Some time ago I wrote about the PNAgent data that is stored in the registry in XML format.

After that post Andrew Morgan asked me if I could extract the PNAgent icons from the XML data.

That got me interested so let’s look at this data!

If you look at XML from PNAgent the icondata as in the AppData.Details.Icon node you’ll see something like this:

Seems like the icon data is stored/encrypted in a proprietary format.

(more…)

Yesterday I was working with an Excel document that contained Combobox form controls.

I wanted to count the number of cells containing a particular value using the COUNTIF formula. However the count returned 0 because the LinkedCell property of the Combobox was not set to the Cell that contained the Combobox.

To set the LinkedCell Ctrl-Click the Combobox to select it, right-click and select Format Control. Then set the correct Cell in the Cell link field:

My sheet contained about 150 Comboboxes, so obviously I was going to do this using a script. I couldn’t find anything useful with Google so I wrote my own Macro.

(more…)

A while ago I published a tool to Encode and Decode Citrix passwords. Today I am publishing a small update to this tool that makes it scriptable by adding a COM interface.

If you start the tool without parameters you will get the GUI, just like before:

To use the COM interface you first need to register the executable with the /regserver switch:

After the registration you can call it using any language that supports COM. To get you started I wrote a few examples

(more…)

Yesterday I wrote about troubleshooting an application that used Com Port redirection in Citrix.

During the troubleshoot I noticed that the application used an ActiveX component, MSCOMM32.OCX, for serial communication.

I wanted to quickly test if the component was correctly registered so I searched the registry from HKEY_CLASSES_ROOT for mscomm32.ocx.

(more…)

After installing a new Plugin in WordPress called Native Apps Builder I got the following error when I tried to go to the Plugin’s settings:

Fatal error: Cannot redeclare class Snoopy in www/blog/wp-content/plugins/native-apps-builder/appsbuilderapi.php on line 34

This error is caused because a class named "Snoopy" is being declared twice. I figured that two plugins were incompatible with each other so I first needed to know which ones.

(more…)

This morning Arjan Beijer sent me an interesting link to a youtube video about obtaining the Citrix IMA Datastore password using Windbg.

The video shows a method, discovered by Denis Gundarev to obtain the IMA Datastore password. Basically he uses DSMaint.exe and set’s a breakpoint on the call to CryptUnprotectData and then reads the password from memory.

I tried to call the CryptUnprotectData API with the data read from the registry directly but this failed with error NTE_BAD_KEY_STATE, this is defined in winerror.h and it means “Key not valid for use in specified state”.

(more…)

I wrote earlier about the startup logo’s on the Volkswagen RNS 510 navigation.

Today I can finally tell you that I succeeded!
I changed the startup logo to the logo from the MFD2 DVD as you can seen on this picture:

(more…)

Today I was reusing some old (pre vista) code the retrieves the Logon SID that I wrote a few years ago. The Logon SID is a special SID that identifies a logon session that has the form S-1-5-5-X-Y.

You can view your Logon SID with Process Explorer, right click a GUI process, select Properties and goto the Security Tab:

(more…)

The GetTokenInformation function can be used with the TokenLinkedToken Information Class on Windows Vista and higher to the linked (Elevated) token.

This is useful when User Account Control is enabled and you want to launch an elevated process e.g. from a service.

This example code fails however when User Account Control is disabled:

GetLastError() returns 1312 which is defined in winerror.h as ERROR_NO_SUCH_LOGON_SESSION with description “A specified logon session does not exist. It may already have been terminated.”

So you should check if User Account Control is enabled in such cases (or make this error non critical).

Snippet below can be used to programmatically determine if User Account Control is enabled: