Eg the word password would be stored like this in hex: This happens because the MD5 hash tables are all based on ASCII and McAfee uses a Unicode string type. So I tried one of the many MD5 hash databases on the net but I couldn’t find the original string for the password. The value is an MD5 Hash of the password so we cannot decrypt it. ![]() I searched further in shutil.dll and concluded that the password is stored in the UIP value under HKLM\Software\McAfee\DesktopProtection registry key. I found out that vsplugin.dll calls some interesting exports in shutil.dll called UIP, UiLockInfoLoad1 and UiLockInfoValidate1. I openend vsplugin.dll in Ida Pro and searched for related strings such as password, lock etc. Right, we check out where this password is stored and how we can get rid of it! However there was a password protection in place that locks the user interface and nobody around that could tell me the password. ![]() I needed to change a few settings on a McAfee VirusScan Enterprise 8.7.Oi client.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |