Ethical hacking tutorials

Introduction:
This is a tutorial on chaining proxies for the use of becoming more anonymous while online. There aren't enough tutorials online about this subject so I decided to make an attempt at writing one. Since it's on the subject, I included a section on chaining wingates to become anonymous on telnet.
------------------------------------------------------------------------------------

I'm going to assume that most of you have already used a proxy before to hide your real IP address or domain or maybe just used one to surf anonymously online. If you didn't, well hopefully you can keep up and possibly learn how to use a proxy. Its also best if you know what an IP address or Domain is first, before reading this tutorial. Hmm, I guess I have to show you where to find a proxy too. Well I find that good, updated proxy websites are…

http://www.multiproxy.org/anon_list.htm
http://tools.rosinstrument.com/proxy/

It will be up to you to figure out which ones work or not. I'm not going to do all the work for you icon_smile.gif. You can check and see if the proxy works by going to http://www.privacy.net to see if your IP address changed.
------------------------------------------------------------------------------------

Proxy Servers
A proxy is a server that acts as a gateway between your computer and your destination (website, IRC chat, etc.). These proxies receive requests from users to view, for example, a web page. The proxy will then forward the request to the internet, find your requested page, then send the web page back to you, the user. Most proxies come with a cache (sounds like "cash") feature that saves former websites that were visited on that proxy. Think of cache as a proxy's storage room. Each site that you make the proxy visit, it saves in its own storage area (cache). So if the user or someone else requests the same site again later on, the proxy will go back into its cache, find the web page and send it back to the user. This saves time because the proxy doesn't have to go search the Internet for the web page. It just pulls the site out of its cache.

The use of proxies to stay anonymous is a favorite thing to do among people on the Internet who are either paranoid or just security conscious. The anonymity factor comes from the proxy's ability to hide your true Internet address. For example, if I were to run a scan on your computer right now, I would get the Internet address that was given to you by your ISP (internet service provider), but if I were to scan you while you were using a proxy, then I would get the Internet address of the proxy server. Basically the whole proxy picture looks like this…

[User]>>>>>[Proxy]>>>>>[Web Pages]

Simple enough, right? Right. So now let's get to the chaining part.

Proxy Chaining
Proxy chaining is merely connecting to more than one proxy and then to your intended destination. You can use as many proxy servers as you can or want. The more you have, the more anonymous you will be. Remember, it doesn't matter how many proxies you chain together, you will never be 100% anonymous. Let's look at an example…

[User]>>>>>[Proxy1]>>>>>[Proxy2]>>>>>[Proxy3]>>>>>[Proxy4]>>>>>[Destination]

The example shows that for a proxy chain to be created, the user must first connect to Proxy1. Once the user is connected to Proxy1, from Proxy1, the user will connect to Proxy2, from Proxy2, the user will connect to Proxy3, from Proxy3, the user will connect to Proxy4, from Proxy4, the user will then connect to the intended destination (web page, Unix server, ftp server, etc.). All together we have 4 proxies in this example. Each proxy is a link in the chain. If the user would be scanned while on the proxy chain in the example, the IP address or domain of Proxy4 would appear on the scan. Now the problem with proxies is they tend to "die out" in a few weeks or less. It all depends. So if Proxy2 were to cease functioning, the chain wouldn't work. You would need to get rid of Proxy2 and just use Proxy1, Proxy3, and Proxy4 or find another proxy to take Proxy2's place. This is why proxy chaining can be a real pain if you are using them just to surf the net. If one dies, you have to figure out which one is the one not working, so you have to go through each one to check them or until you find the one that isn't working.

Proxy chaining is a necessity if you plan on using proxies to execute a "hack". If you are attempting to gain unauthorized remote access to any server, whether it is through telnet, ftp, or http, chaining is a must. As I said, you will never be 100% anonymous no matter what you do online so it is possible that you still can be tracked even if u chain proxies. Chaining just makes it a lot hard to track someone. To make it even harder, its best to use foreign proxies because if someone wanted to trace you, they would need to get logs of your use of each proxy from each proxy administrator. This could take quite a while or even never at all if one of the proxy's, or all for that matter, belong to an admin in a country that isn't too fond of the country you are located in. The longer it takes for the authorities to subpoena the logs of your usage of a single proxy from that proxy's administrator, the more chance that the other proxies that you used in the chain will have their logs deleted by the time anyone gets to the server administrators of those proxies. So when attempting to do any kind of "hack", it's best to use at least five or six proxies in a chain.

HTTP Chaining
HTTP chaining is basically chaining a proxy server in your browser's address bar. Example:

http://proxy.magusnet.com/-_-http://www.google.com

Notice how the above proxy and destination (yahoo) are seperated by a (-_-) If you wanted to make a chain out of this you would simply add another proxy ex. ( http://proxy.server1.com/-_-http://proxy.server2.com/-_-http://www.destination.com)

Another way to use proxys in your address bar is by adding the proxy IP or domain then the port number. Example…

http://anon.free.anonymizer.com:80/http://www.google.com

Notice how the above proxy and destination server are seperated this time by a (/) forward slash instead of a (-_-) dash, underscore, dash. To make a chain out of this you would again simply add another proxy ex. ( http://proxy1:80/http://proxy2:80/proxy3:80/http://www.yahoo.com)

Browser Chaining
To browser chain is fairly easy. I'll use Internet Explorer as an example since I believe it is the browser that most people have and use. First you need to find the Internet Options. You can do this by either finding the Explorer icon on the desktop, right click on it, then press properties or if you have a browser window already opened if you are online then you can go to Tools (or sometimes its View) and press Internet Options. Now that you have the Internet Options window up you can now go to the Connections tab, then go to the first Settings button (not LAN Settings, the one above it) and click it. Now you should be in the Settings box. Put a check in the box where it says to Use a proxy server. Now if you wanted to surf using one proxy you would merely put the proxy in the Address: space and put the proxy's port number in the Port: space. To use a chain here you would put in a proxy along with a ":" colon then the port number followed by a space separting the next proxy then a ":" colon then the port number then a space and so on. The last proxy you add should have its port number placed inside the Port: space. If you did it, then it should look like this exactly…

Address: 213.234.124.23:80 121.172.148.23:80 143.134.54.67 Port: 80

***Notice that each proxy:port is separated by a space and that the last proxy has its port number placed in the Port: space. Do not check the box marked "Bypass proxy server for local addresses". Press OK when you see that everything is in working order***

Wingates
A wingate is a proxy server that someone installs onto his/her computer which allows for a single or multiple online connection to take place through port 23, the default telnet port. Depending on their security, some wingates will allow anyone online to connect to them and usually stay "alive" or "working" anywhere from a few days to even months. There are people out there that scan for these Wingates and post the computer's IP number or domain on their website to give anyone online a free list of them to use. You can also scan them yourself by using programs like WinScan.

