_ACCESS_FILTER_ACE
{
ACE_HEADER Header;
ACCESS_MASK Mask;
DWORD SidStart;
} SYSTEM_ACCESS_FILTER_ACE;
#endif
__declspec(safebuffers)
BOOL PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
WCHAR szBuffer[1025];
DWORD dwBuffer;
DWORD dwConsole;
va_list vaInput;
va_start(vaInput, lpFormat);
dwBuffer = wvsprintf(szBuffer, lpFormat, vaInput);
va_end(vaInput);
if (dwBuffer == 0)
return FALSE;
if (!WriteConsole(hConsole, szBuffer, dwBuffer, &dwConsole, NULL))
return FALSE;
return dwConsole == dwBuffer;
}
const LPCWSTR szSNU[] = {NULL,
L"user",
L"group",
L"domain",
L"alias",
L"well-known group",
L"deleted account",
L"invalid",
L"unknown",
L"computer",
L"label",
L"logon session"};
__declspec(safebuffers)
BOOL PrintSID(HANDLE hConsole, SID *sid, LPCWSTR lpWhich)
{
LPWSTR lpSID;
DWORD dwError = ERROR_SUCCESS;
WCHAR szAccount[UNLEN + 1];
DWORD dwAccount = sizeof(szAccount) / sizeof(*szAccount);
WCHAR szDomain[GNLEN + 1];
DWORD dwDomain = sizeof(szDomain) / sizeof(*szDomain);
SID_NAME_USE snu = 0;
if (!ConvertSidToStringSid(sid, &lpSID))
PrintConsole(hConsole,
L"ConvertSidToStringSid() returned error %lu\n",
dwError = GetLastError());
else
{
if (!LookupAccountSid((LPCWSTR) NULL,
sid,
szAccount, &dwAccount,
szDomain, &dwDomain,
&snu))
{
dwError = GetLastError();
if (dwError != ERROR_NONE_MAPPED)
PrintConsole(hConsole,
L"LookupAccountSid() returned error %lu for security identifier \'%ls\'\n",
dwError, lpSID);
PrintConsole(hConsole,
L"%ls\'%ls\'\n",
lpWhich, lpSID);
}
else
if (*szDomain == L'\0')
PrintConsole(hConsole,
L"%ls\'%ls\' = %ls \'%ls\'\n",
lpWhich, lpSID, szSNU[snu], szAccount);
else if (*szAccount == L'\0')
PrintConsole(hConsole,
L"%ls\'%ls\' = %ls \'%ls\'\n",
lpWhich, lpSID, szSNU[snu], szDomain);
else
PrintConsole(hConsole,
L"%ls\'%ls\' = %ls \'%ls\\%ls\'\n",
lpWhich, lpSID, szSNU[snu], szDomain, szAccount);
if (LocalFree(lpSID) != NULL)
PrintConsole(hConsole,
L"LocalFree() returned error %lu\n",
GetLastError());
}
// SetLastError(dwError);
return dwError == ERROR_SUCCESS;
}
const LPCWSTR szSDC[16] = {L"Owner Defaulted", // SE_OWNER_DEFAULTED
L"Group Defaulted", // SE_GROUP_DEFAULTED
L"DACL Present", // SE_DACL_PRESENT
L"DACL Defaulted", // SE_DACL_DEFAULTED
L"SACL Present", // SE_SACL_PRESENT
L"SACL Defaulted", // SE_SACL_DEFAULTED
NULL,
NULL,
L"DACL Auto Inheritance Request", // SE_DACL_AUTO_INHERIT_REQ
L"SACL Auto Inheritance Request", // SE_SACL_AUTO_INHERIT_REQ
L"DACL Auto Inherited", // SE_DACL_AUTO_INHERITED
L"SACL Auto Inherited", // SE_SACL_AUTO_INHERITED
L"DACL Protected", // SE_DACL_PROTECTED
L"SACL Protected", // SE_SACL_PROTECTED
L"Resource Manager Control", // SE_RM_CONTROL_VALID
L"Self Relative"}; // SE_SELF_RELATIVE
const LPCWSTR szType[22] = {L"Access Allowed",
L"Access Denied",
L"Access Audit",
L"Access Alarm",
L"Compound Access Allowed",
L"Object Access Allowed",
L"Object Access Denied",
L"Object Access Audit",
L"Object Access Alarm",
L"Access Allowed Callback",
L"Access Denied Callback",
L"Object Access Allowed Callback",
L"Object Access Denied Callback",
L"Access Audit Callback",
L"Access Alarm Callback",
L"Object Access Audit Callback",
L"Object Access Alarm Callback",
L"Mandatory Label",
L"Resource Attribute",
L"Scoped Policy Identification",
L"Process Trust Label",
L"Access Filter"};
const LPCWSTR szFlag[8] = {L"Object Inherit", // OBJECT_INHERIT_ACE
L"Container Inherit", // CONTAINER_INHERIT_ACE
L"No Propagate Inherit", // NO_PROPAGATE_INHERIT_ACE
L"Inherit Only", // INHERIT_ONLY_ACE
L"Inherited", // INHERITED_ACE
L"Critical", // CRITICAL_ACE_FLAG
L"Access Success", // SUCCESSFUL_ACCESS_ACE_FLAG
L"Access Failure"}; // FAILED_ACCESS_ACE_FLAG
const LPCWSTR szMask[32] = {L"Directory List Directory, File/Pipe Read Data, Key Query Value, Event/Mutant/Semaphore/Timer Query State, Job Assign Process, Process Terminate, Section Query, Service Query Configuration, Session Query Access, Thread Terminate, Token Assign Primary",
L"Directory Add File, File/Pipe Write Data, Key Set Value, Event/IO Completion/Mutant/Semaphore/Timer Modify State, Job Set Attributes, Process Create Thread, Section Map Write, Service Change Configuration, Session Modify Access, Thread Suspend/Resume, Token Duplicate",
L"Directory Add Subdirectory, File Append Data, Pipe Create Instance, Key Create Subkey, Job Query, Process Set Session Id, Section Map Read, Service Query Status, Token Impersonate",
L"Directory/File Read Extended Attributes, Key Enumerate Subkeys, Job Terminate, Process Virtual Memory Operation, Section Map Execute, Service Enumerate Dependencies, Thread Get Context, Token Query",
L"Directory/File Write Extended Attributes, Key Notify, Job Set Security Attributes, Process Virtual Memory Read, Section Extend Size, Service Start, Thread Set Context, Token Query Source",
L"Directory Traverse, File Execute, Key Create Link, Job Impersonate, Process Virtual Memory Write, Section Map Execute Explicit, Service Stop, Thread Set Information, Token Adjust Privileges",
L"Directory Delete Child, Process Duplicate Handle, Service Pause, Thread Query Information, Token Adjust Groups",
L"Directory/File/Pipe Read Attributes, Process Create Process, Service Interrogate, Thread Set Thread Token, Token Adjust Default",
L"Directory/File/Pipe Write Attributes, Process Set Quota, Service User Defined, Thread Impersonate, Token Adjust Session Id",
L"Process Set Information, Thread Direct Impersonation",
L"Process Query Information, Thread Set Limited Information",
L"Process Suspend/Resume, Thread Query Limited Information",
L"Process Query Limited Information, Thread Resume",
L"Process Set Limited Information",
NULL,
NULL,
L"Standard Delete",
L"Read Control",
L"Write DACL",
L"Write Owner",
L"Synchronize",
NULL,
NULL,
NULL,
L"Access SACL",
L"Maximum Allowed",
NULL,
NULL,
L"Generic All",
L"Generic Execute/Traverse",
L"Generic Write",
L"Generic Read"};
__declspec(noreturn)
VOID WINAPI wmainCRTStartup(VOID)
{
SECURITY_DESCRIPTOR *lpSD;
SECURITY_DESCRIPTOR_CONTROL sdc;
SID *lpSID;
ACL *lpACL;
ACE_HEADER *lpACE;
INT nArgument = 1;
INT nArguments;
LPWSTR *lpArguments;
BYTE rmControl;
BOOL bDefaulted;
BOOL bPresent;
WORD wACE;
DWORD dwError = ERROR_BAD_ARGUMENTS;
DWORD dwIndex;
DWORD dwValue;
DWORD dwLength;
DWORD dwRevision;
DWORD dwSD;
HANDLE hConsole = GetStdHandle(STD_ERROR_HANDLE);
if (hConsole == INVALID_HANDLE_VALUE)
dwError = GetLastError();
else
{
lpArguments = CommandLineToArgvW(GetCommandLine(), &nArguments);
if (lpArguments == NULL)
PrintConsole(hConsole,
L"CommandLineToArgv() returned error %lu\n",
dwError = GetLastError());
else
{
if (nArguments < 2)
PrintConsole(hConsole,
L"No arguments: at least one SDDL string must be given!\n");
else
do
if (!ConvertStringSecurityDescriptorToSecurityDescriptor(lpArguments[nArgument],
SDDL_REVISION_1,
&lpSD,
&dwSD))
PrintConsole(hConsole,
L"ConvertStringSecurityDescriptorToSecurityDescriptor() returned error %lu for argument \'%ls\'\n",
dwError = GetLastError(), lpArguments[nArgument]);
else
{
PrintConsole(hConsole,
L"\n"
L"%ls\n",
lpArguments[nArgument]);
dwLength = GetSecurityDescriptorLength(lpSD);
if (dwSD != dwLength)
PrintConsole(hConsole,
L"ConvertStringSecurityDescriptorToSecurityDescriptor() returned a security descriptor of %lu bytes, but GetSecurityDescriptorLength() returned %lu bytes\n",
dwSD, dwLength);
if (!GetSecurityDescriptorControl(lpSD, &sdc, &dwRevision))
PrintConsole(hConsole,
L"GetSecurityDescriptorControl() returned error %lu\n",
dwError = GetLastError());
else
{
PrintConsole(hConsole,
L"\tRevision:\t%lu\n"
L"\tControl:\t0x%04hX\n",
dwRevision,
sdc);
for (dwValue = sdc & ~SE_SELF_RELATIVE;
_BitScanForward(&dwIndex, dwValue);
dwValue &= dwValue - 1)
PrintConsole(hConsole, L"\t\t%ls\n", szSDC[dwIndex]);
}
if (sdc & SE_RM_CONTROL_VALID)
{
dwError = GetSecurityDescriptorRMControl(lpSD, &rmControl);
if (dwError != ERROR_SUCCESS)
PrintConsole(hConsole,
L"GetSecurityDescriptorRMControl() returned error %lu\n",
dwError);
else
PrintConsole(hConsole,
L"\tRM Control:\t0x%02X\n",
rmControl);
}
if (!GetSecurityDescriptorOwner(lpSD, &lpSID, &bDefaulted))
PrintConsole(hConsole,
L"GetSecurityDescriptorOwner() returned error %lu\n",
dwError = GetLastError());
else
if (lpSID != NULL)
PrintSID(hConsole, lpSID, L"\tOwner:\t\t");
if (!GetSecurityDescriptorGroup(lpSD, &lpSID, &bDefaulted))
PrintConsole(hConsole,
L"GetSecurityDescriptorGroup() returned error %lu\n",
dwError = GetLastError());
else
if (lpSID != NULL)
PrintSID(hConsole, lpSID, L"\tGroup:\t\t");
if (!GetSecurityDescriptorDacl(lpSD, &bPresent, &lpACL, &bDefaulted))
PrintConsole(hConsole,
L"GetSecurityDescriptorDacl() returned error %lu\n",
dwError = GetLastError());
else
if (!bPresent)
PrintConsole(hConsole,
L"\tDACL:\t\tNONE\n");
else
if (lpACL == NULL)
PrintConsole(hConsole,
L"\tDACL:\t\tNULL\n");
else
if (lpACL->AceCount == 0)
PrintConsole(hConsole,
L"\tDACL:\t\tEMPTY\n");
else
{
PrintConsole(hConsole,
L"\tDACL:\t\t%hu bytes, %hu ACE(s)\n",
lpACL->AclSize, lpACL->AceCount);
for (lpACE = (ACE_HEADER *) (lpACL + 1),
wACE = 0; wACE < lpACL->AceCount; wACE++,
lpACE = (ACE_HEADER *) ((BYTE *) lpACE + lpACE->AceSize))
{
switch (lpACE->AceType)
{
case ACCESS_ALLOWED_ACE_TYPE:
lpSID = (SID *) &(((ACCESS_ALLOWED_ACE *) lpACE)->SidStart);
break;
case ACCESS_DENIED_ACE_TYPE:
lpSID = (SID *) &(((ACCESS_DENIED_ACE *) lpACE)->SidStart);
break;
case ACCESS_ALLOWED_COMPOUND_ACE_TYPE:
continue;
case ACCESS_ALLOWED_OBJECT_ACE_TYPE:
if (((((ACCESS_ALLOWED_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
== ((((ACCESS_ALLOWED_OBJECT_ACE *) lpACE)->Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT) == ACE_INHERITED_OBJECT_TYPE_PRESENT))
if ((((ACCESS_ALLOWED_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
