|
Background: There are vulnerable kernel mode drivers for Windows systems, which can be loaded into the system for various purposes. Loaded kernel mode drivers leave traces in the system. Anti-cheat software for video games, for example, look for vulnerable driver traces in various parts of the system because they are used for cheating. The logic used by anti-cheat software could perhaps be (or were already) used by anti-rootkit tools or rootkits themselves.
I am wondering where traces are left after drivers are loaded and then unloaded. From my research, I found these two places in Windows NT kernel, where unloaded drivers leave traces:
1. PiDDBCacheTable
2. MmUnloadedDrivers
(Just to let you know, those are undocumented data structures)
Where else could they leave traces? Is it possible for me to learn it without reverse-engineering the Windows kernel by myself?
|
|
|
|
|
I just searched several dozen .msi files, one by one, using Orca to extract the ProductCode from the Property table. It was cumbersome, and I made a couple mistakes when copy/pasting the values. I will have to repeat this task (for a greater number of msi files) at irregular intervals.
I wish I had a tool to echo the selected attributes from a given table in a file (sort of Select Value from Property where Property="ProductCode") - either as a library or as a complete program so I can traverse a directory tree and apply it to all (relevant) msi files.
This time, I needed the ProductCode from the Property table, but later I may want any attribute from any table in the file(s), if it exists.
Does any such program or library exist?
(I do not have resources to dissect e.g. the Wix source code to learn the database structure inside .msi files!)
|
|
|
|
|
I do something like that all the time. I just wrote a small VBScript to return the ProductCode in an InputBox. It's easy enough to do.
I added the script to the context menu for .MSI files. Now I just right-click an .MSI and click "Get ProductCode..." Done.
It's very unlikely you're going to find any such tool as you describe. It seems specific to your situation only, so you're probably going to have to write your own tool to traverse your directory tree and gather the specifics you need.
|
|
|
|
|
Traversing the directory tree is trivial - I once made a general mechanism for that, and use it all the time (for listing files not accessed for x days, for listing dependencies of Python pakcages, for counting lines of code, for creating warnings about paths that are getting close to the old 260 char limit,...). To this directory travesal function, I supply one or more search roots, filters (such as Extension = "msi"), and a callback function that receives each file that passes the filter. An optional callback handles directory hits, or directories with file hits.
So that part of it is in place. My problem is how do I make that callback function with "a small VBScript to return the ProductCode"? Which mechanism did you use to obtain that value? Is that script available?
The only way I am aware of to read out the ProductCode (or any other .msi value) is to use the GUI application "Orca". At least as a GUI application, it is poorly suited for callback function. It seems to be callable from a script, but the help information gives no help on how to extract a given attribute from a given table. How did your VB script read out the values from the .msi file?
I am programming in C#, but I guess that I could adopt the same mechanism. If I cannot rewrite it to C#, I can run it as a separate process and analyze the console output (I do that all the time, for my other tree traversal functions).
|
|
|
|
|
To get the ProductCode in VBScript is easy:
Dim msi,database,view1,record,productCode
Set msi = CreateObject("WindowsInstaller.Installer")
Set database = msi.OpenDatabase(WScript.Arguments(0), 1)
Set view1 = database.OpenView("SELECT `Value` FROM `Property` WHERE `Property` = 'ProductCode'")
Call view1.Execute
Set record = view1.Fetch
If record Is Nothing Then
MsgBox "Unable to find a ProductCode in the MSI database!"
WScript.Quit
End if
productCode = record.StringData(1)
Set record = Nothing
view1.Close
Set view1 = Nothing
Set database = Nothing
Set msi = Nothing
InputBox "The ProductCode is:", WScript.Arguments(0), productCode
|
|
|
|
|
I found one answer myself: The WiX toolset included dark.exe that translates an .msi file into an XML file. Extracting an arbitrary attribute value from XML is a trivial affair.
So my problems are solved.
|
|
|
|
|
My WiFi drivers have not been functioning well lately. They stop working and don't display any error indication until I try to disconnect/connect, and the network I'm on is alone in the network taskbar thing. Sometimes the driver even vanishes without a trace, and I need to reinstall it/restart my laptop to get it working again.
-My laptop is a Lenovo X220
-I run Windows 7 (Professional, I believe)
-My WiFi drivers (I have tried multiple) are Intel
-I know that it's a software issue, as I changed the hard drive between laptops (the same model) and there was no difference.
Any help at all is much appreciated, and this problem is very annoying when I'm trying to play online with .
|
|
|
|
|
This is a site for software development, not technical support on your laptop.
Contact the manufacturers, they probably have a support forum where people have probably had the same problem.
Sent from my Amstrad PC 1640
Never throw anything away, Griff
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
Hey there, I run a computer repair shop and I'm looking to make basic diagnostics easier for me. I have a list of tasks I do to a computer but I would like to automate with a program. I was wondering what language would best to code the following criteria:
Task One:
Pull System info such as Version of Windows, processor information, GPU information, Ram, Hard drive and just those basic information. I would then like to export this information to my website or to a text file.