Chaining Wingates Using Telnet
I'm going to assume you already know what telnet is so I will just get right down to it. To chain using telnet, you would first bring up the DOS prompt and type in "telnet" then your wingate. (Since telnet's default port is 23 and all wingates run on port 23, the port number is not necessary but I will add it just to show you how you should type any port number out on screen) Example…

C:\WINDOWS>telnet 61.133.119.130 23

So now you have "telnet", a space, the wingate IP, a space, then the port number 23. Once you are connected to the wingate it should look like this…

Wingate>

Now you would type your next wingate and port number in, then press enter like so…

Wingate> 203.207.173.166 23

You can continue to do this until you connected to as many Wingates as you need. Once you are finished with your wingates you would connect to your destination. Example…

WinGate>arbornet.org

So now the entire picture would look something like this…

C:\Windows> telnet 61.133.119.130 23

Wingate>203.207.173.166 23

Wingate>135.245.18.167 23

Wingate>m-net.arbornet.org
Connecting to host arbornet.org...Connected

Welcome to the Once and Future M-Net
FreeBSD 4.3 (m-net.arbornet.org) (ttypv)

Enter newuser at the login prompt to create a new account
Enter upgrade at the login prompt to find out about increased access

login:

How To Stop Spam

Change Mcft to microsoft

HOW TO STOP SPAM VIA WINDOWS MESSENGER SERVICE
Below you'll find many ways (sorted in the most successful ratio first) to stop the Windows Messenger service, depending on your system environment, some may require more than one process. This service is available only on NT, 2K, XP & Server 2003. Administrator Login is REQUIRED

About The Messenger Service


* Messenger is a Windows Service that runs in the background
* Messenger is not the same as MSN Messenger or any other Instant Messaging Program
* Messenger does not facilitate two-way chatting
* Many Windows Programs, Firewalls, UPS and Antiviruses require the Messenger Service
* Antivirus and UPS software, among others, may not work if Messenger is disabled
* The Messenger Service is usually turned on by default in most Windows NT, 2K and XP systems


1. Manually

1. Example 1

1. Click Start, Run and enter the following command:
RunDll32 advpack.dll,LaunchINFSection %windir%\inf\msmsgs.inf,BLC.Remove
NOTE: This will prevent a long delay when opening Outlook Express if you have the Contacts pane enabled
2. To prevent this, click Start, Run and enter {REGEDIT} Go to:
HKEY_LOCAL_MACHINE\Software\Mcft\Outlook Express
3. Right click in the right pane and select New, Dword value
4. Give it the name Hide Messenger Double click this new entry and set the value to 2
5. End result should look EXACTLY like this:
System Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Mcft\Outlook Express]
Value Name: Hide Messenger
Data Type: REG_DWORD (DWORD Value)
Value Data: (2 = remove messenger)

2. Example 2

1. Copy and paste the following to Run Command Bar in the Start Menu:
RunDll32.exe advpack.dll,LaunchINFSection
%windir%\inf\msmsgs.inf,BLC.Remove

3. Example 3

1. If Example 5 didn't work, then try this - Many users miss or don't know of it
2. Click on Start then go to RUN and type:
C:\WINDOWS\inf\sysoc.inf
3. Change:
msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,hide,7
4. To:
msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,7
5. Then use Add/Remove Windows Components to remove Messenger
NOTE: You can also prevent access to Windows Messenger using Group Policy or the Set Program Access and Defaults utility added by default in Windows XP SP1 and Windows 2000 SP3

4. Example 4

1. Open Windows Messenger
2. From the menu, select "Tools" then "Options" then "Preferences" tab
3. Uncheck "Run this program when Windows starts"
4. Open Outlook Express
5. From the menu, select "Tools" then "Options" then "General" tab
6. Uncheck the option to "Automatically log on", if it's there
7. Also in Outlook Express, select "View" then "Layout"
8. Uncheck the option to "display Contacts" - The program will open a connection and display a list of all Contacts on line if you do not
9. In "Startup Folder" make sure there is no entry there for Messenger
10. Open Norton Anti-Virus if you have it installed
11. Click "Options" then "Instant Messenger"
12. Unckeck "Windows Messenger (recommended"
NOTE: This list ought to work in disassociate MSN from Outlook Express, so that it'll only start up if you really want it to

5. Example 5

1. 2000

* Click Start-> Settings-> Control Panel-> Administrative Tools->Services
* Scroll down and highlight "Messenger"
* Right-click the highlighted line and choose Properties
* Click the STOP button
* Select Disable in the Startup Type scroll bar
* Click OK

2. XP Home

* Click Start->Settings ->Control Panel
* Click Performance and Maintenance
* Click Administrative Tools
* Double click Services
* Scroll down and highlight "Messenger"
* Right-click the highlighted line and choose Properties
* Click the STOP button
* Select Disable in the Startup Type scroll bar
* Click OK

3. XP Professional

* Click Start->Settings ->Control Panel
* Click Administrative Tools
* Click Services
* Double click Services
* Scroll down and highlight "Messenger"
* Right-click the highlighted line and choose Properties.
* Click the STOP button.
* Select Disable in the Startup Type scroll bar
* Click OK

4. Windows NT

* Click Start ->Control Panel
* Double Click Administrative Tools
* Select Services-> Double-click on Messenger
* In the Messenger Properties window, select Stop
* Then choose Disable as the Startup Type
* Click OK
NOTE: If you stop the service and don't adjust the startup type, the Messenger service will start automatically the next time you reboot. Keep in mind that when you disable the Messenger service, you'll no longer receive messages about an attached UPS, and you won't be notified of print job completion, performance alerts, or antivirus activity (from Windows) not the program you're using for those purposes.

6. Example 6

1. To disable receipt of messenger pop-ups, verify that your firewall disables inbound traffic on UDP ports 135, 137, and 138, and TCP ports 135 and 139. On a system connected directly to the Internet, you should also disable inbound traffic on TCP port 445. If the system you want to protect is part of a Win2K-based network with Active Directory (AD), don't block incoming traffic on port 445 - Mcft Knowledge Base Article - 330904
Code:
http://support.Mcft.com/default.aspx?scid=kb;en-us;330904

NOTE: You can use the firewall approach only if your system doesn't communicate with legacy systems that rely on NetBIOS name resolution to locate machines and shared resources. If, for example, you let users running Windows 9x share your printer or scanner, when you disable inbound NetBIOS traffic, users won't be able to connect to these shared resources. Regardless of the method you choose, you can stop messenger spam

2. Program

1. Example 1

NOTE: On Oct 15, 2003, Mcft releases Critical Security Bulletin MS03-043 warning users that the Windows Messenger Service running and exposed by default in all versions of Windows NT, 2000 and XP, contains a "Remote Code Execution" vulnerability that allows any not otherwise secured and protected Windows machine to be taken over and remotely compromised over the Internet
1. Shoot the Messenger
Code:
http://grc.com/files/shootthemessenger.exe


2. Example 2

1. Messenger Disable
Code:
http://www.dougknox.com/xp/utils/MessengerDisable.zip

NOTE: If you choose to uninstall Windows Messenger on a system with SP1 installed, you will receive an error message about "un-registering" an OCX file. This is normal, and doest not affect the removal process. Windows Messenger will still be removed

3. TEST

1. Example 1

1. Right-click "My Computer"
2. Select "Manage"
3. Under "System Tools" right-click on "Shared Folders"
4. Choose "All Tasks" and select "Send Console Message..."
5. If you recieve the following error message then the service has been disabled, otherwise confirm that you have disabled it or try another example
"The following error occured while reading the list of sessions from Windows clients:
Error 2114: The Server service is not started."