lpSID = (SID *) &(((ACCESS_ALLOWED_OBJECT_ACE *) lpACE)->SidStart);
else
lpSID = (SID *) &(((ACCESS_ALLOWED_OBJECT_ACE *) lpACE)->ObjectType);
else
lpSID = (SID *) &(((ACCESS_ALLOWED_OBJECT_ACE *) lpACE)->InheritedObjectType);
break;
case ACCESS_DENIED_OBJECT_ACE_TYPE:
if (((((ACCESS_DENIED_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
== ((((ACCESS_DENIED_OBJECT_ACE *) lpACE)->Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT) == ACE_INHERITED_OBJECT_TYPE_PRESENT))
if ((((ACCESS_DENIED_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
lpSID = (SID *) &(((ACCESS_DENIED_OBJECT_ACE *) lpACE)->SidStart);
else
lpSID = (SID *) &(((ACCESS_DENIED_OBJECT_ACE *) lpACE)->ObjectType);
else
lpSID = (SID *) &(((ACCESS_DENIED_OBJECT_ACE *) lpACE)->InheritedObjectType);
break;
case ACCESS_ALLOWED_CALLBACK_ACE_TYPE:
lpSID = (SID *) &(((ACCESS_ALLOWED_CALLBACK_ACE *) lpACE)->SidStart);
break;
case ACCESS_DENIED_CALLBACK_ACE_TYPE:
lpSID = (SID *) &(((ACCESS_DENIED_CALLBACK_ACE *) lpACE)->SidStart);
break;
case ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE:
if (((((ACCESS_ALLOWED_CALLBACK_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
== ((((ACCESS_ALLOWED_CALLBACK_OBJECT_ACE *) lpACE)->Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT) == ACE_INHERITED_OBJECT_TYPE_PRESENT))
if ((((ACCESS_ALLOWED_CALLBACK_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
lpSID = (SID *) &(((ACCESS_ALLOWED_CALLBACK_OBJECT_ACE *) lpACE)->SidStart);
else
lpSID = (SID *) &(((ACCESS_ALLOWED_CALLBACK_OBJECT_ACE *) lpACE)->ObjectType);
else
lpSID = (SID *) &(((ACCESS_ALLOWED_CALLBACK_OBJECT_ACE *) lpACE)->InheritedObjectType);
break;
case ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE:
if (((((ACCESS_DENIED_CALLBACK_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
== ((((ACCESS_DENIED_CALLBACK_OBJECT_ACE *) lpACE)->Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT) == ACE_INHERITED_OBJECT_TYPE_PRESENT))
if ((((ACCESS_DENIED_CALLBACK_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
lpSID = (SID *) &(((ACCESS_DENIED_CALLBACK_OBJECT_ACE *) lpACE)->SidStart);
else
lpSID = (SID *) &(((ACCESS_DENIED_CALLBACK_OBJECT_ACE *) lpACE)->ObjectType);
else
lpSID = (SID *) &(((ACCESS_DENIED_CALLBACK_OBJECT_ACE *) lpACE)->InheritedObjectType);
break;
default:
PrintConsole(hConsole,
L"Unknown ACE type %u in DACL\n",
lpACE->AceType);
continue;
}
PrintConsole(hConsole,
L"\t[%hu]\tACE:\t%hu bytes\n"
L"\t\tType:\t\t0x%02X = %ls\n"
L"\t\tFlags:\t\t0x%02X\n",
wACE, lpACE->AceSize,
lpACE->AceType, szType[lpACE->AceType],
lpACE->AceFlags);
for (dwValue = lpACE->AceFlags & (VALID_INHERIT_FLAGS | CRITICAL_ACE_FLAG);
_BitScanForward(&dwIndex, dwValue);
dwValue &= dwValue - 1)
PrintConsole(hConsole, L"\t\t\t\t%ls\n", szFlag[dwIndex]);
PrintConsole(hConsole,
L"\t\tAccess Mask:\t0x%08lX\n",
((ACCESS_ALLOWED_ACE *) lpACE)->Mask);
for (dwValue = ((ACCESS_ALLOWED_ACE *) lpACE)->Mask;
_BitScanForward(&dwIndex, dwValue);
dwValue &= dwValue - 1)
PrintConsole(hConsole, L"\t\t\t\t%ls\n", szMask[dwIndex]);
PrintSID(hConsole, lpSID, L"\t\tTrustee:\t");
}
}
if (!GetSecurityDescriptorSacl(lpSD, &bPresent, &lpACL, &bDefaulted))
PrintConsole(hConsole,
L"GetSecurityDescriptorSacl() returned error %lu\n",
dwError = GetLastError());
else
if (!bPresent)
PrintConsole(hConsole,
L"\tSACL:\t\tNONE\n");
else
if (lpACL == NULL)
PrintConsole(hConsole,
L"\tSACL:\t\tNULL\n");
else
if (lpACL->AceCount == 0)
PrintConsole(hConsole,
L"\tSACL:\t\tEMPTY\n");
else
{
PrintConsole(hConsole,
L"\tSACL:\t\t%hu bytes, %hu ACE(s)\n",
lpACL->AclSize, lpACL->AceCount);
for (lpACE = (ACE_HEADER *) (lpACL + 1),
wACE = 0; wACE < lpACL->AceCount; wACE++,
lpACE = (ACE_HEADER *) ((BYTE *) lpACE + lpACE->AceSize))
{
switch (lpACE->AceType)
{
case SYSTEM_AUDIT_ACE_TYPE:
lpSID = (SID *) &(((SYSTEM_AUDIT_ACE *) lpACE)->SidStart);
break;
case SYSTEM_ALARM_ACE_TYPE:
lpSID = (SID *) &(((SYSTEM_ALARM_ACE *) lpACE)->SidStart);
break;
case SYSTEM_AUDIT_OBJECT_ACE_TYPE:
if (((((SYSTEM_AUDIT_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
== ((((SYSTEM_AUDIT_OBJECT_ACE *) lpACE)->Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT) == ACE_INHERITED_OBJECT_TYPE_PRESENT))
if ((((SYSTEM_AUDIT_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
lpSID = (SID *) &(((SYSTEM_AUDIT_OBJECT_ACE *) lpACE)->SidStart);
else
lpSID = (SID *) &(((SYSTEM_AUDIT_OBJECT_ACE *) lpACE)->ObjectType);
else
lpSID = (SID *) &(((SYSTEM_AUDIT_OBJECT_ACE *) lpACE)->InheritedObjectType);
break;
case SYSTEM_ALARM_OBJECT_ACE_TYPE:
if (((((SYSTEM_ALARM_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
== ((((SYSTEM_ALARM_OBJECT_ACE *) lpACE)->Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT) == ACE_INHERITED_OBJECT_TYPE_PRESENT))
if ((((SYSTEM_ALARM_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
lpSID = (SID *) &(((SYSTEM_ALARM_OBJECT_ACE *) lpACE)->SidStart);
else
lpSID = (SID *) &(((SYSTEM_ALARM_OBJECT_ACE *) lpACE)->ObjectType);
else
lpSID = (SID *) &(((SYSTEM_ALARM_OBJECT_ACE *) lpACE)->InheritedObjectType);
break;
case SYSTEM_AUDIT_CALLBACK_ACE_TYPE:
lpSID = (SID *) &(((SYSTEM_AUDIT_CALLBACK_ACE *) lpACE)->SidStart);
break;
case SYSTEM_ALARM_CALLBACK_ACE_TYPE:
lpSID = (SID *) &(((SYSTEM_ALARM_CALLBACK_ACE *) lpACE)->SidStart);
break;
case SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE:
if (((((SYSTEM_AUDIT_CALLBACK_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
== ((((SYSTEM_AUDIT_CALLBACK_OBJECT_ACE *) lpACE)->Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT) == ACE_INHERITED_OBJECT_TYPE_PRESENT))
if ((((SYSTEM_AUDIT_CALLBACK_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
lpSID = (SID *) &(((SYSTEM_AUDIT_CALLBACK_OBJECT_ACE *) lpACE)->SidStart);
else
lpSID = (SID *) &(((SYSTEM_AUDIT_CALLBACK_OBJECT_ACE *) lpACE)->ObjectType);
else
lpSID = (SID *) &(((SYSTEM_AUDIT_CALLBACK_OBJECT_ACE *) lpACE)->InheritedObjectType);
break;
case SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE:
if (((((SYSTEM_ALARM_CALLBACK_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
== ((((SYSTEM_ALARM_CALLBACK_OBJECT_ACE *) lpACE)->Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT) == ACE_INHERITED_OBJECT_TYPE_PRESENT))
if ((((SYSTEM_ALARM_CALLBACK_OBJECT_ACE *) lpACE)->Flags & ACE_OBJECT_TYPE_PRESENT) == ACE_OBJECT_TYPE_PRESENT)
lpSID = (SID *) &(((SYSTEM_ALARM_CALLBACK_OBJECT_ACE *) lpACE)->SidStart);
else
lpSID = (SID *) &(((SYSTEM_ALARM_CALLBACK_OBJECT_ACE *) lpACE)->ObjectType);
else
lpSID = (SID *) &(((SYSTEM_ALARM_CALLBACK_OBJECT_ACE *) lpACE)->InheritedObjectType);
break;
case SYSTEM_MANDATORY_LABEL_ACE_TYPE:
lpSID = (SID *) &(((SYSTEM_MANDATORY_LABEL_ACE *) lpACE)->SidStart);
break;
case SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE:
lpSID = (SID *) &(((SYSTEM_RESOURCE_ATTRIBUTE_ACE *) lpACE)->SidStart);
break;
case SYSTEM_SCOPED_POLICY_ID_ACE_TYPE:
lpSID = (SID *) &(((SYSTEM_SCOPED_POLICY_ID_ACE *) lpACE)->SidStart);
break;
case SYSTEM_PROCESS_TRUST_LABEL_ACE_TYPE:
lpSID = (SID *) &(((SYSTEM_PROCESS_TRUST_LABEL_ACE *) lpACE)->SidStart);
break;
case SYSTEM_ACCESS_FILTER_ACE_TYPE:
lpSID = (SID *) &(((SYSTEM_ACCESS_FILTER_ACE *) lpACE)->SidStart);
break;
default:
PrintConsole(hConsole,
L"Unknown ACE type %u in SACL\n",
lpACE->AceType);
continue;
}
PrintConsole(hConsole,
L"\t[%hu]\tACE:\t%hu bytes\n"
L"\t\tType:\t\t0x%02X = %ls\n"
L"\t\tFlags:\t\t0x%02X\n",
wACE, lpACE->AceSize,
lpACE->AceType, szType[lpACE->AceType],
lpACE->AceFlags);
for (dwValue = lpACE->AceFlags & (SUCCESSFUL_ACCESS_ACE_FLAG | FAILED_ACCESS_ACE_FLAG);
_BitScanForward(&dwIndex, dwValue);
dwValue &= dwValue - 1)
PrintConsole(hConsole, L"\t\t\t\t%ls\n", szFlag[dwIndex]);
PrintConsole(hConsole,
L"\t\tAccess Mask:\t0x%08lX\n",
((SYSTEM_MANDATORY_LABEL_ACE *) lpACE)->Mask);
if (lpACE->AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE)
{
if (((SYSTEM_MANDATORY_LABEL_ACE *) lpACE)->Mask & SYSTEM_MANDATORY_LABEL_NO_WRITE_UP)
PrintConsole(hConsole,
L"\t\t\t\tNo Write Up\n");
if (((SYSTEM_MANDATORY_LABEL_ACE *) lpACE)->Mask & SYSTEM_MANDATORY_LABEL_NO_READ_UP)
PrintConsole(hConsole,
L"\t\t\t\tNo Read Up\n");
if (((SYSTEM_MANDATORY_LABEL_ACE *) lpACE)->Mask & SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP)
PrintConsole(hConsole,
L"\t\t\t\tNo Execute Up\n");
}
else
for (dwValue = ((SYSTEM_AUDIT_ACE *) lpACE)->Mask;
_BitScanForward(&dwIndex, dwValue);
dwValue &= dwValue - 1)
PrintConsole(hConsole, L"\t\t\t\t%ls\n", szMask[dwIndex]);
PrintSID(hConsole, lpSID, L"\t\tTrustee:\t");
}
}
if (LocalFree(lpSD) != NULL)
PrintConsole(hConsole,
L"LocalFree() returned error %lu\n",
dwError = GetLastError());
}
while (++nArgument < nArguments);
if (LocalFree(lpArguments) != NULL)
PrintConsole(hConsole,
L"LocalFree() returned error %lu\n",
GetLastError());
}
if (!CloseHandle(hConsole))
PrintConsole(hConsole,
L"CloseHandle() returned error %lu\n",
GetLastError());
}
ExitProcess(dwError);
}
Run the following four command lines to compile the source file
SDDL.C
created in step 1., link the compiled
object file SDDL.OBJ
and cleanup afterwards:
SET CL=/GA /GF /GS /Gy /O1 /Oi /Os /Oy /W4 /Zl SET LINK=/DEFAULTLIB:ADVAPI32.LIB /DEFAULTLIB:KERNEL32.LIB /DEFAULTLIB:SHELL32.LIB /DEFAULTLIB:USER32.LIB /ENTRY:wmainCRTStartup /LARGEADDRESSAWARE /NOCOFFGRPINFO /OSVERSION:5.0 /RELEASE /SUBSYSTEM:CONSOLE /SWAPRUN:CD,NET /VERSION:0.815 CL.EXE /FeSDDL.COM SDDL.C ERASE SDDL.OBJFor details and reference see the MSDN articles Compiler Options and Linker Options.
Note: if necessary, see the
MSDN article
Use the Microsoft C++ toolset from the command line
for an introduction.
Note: the command lines can be copied and pasted as block into a Command Processor window!