Task Two: Run certain programs I use to clean up the computers. I run them in a certain order so I'd like to be able to somehow run them in a certain order and then when each program finishes, to create a report of the results.
Do you think this would be possible in one program/language? Or would it be best to separate the task based on which programming language would be most efficient? I want to be able to just put it on a flash drive or run a program and just have it autorun while I do other things and then come back to it later.
|
|
|
|
|
Yes; it's possible to do that all in one language.
It's usually called "malware". Lots of options available.
A favorite of "computer repair shops", I hear ... "while you do other things...".
Déjà vu.
"(I) am amazed to see myself here rather than there ... now rather than then".
― Blaise Pascal
|
|
|
|
|
Well it's not malware but I can see how my post made it seem like that  .
|
|
|
|
|
1. Most information ca be provided by the systeminfo command.
2. Run the programs in a batch file, piping their output to whatever repository you want.
|
|
|
|
|
Hi
Imagine a user-mode process is communicating with a driver using IOCTL (DeviceIoControl).
1.) I'd like to learn if there is a way to find if a process is communicating with a driver.
2.) In which cases would it be impossible to find it? For example there are multiple ways that a process can communicate with a driver: IOCTL, shared memory, netlink, system calls, netlink Sockets etc.
|
|
|
|
|
1. You would need to use Windows hooking (Google will find you details).
2. Maybe not impossible, but extremely difficult. You would probably need a good knowledge of windows drivers.
|
|
|
|
|
Thurrott: It's "Game Over", "UWP will disappear" - MSPoweruser[^]
"As far as I can see, the future of native applications on Windows has very little to do with the Microsoft Store. However, I do not expect the store to disappear. But I expect that UWP will disappear, especially on the Windows desktop. And that the Microsoft Store remains irrelevant to most users and most developers."
This sums up my opinion of UWP pretty much since its introduction. Thoughts? Any fans of UWP over "legacy" WPF desktop app development?
|
|
|
|
|
FUD.
Surface sales are exceeding all expectations. Most apparently not even being moved out of "Z" mode (i.e. "Store").
Windows store is getting rid of "Books" ... good?
Learn WPF or UWP; i.e. XAML.
Create Net standard libraries for inter-op.
Avoid Xamarin for now unless you like big buttons, lame list controls and tiny real estate (and long compiles).
"(I) am amazed to see myself here rather than there ... now rather than then".
― Blaise Pascal
|
|
|
|
|
The thing you have to remember about Thurrott is that he's aiming to make money from clicks so titles like this are massive clickbait. UWP will not disappear - for some reason, he completely failed to understand what all the announcements at Build were wrt UWP.
This space for rent
|
|
|
|
|
hi
i have a laptop Dell N5110 whith :
Intel core i7-2570qm cpu 2.20 ghz
ram 8 gig
Intel hd graphic 3000 and nvidia gforce gt 525m
now i want to installing new windows but i don't know which is good for me : windows 10 or windows 8.1
can you help me for choice a windows with good performance for my laptop
tanks
|
|
|
|
|
Windows 10 will allow you to run the "newer" software apps which Windows 8.1 doesn't (e.g. MS Edge; 3D Paint).
However, you won't have a "good" experience with the new virtual / mixed reality apps which require a more powerful graphics cards than what your laptop has.
"(I) am amazed to see myself here rather than there ... now rather than then".
― Blaise Pascal
|
|
|
|
|
Your only choice is Windows 10. You can't buy Windows 8.x anymore.
Also, Windows 8.1 went into "extended support" in January this year. It now only receives security patches and will only do so until January 2023.
|
|
|
|
|
|
hi
i have a laptop Dell N5110 whith :
Intel core i7-2570qm cpu 2.20 ghz
ram 8 gig
Intel hd graphic 3000 and nvidia gforce gt 525m
now i want to installing new windows but i don't know which is good for me : windows 10 or windows 8.1
can you help me for choice a windows with good performance for my laptop
tanks
|
|
|
|
|
I think your system is good enough for Windows 10. Go for Windows 10. You will have the latest and most stable operating system.
I cannot think of any specific reason for Windows 8.1.
|
|
|
|
|
Hi all,
I'm trying to schedule a backup operation at system shut down.
I've tried EaseUs and AOMEI programs. Both state that this works.
If I shut down the computer using the start menu nothing happens.
If I call the command "shutdown /s /t 0" from the command line both work well and the backup gets performed.
This makes me think there is a difference between the shutdown in the start menu and that command line.
Is there a way to configure the start menu shut down button to mimic that command line?
Thank you all.
|
|
|
|
|
Found it...
If you are using windows 10, then it is possible you have selected "fast boot" in the power options (it comes active by default).
Disselecting it solved the issue.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
