All About SAM Files

What is SAM?

SAM is short for Security Accounts Manager, which is located on the PDC and has information on all user accounts and passwords. Most of the time while the PDC is running, it is being accessed or used.

What do I do with a copy of SAM?

You get passwords. First use a copy of SAMDUMP.EXE to extract the user info out of it. You do not need to import this data into the Registry of your home machine to play with it. You can simply load it up into one of the many applications for cracking passwords, such as L0phtCrack, which is available from: http://www.L0phtCrack.com

Of interest to hackers is the fact that all access control and assorted parameters are located in the Registry. The Registry contains thousands of individual items of data, and is grouped together into "keys" or some type of optional value. These keys are grouped together into subtrees -- placing like keys together and making copies of others into separate trees for more convenient system access.

The Registry is divided into four separate subtrees. These subtrees are called

• HKEY_CLASSES_ROOT
• HKEY_CURRENT_USER
• HKEY_LOCAL_MACHINE
• HKEY_USERS

We'll go through them from most important to the hacker to least important to the hacker.

First and foremost is the HKEY_LOCAL_MACHINE subtree. It contains five different keys. These keys are as follows:

• SAM and SECURITY - These keys contain the info such as user rights, user and group info for the domain (or workgroup if there is no domain), and passwords. In the NT hacker game of capture the flag, this is the flag. Bag this and all bets are off.

The keys are binary data only (for security reasons) and are typically not accessible unless you are an Administrator or in the Administrators group. It is easier to copy the data and play with it offline than to work on directly.

• HARDWARE - this is a storage database of throw-away data that describes the hardware components of the computer. Device drivers and applications build this database during boot and update it during runtime (although most of the database is updated during the boot process). When the computer is rebooted, the data is built again from scratch. It is not recommended to directly edit this particular database unless you can read hex easily.

There are three subkeys under HARDWARE, these are the Description key, the DeviceMap key, and the ResourceMap key. The Description key has describes each hardware resource, the DeviceMap key has data in it specific to individual groups of drivers, and the ResourceMap key tells which driver goes with which resource.

• SYSTEM - This key contains basic operating stuff like what happens at startup, what device drivers are loaded, what services are in use, etc. These are split into ControlSets which have unique system configurations (some bootable, some not), with each ControlSet containing service data and OS components for that ControlSet. Ever had to boot from the "Last Known Good" configuration because something got hosed? That is a ControlSet stored here.
• SOFTWARE - This key has info on software loaded locally. File associations, OLE info, and some miscellaneous configuration data is located here.

The second most important main key is HKEY_USERS. It contains a subkey for each local user who accesses the system, either locally or remotely. If the server is a part of a domain and logs in across the network, their subkey is not stored here, but on a Domain Controller. Things such as Desktop settings and user profiles are stored here.

The third and fourth main keys, HKEY_CURRENT_USER and HKEY_CLASSES_ROOT, contain copies of portions of HKEY_USERS and HKEY_LOCAL_MACHINE respectively. HKEY_CURRENT_USER contains exactly would you would expect a copy of the subkey from HKEY_USERS of the currently logged in user. HKEY_CLASSES_ROOT contains a part of HKEY_LOCAL_MACHINE, specifically from the SOFTWARE subkey. File associations, OLE configuration and dependency information.

All Windows Games' Cheats

1. Minesweeper:

• Secret- Reveal Mines|Instructions - Minimize or close all running applications. Launch Minesweeper, then type xyzzy. Next hold down either shift key for one second. Now when you move the mouse cursor over a Minesweeper square you will see a tiny white pixel in the top left corner of your desktop screen. This pixel will change to black when your mouse moves over a mine. You may need to change you desktop background to a solid color other then white or black to see the pixel.

2. Pinball:

• Secret - Extra Balls|Instructions - Type 1max at the start of a new ball to get extra balls.
• Secret - Gravity Well|Instructions - Type gmax at the start of a new game to activate the Gravity Well.
• Secret - Instant Promotion|Instructions - Type rmax at the start of a new game to go up in ranks.
• Secret - Skill Shot|Instructions - Launch the ball partially up the chute past the third yellow light bar so it falls back down to get 75,000 points. There are six yellow light bars that are worth a varying amount of points: First: 15,000 points, Second: 30,000 points, Third: 75,000 points, Fourth: 30,000 points, Fifth: 15,000 points, Sixth: 7,500 points.
• Secret - Test Mode|Instructions - Type hidden test at the start of a new ball to activate Test Mode. No notification will be given that this is activated but you can now left-click the mouse button and drag the ball around.
• Secret - Unlimited Balls|Instructions - Type bmax at the start of a new ball. No notification will be given that this is activated but when a ball is lost a new ball will appear from the yellow wormhole indefinitely. Once this is activated you will be unable to activate other secrets without restarting.

3. Solitaire

• Secret - Instant Win|Instructions - Press Alt + Shift + 2 during game play to instantly win.
• Secret - Draw single cards in a Draw Three game.|Instructions - Hold down CTRL + ALT + SHIFT while drawing a new card. Instead of drawing three cards you will only draw one. Infinite Points. In the Windows XP version of solitaire, draw from the deck at least twice. Hold control and drag a card down from the deck. Click the “A” key and then let go of the left mouse key. You will get 10 points for this. Continue doing this for infinite points!

4. FreeCell

• Secret - Instant Win|Instructions - Hold down Ctrl + Shift + F10 during game play. Then you will be asked if you want to Abort, Retry or Ignore. Choose Abort, then move any card to instantly win.
• Secret - Hidden Game Modes|Instructions - In the “Game” menu choose “Select Game”. Enter -1 or -2 to activate the hidden game.

Use Your Computer As An Alarm

Now this is specially for the ones who are too lazy to get up even when the trust cellphone dies screeching its lungs out. Its pretty simple Creating the playlist create a playlist of your favourite songs in Winamp, WMP or any other player. Export the playlist as a M3U playlist. M3U is generally accepted by almost every player. Triggering the alarm point to start> programs >accessories > system tools >scheduled tasks Create a new task and choose program as windows media player or winamp (May work with others too but I haven't tried anything else) Choose "daily", Enter the time and choose "every day" at next screen. It would now ask for password (leave blank in case you don't have one) Right click on the newly created task and check the "run only if logged in" check box. In the properties. Append the path to the playlist you created in the "run" text box. It should now look like Code:
Code:
"D:\windows mediaplayer\wmplayer.exe"K:\Playlists\smoothies.m3uthe text inside quotes is my WMP's path. It may vary for you. The text after WMP's path is the one to the playlist. Click OK and you're done.

Increasing Internet Band-Width By 20%

Microsoft reserves 20% of your available bandwidth for their own purposes like Windows Updates and interrogating your PC etc. Click Start then Run and type gpedit.msc. This opens the group policy editor. Then go to: Local Computer Policy-->Computer Configuration-->Administrative Templates-->Network-->QoS Packet Scheduler and then to LimitReservableBandwidth. Double click on Limit Reservable bandwidth. It will say it is not configured, but the truth is under the 'Explain' tab i.e."By default, the Packet Scheduler limits the system to 20 percent of the bandwidth of a connection, but you can use this setting to override the default." So the trick is to ENABLE reservable bandwidth, then set it to ZERO. This will allow the system to reserve nothing, rather than the default 20%.It works on Windows 2000 and XP as well.