Microsoft (R) C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86 Copyright (C) Microsoft Corporation. All rights reserved. SDDL.C Microsoft (R) Incremental Linker Version 10.00.40219.386 Copyright (C) Microsoft Corporation. All rights reserved. …
Finally execute the console application
REGISTRY.COM
built in step 2. to decode two
SDDL
strings:
.\SDDL.COM O:AOG:DAD:(A;;RPWPCCDCLCSWRCWDWOGA;;;S-1-0-0) O:DAG:DAD:(A;;RPWPCCDCLCRCWOWDSDSW;;;SY)(A;;RPWPCCDCLCRCWOWDSDSW;;;DA)(OA;;CCDC;BF967ABA-0DE6-11D0-A285-00AA003049E2;;AO)(OA;;CCDC;BF967A9C-0DE6-11D0-A285-00AA003049E2;;AO)(OA;;CCDC;6DA8A4FF-0E52-11D0-A286-00AA003049E2;;AO)(OA;;CCDC;BF967AA8-0DE6-11D0-A285-00AA003049E2;;PO)(A;;RPLCRC;;;AU)S:(AU;SAFA;WDWOSDWPCCDCSW;;;WD)
O:AOG:DAD:(A;;RPWPCCDCLCSWRCWDWOGA;;;S-1-0-0) Revision: 1 Control: 0x8004 DACL Present Owner: 'S-1-5-32-548' = alias 'BUILTIN\Account Operators' Group: 'S-1-5-21-820728443-44925810-1835867902-512' = group 'AMNESIAC\Domain Administrators' DACL: 28 bytes, 1 ACE(s) [0] ACE: 20 bytes Type: 0x00 = Access Allowed Flags: 0x00 Access Mask: 0x100E003F Directory List Directory, File/Pipe Read Data, Key Query Value, Event/Mutant/Semaphore/Timer Query State, Job Assign Process, Process Terminate, Section Query, Service Query Configuration, Session Query Access, Thread Terminate, Token Assign Primary Directory Add File, File/Pipe Write Data, Key Set Value, Event/IO Completion/Mutant/Semaphore/Timer Modify State, Job Set Attributes, Process Create Thread, Section Map Write, Service Change Configuration, Session Modify Access, Thread Suspend/Resume, Token Duplicate Directory Add Subdirectory, File Append Data, Pipe Create Instance, Key Create Subkey, Job Query, Process Set Session Id, Section Map Read, Service Query Status, Token Impersonate Directory/File Read Extended Attributes, Key Enumerate Subkeys, Job Terminate, Process Virtual Memory Operation, Section Map Execute, Service Enumerate Dependencies, Thread Get Context, Token Query Directory/File Write Extended Attributes, Key Notify, Job Set Security Attributes, Process Virtual Memory Read, Section Extend Size, Service Start, Thread Set Context, Token Query Source Directory Traverse, File Execute, Key Create Link, Job Impersonate, Process Virtual Memory Write, Section Map Execute Explicit, Service Stop, Thread Set Information, Token Adjust Privileges Read Control Write DACL Write Owner Generic All Trustee: 'S-1-0-0' = well-known group 'NULL SID' SACL: NONE O:DAG:DAD:(A;;RPWPCCDCLCRCWOWDSDSW;;;SY)(A;;RPWPCCDCLCRCWOWDSDSW;;;DA)(OA;;CCDC;BF967ABA-0DE6-11D0-A285-00AA003049E2;;AO)(OA;;CCDC;BF967A9C-0DE6-11D0-A285-00AA003049E2;;AO)(OA;;CCDC;6DA8A4FF-0E52-11D0-A286-00AA003049E2;;AO)(OA;;CCDC;BF967AA8-0DE6-11D0-A285-00AA003049E2;;PO)(A;;RPLCRC;;;AU)S:(AU;SAFA;WDWOSDWPCCDCSW;;;WD) Revision: 1 Control: 0x8014 DACL Present SACL Present Owner: 'S-1-5-21-820728443-44925810-1835867902-512' = group 'AMNESIAC\Domain Administrators' Group: 'S-1-5-21-820728443-44925810-1835867902-512' = group 'AMNESIAC\Domain Administrators' DACL: 248 bytes, 7 ACE(s) [0] ACE: 20 bytes Type: 0x00 = Access Allowed Flags: 0x00 Access Mask: 0x000F003F Directory List Directory, File/Pipe Read Data, Key Query Value, Event/Mutant/Semaphore/Timer Query State, Job Assign Process, Process Terminate, Section Query, Service Query Configuration, Session Query Access, Thread Terminate, Token Assign Primary Directory Add File, File/Pipe Write Data, Key Set Value, Event/IO Completion/Mutant/Semaphore/Timer Modify State, Job Set Attributes, Process Create Thread, Section Map Write, Service Change Configuration, Session Modify Access, Thread Suspend/Resume, Token Duplicate Directory Add Subdirectory, File Append Data, Pipe Create Instance, Key Create Subkey, Job Query, Process Set Session Id, Section Map Read, Service Query Status, Token Impersonate Directory/File Read Extended Attributes, Key Enumerate Subkeys, Job Terminate, Process Virtual Memory Operation, Section Map Execute, Service Enumerate Dependencies, Thread Get Context, Token Query Directory/File Write Extended Attributes, Key Notify, Job Set Security Attributes, Process Virtual Memory Read, Section Extend Size, Service Start, Thread Set Context, Token Query Source Directory Traverse, File Execute, Key Create Link, Job Impersonate, Process Virtual Memory Write, Section Map Execute Explicit, Service Stop, Thread Set Information, Token Adjust Privileges Standard Delete Read Control Write DACL Write Owner Trustee: 'S-1-5-18' = well-known group 'NT AUTHORITY\SYSTEM' [1] ACE: 24 bytes Type: 0x00 = Access Allowed Flags: 0x00 Access Mask: 0x000F003F Directory List Directory, File/Pipe Read Data, Key Query Value, Event/Mutant/Semaphore/Timer Query State, Job Assign Process, Process Terminate, Section Query, Service Query Configuration, Session Query Access, Thread Terminate, Token Assign Primary Directory Add File, File/Pipe Write Data, Key Set Value, Event/IO Completion/Mutant/Semaphore/Timer Modify State, Job Set Attributes, Process Create Thread, Section Map Write, Service Change Configuration, Session Modify Access, Thread Suspend/Resume, Token Duplicate Directory Add Subdirectory, File Append Data, Pipe Create Instance, Key Create Subkey, Job Query, Process Set Session Id, Section Map Read, Service Query Status, Token Impersonate Directory/File Read Extended Attributes, Key Enumerate Subkeys, Job Terminate, Process Virtual Memory Operation, Section Map Execute, Service Enumerate Dependencies, Thread Get Context, Token Query Directory/File Write Extended Attributes, Key Notify, Job Set Security Attributes, Process Virtual Memory Read, Section Extend Size, Service Start, Thread Set Context, Token Query Source Directory Traverse, File Execute, Key Create Link, Job Impersonate, Process Virtual Memory Write, Section Map Execute Explicit, Service Stop, Thread Set Information, Token Adjust Privileges Standard Delete Read Control Write DACL Write Owner Trustee: 'S-1-5-21-820728443-44925810-1835867902-512' = group 'AMNESIAC\Domain Administrators' [2] ACE: 44 bytes Type: 0x05 = Object Access Allowed Flags: 0x00 Access Mask: 0x00000003 Directory List Directory, File/Pipe Read Data, Key Query Value, Event/Mutant/Semaphore/Timer Query State, Job Assign Process, Process Terminate, Section Query, Service Query Configuration, Session Query Access, Thread Terminate, Token Assign Primary Directory Add File, File/Pipe Write Data, Key Set Value, Event/IO Completion/Mutant/Semaphore/Timer Modify State, Job Set Attributes, Process Create Thread, Section Map Write, Service Change Configuration, Session Modify Access, Thread Suspend/Resume, Token Duplicate Trustee: 'S-1-5-32-548' = alias 'BUILTIN\Account Operators' [3] ACE: 44 bytes Type: 0x05 = Object Access Allowed Flags: 0x00 Access Mask: 0x00000003 Directory List Directory, File/Pipe Read Data, Key Query Value, Event/Mutant/Semaphore/Timer Query State, Job Assign Process, Process Terminate, Section Query, Service Query Configuration, Session Query Access, Thread Terminate, Token Assign Primary Directory Add File, File/Pipe Write Data, Key Set Value, Event/IO Completion/Mutant/Semaphore/Timer Modify State, Job Set Attributes, Process Create Thread, Section Map Write, Service Change Configuration, Session Modify Access, Thread Suspend/Resume, Token Duplicate Trustee: 'S-1-5-32-548' = alias 'BUILTIN\Account Operators' [4] ACE: 44 bytes Type: 0x05 = Object Access Allowed Flags: 0x00 Access Mask: 0x00000003 Directory List Directory, File/Pipe Read Data, Key Query Value, Event/Mutant/Semaphore/Timer Query State, Job Assign Process, Process Terminate, Section Query, Service Query Configuration, Session Query Access, Thread Terminate, Token Assign Primary Directory Add File, File/Pipe Write Data, Key Set Value, Event/IO Completion/Mutant/Semaphore/Timer Modify State, Job Set Attributes, Process Create Thread, Section Map Write, Service Change Configuration, Session Modify Access, Thread Suspend/Resume, Token Duplicate Trustee: 'S-1-5-32-548' = alias 'BUILTIN\Account Operators' [5] ACE: 44 bytes Type: 0x05 = Object Access Allowed Flags: 0x00 Access Mask: 0x00000003 Directory List Directory, File/Pipe Read Data, Key Query Value, Event/Mutant/Semaphore/Timer Query State, Job Assign Process, Process Terminate, Section Query, Service Query Configuration, Session Query Access, Thread Terminate, Token Assign Primary Directory Add File, File/Pipe Write Data, Key Set Value, Event/IO Completion/Mutant/Semaphore/Timer Modify State, Job Set Attributes, Process Create Thread, Section Map Write, Service Change Configuration, Session Modify Access, Thread Suspend/Resume, Token Duplicate Trustee: 'S-1-5-32-550' = alias 'BUILTIN\Print Operators' [6] ACE: 20 bytes Type: 0x00 = Access Allowed Flags: 0x00 Access Mask: 0x00020014 Directory Add Subdirectory, File Append Data, Pipe Create Instance, Key Create Subkey, Job Query, Process Set Session Id, Section Map Read, Service Query Status, Token Impersonate Directory/File Write Extended Attributes, Key Notify, Job Set Security Attributes, Process Virtual Memory Read, Section Extend Size, Service Start, Thread Set Context, Token Query Source Read Control Trustee: 'S-1-5-11' = well-known group 'NT AUTHORITY\Authenticated Users' SACL: 28 bytes, 1 ACE(s) [0] ACE: 20 bytes Type: 0x02 = Access Audit Flags: 0xC0 Access Success Access Failure Access Mask: 0x000D002B Directory List Directory, File/Pipe Read Data, Key Query Value, Event/Mutant/Semaphore/Timer Query State, Job Assign Process, Process Terminate, Section Query, Service Query Configuration, Session Query Access, Thread Terminate, Token Assign Primary Directory Add File, File/Pipe Write Data, Key Set Value, Event/IO Completion/Mutant/Semaphore/Timer Modify State, Job Set Attributes, Process Create Thread, Section Map Write, Service Change Configuration, Session Modify Access, Thread Suspend/Resume, Token Duplicate Directory/File Read Extended Attributes, Key Enumerate Subkeys, Job Terminate, Process Virtual Memory Operation, Section Map Execute, Service Enumerate Dependencies, Thread Get Context, Token Query Directory Traverse, File Execute, Key Create Link, Job Impersonate, Process Virtual Memory Write, Section Map Execute Explicit, Service Stop, Thread Set Information, Token Adjust Privileges Standard Delete Write DACL Write Owner Trustee: 'S-1-1-0' = well-known group 'Everyone'
Create the text file SDDL.TXT
with the following
content in an arbitrary, preferable empty directory:
4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
d0 00 00 00 43 00 00 00 40 00 00 00 00 00 00 00 ....C...@.......
00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00 .....W.'........
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 ................
28 43 29 6f 70 79 72 69 67 68 74 20 32 30 30 34 (C)opyright 2004
2d 32 30 32 33 2c 20 53 74 65 66 61 6e 20 4b 61 -2023, Stefan Ka
6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 nthak <stefan.ka
6e 74 68 61 6b 40 6e 65 78 67 6f 2e 64 65 3e 0d nthak@nexgo.de>.
0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21 ..$..3....!..L.!
50 45 00 00 4c 01 02 00 56 4f 49 44 00 00 00 00 PE..L...VOID....
00 00 00 00 e0 00 23 0d 0b 01 0a 00 00 0a 00 00 ......#.........
00 26 00 00 00 00 00 00 a9 11 00 00 00 10 00 00 .&..............
00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . ....@.........
05 00 00 00 00 00 2f 03 05 00 00 00 00 00 00 00 ....../.........
00 50 00 00 00 02 00 00 b7 6b 00 00 03 00 00 85 .P.......k......
00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
44 42 00 00 64 00 00 00 00 00 00 00 00 00 00 00 DB..d...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 20 00 00 5c 00 00 00 ......... ..\...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 .........code...
60 08 00 00 00 10 00 00 00 0a 00 00 00 02 00 00 `...............
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
2e 63 6f 6e 73 74 00 00 00 25 00 00 00 20 00 00 .const...%... ..
00 26 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 .&..............
00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 ....@..@........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
55 8b ec 81 ec 08 08 00 00 56 8d 45 10 50 ff 75 U........V.E.P.u
0c 8d 85 f8 f7 ff ff 50 ff 15 54 20 40 00 8b f0 .......P..T @...
85 f6 75 04 33 c0 eb 23 6a 00 8d 45 fc 50 56 8d ..u.3..#j..E.PV.
85 f8 f7 ff ff 50 ff 75 08 ff 15 2c 20 40 00 85 .....P.u..., @..
c0 74 e1 33 c0 39 75 fc 0f 94 c0 5e c9 c3 55 8b .t.3.9u....^..U.
ec 81 ec 18 04 00 00 b8 01 01 00 00 57 89 45 f0 ............W.E.
89 45 f4 8d 45 fc 50 ff 75 0c 33 ff 21 7d f8 e8 .E..E.P.u.3.!}..
e0 07 00 00 85 c0 75 23 ff 15 34 20 40 00 8b f8 ......u#..4 @...
57 68 d0 3a 40 00 68 9c 3a 40 00 ff 75 08 e8 6d Wh.:@.h.:@..u..m
ff ff ff 83 c4 10 e9 04 01 00 00 56 8d 45 f8 50 ...........V.E.P
8d 45 f4 50 8d 85 e8 fb ff ff 50 8d 45 f0 50 8d .E.P......P.E.P.
85 ec fd ff ff 50 ff 75 0c 6a 00 ff 15 00 20 40 .....P.u.j.... @
00 8b 35 34 20 40 00 85 c0 75 3d ff d6 8b f8 81 ..54 @...u=.....
ff 34 05 00 00 74 19 ff 75 fc 57 68 78 3a 40 00 .4...t..u.Whx:@.
68 08 3a 40 00 ff 75 08 e8 13 ff ff ff 83 c4 14 h.:@..u.........
ff 75 fc ff 75 10 68 f4 39 40 00 ff 75 08 e8 fd .u..u.h.9@..u...
fe ff ff 83 c4 10 eb 71 66 39 bd e8 fb ff ff 75 .......qf9.....u
08 8d 85 ec fd ff ff eb 0f 66 39 bd ec fd ff ff .........f9.....
75 29 8d 85 e8 fb ff ff 50 8b 45 f8 ff 34 85 18 u)......P.E..4..
38 40 00 ff 75 fc ff 75 10 68 c8 39 40 00 ff 75 8@..u..u.h.9@..u
08 e8 ba fe ff ff 83 c4 18 eb 2e 8d 85 ec fd ff ................
ff 50 8d 85 e8 fb ff ff 50 8b 45 f8 ff 34 85 18 .P......P.E..4..
38 40 00 ff 75 fc ff 75 10 68 94 39 40 00 ff 75 8@..u..u.h.9@..u
08 e8 8a fe ff ff 83 c4 1c ff 75 fc ff 15 30 20 ..........u...0
40 00 85 c0 74 18 ff d6 50 68 80 39 40 00 68 9c @...t...Ph.9@.h.
3a 40 00 ff 75 08 e8 65 fe ff ff 83 c4 10 5e 33 :@..u..e......^3
c0 85 ff 0f 94 c0 5f c9 c3 55 8b ec 83 ec 3c 53 ......_..U....<S
56 57 6a f4 c7 45 dc 01 00 00 00 c7 45 ec a0 00 VWj..E......E...
00 00 ff 15 44 20 40 00 8b f0 89 75 f0 83 fe ff ....D @....u....
75 0e ff 15 34 20 40 00 89 45 ec e9 69 06 00 00 u...4 @..E..i...
8d 45 cc 50 ff 15 40 20 40 00 50 ff 15 4c 20 40 .E.P..@ @.P..L @
00 8b 3d 34 20 40 00 89 45 c8 85 c0 75 17 ff d7 ..=4 @..E...u...
50 68 20 42 40 00 bb 9c 3a 40 00 53 89 45 ec 56 Ph B@...:@.S.E.V
e9 0b 06 00 00 83 7d cc 02 bb 9c 3a 40 00 7d 12 ......}....:@.}.
68 b0 41 40 00 56 e8 d5 fd ff ff 59 59 e9 d5 05 h.A@.V.....YY...
00 00 8b 45 c8 8b 4d dc 8d 34 88 8d 45 d0 50 8d ...E..M..4..E.P.
45 e8 50 6a 01 ff 36 e8 0e 06 00 00 85 c0 75 22 E.Pj..6.......u"
ff d7 ff 36 89 45 ec 50 68 48 41 40 00 68 e8 40 ...6.E.PhHA@.h.@
40 00 ff 75 f0 e8 96 fd ff ff 83 c4 14 e9 86 05 @..u............
00 00 ff 36 68 dc 40 40 00 ff 75 f0 e8 7f fd ff ...6h.@@..u.....
ff 83 c4 0c ff 75 e8 ff 15 20 20 40 00 39 45 d0 .....u... @.9E.
74 1e 50 68 a4 40 40 00 ff 75 d0 68 48 41 40 00 t.Ph.@@..u.hHA@.
68 00 40 40 00 ff 75 f0 e8 53 fd ff ff 83 c4 18 h.@@..u..S......
8d 45 c4 50 8d 45 f8 50 ff 75 e8 ff 15 1c 20 40 .E.P.E.P.u.... @
00 85 c0 75 19 ff d7 50 68 c4 3f 40 00 53 ff 75 ...u...Ph.?@.S.u
f0 89 45 ec e8 27 fd ff ff 83 c4 10 eb 45 0f b7 ..E..'.......E..
45 f8 50 ff 75 c4 68 80 3f 40 00 ff 75 f0 e8 0d E.P.u.h.?@..u...
fd ff ff 0f b7 75 f8 83 c4 10 81 e6 ff 7f ff ff .....u..........
eb 1c ff 34 85 48 38 40 00 68 70 3f 40 00 ff 75 ...4.H8@.hp?@..u
f0 e8 ea fc ff ff 8d 46 ff 83 c4 0c 23 f0 0f bc .......F....#...
c6 75 df 0f b7 45 f8 a9 00 40 00 00 74 3e 8d 45 .u...E...@..t>.E
ff 50 ff 75 e8 ff 15 18 20 40 00 8b 75 f0 89 45 .P.u.... @..u..E
ec 85 c0 74 12 50 68 30 3f 40 00 53 56 e8 ae fc ...t.Ph0?@.SV...
ff ff 83 c4 10 eb 18 0f b6 45 ff 50 68 04 3f 40 .........E.Ph.?@
00 56 e8 99 fc ff ff 83 c4 0c eb 03 8b 75 f0 8d .V...........u..