2. Example 2

1. Click Start then "Run"
2. Type in {cmd.exe}
3. Type in net send 127.0.0.1 hi
4. If you get a popup "hi" message, then confirm that you have disabled it or try another example

4. IF YOU INSIST

1. If you insist on keeping Windows Messenger, then I'd recommend Messenger Manager - "Allows you to keep your messenger service running, as is intended and needed by Windows. This ensures that vital system errors and notifications may be sent informing you of Important System Events"
Code:
http://www.sellertools.com/default.asp?i=MessageManager3.htm

2. However, as a replacement to Windows Messenger remote control feature, I'd recommend this free tool Virtual Network Computing - "It is a remote control software which allows you to view and interact with one computer (the "server") using a simple program (the "viewer") on another computer anywhere on the Internet. The two computers don't even have to be the same type, so for example you can use VNC to view an office Linux machine on your Windows PC at home"
Code:
http://www.realvnc.com/download.html



RESULTS WILL VARY
No matter how good your systems may be, they're only as effective as what you put into them.

How to set up a server with Apache , PHP , MySQL , Perl , phpMyAdmin

=====

Let's start by installing apache (http server) . you can download the
apache installer on www.apache.org . download the verion you like ,
even thought , in win systems i recomand verion 2 (this tutorials is
for apache 2) . here is a link for it :

Code:
http://apache.mirror.nedlinux.nl/dist/httpd/binaries/win32/apache_2.0.52-win32-x86-no_ssl.msi


for a faster mirror , visit http://httpd.apache.org/download.cgi .

After downloading the file (.msi installer) , run it . The installation wizard
is a next , next , finish 'work' ... The installer will ask you some details like
your server name , your server adress and the admin's mail adress . if
you have a domain name or a hostname , enter the info's like this :

Code:
Server Name : your_domain.org

Server Adress : www.your-domain.org

Admin Email : admin@yourdomain.org


if you don't have one , you should get on e free at :

Code:
http://www.no-ip.org/


Check the 'Run as a service for all users on port 8080' option and click
next , finish to fiinish the instllation . Advice : Install it in c: (he creates
a folder for it , don't worry) to make sure you configure it easyer .
If you are finished , open up a browser and write in the adress bar :

Code:
http://localhost/


If you will see a 'Test Page for Apache Installation' , everything works .

=====

Let's install PHP . download the archives from www.php.net . Here is a
direct link for verion 4.3.9 :

Code:
http://nl.php.net/get/php-4.3.9-Win32.zip/from/this/mirror


Make sure you download the archive and not the installer . Ok! after
downloading it , extract the archive in c:/php (this is to simplify paths) .
Now , open up c:/apache/conf/httpd.conf and search for this line :

Code:
#LoadModule ssl_module modules/mod_ssl.so


under that line , add this :

Code:
LoadModule rewrite_module modules/mod_rewrite.so

LoadModule php4_module "c:/php/sapi/php4apache2.dll"
AddType application/x-httpd-php .php
AddType application/x-httpd-php .php3
AddType application/x-httpd-php .php4


Now search for this line :

Code:
<Directory "C:/Apache2/htdocs">


Change :

Code:
Options Indexes FollowSymLinks

#
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
# Options FileInfo AuthConfig Limit
#
AllowOverride None


into :

Code:
Options Indexes Includes FollowSymLinks MultiViews ExecCGI

#
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
# Options FileInfo AuthConfig Limit
#
AllowOverride All


This will allow .htaccess support on your server and make sure you can
see the content of a folder without getting a 403 forbidden error .

Now search for :

Code:
DirectoryIndex index.html index.var.html


and change it into :

Code:
DirectoryIndex index.html index.php


Save the file and restart apache . (you can restart it by pressing the
Restart apache server shortcut in the start menu or by writing :

Code:
net apache restart


in a command prompt window . Ok!

you have php working for your server icon_wink.gif . Now let's configure php and
make sure it really works ! Open up c:/php/php.ini (php.ini-dist renamed)
and search for this paragraph :

Code:
max_execution_time = 60 ; Maximum execution time of each script, in seconds
max_input_time = 60 ; Maximum amount of time each script may spend parsing request data
memory_limit = 5M ; Maximum amount of memory a script may consume (8MB)


you should change this to whatever you want . here is an option i use :

Code:
max_execution_time = 300 ; Maximum execution time of each script, in seconds
max_input_time = 300 ; Maximum amount of time each script may spend parsing request data
memory_limit = 5M ; Maximum amount of memory a script may consume (8MB)


Now search for :

Code:
register_globals = Off


and change it into :

Code:
register_globals = On


Search for :

Code:
extension_dir = ".\"


and change it into :

Code:
extension_dir = "c:/php/extensions"


assuming you have installed php in c: ...

Search for :

Code:
;Windows Extensions
;Note that MySQL and ODBC support is now built in, so no dll is needed for it.


and uncomment (delete the ; in the front) the following modules :

Code:
extension=php_bz2.dll
extension=php_db.dll
extension=php_gd2.dll
extension=php_java.dll
extension=php_msql.dll
extension=php_pdf.dll
extension=php_pgsql.dll
extension=php_sockets.dll


Ok! now let's change the smtp settings (this is good icon_smile.gif for you mail()
function . you need this !!!) Search for :

Code:
[mail function]
; For Win32 only.
SMTP =
smtp_port = 25

; For Win32 only.
;sendmail_from =


and change to :

Code:
[mail function]
; For Win32 only.
SMTP = mail.isp.org
smtp_port = 25

; For Win32 only.
sendmail_from = mail@your_domain.org

if you don't have a mail server or :

Code:
[mail function]
; For Win32 only.
SMTP = localhost
smtp_port = 25

; For Win32 only.
sendmail_from = mail@your_domain.org

if you have a mail server ...

Save the files . Now let's finalize the php installation . copy all the dll's
from c:/php/dlls into c:/windows/system32 . copy c:/php/php4ts.dll into
c:/windows/system32/ and copy php.ini from your folder php into
windows and system32 folder . restart apache . open up notepad and
add this into the file :

Code:
<?php
phpinfo();
?>


save this file in your htdocs folder (c:/apache/htdocs) as info.php and
open up a browser . in the adress bar write :

Code:
http://localhost/info.php


you should see php's configuration in a table . a looong file icon_smile.gif
you can optionaly install zend optimizer . i am using it ... it doesn't
needs a tutorial . to install the PEAR modules for php , just run the
go-pear batch from the php folder and 2click the reg file to finish the
instllation .

=====

let's install mysql . download mysql from http://www.mysql.com/ .
this tutorial applyes to verion 4.0.* ... i don't recomand using mysql
4.1 . here is a direct link :

Code:
http://dev.mysql.com/get/Downloads/MySQL-4.0/mysql-4.0.22-win.zip/from/http://mysql.proserve.nl/


after downloading , extract the arhive somewhere and run the setup.exe .
install mysql in c:/mysql and complete the installation . open up command
prompt and write this :

Code:
cd mysql
cd bin
mysqld-max-nt --install


this will install mysql as a service . recomended . now you would probably
consider downloading mysql control center . a gui tool to administrate the
server in a graphical mode . here is a link :

Code:
http://dev.mysql.com/get/Downloads/MySQLCC/mysqlcc-0.9.4-win32.zip/from/http://mysql.proserve.nl/


install it like any other program and run the shortcut in the desktop . a
window will pop-up . it will ask you to add a new connection . here are the
info's you need to fill in :

Code:
name : localhost or main or whatever :)
host : localhost
user : root
pass :


click add , expand the databases menu and delete databse text . now
expand the users menu and delete all users except root@localhost . right
click it and select edit user . change it's password to whatever you want icon_smile.gif
now right click the server and select edit . change the password to the
pass you chosed for user root . as easy as that . mysql is installed !

=====

phpMyADmin . you can download it from http://www.phpmyadmin.net/ .
i recommend using verion 2.5.1 pl1 . the last verion is still bugy icon_smile.gif
download , unzip the contecnt into a folder in htdocs (phpMyAdmin) and
open up config.inc.php with a text editor .

search for :

Code:
$cfg['PmaAbsoluteUri'] = '';


change it to your phpmyadmin url . eg. :

Code:
$cfg['PmaAbsoluteUri'] = http://www.your_domain.org/phpMyAdmin/';


now search for :

Code:
$cfg['blowfish_secret'] = '';


and change it to your mysql root password like this :

Code:
$cfg['blowfish_secret'] = 'password';


now search for :

Code:
$cfg['Servers'][$i]['auth_type'] = 'config';


and change it to :

Code:
$cfg['Servers'][$i]['auth_type'] = 'cookie';


save and exit . that's it ! phpMyAdmin works icon_wink.gif

=====

Perl . Optioanl for your server , very usefull . i recomend you to install
it . you can download it from http://www.activestate.com/ . here is a
direct link :

Code:
http://downloads.activestate.com/ActivePerl/Windows/5.8/ActivePerl-5.8.4.810-MSWin32-x86.msi


download , install and you are ready . put your perl scripts in the /cgi-bin/
folder (c:/apache/cgi-bin) .

=====

Hope this helped , you're welcome . No , you don't need to pay

How to make key generators?
-===========================-
Introduction
------------
I take no responsibility of the usage of this information.
This tutorial, is for educational knowledge ONLY.
Hi there, in this tutorial, I intend to teach you how to make a pretty
simple keygen, of a program called W3Filer 32 V1.1.3.
W3Filer is a pretty good web downloader...
I guess some of you might know the program.
I`ll assume you know:
A.How to use debugger (in this case, SoftIce).
B.How to crack, generally (finding protection routines,patching them,etc...).
C.How to use Disassembler (This knowledge can help).
D.Assembly.
E.How to code in Turbo Pascal ™.
Tools you`ll need:
A.SoftIce 3.00/01 or newer.
B.WD32Asm. (Not a must).
C.The program W3Filer V1.13 (if not provided in this package), can be found in
www.windows95.com I believe.
D.Turbo Pascal (ANY version).
Well, enough blah blah, let's go cracking...
Run W3Filer 32.
A nag screen pops, and , demands registration (Hmm, this sux ;-)) Now,
We notice this program has some kind of serial number (Mine is 873977046),
Let's keep the serial in mind, I bet we`ll meet it again while we're on
the debugger.
Well, now, let's put your name and a dummy reg code...
set a BP on GetDlgItemTextA, and, press OK.
We pop inside GetDlgItemTextA, Lets find the registration routine...
I`ll save you the work, the registration routine is this:
:00404DB2 8D95A8FAFFFF lea edx, dword ptr [ebp+FFFFFAA8]
:00404DB8 52 push edx ---> Your user name here.
:00404DB9 E80B550000 call 0040A2C9 ---> Registration routine.
:00404DBE 83C408 add esp, 00000008 ---> Dunno exactly what is it.
:00404DC1 85C0 test eax, eax ---> Boolean identifier, 0 if
:00404DC3 7D17 jge 00404DDC ---> registration failed, 1 if
OK.
Well, Let's enter the CALL 40A2C9, and see what's inside it:
(Please read my comments in the code).
* Referenced by a CALL at Addresses:
|:00404DB9 , :00407F76
|
:0040A2C9 55 push ebp
:0040A2CA 8BEC mov ebp, esp
:0040A2CC 81C4B0FEFFFF add esp, FFFFFEB0
:0040A2D2 53 push ebx
:0040A2D3 56 push esi
:0040A2D4 57 push edi
:0040A2D5 8B5508 mov edx, dword ptr [ebp+08]
:0040A2D8 8DB500FFFFFF lea esi, dword ptr [ebp+FFFFFF00]
:0040A2DE 33C0 xor eax, eax
:0040A2E0 EB16 jmp 0040A2F8
* Referenced by a (U)nconditional or ©onditional Jump at Address:
|:0040A2FB©
|
:0040A2E2 0FBE0A movsx ecx, byte ptr [edx] ----> Here Starts the
interesting part.
:0040A2E5 83F920 cmp ecx, 00000020 ----> ECX is the the current
char in the user name, Hmm, 20h=' '...
:0040A2E8 740D je 0040A2F7 ----> Let's see,
:0040A2EA 8A0A mov cl, byte ptr [edx] ----> Generally, all this loop
does, is copying
the user name from
[EDX], to [ESI], WITHOUT the spaces!
(Keep this in mind! ).
:0040A2EC 880C06 mov byte ptr [esi+eax], cl
:0040A2EF 42 inc edx
:0040A2F0 40 inc eax
:0040A2F1 C6040600 mov byte ptr [esi+eax], 00
:0040A2F5 EB01 jmp 0040A2F8
* Referenced by a (U)nconditional or ©onditional Jump at Address:
|:0040A2E8©
|
:0040A2F7 42 inc edx
* Referenced by a (U)nconditional or ©onditional Jump at Addresses:
|:0040A2E0(U), :0040A2F5(U)
|
:0040A2F8 803A00 cmp byte ptr [edx], 00
:0040A2FB 75E5 jne 0040A2E2 ----------------> This is the loop , we got
what it does,
Let's continue tracing
the code...
:0040A2FD 56 push esi --------> The user name is pushed, in order
to
Upcase it's chars.
* Reference To: USER32.CharUpperA, Ord:0000h
|
:0040A2FE E80F330000 Call User!CharUpper ---> After this, our name is in
upper case.
:0040A303 56 push esi -----> Our name in upper case here.
* Reference To: cw3220mt._strlen, Ord:0000h
|
:0040A304 E86F300000 Call 0040D378 ---> This is the length of our name.
:0040A309 59 pop ecx
:0040A30A 8BC8 mov ecx, eax ---> ECX=Length.
:0040A30C 83F904 cmp ecx, 00000004 ---> Length>=4 (MUST).
:0040A30F 7D05 jge 0040A316 ---> Let's go to this address...
:0040A311 83C8FF or eax, FFFFFFFF
:0040A314 EB67 jmp 0040A37D
* Referenced by a (U)nconditional or ©onditional Jump at Address:
|:0040A30F©
|
:0040A316 33D2 xor edx, edx
:0040A318 33C0 xor eax, eax
:0040A31A 3BC8 cmp ecx, eax
:0040A31C 7E17 jle 0040A335 ---> (Not important, just another useless
checking).
===================================================================================
============ FROM HERE AND ON, THE IMPORTANT CODE, PAY ATTENTION ==================
===================================================================================
One thing before we continue, EDX = 00000000h as we enter to the next instructions.
* Referenced by a (U)nconditional or ©onditional Jump at Address:
|:0040A333©
|
:0040A31E 0FBE1C06 movsx ebx, byte ptr [esi+eax] ---> EBX <--- char in user
name, offset EAX.
:0040A322 C1E303 shl ebx, 03 -----> Hmm, it shl's the char by 03h...
(Remember that).
:0040A325 0FBE3C06 movsx edi, byte ptr [esi+eax] ---> Now EDI <--- Char in
user name , offset EAX.
:0040A329 0FAFF8 imul edi, eax -----> It multiplies the char by the
offset in user name! (Remember that).
:0040A32C 03DF add ebx, edi -----> Adds the result to EBX (That was
Shelled (Ding Dong =)).
:0040A32E 03D3 add edx, ebx -----> EDX=EDX+EBX!!! - This is the CORE
of this registration routine!!!
:0040A330 40 inc eax -----> Increase EAX by one (next char).
:0040A331 3BC8 cmp ecx, eax
:0040A333 7FE9 jg 0040A31E ----> If ECX<EAX then, we leave the
loop.
* Referenced by a (U)nconditional or ©onditional Jump at Address:
|:0040A31C©
|
:0040A335 A120674100 mov eax, dword ptr [00416720] ---> HMMMMMM, What's in
here?????
:0040A33A C1F803 sar eax, 03 ---------> WAIT! Please type in SIce '?
EAX'
Does this number in EAX look
familiar to us? ;-)
If you still don`t understand,
than, It's
our SERIAL NUMBER! (PLEASE, take
your time, and check by
yourself - don`t trust me!). OK,
so now we know,
That it SHR's EAX by 03 (SAR is
almost identical to SHR).
:0040A33D 03D0 add edx, eax ---------> Hmm, it adds the result from the
loop, the serial number shr'd by 03h
:0040A33F 52 push edx -------> Let's continue. (At this point, I
can tell you , the reg number, is
in EDX - only that the reg number
is in HEX --> That's how you enter it).
* Possible StringData Ref from Data Obj ->"%lx"
|
:0040A340 685EF54000 push 0040F55E
:0040A345 8D95B0FEFFFF lea edx, dword ptr [ebp+FFFFFEB0]
:0040A34B 52 push edx
* Reference To: USER32.wsprintfA, Ord:0000h
|
:0040A34C E8E5320000 Call 0040D636 -------> This one, does HEX2STR (Takes
the value from EDX, and turns it to an hex string).
:0040A351 83C40C add esp, 0000000C
:0040A354 8D8DB0FEFFFF lea ecx, dword ptr [ebp+FFFFFEB0] -----> type 'd ecx' -
THIS is the reg number! That's enough for us, the rest of
the code, is
just for comparing the correct reg code with ours.
:0040A35A 51 push ecx
* Reference To: USER32.CharLowerA, Ord:0000h
|
:0040A35B E8B8320000 Call 0040D618
:0040A360 8D85B0FEFFFF lea eax, dword ptr [ebp+FFFFFEB0]
:0040A366 50 push eax
:0040A367 FF750C push [ebp+0C]
* Reference To: cw3220mt._strcmp, Ord:0000h
|
:0040A36A E875300000 Call 0040D3E4
:0040A36F 83C408 add esp, 00000008
:0040A372 85C0 test eax, eax
:0040A374 7405 je 0040A37B
:0040A376 83C8FF or eax, FFFFFFFF
:0040A379 EB02 jmp 0040A37D
* Referenced by a (U)nconditional or ©onditional Jump at Address:
|:0040A374©
|
:0040A37B 33C0 xor eax, eax
* Referenced by a (U)nconditional or ©onditional Jump at Addresses:
|:0040A314(U), :0040A379(U)
|
:0040A37D 5F pop edi
:0040A37E 5E pop esi
:0040A37F 5B pop ebx
:0040A380 8BE5 mov esp, ebp
:0040A382 5D pop ebp
:0040A383 C3 ret
Making the actual Keygen
~~~~~~~~~~~~~~~~~~~~~~~~
Now, after I've explained how does the program calculate the registration
code, you can either write your own keymaker, without looking at my code, or
look at my code (in Turbo Pascal - sorry for all you C lovers ;-) Next time).
That's it, here's the source of my keygen:
------------------- Cut here ---------------------------------------------
Program W3FilerKeygen;
var
Key,SerialNum,EB,ED,digit:Longint;
I,x:Byte;
Name,KeyHex:String;
begin
Writeln(' W3Filer32 V1.1.3 Keymaker');
writeln('Cracked by ^pain^ ''97 / Rebels!');
Write('Your Name:'); { Read the name }
readln(Name);
Write('Serial Number:');
