MSVPWN(1)

NAME
msvpwn - Bypass Windows authentication using binary patching

SYNOPSIS
msvpwn [-s] file

DESCRIPTION
msvpwn patches the DLL file so as to bypass the Windows authentication. The DLL should be C:\Windows\System32\msv1_0.dll (the directories' names change between two Windows versions, but the DLL's name doesn't).

OPTIONS
If no options are given, the DLL's state will be reverted

-s: displays the DLL's state: patched, unpatched or not recognized. Nothing else is done.

EXAMPLES
We'll assume a Windows 7 computer here, the path to msv1_0.dll is different in XP.

$ sudo fdisk -l # List block devices. The device containing msv1_0.dll is /dev/sda3 here
$ sudo mount /dev/sda3 /mnt
$ msvpwn -s /mnt/Windows/System32/msv1_0.dll # Check if the DLL is known to msvpwn.
$ msvpwn /mnt/Windows/System32/msv1_0.dll # Here, the DLL is known, so let's patch it ! If we re-run this command, the DLL will be unpatched

BUGS
Not all msv1_0.dll versions are known to msvpwn. If you stumble upon one that isn't recognized, store it somewhere and send it to me, either by mail (matthias.rabault@mailoo.org), or file a pull request at https://bitbucket.org/mrabault/msvpwn (there's no - character in the URL, just in case the line splits). Don't forget to send me details about the Windows version. If you send me a bug report by mail, I'll add it to the bugtracker.