45 d8 50 8d 45 f4 50 ff 75 e8 ff 15 14 20 40 00 E.P.E.P.u.... @.
85 c0 75 17 ff d7 50 68 cc 3e 40 00 53 56 89 45 ..u...Ph.>@.SV.E
ec e8 6a fc ff ff 83 c4 10 eb 17 83 7d f4 00 74 ..j.........}..t
11 68 b8 3e 40 00 ff 75 f4 56 e8 9f fc ff ff 83 .h.>@..u.V......
c4 0c 8d 45 d8 50 8d 45 f4 50 ff 75 e8 ff 15 10 ...E.P.E.P.u....
20 40 00 85 c0 75 17 ff d7 50 68 80 3e 40 00 53 @...u...Ph.>@.S
56 89 45 ec e8 27 fc ff ff 83 c4 10 eb 17 83 7d V.E..'.........}
f4 00 74 11 68 6c 3e 40 00 ff 75 f4 56 e8 5c fc ..t.hl>@..u.V.\.
ff ff 83 c4 0c 8d 45 d8 50 8d 45 e4 50 8d 45 d4 ......E.P.E.P.E.
50 ff 75 e8 ff 15 0c 20 40 00 85 c0 75 1a ff d7 P.u.... @...u...
50 68 38 3e 40 00 53 56 89 45 ec e8 e0 fb ff ff Ph8>@.SV.E......
83 c4 10 e9 97 01 00 00 83 7d d4 00 75 07 68 1c .........}..u.h.
3e 40 00 eb 1c 8b 45 e4 85 c0 75 07 68 00 3e 40 >@....E...u.h.>@
00 eb 0e 0f b7 48 04 66 85 c9 75 12 68 e0 3d 40 .....H.f..u.h.=@
00 56 e8 a9 fb ff ff 59 59 e9 61 01 00 00 0f b7 .V.....YY.a.....
40 02 51 50 68 a0 3d 40 00 ff 75 f0 e8 8f fb ff @.QPh.=@..u.....
ff 8b 45 e4 33 c9 83 c4 10 33 db 8d 70 08 66 3b ..E.3....3..p.f;
48 04 0f 83 32 01 00 00 0f b6 06 83 f8 06 7f 49 H...2..........I
74 16 8b c8 83 e9 00 74 62 49 74 5f 83 e9 03 0f t......tbIt_....
84 01 01 00 00 49 75 40 8b 46 08 8b c8 24 02 33 .....Iu@.F...$.3
d2 83 e1 01 3c 02 0f 94 c2 33 c0 83 f9 01 0f 94 ....<....3......
c0 3b c2 75 0f 83 f9 01 75 05 8d 46 2c eb 2f 8d .;.u....u..F,./.
46 0c eb 2a 8d 46 1c eb 25 8b c8 83 e9 09 74 1b F..*.F..%.....t.
49 74 18 49 74 c2 eb bd 50 68 64 3d 40 00 ff 75 It.It...Phd=@..u
f0 e8 0a fb ff ff e9 a8 00 00 00 8d 46 08 89 45 ............F..E
f4 0f b6 06 0f b6 4e 01 51 ff 34 85 88 38 40 00 ......N.Q.4..8@.
50 0f b7 46 02 50 0f b7 c3 50 68 e8 3c 40 00 ff P..F.P...Ph.<@..
75 f0 e8 d9 fa ff ff 0f b6 7e 01 83 c4 1c 83 e7 u........~......
3f eb 1c ff 34 85 e0 38 40 00 68 d0 3c 40 00 ff ?...4..8@.h.<@..
75 f0 e8 b9 fa ff ff 8d 47 ff 83 c4 0c 23 f8 0f u.......G....#..
bc c7 75 df ff 76 04 68 a0 3c 40 00 ff 75 f0 e8 ..u..v.h.<@..u..
9c fa ff ff 8b 7e 04 83 c4 0c eb 1c ff 34 85 00 .....~.......4..
39 40 00 68 d0 3c 40 00 ff 75 f0 e8 80 fa ff ff 9@.h.<@..u......
8d 47 ff 83 c4 0c 23 f8 0f bc c7 75 df 68 88 3c .G....#....u.h.<
40 00 ff 75 f4 ff 75 f0 e8 b1 fa ff ff 8b 3d 34 @..u..u.......=4
20 40 00 83 c4 0c 0f b7 46 02 03 f0 8b 45 e4 43 @......F....E.C
66 3b 58 04 0f 82 ce fe ff ff bb 9c 3a 40 00 8d f;X.........:@..
45 d8 50 8d 45 e4 50 8d 45 d4 50 ff 75 e8 ff 15 E.P.E.P.E.P.u...
08 20 40 00 85 c0 75 1c ff d7 50 68 54 3c 40 00 . @...u...PhT<@.
53 ff 75 f0 89 45 ec e8 14 fa ff ff 83 c4 10 e9 S.u..E..........
e0 01 00 00 83 7d d4 00 75 07 68 38 3c 40 00 eb .....}..u.h8<@..
1c 8b 45 e4 85 c0 75 07 68 1c 3c 40 00 eb 0e 0f ..E...u.h.<@....
b7 48 04 66 85 c9 75 14 68 fc 3b 40 00 ff 75 f0 .H.f..u.h.;@..u.
e8 db f9 ff ff 59 59 e9 a8 01 00 00 0f b7 40 02 .....YY.......@.
51 50 68 bc 3b 40 00 ff 75 f0 e8 c1 f9 ff ff 8b QPh.;@..u.......
45 e4 83 65 e0 00 83 c4 10 8d 70 08 33 c9 e9 77 E..e......p.3..w
01 00 00 0f b6 0e 83 f9 0f 7f 49 74 1b 8d 41 ff ..........It..A.
48 74 10 48 74 0d 83 e8 04 74 0d 48 74 0a 83 e8 Ht.Ht....t.Ht...
05 eb 42 8d 46 08 eb 58 8b 46 08 8b c8 24 02 33 ..B.F..X.F...$.3
d2 83 e1 01 3c 02 0f 94 c2 33 c0 83 f9 01 0f 94 ....<....3......
c0 3b c2 75 38 83 f9 01 75 05 8d 46 2c eb 31 8d .;.u8...u..F,.1.
46 0c eb 2c 8b c1 83 e8 10 74 cd 48 74 c5 48 74 F..,.....t.Ht.Ht
c2 48 74 bf 48 74 bc 48 74 b9 51 68 80 3b 40 00 .Ht.Ht.Ht.Qh.;@.
ff 75 f0 e8 38 f9 ff ff e9 ea 00 00 00 8d 46 1c .u..8.........F.
8b 5d f0 89 45 f4 0f b6 06 0f b6 4e 01 51 ff 34 .]..E......N.Q.4
85 88 38 40 00 50 0f b7 46 02 50 0f b7 45 e0 50 ..8@.P..F.P..E.P
68 e8 3c 40 00 53 e8 05 f9 ff ff 0f b6 7e 01 83 h.<@.S.......~..
c4 1c 81 e7 c0 00 00 00 eb 1a ff 34 85 e0 38 40 ...........4..8@
00 68 d0 3c 40 00 53 e8 e4 f8 ff ff 8d 47 ff 83 .h.<@.S......G..
c4 0c 23 f8 0f bc c7 75 e1 ff 76 04 68 a0 3c 40 ..#....u..v.h.<@
00 53 e8 c9 f8 ff ff 83 c4 0c 80 3e 11 75 3b f6 .S.........>.u;.
46 04 01 74 0d 68 5c 3b 40 00 53 e8 b0 f8 ff ff F..t.h\;@.S.....
59 59 f6 46 04 02 74 0d 68 3c 3b 40 00 53 e8 9d YY.F..t.h<;@.S..
f8 ff ff 59 59 f6 46 04 04 74 33 68 14 3b 40 00 ...YY.F..t3h.;@.
53 e8 8a f8 ff ff 59 59 eb 24 8b 7e 04 eb 1a ff S.....YY.$.~....
34 85 00 39 40 00 68 d0 3c 40 00 53 e8 6f f8 ff 4..9@.h.<@.S.o..
ff 8d 47 ff 83 c4 0c 23 f8 0f bc c7 75 e1 68 88 ..G....#....u.h.
3c 40 00 ff 75 f4 53 e8 a2 f8 ff ff 8b 3d 34 20 <@..u.S......=4
40 00 bb 9c 3a 40 00 0f b7 46 02 83 c4 0c ff 45 @...:@...F.....E
e0 66 8b 4d e0 03 f0 8b 45 e4 66 3b 48 04 0f 82 .f.M....E.f;H...
7f fe ff ff ff 75 e8 ff 15 30 20 40 00 85 c0 74 .....u...0 @...t
17 ff d7 50 68 80 39 40 00 53 ff 75 f0 89 45 ec ...Ph.9@.S.u..E.
e8 0b f8 ff ff 83 c4 10 ff 45 dc 8b 45 dc 3b 45 .........E..E.;E
cc 0f 8c 2b fa ff ff ff 75 c8 ff 15 30 20 40 00 ...+....u...0 @.
85 c0 74 14 ff d7 50 68 80 39 40 00 53 ff 75 f0 ..t...Ph.9@.S.u.
e8 db f7 ff ff 83 c4 10 ff 75 f0 ff 15 3c 20 40 .........u...< @
00 85 c0 75 14 ff d7 50 68 fc 3a 40 00 53 ff 75 ...u...Ph.:@.S.u
f0 e8 ba f7 ff ff 83 c4 10 ff 75 ec ff 15 38 20 ..........u...8
40 00 cc cc ff 25 04 20 40 00 ff 25 24 20 40 00 @....%. @..%$ @.
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04 43 00 00 18 43 00 00 32 43 00 00 4e 43 00 00 .C...C..2C..NC..
6a 43 00 00 88 43 00 00 a6 43 00 00 c8 43 00 00 jC...C...C...C..
e8 43 00 00 06 44 00 00 00 00 00 00 4c 44 00 00 .C...D......LD..
5c 44 00 00 68 44 00 00 78 44 00 00 86 44 00 00 \D..hD..xD...D..
94 44 00 00 a6 44 00 00 00 00 00 00 c4 44 00 00 .D...D.......D..
00 00 00 00 e6 44 00 00 00 00 00 00 00 00 00 00 .....D..........
47 00 65 00 6e 00 65 00 72 00 69 00 63 00 20 00 G.e.n.e.r.i.c. .
52 00 65 00 61 00 64 00 00 00 00 00 47 00 65 00 R.e.a.d.....G.e.
6e 00 65 00 72 00 69 00 63 00 20 00 57 00 72 00 n.e.r.i.c. .W.r.
69 00 74 00 65 00 00 00 47 00 65 00 6e 00 65 00 i.t.e...G.e.n.e.
72 00 69 00 63 00 20 00 45 00 78 00 65 00 63 00 r.i.c. .E.x.e.c.
75 00 74 00 65 00 2f 00 54 00 72 00 61 00 76 00 u.t.e./.T.r.a.v.
65 00 72 00 73 00 65 00 00 00 00 00 47 00 65 00 e.r.s.e.....G.e.
6e 00 65 00 72 00 69 00 63 00 20 00 41 00 6c 00 n.e.r.i.c. .A.l.
6c 00 00 00 4d 00 61 00 78 00 69 00 6d 00 75 00 l...M.a.x.i.m.u.
6d 00 20 00 41 00 6c 00 6c 00 6f 00 77 00 65 00 m. .A.l.l.o.w.e.
64 00 00 00 41 00 63 00 63 00 65 00 73 00 73 00 d...A.c.c.e.s.s.
20 00 53 00 41 00 43 00 4c 00 00 00 53 00 79 00 .S.A.C.L...S.y.
6e 00 63 00 68 00 72 00 6f 00 6e 00 69 00 7a 00 n.c.h.r.o.n.i.z.
65 00 00 00 57 00 72 00 69 00 74 00 65 00 20 00 e...W.r.i.t.e. .
4f 00 77 00 6e 00 65 00 72 00 00 00 57 00 72 00 O.w.n.e.r...W.r.
69 00 74 00 65 00 20 00 44 00 41 00 43 00 4c 00 i.t.e. .D.A.C.L.
00 00 00 00 52 00 65 00 61 00 64 00 20 00 43 00 ....R.e.a.d. .C.
6f 00 6e 00 74 00 72 00 6f 00 6c 00 00 00 00 00 o.n.t.r.o.l.....
53 00 74 00 61 00 6e 00 64 00 61 00 72 00 64 00 S.t.a.n.d.a.r.d.
20 00 44 00 65 00 6c 00 65 00 74 00 65 00 00 00 .D.e.l.e.t.e...
50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 P.r.o.c.e.s.s. .
53 00 65 00 74 00 20 00 4c 00 69 00 6d 00 69 00 S.e.t. .L.i.m.i.
74 00 65 00 64 00 20 00 49 00 6e 00 66 00 6f 00 t.e.d. .I.n.f.o.
72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 00 00 r.m.a.t.i.o.n...
50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 P.r.o.c.e.s.s. .
51 00 75 00 65 00 72 00 79 00 20 00 4c 00 69 00 Q.u.e.r.y. .L.i.
6d 00 69 00 74 00 65 00 64 00 20 00 49 00 6e 00 m.i.t.e.d. .I.n.
66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 f.o.r.m.a.t.i.o.
6e 00 2c 00 20 00 54 00 68 00 72 00 65 00 61 00 n.,. .T.h.r.e.a.
64 00 20 00 52 00 65 00 73 00 75 00 6d 00 65 00 d. .R.e.s.u.m.e.
00 00 00 00 00 00 00 00 50 00 72 00 6f 00 63 00 ........P.r.o.c.
65 00 73 00 73 00 20 00 53 00 75 00 73 00 70 00 e.s.s. .S.u.s.p.
65 00 6e 00 64 00 2f 00 52 00 65 00 73 00 75 00 e.n.d./.R.e.s.u.
6d 00 65 00 2c 00 20 00 54 00 68 00 72 00 65 00 m.e.,. .T.h.r.e.
61 00 64 00 20 00 51 00 75 00 65 00 72 00 79 00 a.d. .Q.u.e.r.y.
20 00 4c 00 69 00 6d 00 69 00 74 00 65 00 64 00 .L.i.m.i.t.e.d.
20 00 49 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 .I.n.f.o.r.m.a.
74 00 69 00 6f 00 6e 00 00 00 00 00 00 00 00 00 t.i.o.n.........
50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 P.r.o.c.e.s.s. .
51 00 75 00 65 00 72 00 79 00 20 00 49 00 6e 00 Q.u.e.r.y. .I.n.
66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 f.o.r.m.a.t.i.o.
6e 00 2c 00 20 00 54 00 68 00 72 00 65 00 61 00 n.,. .T.h.r.e.a.
64 00 20 00 53 00 65 00 74 00 20 00 4c 00 69 00 d. .S.e.t. .L.i.
6d 00 69 00 74 00 65 00 64 00 20 00 49 00 6e 00 m.i.t.e.d. .I.n.
66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 f.o.r.m.a.t.i.o.
6e 00 00 00 00 00 00 00 50 00 72 00 6f 00 63 00 n.......P.r.o.c.
65 00 73 00 73 00 20 00 53 00 65 00 74 00 20 00 e.s.s. .S.e.t. .
49 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 I.n.f.o.r.m.a.t.
69 00 6f 00 6e 00 2c 00 20 00 54 00 68 00 72 00 i.o.n.,. .T.h.r.
65 00 61 00 64 00 20 00 44 00 69 00 72 00 65 00 e.a.d. .D.i.r.e.
63 00 74 00 20 00 49 00 6d 00 70 00 65 00 72 00 c.t. .I.m.p.e.r.
73 00 6f 00 6e 00 61 00 74 00 69 00 6f 00 6e 00 s.o.n.a.t.i.o.n.
00 00 00 00 00 00 00 00 44 00 69 00 72 00 65 00 ........D.i.r.e.
63 00 74 00 6f 00 72 00 79 00 2f 00 46 00 69 00 c.t.o.r.y./.F.i.
6c 00 65 00 2f 00 50 00 69 00 70 00 65 00 20 00 l.e./.P.i.p.e. .
57 00 72 00 69 00 74 00 65 00 20 00 41 00 74 00 W.r.i.t.e. .A.t.
74 00 72 00 69 00 62 00 75 00 74 00 65 00 73 00 t.r.i.b.u.t.e.s.
2c 00 20 00 50 00 72 00 6f 00 63 00 65 00 73 00 ,. .P.r.o.c.e.s.
73 00 20 00 53 00 65 00 74 00 20 00 51 00 75 00 s. .S.e.t. .Q.u.
6f 00 74 00 61 00 2c 00 20 00 53 00 65 00 72 00 o.t.a.,. .S.e.r.
76 00 69 00 63 00 65 00 20 00 55 00 73 00 65 00 v.i.c.e. .U.s.e.
72 00 20 00 44 00 65 00 66 00 69 00 6e 00 65 00 r. .D.e.f.i.n.e.
64 00 2c 00 20 00 54 00 68 00 72 00 65 00 61 00 d.,. .T.h.r.e.a.
64 00 20 00 49 00 6d 00 70 00 65 00 72 00 73 00 d. .I.m.p.e.r.s.
6f 00 6e 00 61 00 74 00 65 00 2c 00 20 00 54 00 o.n.a.t.e.,. .T.
6f 00 6b 00 65 00 6e 00 20 00 41 00 64 00 6a 00 o.k.e.n. .A.d.j.
75 00 73 00 74 00 20 00 53 00 65 00 73 00 73 00 u.s.t. .S.e.s.s.
69 00 6f 00 6e 00 20 00 49 00 64 00 00 00 00 00 i.o.n. .I.d.....
44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 D.i.r.e.c.t.o.r.
79 00 2f 00 46 00 69 00 6c 00 65 00 2f 00 50 00 y./.F.i.l.e./.P.
69 00 70 00 65 00 20 00 52 00 65 00 61 00 64 00 i.p.e. .R.e.a.d.
20 00 41 00 74 00 74 00 72 00 69 00 62 00 75 00 .A.t.t.r.i.b.u.
74 00 65 00 73 00 2c 00 20 00 50 00 72 00 6f 00 t.e.s.,. .P.r.o.
63 00 65 00 73 00 73 00 20 00 43 00 72 00 65 00 c.e.s.s. .C.r.e.
61 00 74 00 65 00 20 00 50 00 72 00 6f 00 63 00 a.t.e. .P.r.o.c.
65 00 73 00 73 00 2c 00 20 00 53 00 65 00 72 00 e.s.s.,. .S.e.r.
76 00 69 00 63 00 65 00 20 00 49 00 6e 00 74 00 v.i.c.e. .I.n.t.
65 00 72 00 72 00 6f 00 67 00 61 00 74 00 65 00 e.r.r.o.g.a.t.e.
2c 00 20 00 54 00 68 00 72 00 65 00 61 00 64 00 ,. .T.h.r.e.a.d.
20 00 53 00 65 00 74 00 20 00 54 00 68 00 72 00 .S.e.t. .T.h.r.
65 00 61 00 64 00 20 00 54 00 6f 00 6b 00 65 00 e.a.d. .T.o.k.e.
6e 00 2c 00 20 00 54 00 6f 00 6b 00 65 00 6e 00 n.,. .T.o.k.e.n.
20 00 41 00 64 00 6a 00 75 00 73 00 74 00 20 00 .A.d.j.u.s.t. .
44 00 65 00 66 00 61 00 75 00 6c 00 74 00 00 00 D.e.f.a.u.l.t...
44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 D.i.r.e.c.t.o.r.
79 00 20 00 44 00 65 00 6c 00 65 00 74 00 65 00 y. .D.e.l.e.t.e.
20 00 43 00 68 00 69 00 6c 00 64 00 2c 00 20 00 .C.h.i.l.d.,. .
50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 P.r.o.c.e.s.s. .
44 00 75 00 70 00 6c 00 69 00 63 00 61 00 74 00 D.u.p.l.i.c.a.t.
65 00 20 00 48 00 61 00 6e 00 64 00 6c 00 65 00 e. .H.a.n.d.l.e.
2c 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 ,. .S.e.r.v.i.c.
65 00 20 00 50 00 61 00 75 00 73 00 65 00 2c 00 e. .P.a.u.s.e.,.
20 00 54 00 68 00 72 00 65 00 61 00 64 00 20 00 .T.h.r.e.a.d. .
51 00 75 00 65 00 72 00 79 00 20 00 49 00 6e 00 Q.u.e.r.y. .I.n.
66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 f.o.r.m.a.t.i.o.
6e 00 2c 00 20 00 54 00 6f 00 6b 00 65 00 6e 00 n.,. .T.o.k.e.n.
20 00 41 00 64 00 6a 00 75 00 73 00 74 00 20 00 .A.d.j.u.s.t. .
47 00 72 00 6f 00 75 00 70 00 73 00 00 00 00 00 G.r.o.u.p.s.....
44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 D.i.r.e.c.t.o.r.
79 00 20 00 54 00 72 00 61 00 76 00 65 00 72 00 y. .T.r.a.v.e.r.
73 00 65 00 2c 00 20 00 46 00 69 00 6c 00 65 00 s.e.,. .F.i.l.e.
20 00 45 00 78 00 65 00 63 00 75 00 74 00 65 00 .E.x.e.c.u.t.e.
2c 00 20 00 4b 00 65 00 79 00 20 00 43 00 72 00 ,. .K.e.y. .C.r.
65 00 61 00 74 00 65 00 20 00 4c 00 69 00 6e 00 e.a.t.e. .L.i.n.
6b 00 2c 00 20 00 4a 00 6f 00 62 00 20 00 49 00 k.,. .J.o.b. .I.
6d 00 70 00 65 00 72 00 73 00 6f 00 6e 00 61 00 m.p.e.r.s.o.n.a.
74 00 65 00 2c 00 20 00 50 00 72 00 6f 00 63 00 t.e.,. .P.r.o.c.
65 00 73 00 73 00 20 00 56 00 69 00 72 00 74 00 e.s.s. .V.i.r.t.
75 00 61 00 6c 00 20 00 4d 00 65 00 6d 00 6f 00 u.a.l. .M.e.m.o.
72 00 79 00 20 00 57 00 72 00 69 00 74 00 65 00 r.y. .W.r.i.t.e.
2c 00 20 00 53 00 65 00 63 00 74 00 69 00 6f 00 ,. .S.e.c.t.i.o.
6e 00 20 00 4d 00 61 00 70 00 20 00 45 00 78 00 n. .M.a.p. .E.x.
65 00 63 00 75 00 74 00 65 00 20 00 45 00 78 00 e.c.u.t.e. .E.x.
70 00 6c 00 69 00 63 00 69 00 74 00 2c 00 20 00 p.l.i.c.i.t.,. .
53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 S.e.r.v.i.c.e. .
53 00 74 00 6f 00 70 00 2c 00 20 00 54 00 68 00 S.t.o.p.,. .T.h.
72 00 65 00 61 00 64 00 20 00 53 00 65 00 74 00 r.e.a.d. .S.e.t.
20 00 49 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 .I.n.f.o.r.m.a.
74 00 69 00 6f 00 6e 00 2c 00 20 00 54 00 6f 00 t.i.o.n.,. .T.o.
6b 00 65 00 6e 00 20 00 41 00 64 00 6a 00 75 00 k.e.n. .A.d.j.u.
73 00 74 00 20 00 50 00 72 00 69 00 76 00 69 00 s.t. .P.r.i.v.i.
6c 00 65 00 67 00 65 00 73 00 00 00 00 00 00 00 l.e.g.e.s.......
44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 D.i.r.e.c.t.o.r.
79 00 2f 00 46 00 69 00 6c 00 65 00 20 00 57 00 y./.F.i.l.e. .W.
72 00 69 00 74 00 65 00 20 00 45 00 78 00 74 00 r.i.t.e. .E.x.t.
65 00 6e 00 64 00 65 00 64 00 20 00 41 00 74 00 e.n.d.e.d. .A.t.
74 00 72 00 69 00 62 00 75 00 74 00 65 00 73 00 t.r.i.b.u.t.e.s.
2c 00 20 00 4b 00 65 00 79 00 20 00 4e 00 6f 00 ,. .K.e.y. .N.o.
74 00 69 00 66 00 79 00 2c 00 20 00 4a 00 6f 00 t.i.f.y.,. .J.o.
62 00 20 00 53 00 65 00 74 00 20 00 53 00 65 00 b. .S.e.t. .S.e.
63 00 75 00 72 00 69 00 74 00 79 00 20 00 41 00 c.u.r.i.t.y. .A.
74 00 74 00 72 00 69 00 62 00 75 00 74 00 65 00 t.t.r.i.b.u.t.e.
73 00 2c 00 20 00 50 00 72 00 6f 00 63 00 65 00 s.,. .P.r.o.c.e.
73 00 73 00 20 00 56 00 69 00 72 00 74 00 75 00 s.s. .V.i.r.t.u.
61 00 6c 00 20 00 4d 00 65 00 6d 00 6f 00 72 00 a.l. .M.e.m.o.r.
79 00 20 00 52 00 65 00 61 00 64 00 2c 00 20 00 y. .R.e.a.d.,. .
53 00 65 00 63 00 74 00 69 00 6f 00 6e 00 20 00 S.e.c.t.i.o.n. .
45 00 78 00 74 00 65 00 6e 00 64 00 20 00 53 00 E.x.t.e.n.d. .S.
69 00 7a 00 65 00 2c 00 20 00 53 00 65 00 72 00 i.z.e.,. .S.e.r.
76 00 69 00 63 00 65 00 20 00 53 00 74 00 61 00 v.i.c.e. .S.t.a.
72 00 74 00 2c 00 20 00 54 00 68 00 72 00 65 00 r.t.,. .T.h.r.e.
61 00 64 00 20 00 53 00 65 00 74 00 20 00 43 00 a.d. .S.e.t. .C.
6f 00 6e 00 74 00 65 00 78 00 74 00 2c 00 20 00 o.n.t.e.x.t.,. .
54 00 6f 00 6b 00 65 00 6e 00 20 00 51 00 75 00 T.o.k.e.n. .Q.u.
65 00 72 00 79 00 20 00 53 00 6f 00 75 00 72 00 e.r.y. .S.o.u.r.
63 00 65 00 00 00 00 00 44 00 69 00 72 00 65 00 c.e.....D.i.r.e.
63 00 74 00 6f 00 72 00 79 00 2f 00 46 00 69 00 c.t.o.r.y./.F.i.
6c 00 65 00 20 00 52 00 65 00 61 00 64 00 20 00 l.e. .R.e.a.d. .
45 00 78 00 74 00 65 00 6e 00 64 00 65 00 64 00 E.x.t.e.n.d.e.d.
20 00 41 00 74 00 74 00 72 00 69 00 62 00 75 00 .A.t.t.r.i.b.u.
74 00 65 00 73 00 2c 00 20 00 4b 00 65 00 79 00 t.e.s.,. .K.e.y.
20 00 45 00 6e 00 75 00 6d 00 65 00 72 00 61 00 .E.n.u.m.e.r.a.
74 00 65 00 20 00 53 00 75 00 62 00 6b 00 65 00 t.e. .S.u.b.k.e.
79 00 73 00 2c 00 20 00 4a 00 6f 00 62 00 20 00 y.s.,. .J.o.b. .
54 00 65 00 72 00 6d 00 69 00 6e 00 61 00 74 00 T.e.r.m.i.n.a.t.
65 00 2c 00 20 00 50 00 72 00 6f 00 63 00 65 00 e.,. .P.r.o.c.e.
73 00 73 00 20 00 56 00 69 00 72 00 74 00 75 00 s.s. .V.i.r.t.u.
61 00 6c 00 20 00 4d 00 65 00 6d 00 6f 00 72 00 a.l. .M.e.m.o.r.
79 00 20 00 4f 00 70 00 65 00 72 00 61 00 74 00 y. .O.p.e.r.a.t.
69 00 6f 00 6e 00 2c 00 20 00 53 00 65 00 63 00 i.o.n.,. .S.e.c.
74 00 69 00 6f 00 6e 00 20 00 4d 00 61 00 70 00 t.i.o.n. .M.a.p.
20 00 45 00 78 00 65 00 63 00 75 00 74 00 65 00 .E.x.e.c.u.t.e.
2c 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 ,. .S.e.r.v.i.c.
65 00 20 00 45 00 6e 00 75 00 6d 00 65 00 72 00 e. .E.n.u.m.e.r.
61 00 74 00 65 00 20 00 44 00 65 00 70 00 65 00 a.t.e. .D.e.p.e.
6e 00 64 00 65 00 6e 00 63 00 69 00 65 00 73 00 n.d.e.n.c.i.e.s.
2c 00 20 00 54 00 68 00 72 00 65 00 61 00 64 00 ,. .T.h.r.e.a.d.
20 00 47 00 65 00 74 00 20 00 43 00 6f 00 6e 00 .G.e.t. .C.o.n.
74 00 65 00 78 00 74 00 2c 00 20 00 54 00 6f 00 t.e.x.t.,. .T.o.
6b 00 65 00 6e 00 20 00 51 00 75 00 65 00 72 00 k.e.n. .Q.u.e.r.
79 00 00 00 00 00 00 00 44 00 69 00 72 00 65 00 y.......D.i.r.e.
63 00 74 00 6f 00 72 00 79 00 20 00 41 00 64 00 c.t.o.r.y. .A.d.
64 00 20 00 53 00 75 00 62 00 64 00 69 00 72 00 d. .S.u.b.d.i.r.
65 00 63 00 74 00 6f 00 72 00 79 00 2c 00 20 00 e.c.t.o.r.y.,. .
46 00 69 00 6c 00 65 00 20 00 41 00 70 00 70 00 F.i.l.e. .A.p.p.
65 00 6e 00 64 00 20 00 44 00 61 00 74 00 61 00 e.n.d. .D.a.t.a.
2c 00 20 00 50 00 69 00 70 00 65 00 20 00 43 00 ,. .P.i.p.e. .C.
72 00 65 00 61 00 74 00 65 00 20 00 49 00 6e 00 r.e.a.t.e. .I.n.
73 00 74 00 61 00 6e 00 63 00 65 00 2c 00 20 00 s.t.a.n.c.e.,. .
4b 00 65 00 79 00 20 00 43 00 72 00 65 00 61 00 K.e.y. .C.r.e.a.
74 00 65 00 20 00 53 00 75 00 62 00 6b 00 65 00 t.e. .S.u.b.k.e.
79 00 2c 00 20 00 4a 00 6f 00 62 00 20 00 51 00 y.,. .J.o.b. .Q.
75 00 65 00 72 00 79 00 2c 00 20 00 50 00 72 00 u.e.r.y.,. .P.r.
6f 00 63 00 65 00 73 00 73 00 20 00 53 00 65 00 o.c.e.s.s. .S.e.
74 00 20 00 53 00 65 00 73 00 73 00 69 00 6f 00 t. .S.e.s.s.i.o.
6e 00 20 00 49 00 64 00 2c 00 20 00 53 00 65 00 n. .I.d.,. .S.e.
63 00 74 00 69 00 6f 00 6e 00 20 00 4d 00 61 00 c.t.i.o.n. .M.a.
70 00 20 00 52 00 65 00 61 00 64 00 2c 00 20 00 p. .R.e.a.d.,. .
53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 S.e.r.v.i.c.e. .
51 00 75 00 65 00 72 00 79 00 20 00 53 00 74 00 Q.u.e.r.y. .S.t.
61 00 74 00 75 00 73 00 2c 00 20 00 54 00 6f 00 a.t.u.s.,. .T.o.
6b 00 65 00 6e 00 20 00 49 00 6d 00 70 00 65 00 k.e.n. .I.m.p.e.
72 00 73 00 6f 00 6e 00 61 00 74 00 65 00 00 00 r.s.o.n.a.t.e...
44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 D.i.r.e.c.t.o.r.
79 00 20 00 41 00 64 00 64 00 20 00 46 00 69 00 y. .A.d.d. .F.i.
6c 00 65 00 2c 00 20 00 46 00 69 00 6c 00 65 00 l.e.,. .F.i.l.e.
2f 00 50 00 69 00 70 00 65 00 20 00 57 00 72 00 /.P.i.p.e. .W.r.
69 00 74 00 65 00 20 00 44 00 61 00 74 00 61 00 i.t.e. .D.a.t.a.
2c 00 20 00 4b 00 65 00 79 00 20 00 53 00 65 00 ,. .K.e.y. .S.e.
74 00 20 00 56 00 61 00 6c 00 75 00 65 00 2c 00 t. .V.a.l.u.e.,.
20 00 45 00 76 00 65 00 6e 00 74 00 2f 00 49 00 .E.v.e.n.t./.I.
4f 00 20 00 43 00 6f 00 6d 00 70 00 6c 00 65 00 O. .C.o.m.p.l.e.
74 00 69 00 6f 00 6e 00 2f 00 4d 00 75 00 74 00 t.i.o.n./.M.u.t.
61 00 6e 00 74 00 2f 00 53 00 65 00 6d 00 61 00 a.n.t./.S.e.m.a.
70 00 68 00 6f 00 72 00 65 00 2f 00 54 00 69 00 p.h.o.r.e./.T.i.
6d 00 65 00 72 00 20 00 4d 00 6f 00 64 00 69 00 m.e.r. .M.o.d.i.
66 00 79 00 20 00 53 00 74 00 61 00 74 00 65 00 f.y. .S.t.a.t.e.
2c 00 20 00 4a 00 6f 00 62 00 20 00 53 00 65 00 ,. .J.o.b. .S.e.
74 00 20 00 41 00 74 00 74 00 72 00 69 00 62 00 t. .A.t.t.r.i.b.
75 00 74 00 65 00 73 00 2c 00 20 00 50 00 72 00 u.t.e.s.,. .P.r.
6f 00 63 00 65 00 73 00 73 00 20 00 43 00 72 00 o.c.e.s.s. .C.r.
65 00 61 00 74 00 65 00 20 00 54 00 68 00 72 00 e.a.t.e. .T.h.r.
65 00 61 00 64 00 2c 00 20 00 53 00 65 00 63 00 e.a.d.,. .S.e.c.
74 00 69 00 6f 00 6e 00 20 00 4d 00 61 00 70 00 t.i.o.n. .M.a.p.
20 00 57 00 72 00 69 00 74 00 65 00 2c 00 20 00 .W.r.i.t.e.,. .
53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 S.e.r.v.i.c.e. .
43 00 68 00 61 00 6e 00 67 00 65 00 20 00 43 00 C.h.a.n.g.e. .C.
6f 00 6e 00 66 00 69 00 67 00 75 00 72 00 61 00 o.n.f.i.g.u.r.a.
74 00 69 00 6f 00 6e 00 2c 00 20 00 53 00 65 00 t.i.o.n.,. .S.e.
73 00 73 00 69 00 6f 00 6e 00 20 00 4d 00 6f 00 s.s.i.o.n. .M.o.
64 00 69 00 66 00 79 00 20 00 41 00 63 00 63 00 d.i.f.y. .A.c.c.
65 00 73 00 73 00 2c 00 20 00 54 00 68 00 72 00 e.s.s.,. .T.h.r.
65 00 61 00 64 00 20 00 53 00 75 00 73 00 70 00 e.a.d. .S.u.s.p.
65 00 6e 00 64 00 2f 00 52 00 65 00 73 00 75 00 e.n.d./.R.e.s.u.
6d 00 65 00 2c 00 20 00 54 00 6f 00 6b 00 65 00 m.e.,. .T.o.k.e.
6e 00 20 00 44 00 75 00 70 00 6c 00 69 00 63 00 n. .D.u.p.l.i.c.
61 00 74 00 65 00 00 00 44 00 69 00 72 00 65 00 a.t.e...D.i.r.e.
63 00 74 00 6f 00 72 00 79 00 20 00 4c 00 69 00 c.t.o.r.y. .L.i.
73 00 74 00 20 00 44 00 69 00 72 00 65 00 63 00 s.t. .D.i.r.e.c.
74 00 6f 00 72 00 79 00 2c 00 20 00 46 00 69 00 t.o.r.y.,. .F.i.
6c 00 65 00 2f 00 50 00 69 00 70 00 65 00 20 00 l.e./.P.i.p.e. .
52 00 65 00 61 00 64 00 20 00 44 00 61 00 74 00 R.e.a.d. .D.a.t.
61 00 2c 00 20 00 4b 00 65 00 79 00 20 00 51 00 a.,. .K.e.y. .Q.
75 00 65 00 72 00 79 00 20 00 56 00 61 00 6c 00 u.e.r.y. .V.a.l.
75 00 65 00 2c 00 20 00 45 00 76 00 65 00 6e 00 u.e.,. .E.v.e.n.
74 00 2f 00 4d 00 75 00 74 00 61 00 6e 00 74 00 t./.M.u.t.a.n.t.
2f 00 53 00 65 00 6d 00 61 00 70 00 68 00 6f 00 /.S.e.m.a.p.h.o.
72 00 65 00 2f 00 54 00 69 00 6d 00 65 00 72 00 r.e./.T.i.m.e.r.
20 00 51 00 75 00 65 00 72 00 79 00 20 00 53 00 .Q.u.e.r.y. .S.
74 00 61 00 74 00 65 00 2c 00 20 00 4a 00 6f 00 t.a.t.e.,. .J.o.
62 00 20 00 41 00 73 00 73 00 69 00 67 00 6e 00 b. .A.s.s.i.g.n.
20 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 .P.r.o.c.e.s.s.
2c 00 20 00 50 00 72 00 6f 00 63 00 65 00 73 00 ,. .P.r.o.c.e.s.
73 00 20 00 54 00 65 00 72 00 6d 00 69 00 6e 00 s. .T.e.r.m.i.n.
61 00 74 00 65 00 2c 00 20 00 53 00 65 00 63 00 a.t.e.,. .S.e.c.
74 00 69 00 6f 00 6e 00 20 00 51 00 75 00 65 00 t.i.o.n. .Q.u.e.
72 00 79 00 2c 00 20 00 53 00 65 00 72 00 76 00 r.y.,. .S.e.r.v.
69 00 63 00 65 00 20 00 51 00 75 00 65 00 72 00 i.c.e. .Q.u.e.r.
79 00 20 00 43 00 6f 00 6e 00 66 00 69 00 67 00 y. .C.o.n.f.i.g.
75 00 72 00 61 00 74 00 69 00 6f 00 6e 00 2c 00 u.r.a.t.i.o.n.,.
20 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 .S.e.s.s.i.o.n.
20 00 51 00 75 00 65 00 72 00 79 00 20 00 41 00 .Q.u.e.r.y. .A.
63 00 63 00 65 00 73 00 73 00 2c 00 20 00 54 00 c.c.e.s.s.,. .T.
68 00 72 00 65 00 61 00 64 00 20 00 54 00 65 00 h.r.e.a.d. .T.e.
72 00 6d 00 69 00 6e 00 61 00 74 00 65 00 2c 00 r.m.i.n.a.t.e.,.
20 00 54 00 6f 00 6b 00 65 00 6e 00 20 00 41 00 .T.o.k.e.n. .A.
73 00 73 00 69 00 67 00 6e 00 20 00 50 00 72 00 s.s.i.g.n. .P.r.
69 00 6d 00 61 00 72 00 79 00 00 00 41 00 63 00 i.m.a.r.y...A.c.
63 00 65 00 73 00 73 00 20 00 46 00 61 00 69 00 c.e.s.s. .F.a.i.
6c 00 75 00 72 00 65 00 00 00 00 00 41 00 63 00 l.u.r.e.....A.c.
63 00 65 00 73 00 73 00 20 00 53 00 75 00 63 00 c.e.s.s. .S.u.c.
63 00 65 00 73 00 73 00 00 00 00 00 43 00 72 00 c.e.s.s.....C.r.
69 00 74 00 69 00 63 00 61 00 6c 00 00 00 00 00 i.t.i.c.a.l.....
49 00 6e 00 68 00 65 00 72 00 69 00 74 00 65 00 I.n.h.e.r.i.t.e.
64 00 00 00 49 00 6e 00 68 00 65 00 72 00 69 00 d...I.n.h.e.r.i.
74 00 20 00 4f 00 6e 00 6c 00 79 00 00 00 00 00 t. .O.n.l.y.....
4e 00 6f 00 20 00 50 00 72 00 6f 00 70 00 61 00 N.o. .P.r.o.p.a.
67 00 61 00 74 00 65 00 20 00 49 00 6e 00 68 00 g.a.t.e. .I.n.h.
65 00 72 00 69 00 74 00 00 00 00 00 43 00 6f 00 e.r.i.t.....C.o.
6e 00 74 00 61 00 69 00 6e 00 65 00 72 00 20 00 n.t.a.i.n.e.r. .
49 00 6e 00 68 00 65 00 72 00 69 00 74 00 00 00 I.n.h.e.r.i.t...
4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 49 00 O.b.j.e.c.t. .I.
6e 00 68 00 65 00 72 00 69 00 74 00 00 00 00 00 n.h.e.r.i.t.....
41 00 63 00 63 00 65 00 73 00 73 00 20 00 46 00 A.c.c.e.s.s. .F.
69 00 6c 00 74 00 65 00 72 00 00 00 50 00 72 00 i.l.t.e.r...P.r.
6f 00 63 00 65 00 73 00 73 00 20 00 54 00 72 00 o.c.e.s.s. .T.r.
75 00 73 00 74 00 20 00 4c 00 61 00 62 00 65 00 u.s.t. .L.a.b.e.
6c 00 00 00 53 00 63 00 6f 00 70 00 65 00 64 00 l...S.c.o.p.e.d.
20 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 .P.o.l.i.c.y. .
49 00 64 00 65 00 6e 00 74 00 69 00 66 00 69 00 I.d.e.n.t.i.f.i.
63 00 61 00 74 00 69 00 6f 00 6e 00 00 00 00 00 c.a.t.i.o.n.....
52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 R.e.s.o.u.r.c.e.
20 00 41 00 74 00 74 00 72 00 69 00 62 00 75 00 .A.t.t.r.i.b.u.
74 00 65 00 00 00 00 00 4d 00 61 00 6e 00 64 00 t.e.....M.a.n.d.
61 00 74 00 6f 00 72 00 79 00 20 00 4c 00 61 00 a.t.o.r.y. .L.a.
62 00 65 00 6c 00 00 00 4f 00 62 00 6a 00 65 00 b.e.l...O.b.j.e.
63 00 74 00 20 00 41 00 63 00 63 00 65 00 73 00 c.t. .A.c.c.e.s.
73 00 20 00 41 00 6c 00 61 00 72 00 6d 00 20 00 s. .A.l.a.r.m. .
43 00 61 00 6c 00 6c 00 62 00 61 00 63 00 6b 00 C.a.l.l.b.a.c.k.
00 00 00 00 4f 00 62 00 6a 00 65 00 63 00 74 00 ....O.b.j.e.c.t.
20 00 41 00 63 00 63 00 65 00 73 00 73 00 20 00 .A.c.c.e.s.s. .
41 00 75 00 64 00 69 00 74 00 20 00 43 00 61 00 A.u.d.i.t. .C.a.
6c 00 6c 00 62 00 61 00 63 00 6b 00 00 00 00 00 l.l.b.a.c.k.....
41 00 63 00 63 00 65 00 73 00 73 00 20 00 41 00 A.c.c.e.s.s. .A.
6c 00 61 00 72 00 6d 00 20 00 43 00 61 00 6c 00 l.a.r.m. .C.a.l.
6c 00 62 00 61 00 63 00 6b 00 00 00 41 00 63 00 l.b.a.c.k...A.c.
63 00 65 00 73 00 73 00 20 00 41 00 75 00 64 00 c.e.s.s. .A.u.d.
69 00 74 00 20 00 43 00 61 00 6c 00 6c 00 62 00 i.t. .C.a.l.l.b.
61 00 63 00 6b 00 00 00 4f 00 62 00 6a 00 65 00 a.c.k...O.b.j.e.
63 00 74 00 20 00 41 00 63 00 63 00 65 00 73 00 c.t. .A.c.c.e.s.
73 00 20 00 44 00 65 00 6e 00 69 00 65 00 64 00 s. .D.e.n.i.e.d.
20 00 43 00 61 00 6c 00 6c 00 62 00 61 00 63 00 .C.a.l.l.b.a.c.
6b 00 00 00 4f 00 62 00 6a 00 65 00 63 00 74 00 k...O.b.j.e.c.t.
20 00 41 00 63 00 63 00 65 00 73 00 73 00 20 00 .A.c.c.e.s.s. .
41 00 6c 00 6c 00 6f 00 77 00 65 00 64 00 20 00 A.l.l.o.w.e.d. .
43 00 61 00 6c 00 6c 00 62 00 61 00 63 00 6b 00 C.a.l.l.b.a.c.k.
00 00 00 00 41 00 63 00 63 00 65 00 73 00 73 00 ....A.c.c.e.s.s.
20 00 44 00 65 00 6e 00 69 00 65 00 64 00 20 00 .D.e.n.i.e.d. .
43 00 61 00 6c 00 6c 00 62 00 61 00 63 00 6b 00 C.a.l.l.b.a.c.k.
00 00 00 00 41 00 63 00 63 00 65 00 73 00 73 00 ....A.c.c.e.s.s.
20 00 41 00 6c 00 6c 00 6f 00 77 00 65 00 64 00 .A.l.l.o.w.e.d.
20 00 43 00 61 00 6c 00 6c 00 62 00 61 00 63 00 .C.a.l.l.b.a.c.
6b 00 00 00 4f 00 62 00 6a 00 65 00 63 00 74 00 k...O.b.j.e.c.t.
20 00 41 00 63 00 63 00 65 00 73 00 73 00 20 00 .A.c.c.e.s.s. .
41 00 6c 00 61 00 72 00 6d 00 00 00 4f 00 62 00 A.l.a.r.m...O.b.
6a 00 65 00 63 00 74 00 20 00 41 00 63 00 63 00 j.e.c.t. .A.c.c.
65 00 73 00 73 00 20 00 41 00 75 00 64 00 69 00 e.s.s. .A.u.d.i.