readln(SerialNum); {Yes, we need the serial number for the calculation!}
Key:=0;
x:=0;
For I:=1 to length(Name) do
begin
Name[I]:=upcase(Name[i]);
If Name[I]<>' ' then begin
eb:=ord(Name[I]) shl 3; {EB = Name[I] Shl 03h}
Ed:=ord(Name[I]); {ED = Name[I]}
ed:=ed*(x); {ED=ED*Offset}
inc(x);
eb:=eb+ed; {Add ED to EB}
Key:=Key+EB; {Add EB to KEY}
end;
end;
Key:=Key+(SerialNum shr 3); { Add SerialNum shr 03h to Key}
{ From here, this is just HEX2STRING --> I`m quite sure it's
Self explaintory, else - go and learn number bases again! ;-)}
KeyHex:='';
repeat
digit:=Key mod 16;
key:=key div 16;
If digit<10 then KeyHex:=Chr(Digit+ord('0'))+KeyHex;
If digit>10 then KeyHex:=Chr(Digit-10+ord('a'))+KeyHex;
until key=0;
writeln('Your Key:',KeyHex);
writeln(' Enjoy!');
end.

READ EVEYTHING BEFORE YOU USE ANY METHOD LISTED BELOW

Basic BIOS password crack - works 9.9 times out of ten
This is a password hack but it clears the BIOS such that the next time you start the PC, the CMOS does not ask for any password. Now if you are able to bring the DOS prompt up, then you will be able to change the BIOS setting to the default. To clear the CMOS do the following:
Get DOS prompt and type:
DEBUG hit enter
-o 70 2e hit enter
-o 71 ff hit enter
-q hit enter
exit hit enter
Restart the computer. It works on most versions of the AWARD BIOS.



Accessing information on the hard disk
When you turn on the host machine, enter the CMOS setup menu (usually you have to press F2, or DEL, or CTRL+ALT+S during the boot sequence) and go to STANDARD CMOS SETUP, and set the channel to which you have put the hard disk as TYPE=Auto, MODE=AUTO, then SAVE & EXIT SETUP. Now you have access to the hard disk.

Standard BIOS backdoor passwords
The first, less invasive, attempt to bypass a BIOS password is to try on of these standard manufacturer's backdoor passwords:
AWARD BIOS
AWARD SW, AWARD_SW, Award SW, AWARD PW, _award, awkward, J64, j256, j262, j332, j322, 01322222, 589589, 589721, 595595, 598598, HLT, SER, SKY_FOX, aLLy, aLLY, Condo, CONCAT, TTPTHA, aPAf, HLT, KDD, ZBAAACA, ZAAADA, ZJAAADC, djonet, %øåñòü ïpîáåëîâ%, %äåâÿòü ïpîáåëîâ%
AMI BIOS
AMI, A.M.I., AMI SW, AMI_SW, BIOS, PASSWORD, HEWITT RAND, Oder
Other passwords you may try (for AMI/AWARD or other BIOSes)
LKWPETER, lkwpeter, BIOSTAR, biostar, BIOSSTAR, biosstar, ALFAROME, Syxz, Wodj
Note that the key associated to "_" in the US keyboard corresponds to "?" in some European keyboards (such as Italian and German ones), so -- for example -- you should type AWARD?SW when using those keyboards. Also remember that passwords are Case Sensitive. The last two passwords in the AWARD BIOS list are in Russian.

Flashing BIOS via software
If you have access to the computer when it's turned on, you could try one of those programs that remove the password from the BIOS, by invalidating its memory.
However, it might happen you don't have one of those programs when you have access to the computer, so you'd better learn how to do manually what they do. You can reset the BIOS to its default values using the MS-DOS tool DEBUG (type DEBUG at the command prompt. You'd better do it in pure MS-DOS mode, not from a MS-DOS shell window in Windows). Once you are in the debug environment enter the following commands:
AMI/AWARD BIOS
O 70 17
O 71 17
Q
PHOENIX BIOS
O 70 FF
O 71 17
Q
GENERIC
Invalidates CMOS RAM.
Should work on all AT motherboards
(XT motherboards don't have CMOS)
O 70 2E
O 71 FF
Q
Note that the first letter is a "O" not the number "0". The numbers which follow are two bytes in hex format.

Flashing BIOS via hardware
If you can't access the computer when it's on, and the standard backdoor passwords didn't work, you'll have to flash the BIOS via hardware. Please read the important notes at the end of this section before to try any of these methods.

Using the jumpers
The canonical way to flash the BIOS via hardware is to plug, unplug, or switch a jumper on the motherboard (for "switching a jumper" I mean that you find a jumper that joins the central pin and a side pin of a group of three pins, you should then unplug the jumper and then plug it to the central pin and to the pin on the opposite side, so if the jumper is normally on position 1-2, you have to put it on position 2-3, or vice versa). This jumper is not always located near to the BIOS, but could be anywhere on the motherboard.
To find the correct jumper you should read the motherboard's manual.
Once you've located the correct jumper, switch it (or plug or unplug it, depending from what the manual says) while the computer is turned OFF. Wait a couple of seconds then put the jumper back to its original position. In some motherboards it may happen that the computer will automatically turn itself on, after flashing the BIOS. In this case, turn it off, and put the jumper back to its original position, then turn it on again. Other motherboards require you turn the computer on for a few seconds to flash the BIOS.
If you don't have the motherboard's manual, you'll have to "brute force" it... trying out all the jumpers. In this case, try first the isolated ones (not in a group), the ones near to the BIOS, and the ones you can switch (as I explained before). If all them fail, try all the others. However, you must modify the status of only one jumper per attempt, otherwise you could damage the motherboard (since you don't know what the jumper you modified is actually meant for). If the password request screen still appear, try another one.
If after flashing the BIOS, the computer won't boot when you turn it on, turn it off, and wait some seconds before to retry.

Removing the battery
If you can't find the jumper to flash the BIOS or if such jumper doesn't exist, you can remove the battery that keeps the BIOS memory alive. It's a button-size battery somewhere on the motherboard (on elder computers the battery could be a small, typically blue, cylinder soldered to the motherboard, but usually has a jumper on its side to disconnect it, otherwise you'll have to unsolder it and then solder it back). Take it away for 15-30 minutes or more, then put it back and the data contained into the BIOS memory should be volatilized. I'd suggest you to remove it for about one hour to be sure, because if you put it back when the data aren't erased yet you'll have to wait more time, as you've never removed it. If at first it doesn't work, try to remove the battery overnight.
Important note: in laptop and notebooks you don't have to remove the computer's power batteries (which would be useless), but you should open your computer and remove the CMOS battery from the motherboard.

Short-circuiting the chip
Another way to clear the CMOS RAM is to reset it by short circuiting two pins of the BIOS chip for a few seconds. You can do that with a small piece of electric wire or with a bent paper clip. Always make sure that the computer is turned OFF before to try this operation.
Here is a list of EPROM chips that are commonly used in the BIOS industry. You may find similar chips with different names if they are compatible chips made by another brand. If you find the BIOS chip you are working on matches with one of the following you can try to short-circuit the appropriate pins. Be careful, because this operation may damage the chip.
CHIPS P82C206 (square)
Short together pins 12 and 32 (the first and the last pins on the bottom edge of the chip) or pins 74 and 75 (the two pins on the upper left corner).
gnd
74
|__________________
5v 75--| |
| |
| |
| CHIPS |
1 * | |
| P82C206 |
| |
| |
|___________________|
| |
| gnd | 5v
12 32
OPTi F82C206 (rectangular)
Short together pins 3 and 26 (third pin from left side and fifth pin from right side on the bottom edge).
80 51
|______________|
81 -| |- 50
| |
| |
| OPTi |
| |
| F82C206 |
| |
100-|________________|-31
|| | |
1 || | | 30
3 26

Dallas DS1287, DS1287A
Benchmarq bp3287MT, bq3287AMT
The Dallas DS1287 and DS1287A, and the compatible Benchmarq bp3287MT and bq3287AMT chips have a built-in battery. This battery should last up to ten years. Any motherboard using these chips should not have an additional battery (this means you can't flash the BIOS by removing a battery). When the battery fails, the RTC chip would be replaced.
CMOS RAM can be cleared on the 1287A and 3287AMT chips by shorting pins 12 and 21.
The 1287 (and 3287MT) differ from the 1287A in that the CMOS RAM can't be cleared. If there is a problem such as a forgotten password, the chip must be replaced. (In this case it is recommended to replace the 1287 with a 1287A). Also the Dallas 12887 and 12887A are similar but contain twice as much CMOS RAM storage.
__________
1 -| * U |- 24 5v
2 -| |- 23
3 -| |- 22
4 -| |- 21 RCL (RAM Clear)
5 -| |- 20
6 -| |- 19
7 -| |- 18
8 -| |- 17
9 -| |- 16
10 -| |- 15
11 -| |- 14
gnd 12 -|__________|- 13

NOTE: Although these are 24-pin chips,
the Dallas chips may be missing 5 pins,
these are unused pins.
Most chips have unused pins,
though usually they are still present.

Dallas DS12885S
Benchmarq bq3258S
Hitachi HD146818AP
Samsung KS82C6818A
This is a rectangular 24-pin DIP chip, usually in a socket. The number on the chip should end in 6818.
Although this chip is pin-compatible with the Dallas 1287/1287A, there is no built-in battery.
Short together pins 12 and 24.
5v
24 20 13
|___________|____________________|
| |
| DALLAS |
|> |
| DS12885S |
| |
|__________________________________|
| |
1 12
gnd

Motorola MC146818AP
Short pins 12 and 24. These are the pins on diagonally opposite corners - lower left and upper right. You might also try pins 12 and 20.
__________
1 -| * U |- 24 5v
2 -| |- 23
3 -| |- 22
4 -| |- 21
5 -| |- 20
6 -| |- 19
7 -| |- 18
8 -| |- 17
9 -| |- 16
10 -| |- 15
11 -| |- 14
gnd 12 -|__________|- 13

Replacing the chip
If nothing works, you could replace the existing BIOS chip with a new one you can buy from your specialized electronic shop or your computer supplier. It's a quick operation if the chip is inserted on a base and not soldered to the motherboard, otherwise you'll have to unsolder it and then put the new one. In this case would be more convenient to solder a base on which you'll then plug the new chip, in the eventuality that you'll have to change it again. If you can't find the BIOS chip specifically made for your motherboard, you should buy one of the same type (probably one of the ones shown above) and look in your motherboard manufacturer's website to see if there's the BIOS image to download. Then you should copy that image on the chip you bought with an EPROM programmer.

Important
Whether is the method you use, when you flash the BIOS not only the password, but also all the other configuration data will be reset to the factory defaults, so when you are booting for the first time after a BIOS flash, you should enter the CMOS configuration menu (as explained before) and fix up some things.
Also, when you boot Windows, it may happen that it finds some new device, because of the new configuration of the BIOS, in this case you'll probably need the Windows installation CD because Windows may ask you for some external files. If Windows doesn't see the CD-ROM try to eject and re-insert the CD-ROM again. If Windows can't find the CD-ROM drive and you set it properly from the BIOS config, just reboot with the reset key, and in the next run Windows should find it. However most files needed by the system while installing new hardware could also be found in C:WINDOWS, C:WINDOWSSYSTEM, or C:WINDOWSINF .

Key Disk for Toshiba laptops
Some Toshiba notebooks allow to bypass BIOS by inserting a "key-disk" in the floppy disk drive while booting. To create a Toshiba Keydisk, take a 720Kb or 1.44Mb floppy disk, format it (if it's not formatted yet), then use a hex editor such as Hex Workshop (***.bpsoft.com/downloads/index.html) to change the first five bytes of the second sector (the one after the boot sector) and set them to 4B 45 59 00 00 (note that the first three bytes are the ASCII for "KEY" followed by two zeroes). Once you have created the key disk put it into the notebook's drive and turn it on, then push the reset button and when asked for password, press Enter. You will be asked to Set Password again. Press Y and Enter. You'll enter the BIOS configuration where you can set a new password.

Key protected cases
A final note about those old computers (up to 486 and early Pentiums) protected with a key that prevented the use of the mouse and the keyboard or the power button. All you have to do with them is to follow the wires connected to the key hole, locate the jumper to which they are connected and unplug it.

How to Bypass BIOS Passwords

BIOS passwords can add an extra layer of security for desktop and laptop computers. They are used to either prevent a user from changing the BIOS settings or to prevent the PC from booting without a password. Unfortunately, BIOS passwords can also be a liability if a user forgets their password, or changes the password to intentionally lock out the corporate IT department. Sending the unit back to the manufacturer to have the BIOS reset can be expensive and is usually not covered in the warranty. Never fear, all is not lost. There are a few known backdoors and other tricks of the trade that can be used to bypass or reset the BIOS

DISCLAIMER
This article is intended for IT Professionals and systems administrators with experience servicing computer hardware. It is not intended for home users, hackers, or computer thieves attempting to crack the password on a stolen PC. Please do not attempt any of these procedures if you are unfamiliar with computer hardware, and please use this information responsibly. LabMice.net is not responsible for the use or misuse of this material, including loss of data, damage to hardware, or personal injury.


Before attempting to bypass the BIOS password on a computer, please take a minute to contact the hardware manufacturer support staff directly and ask for their recommended methods of bypassing the BIOS security. In the event the manufacturer cannot (or will not) help you, there are a number of methods that can be used to bypass or reset the BIOS password yourself. They include:

Using a manufacturers backdoor password to access the BIOS

Use password cracking software

Reset the CMOS using the jumpers or solder beads.

Removing the CMOS battery for at least 10 minutes

Overloading the keyboard buffer

Using a professional service

Please remember that most BIOS passwords do not protect the hard drive, so if you need to recover the data, simply remove the hard drive and install it in an identical system, or configure it as a slave drive in an existing system. The exception to this are laptops, especially IBM Thinkpads, which silently lock the hard drive if the supervisor password is enabled. If the supervisor password is reset without resetting the and hard drive as well, you will be unable to access the data on the drive.


--------------------------------------------------------------------------------

Backdoor passwords

Many BIOS manufacturers have provided backdoor passwords that can be used to access the BIOS setup in the event you have lost your password. These passwords are case sensitive, so you may wish to try a variety of combinations. Keep in mind that the key associated to "_" in the US keyboard corresponds to "?" in some European keyboards. Laptops typically have better BIOS security than desktop systems, and we are not aware of any backdoor passwords that will work with name brand laptops.

WARNING: Some BIOS configurations will lock you out of the system completely if you type in an incorrect password more than 3 times. Read your manufacturers documentation for the BIOS setting before you begin typing in passwords

Award BIOS backdoor passwords:

ALFAROME ALLy aLLy aLLY ALLY aPAf _award AWARD_SW AWARD?SW AWARD SW AWARD PW AWKWARD awkward BIOSTAR CONCAT CONDO Condo d8on djonet HLT J64 J256 J262 j332 j322 KDD Lkwpeter LKWPETER PINT pint SER SKY_FOX SYXZ syxz shift + syxz TTPTHA ZAAADA ZBAAACA ZJAAADC 01322222
589589 589721 595595 598598

AMI BIOS backdoor passwords:

AMI AAAMMMIII BIOS PASSWORD HEWITT RAND AMI?SW AMI_SW LKWPETER A.M.I. CONDO

PHOENIX BIOS backdoor passwords:

phoenix, PHOENIX, CMOS, BIOS

MISC. COMMON PASSWORDS