74 00 00 00 4f 00 62 00 6a 00 65 00 63 00 74 00 t...O.b.j.e.c.t.
20 00 41 00 63 00 63 00 65 00 73 00 73 00 20 00 .A.c.c.e.s.s. .
44 00 65 00 6e 00 69 00 65 00 64 00 00 00 00 00 D.e.n.i.e.d.....
4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 41 00 O.b.j.e.c.t. .A.
63 00 63 00 65 00 73 00 73 00 20 00 41 00 6c 00 c.c.e.s.s. .A.l.
6c 00 6f 00 77 00 65 00 64 00 00 00 43 00 6f 00 l.o.w.e.d...C.o.
6d 00 70 00 6f 00 75 00 6e 00 64 00 20 00 41 00 m.p.o.u.n.d. .A.
63 00 63 00 65 00 73 00 73 00 20 00 41 00 6c 00 c.c.e.s.s. .A.l.
6c 00 6f 00 77 00 65 00 64 00 00 00 41 00 63 00 l.o.w.e.d...A.c.
63 00 65 00 73 00 73 00 20 00 41 00 6c 00 61 00 c.e.s.s. .A.l.a.
72 00 6d 00 00 00 00 00 41 00 63 00 63 00 65 00 r.m.....A.c.c.e.
73 00 73 00 20 00 41 00 75 00 64 00 69 00 74 00 s.s. .A.u.d.i.t.
00 00 00 00 41 00 63 00 63 00 65 00 73 00 73 00 ....A.c.c.e.s.s.
20 00 44 00 65 00 6e 00 69 00 65 00 64 00 00 00 .D.e.n.i.e.d...
41 00 63 00 63 00 65 00 73 00 73 00 20 00 41 00 A.c.c.e.s.s. .A.
6c 00 6c 00 6f 00 77 00 65 00 64 00 00 00 00 00 l.l.o.w.e.d.....
53 00 65 00 6c 00 66 00 20 00 52 00 65 00 6c 00 S.e.l.f. .R.e.l.
61 00 74 00 69 00 76 00 65 00 00 00 52 00 65 00 a.t.i.v.e...R.e.
73 00 6f 00 75 00 72 00 63 00 65 00 20 00 4d 00 s.o.u.r.c.e. .M.
61 00 6e 00 61 00 67 00 65 00 72 00 20 00 43 00 a.n.a.g.e.r. .C.
6f 00 6e 00 74 00 72 00 6f 00 6c 00 00 00 00 00 o.n.t.r.o.l.....
53 00 41 00 43 00 4c 00 20 00 50 00 72 00 6f 00 S.A.C.L. .P.r.o.
74 00 65 00 63 00 74 00 65 00 64 00 00 00 00 00 t.e.c.t.e.d.....
44 00 41 00 43 00 4c 00 20 00 50 00 72 00 6f 00 D.A.C.L. .P.r.o.
74 00 65 00 63 00 74 00 65 00 64 00 00 00 00 00 t.e.c.t.e.d.....
53 00 41 00 43 00 4c 00 20 00 41 00 75 00 74 00 S.A.C.L. .A.u.t.
6f 00 20 00 49 00 6e 00 68 00 65 00 72 00 69 00 o. .I.n.h.e.r.i.
74 00 65 00 64 00 00 00 44 00 41 00 43 00 4c 00 t.e.d...D.A.C.L.
20 00 41 00 75 00 74 00 6f 00 20 00 49 00 6e 00 .A.u.t.o. .I.n.
68 00 65 00 72 00 69 00 74 00 65 00 64 00 00 00 h.e.r.i.t.e.d...
53 00 41 00 43 00 4c 00 20 00 41 00 75 00 74 00 S.A.C.L. .A.u.t.
6f 00 20 00 49 00 6e 00 68 00 65 00 72 00 69 00 o. .I.n.h.e.r.i.
74 00 61 00 6e 00 63 00 65 00 20 00 52 00 65 00 t.a.n.c.e. .R.e.
71 00 75 00 65 00 73 00 74 00 00 00 44 00 41 00 q.u.e.s.t...D.A.
43 00 4c 00 20 00 41 00 75 00 74 00 6f 00 20 00 C.L. .A.u.t.o. .
49 00 6e 00 68 00 65 00 72 00 69 00 74 00 61 00 I.n.h.e.r.i.t.a.
6e 00 63 00 65 00 20 00 52 00 65 00 71 00 75 00 n.c.e. .R.e.q.u.
65 00 73 00 74 00 00 00 53 00 41 00 43 00 4c 00 e.s.t...S.A.C.L.
20 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 .D.e.f.a.u.l.t.
65 00 64 00 00 00 00 00 53 00 41 00 43 00 4c 00 e.d.....S.A.C.L.
20 00 50 00 72 00 65 00 73 00 65 00 6e 00 74 00 .P.r.e.s.e.n.t.
00 00 00 00 44 00 41 00 43 00 4c 00 20 00 44 00 ....D.A.C.L. .D.
65 00 66 00 61 00 75 00 6c 00 74 00 65 00 64 00 e.f.a.u.l.t.e.d.
00 00 00 00 44 00 41 00 43 00 4c 00 20 00 50 00 ....D.A.C.L. .P.
72 00 65 00 73 00 65 00 6e 00 74 00 00 00 00 00 r.e.s.e.n.t.....
47 00 72 00 6f 00 75 00 70 00 20 00 44 00 65 00 G.r.o.u.p. .D.e.
66 00 61 00 75 00 6c 00 74 00 65 00 64 00 00 00 f.a.u.l.t.e.d...
4f 00 77 00 6e 00 65 00 72 00 20 00 44 00 65 00 O.w.n.e.r. .D.e.
66 00 61 00 75 00 6c 00 74 00 65 00 64 00 00 00 f.a.u.l.t.e.d...
6c 00 6f 00 67 00 6f 00 6e 00 20 00 73 00 65 00 l.o.g.o.n. .s.e.
73 00 73 00 69 00 6f 00 6e 00 00 00 6c 00 61 00 s.s.i.o.n...l.a.
62 00 65 00 6c 00 00 00 63 00 6f 00 6d 00 70 00 b.e.l...c.o.m.p.
75 00 74 00 65 00 72 00 00 00 00 00 75 00 6e 00 u.t.e.r.....u.n.
6b 00 6e 00 6f 00 77 00 6e 00 00 00 69 00 6e 00 k.n.o.w.n...i.n.
76 00 61 00 6c 00 69 00 64 00 00 00 64 00 65 00 v.a.l.i.d...d.e.
6c 00 65 00 74 00 65 00 64 00 20 00 61 00 63 00 l.e.t.e.d. .a.c.
63 00 6f 00 75 00 6e 00 74 00 00 00 77 00 65 00 c.o.u.n.t...w.e.
6c 00 6c 00 2d 00 6b 00 6e 00 6f 00 77 00 6e 00 l.l.-.k.n.o.w.n.
20 00 67 00 72 00 6f 00 75 00 70 00 00 00 00 00 .g.r.o.u.p.....
61 00 6c 00 69 00 61 00 73 00 00 00 64 00 6f 00 a.l.i.a.s...d.o.
6d 00 61 00 69 00 6e 00 00 00 00 00 67 00 72 00 m.a.i.n.....g.r.
6f 00 75 00 70 00 00 00 75 00 73 00 65 00 72 00 o.u.p...u.s.e.r.
00 00 00 00 00 00 00 00 00 00 00 00 08 38 40 00 .............8@.
fc 37 40 00 ec 37 40 00 e0 37 40 00 bc 37 40 00 .7@..7@..7@..7@.
9c 37 40 00 8c 37 40 00 7c 37 40 00 68 37 40 00 .7@..7@.|7@.h7@.
5c 37 40 00 40 37 40 00 20 37 40 00 00 37 40 00 \7@.@7@. 7@..7@.
e4 36 40 00 c4 36 40 00 a8 36 40 00 88 36 40 00 .6@..6@..6@..6@.
00 00 00 00 00 00 00 00 4c 36 40 00 10 36 40 00 ........L6@..6@.
e8 35 40 00 c0 35 40 00 a0 35 40 00 80 35 40 00 .5@..5@..5@..5@.
4c 35 40 00 30 35 40 00 10 35 40 00 f4 34 40 00 L5@.05@..5@..4@.
d8 34 40 00 bc 34 40 00 8c 34 40 00 60 34 40 00 .4@..4@..4@.`4@.
34 34 40 00 0c 34 40 00 e4 33 40 00 b4 33 40 00 44@..4@..3@..3@.
84 33 40 00 44 33 40 00 08 33 40 00 dc 32 40 00 .3@.D3@..3@..2@.
b0 32 40 00 74 32 40 00 38 32 40 00 18 32 40 00 .2@.t2@.82@..2@.
f0 31 40 00 b4 31 40 00 8c 31 40 00 70 31 40 00 .1@..1@..1@.p1@.
50 31 40 00 2c 31 40 00 00 31 40 00 e4 30 40 00 P1@.,1@..1@..0@.
d0 30 40 00 bc 30 40 00 9c 30 40 00 7c 30 40 00 .0@..0@..0@.|0@.
88 2e 40 00 70 2c 40 00 08 2b 40 00 78 29 40 00 ..@.p,@..+@.x)@.
00 28 40 00 80 26 40 00 a0 25 40 00 a0 24 40 00 .(@..&@..%@..$@.
a8 23 40 00 38 23 40 00 c0 22 40 00 48 22 40 00 .#@.8#@.."@.H"@.
e0 21 40 00 a0 21 40 00 00 00 00 00 00 00 00 00 .!@..!@.........
80 21 40 00 64 21 40 00 4c 21 40 00 34 21 40 00 .!@.d!@.L!@.4!@.
1c 21 40 00 00 00 00 00 00 00 00 00 00 00 00 00 .!@.............
04 21 40 00 e4 20 40 00 00 00 00 00 00 00 00 00 .!@.. @.........
cc 20 40 00 98 20 40 00 7c 20 40 00 60 20 40 00 . @.. @.| @.` @.
4c 00 6f 00 63 00 61 00 6c 00 46 00 72 00 65 00 L.o.c.a.l.F.r.e.
65 00 00 00 25 00 6c 00 73 00 27 00 25 00 6c 00 e...%.l.s.'.%.l.
73 00 27 00 20 00 3d 00 20 00 25 00 6c 00 73 00 s.'. .=. .%.l.s.
20 00 27 00 25 00 6c 00 73 00 5c 00 25 00 6c 00 .'.%.l.s.\.%.l.
73 00 27 00 0a 00 00 00 25 00 6c 00 73 00 27 00 s.'.....%.l.s.'.
25 00 6c 00 73 00 27 00 20 00 3d 00 20 00 25 00 %.l.s.'. .=. .%.
6c 00 73 00 20 00 27 00 25 00 6c 00 73 00 27 00 l.s. .'.%.l.s.'.
0a 00 00 00 25 00 6c 00 73 00 27 00 25 00 6c 00 ....%.l.s.'.%.l.
73 00 27 00 0a 00 00 00 25 00 6c 00 73 00 28 00 s.'.....%.l.s.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 20 00 66 00 6f 00 72 00 .%.l.u. .f.o.r.
20 00 73 00 65 00 63 00 75 00 72 00 69 00 74 00 .s.e.c.u.r.i.t.
79 00 20 00 69 00 64 00 65 00 6e 00 74 00 69 00 y. .i.d.e.n.t.i.
66 00 69 00 65 00 72 00 20 00 27 00 25 00 6c 00 f.i.e.r. .'.%.l.
73 00 27 00 0a 00 00 00 4c 00 6f 00 6f 00 6b 00 s.'.....L.o.o.k.
75 00 70 00 41 00 63 00 63 00 6f 00 75 00 6e 00 u.p.A.c.c.o.u.n.
74 00 53 00 69 00 64 00 00 00 00 00 25 00 6c 00 t.S.i.d.....%.l.
73 00 28 00 29 00 20 00 72 00 65 00 74 00 75 00 s.(.). .r.e.t.u.
72 00 6e 00 65 00 64 00 20 00 65 00 72 00 72 00 r.n.e.d. .e.r.r.
6f 00 72 00 20 00 25 00 6c 00 75 00 0a 00 00 00 o.r. .%.l.u.....
43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 53 00 C.o.n.v.e.r.t.S.
69 00 64 00 54 00 6f 00 53 00 74 00 72 00 69 00 i.d.T.o.S.t.r.i.
6e 00 67 00 53 00 69 00 64 00 00 00 43 00 6c 00 n.g.S.i.d...C.l.
6f 00 73 00 65 00 48 00 61 00 6e 00 64 00 6c 00 o.s.e.H.a.n.d.l.
65 00 00 00 09 00 09 00 09 00 09 00 4e 00 6f 00 e...........N.o.
20 00 45 00 78 00 65 00 63 00 75 00 74 00 65 00 .E.x.e.c.u.t.e.
20 00 55 00 70 00 0a 00 00 00 00 00 09 00 09 00 .U.p...........
09 00 09 00 4e 00 6f 00 20 00 52 00 65 00 61 00 ....N.o. .R.e.a.
64 00 20 00 55 00 70 00 0a 00 00 00 09 00 09 00 d. .U.p.........
09 00 09 00 4e 00 6f 00 20 00 57 00 72 00 69 00 ....N.o. .W.r.i.
74 00 65 00 20 00 55 00 70 00 0a 00 00 00 00 00 t.e. .U.p.......
55 00 6e 00 6b 00 6e 00 6f 00 77 00 6e 00 20 00 U.n.k.n.o.w.n. .
41 00 43 00 45 00 20 00 74 00 79 00 70 00 65 00 A.C.E. .t.y.p.e.
20 00 25 00 75 00 20 00 69 00 6e 00 20 00 53 00 .%.u. .i.n. .S.
41 00 43 00 4c 00 0a 00 00 00 00 00 09 00 53 00 A.C.L.........S.
41 00 43 00 4c 00 3a 00 09 00 09 00 25 00 68 00 A.C.L.:.....%.h.
75 00 20 00 62 00 79 00 74 00 65 00 73 00 2c 00 u. .b.y.t.e.s.,.
20 00 25 00 68 00 75 00 20 00 41 00 43 00 45 00 .%.h.u. .A.C.E.
28 00 73 00 29 00 0a 00 00 00 00 00 09 00 53 00 (.s.).........S.
41 00 43 00 4c 00 3a 00 09 00 09 00 45 00 4d 00 A.C.L.:.....E.M.
50 00 54 00 59 00 0a 00 00 00 00 00 09 00 53 00 P.T.Y.........S.
41 00 43 00 4c 00 3a 00 09 00 09 00 4e 00 55 00 A.C.L.:.....N.U.
4c 00 4c 00 0a 00 00 00 09 00 53 00 41 00 43 00 L.L.......S.A.C.
4c 00 3a 00 09 00 09 00 4e 00 4f 00 4e 00 45 00 L.:.....N.O.N.E.
0a 00 00 00 47 00 65 00 74 00 53 00 65 00 63 00 ....G.e.t.S.e.c.
75 00 72 00 69 00 74 00 79 00 44 00 65 00 73 00 u.r.i.t.y.D.e.s.
63 00 72 00 69 00 70 00 74 00 6f 00 72 00 53 00 c.r.i.p.t.o.r.S.
61 00 63 00 6c 00 00 00 09 00 09 00 54 00 72 00 a.c.l.......T.r.
75 00 73 00 74 00 65 00 65 00 3a 00 09 00 00 00 u.s.t.e.e.:.....
09 00 09 00 41 00 63 00 63 00 65 00 73 00 73 00 ....A.c.c.e.s.s.
20 00 4d 00 61 00 73 00 6b 00 3a 00 09 00 30 00 .M.a.s.k.:...0.
78 00 25 00 30 00 38 00 6c 00 58 00 0a 00 00 00 x.%.0.8.l.X.....
09 00 09 00 09 00 09 00 25 00 6c 00 73 00 0a 00 ........%.l.s...
00 00 00 00 00 00 00 00 09 00 5b 00 25 00 68 00 ..........[.%.h.
75 00 5d 00 09 00 41 00 43 00 45 00 3a 00 09 00 u.]...A.C.E.:...
25 00 68 00 75 00 20 00 62 00 79 00 74 00 65 00 %.h.u. .b.y.t.e.
73 00 0a 00 09 00 09 00 54 00 79 00 70 00 65 00 s.......T.y.p.e.
3a 00 09 00 09 00 30 00 78 00 25 00 30 00 32 00 :.....0.x.%.0.2.
58 00 20 00 3d 00 20 00 25 00 6c 00 73 00 0a 00 X. .=. .%.l.s...
09 00 09 00 46 00 6c 00 61 00 67 00 73 00 3a 00 ....F.l.a.g.s.:.
09 00 09 00 30 00 78 00 25 00 30 00 32 00 58 00 ....0.x.%.0.2.X.
0a 00 00 00 55 00 6e 00 6b 00 6e 00 6f 00 77 00 ....U.n.k.n.o.w.
6e 00 20 00 41 00 43 00 45 00 20 00 74 00 79 00 n. .A.C.E. .t.y.
70 00 65 00 20 00 25 00 75 00 20 00 69 00 6e 00 p.e. .%.u. .i.n.
20 00 44 00 41 00 43 00 4c 00 0a 00 00 00 00 00 .D.A.C.L.......
09 00 44 00 41 00 43 00 4c 00 3a 00 09 00 09 00 ..D.A.C.L.:.....
25 00 68 00 75 00 20 00 62 00 79 00 74 00 65 00 %.h.u. .b.y.t.e.
73 00 2c 00 20 00 25 00 68 00 75 00 20 00 41 00 s.,. .%.h.u. .A.
43 00 45 00 28 00 73 00 29 00 0a 00 00 00 00 00 C.E.(.s.).......
09 00 44 00 41 00 43 00 4c 00 3a 00 09 00 09 00 ..D.A.C.L.:.....
45 00 4d 00 50 00 54 00 59 00 0a 00 00 00 00 00 E.M.P.T.Y.......
09 00 44 00 41 00 43 00 4c 00 3a 00 09 00 09 00 ..D.A.C.L.:.....
4e 00 55 00 4c 00 4c 00 0a 00 00 00 09 00 44 00 N.U.L.L.......D.
41 00 43 00 4c 00 3a 00 09 00 09 00 4e 00 4f 00 A.C.L.:.....N.O.
4e 00 45 00 0a 00 00 00 47 00 65 00 74 00 53 00 N.E.....G.e.t.S.
65 00 63 00 75 00 72 00 69 00 74 00 79 00 44 00 e.c.u.r.i.t.y.D.
65 00 73 00 63 00 72 00 69 00 70 00 74 00 6f 00 e.s.c.r.i.p.t.o.
72 00 44 00 61 00 63 00 6c 00 00 00 09 00 47 00 r.D.a.c.l.....G.
72 00 6f 00 75 00 70 00 3a 00 09 00 09 00 00 00 r.o.u.p.:.......
47 00 65 00 74 00 53 00 65 00 63 00 75 00 72 00 G.e.t.S.e.c.u.r.
69 00 74 00 79 00 44 00 65 00 73 00 63 00 72 00 i.t.y.D.e.s.c.r.
69 00 70 00 74 00 6f 00 72 00 47 00 72 00 6f 00 i.p.t.o.r.G.r.o.
75 00 70 00 00 00 00 00 09 00 4f 00 77 00 6e 00 u.p.......O.w.n.
65 00 72 00 3a 00 09 00 09 00 00 00 47 00 65 00 e.r.:.......G.e.
74 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 t.S.e.c.u.r.i.t.
79 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 y.D.e.s.c.r.i.p.
74 00 6f 00 72 00 4f 00 77 00 6e 00 65 00 72 00 t.o.r.O.w.n.e.r.
00 00 00 00 09 00 52 00 4d 00 20 00 43 00 6f 00 ......R.M. .C.o.
6e 00 74 00 72 00 6f 00 6c 00 3a 00 09 00 30 00 n.t.r.o.l.:...0.
78 00 25 00 30 00 32 00 58 00 0a 00 00 00 00 00 x.%.0.2.X.......
47 00 65 00 74 00 53 00 65 00 63 00 75 00 72 00 G.e.t.S.e.c.u.r.
69 00 74 00 79 00 44 00 65 00 73 00 63 00 72 00 i.t.y.D.e.s.c.r.
69 00 70 00 74 00 6f 00 72 00 52 00 4d 00 43 00 i.p.t.o.r.R.M.C.
6f 00 6e 00 74 00 72 00 6f 00 6c 00 00 00 00 00 o.n.t.r.o.l.....
09 00 09 00 25 00 6c 00 73 00 0a 00 00 00 00 00 ....%.l.s.......
09 00 52 00 65 00 76 00 69 00 73 00 69 00 6f 00 ..R.e.v.i.s.i.o.
6e 00 3a 00 09 00 25 00 6c 00 75 00 0a 00 09 00 n.:...%.l.u.....
43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 3a 00 C.o.n.t.r.o.l.:.
09 00 30 00 78 00 25 00 30 00 34 00 68 00 58 00 ..0.x.%.0.4.h.X.
0a 00 00 00 47 00 65 00 74 00 53 00 65 00 63 00 ....G.e.t.S.e.c.
75 00 72 00 69 00 74 00 79 00 44 00 65 00 73 00 u.r.i.t.y.D.e.s.
63 00 72 00 69 00 70 00 74 00 6f 00 72 00 43 00 c.r.i.p.t.o.r.C.
6f 00 6e 00 74 00 72 00 6f 00 6c 00 00 00 00 00 o.n.t.r.o.l.....
25 00 6c 00 73 00 28 00 29 00 20 00 72 00 65 00 %.l.s.(.). .r.e.
74 00 75 00 72 00 6e 00 65 00 64 00 20 00 61 00 t.u.r.n.e.d. .a.
20 00 73 00 65 00 63 00 75 00 72 00 69 00 74 00 .s.e.c.u.r.i.t.
79 00 20 00 64 00 65 00 73 00 63 00 72 00 69 00 y. .d.e.s.c.r.i.
70 00 74 00 6f 00 72 00 20 00 6f 00 66 00 20 00 p.t.o.r. .o.f. .
25 00 6c 00 75 00 20 00 62 00 79 00 74 00 65 00 %.l.u. .b.y.t.e.
73 00 2c 00 20 00 62 00 75 00 74 00 20 00 25 00 s.,. .b.u.t. .%.
6c 00 73 00 28 00 29 00 20 00 72 00 65 00 74 00 l.s.(.). .r.e.t.
75 00 72 00 6e 00 65 00 64 00 20 00 25 00 6c 00 u.r.n.e.d. .%.l.
75 00 20 00 62 00 79 00 74 00 65 00 73 00 0a 00 u. .b.y.t.e.s...
00 00 00 00 47 00 65 00 74 00 53 00 65 00 63 00 ....G.e.t.S.e.c.
75 00 72 00 69 00 74 00 79 00 44 00 65 00 73 00 u.r.i.t.y.D.e.s.
63 00 72 00 69 00 70 00 74 00 6f 00 72 00 4c 00 c.r.i.p.t.o.r.L.
65 00 6e 00 67 00 74 00 68 00 00 00 0a 00 25 00 e.n.g.t.h.....%.
6c 00 73 00 0a 00 00 00 25 00 6c 00 73 00 28 00 l.s.....%.l.s.(.
29 00 20 00 72 00 65 00 74 00 75 00 72 00 6e 00 ). .r.e.t.u.r.n.
65 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 e.d. .e.r.r.o.r.
20 00 25 00 6c 00 75 00 20 00 66 00 6f 00 72 00 .%.l.u. .f.o.r.
20 00 61 00 72 00 67 00 75 00 6d 00 65 00 6e 00 .a.r.g.u.m.e.n.
74 00 20 00 27 00 25 00 6c 00 73 00 27 00 0a 00 t. .'.%.l.s.'...
00 00 00 00 00 00 00 00 43 00 6f 00 6e 00 76 00 ........C.o.n.v.
65 00 72 00 74 00 53 00 74 00 72 00 69 00 6e 00 e.r.t.S.t.r.i.n.
67 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 g.S.e.c.u.r.i.t.
79 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 y.D.e.s.c.r.i.p.
74 00 6f 00 72 00 54 00 6f 00 53 00 65 00 63 00 t.o.r.T.o.S.e.c.
75 00 72 00 69 00 74 00 79 00 44 00 65 00 73 00 u.r.i.t.y.D.e.s.
63 00 72 00 69 00 70 00 74 00 6f 00 72 00 00 00 c.r.i.p.t.o.r...
4e 00 6f 00 20 00 61 00 72 00 67 00 75 00 6d 00 N.o. .a.r.g.u.m.
65 00 6e 00 74 00 73 00 3a 00 20 00 61 00 74 00 e.n.t.s.:. .a.t.
20 00 6c 00 65 00 61 00 73 00 74 00 20 00 6f 00 .l.e.a.s.t. .o.
6e 00 65 00 20 00 53 00 44 00 44 00 4c 00 20 00 n.e. .S.D.D.L. .
73 00 74 00 72 00 69 00 6e 00 67 00 20 00 6d 00 s.t.r.i.n.g. .m.
75 00 73 00 74 00 20 00 62 00 65 00 20 00 67 00 u.s.t. .b.e. .g.
69 00 76 00 65 00 6e 00 21 00 0a 00 00 00 00 00 i.v.e.n.!.......
43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 4c 00 C.o.m.m.a.n.d.L.
69 00 6e 00 65 00 54 00 6f 00 41 00 72 00 67 00 i.n.e.T.o.A.r.g.
76 00 00 00 a8 42 00 00 00 00 00 00 00 00 00 00 v....B..........
3e 44 00 00 00 20 00 00 d4 42 00 00 00 00 00 00 >D... ...B......
00 00 00 00 b6 44 00 00 2c 20 00 00 f4 42 00 00 .....D.., ...B..
00 00 00 00 00 00 00 00 da 44 00 00 4c 20 00 00 .........D..L ..
fc 42 00 00 00 00 00 00 00 00 00 00 f4 44 00 00 .B...........D..
54 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 T ..............
00 00 00 00 00 00 00 00 04 43 00 00 18 43 00 00 .........C...C..
32 43 00 00 4e 43 00 00 6a 43 00 00 88 43 00 00 2C..NC..jC...C..
a6 43 00 00 c8 43 00 00 e8 43 00 00 06 44 00 00 .C...C...C...D..
00 00 00 00 4c 44 00 00 5c 44 00 00 68 44 00 00 ....LD..\D..hD..
78 44 00 00 86 44 00 00 94 44 00 00 a6 44 00 00 xD...D...D...D..
00 00 00 00 c4 44 00 00 00 00 00 00 e6 44 00 00 .....D.......D..
00 00 00 00 91 01 4c 6f 6f 6b 75 70 41 63 63 6f ......LookupAcco
75 6e 74 53 69 64 57 00 6c 00 43 6f 6e 76 65 72 untSidW.l.Conver
74 53 69 64 54 6f 53 74 72 69 6e 67 53 69 64 57 tSidToStringSidW
00 00 4d 01 47 65 74 53 65 63 75 72 69 74 79 44 ..M.GetSecurityD
65 73 63 72 69 70 74 6f 72 53 61 63 6c 00 48 01 escriptorSacl.H.
47 65 74 53 65 63 75 72 69 74 79 44 65 73 63 72 GetSecurityDescr
69 70 74 6f 72 44 61 63 6c 00 49 01 47 65 74 53 iptorDacl.I.GetS
65 63 75 72 69 74 79 44 65 73 63 72 69 70 74 6f ecurityDescripto
72 47 72 6f 75 70 00 00 4b 01 47 65 74 53 65 63 rGroup..K.GetSec
75 72 69 74 79 44 65 73 63 72 69 70 74 6f 72 4f urityDescriptorO
77 6e 65 72 00 00 4c 01 47 65 74 53 65 63 75 72 wner..L.GetSecur
69 74 79 44 65 73 63 72 69 70 74 6f 72 52 4d 43 ityDescriptorRMC
6f 6e 74 72 6f 6c 00 00 47 01 47 65 74 53 65 63 ontrol..G.GetSec
75 72 69 74 79 44 65 73 63 72 69 70 74 6f 72 43 urityDescriptorC
6f 6e 74 72 6f 6c 00 00 4a 01 47 65 74 53 65 63 ontrol..J.GetSec
75 72 69 74 79 44 65 73 63 72 69 70 74 6f 72 4c urityDescriptorL
65 6e 67 74 68 00 72 00 43 6f 6e 76 65 72 74 53 ength.r.ConvertS
74 72 69 6e 67 53 65 63 75 72 69 74 79 44 65 73 tringSecurityDes
63 72 69 70 74 6f 72 54 6f 53 65 63 75 72 69 74 criptorToSecurit
79 44 65 73 63 72 69 70 74 6f 72 57 00 00 41 44 yDescriptorW..AD
56 41 50 49 33 32 2e 64 6c 6c 00 00 24 05 57 72 VAPI32.dll..$.Wr
69 74 65 43 6f 6e 73 6f 6c 65 57 00 48 03 4c 6f iteConsoleW.H.Lo
63 61 6c 46 72 65 65 00 02 02 47 65 74 4c 61 73 calFree...GetLas
74 45 72 72 6f 72 00 00 19 01 45 78 69 74 50 72 tError....ExitPr
6f 63 65 73 73 00 52 00 43 6c 6f 73 65 48 61 6e ocess.R.CloseHan
64 6c 65 00 87 01 47 65 74 43 6f 6d 6d 61 6e 64 dle...GetCommand
4c 69 6e 65 57 00 64 02 47 65 74 53 74 64 48 61 LineW.d.GetStdHa
6e 64 6c 65 00 00 4b 45 52 4e 45 4c 33 32 2e 64 ndle..KERNEL32.d
6c 6c 00 00 06 00 43 6f 6d 6d 61 6e 64 4c 69 6e ll....CommandLin
65 54 6f 41 72 67 76 57 00 00 53 48 45 4c 4c 33 eToArgvW..SHELL3
32 2e 64 6c 6c 00 35 03 77 76 73 70 72 69 6e 74 2.dll.5.wvsprint
66 57 00 00 55 53 45 52 33 32 2e 64 6c 6c 00 00 fW..USER32.dll..
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Decode the dump file SDDL.TXT
created in
step 5. to recreate the console application
Security Descriptor Definition Language Decoder:
CERTUTIL.EXE /DecodeHex /V SDDL.TXT SDDL.COM
Input Length = 54400 Output Length = 12800 CertUtil: -decodehex command completed successfully.
SECURITY.COM { ‹directory name› | ‹file name› } …Note: when run under a user account which has the privileges
SeBackupPrivilege
and
SeSecurityPrivilege
assigned, the
Security Descriptor Inspector
enables them to access all directories and files.
Note: due to the design and implementation of Windows’ (classic alias legacy) console, the Win32 func