ALFAROME BIOSTAR biostar biosstar CMOS cmos LKWPETER lkwpeter setup SETUP Syxz Wodj

OTHER BIOS PASSWORDS BY MANUFACTURER

Manufacturer Password
VOBIS & IBM merlin
Dell Dell
Biostar Biostar
Compaq Compaq
Enox xo11nE
Epox central
Freetech Posterie
IWill iwill
Jetway spooml
Packard Bell bell9
QDI QDI
Siemens SKY_FOX
TMC BIGO
Toshiba Toshiba

TOSHIBA BIOS

Most Toshiba laptops and some desktop systems will bypass the BIOS password if the left shift key is held down during boot

IBM APTIVA BIOS

Press both mouse buttons repeatedly during the boot


--------------------------------------------------------------------------------

Password cracking software

The following software can be used to either crack or reset the BIOS on many chipsets. If your PC is locked with a BIOS administrator password that will not allow access to the floppy drive, these utilities may not work. Also, since these utilities do not come from the manufacturer, use them cautiously and at your own risk.

Cmos password recovery tools 3.1
!BIOS (get the how-to article)
RemPass
KILLCMOS

--------------------------------------------------------------------------------

Using the Motherboard "Clear CMOS" Jumper or Dipswitch settings

Many motherboards feature a set of jumpers or dipswitches that will clear the CMOS and wipe all of the custom settings including BIOS passwords. The locations of these jumpers / dipswitches will vary depending on the motherboard manufacturer and ideally you should always refer to the motherboard or computer manufacturers documentation. If the documentation is unavailable, the jumpers/dipswitches can sometimes be found along the edge of the motherboard, next to the CMOS battery, or near the processor. Some manufacturers may label the jumper / dipswitch CLEAR - CLEAR CMOS - CLR - CLRPWD - PASSWD - PASSWORD - PWD. On laptop computers, the dipswitches are usually found under the keyboard or within a compartment at the bottom of the laptop.
Please remember to unplug your PC and use a grounding strip before reaching into your PC and touching the motherboard. Once you locate and rest the jumper switches, turn the computer on and check if the password has been cleared. If it has, turn the computer off and return the jumpers or dipswitches to its original position.


--------------------------------------------------------------------------------

Removing the CMOS Battery

The CMOS settings on most systems are buffered by a small battery that is attached to the motherboard. (It looks like a small watch battery). If you unplug the PC and remove the battery for 10-15 minutes, the CMOS may reset itself and the password should be blank. (Along with any other machine specific settings, so be sure you are familiar with manually reconfiguring the BIOS settings before you do this.) Some manufacturers backup the power to the CMOS chipset by using a capacitor, so if your first attempt fails, leave the battery out (with the system unplugged) for at least 24 hours. Some batteries are actually soldered onto the motherboard making this task more difficult. Unsoldering the battery incorrectly may damage your motherboard and other components, so please don't attempt this if you are inexperienced. Another option may be to remove the CMOS chip from the motherboard for a period of time.
Note: Removing the battery to reset the CMOS will not work for all PC's, and almost all of the newer laptops store their BIOS passwords in a manner which does not require continuous power, so removing the CMOS battery may not work at all. IBM Thinkpad laptops lock the hard drive as well as the BIOS when the supervisor password is set. If you reset the BIOS password, but cannot reset the hard drive password, you may not be able to access the drive and it will remain locked, even if you place it in a new laptop. IBM Thinkpads have special jumper switches on the motherboard, and these should be used to reset the system.


--------------------------------------------------------------------------------

Overloading the KeyBoard Buffer

On some older computer systems, you can force the CMOS to enter its setup screen on boot by overloading the keyboard buffer. This can be done by booting with the keyboard or mouse unattached to the systems, or on some systems by hitting the ESC key over 100 times in rapid succession.


--------------------------------------------------------------------------------

Jumping the Solder Beads on the CMOS

It is also possible to reset the CMOS by connecting or "jumping" specific solder beads on the chipset. There are too many chipsets to do a breakdown of which points to jump on individual chipsets, and the location of these solder beads can vary by manufacturer, so please check your computer and motherboard documentation for details. This technique is not recommended for the inexperienced and should be only be used as a "last ditch" effort.


--------------------------------------------------------------------------------

Using a professional service

If the manufacturer of the laptop or desktop PC can't or won't reset the BIOS password, you still have the option of using a professional service. Password Crackers, Inc., offers a variety of services for desktop and laptop computers for between $100 and $400. For most of these services, you'll need to provide some type of legitimate proof of ownership. This may be difficult if you've acquired the computer second hand or from an online auction.

Get the Most Out of Your DVD Recorder


Assoc. Ed. PC World
Melissa J. Perenson

I admit it: I'm a former tape-a-holic. When I began using a VCR some 20 years ago (I ended up teaching Mom and Dad how to program the darn thing back then), I got hooked on the idea of creating my own video library, replete with everything from "Star Trek" episodes to gymnastics competitions.

Recently, however, I stopped recording video on tape and switched to DVD--and I haven't looked back. But after using several DVD recorders, I've identified some quirks and frustrations that are specific to frequent users like myself. Recording to DVD is very different from recording to tape; you encounter new types of hassles ranging from pesky so-called disc preparation times to annoying delays in ejecting discs and the challenge of creating visually appealing menus. The tips that follow are geared towards hardcore videophiles (you know who you are), but they're also applicable to the most casual user.

1. Choosing the Best Recorder for TV

If you've already bought your DVD recorder, skip to tip 2. But if you haven't, be prepared to be confused by a torrent of acronyms and options. DVD+R, DVD+RW, DVD-R, DVD-RW, DVD-RAM, EPGs ... and you thought buying an HDTV would be confusing.

When you walk into a store, chances are you won't be able to tell the differences between the slim DVD recorders gracing the shelves--at least, not at a glance. On the outside, they look virtually identical. And the only additional information you might get from the price tag or label is what format the recorder supports and whether it has a hard drive.

Don't stress so much about the formats. No single manufacturer supports all of the formats available; a couple of makers come close (Lite-On, Sony), supporting all but DVD-RAM. The - and + formats are quite similar, and either will get the recording job done.

I've personally observed that the - format discs tend to take longer to initialize and finalize. By longer, I'm talking about anywhere from 5 to 120 seconds, depending upon the unit--enough to be incredibly annoying when you're sitting in front of the TV, your finger eagerly hovering over the record button to start a recording, or the eject button so you can swap discs without missing any action.

If your goal is to record a lot of TV shows, then I can't recommend highly enough a DVD recorder with integrated TiVo service. Humax, Pioneer, and Toshiba all offer such recorders, which combine a hard drive of 80GB or greater with a DVD burner, and, of course, the TiVo service. The full-blown TiVo service costs extra ($299 for the lifetime of the unit, on top of the cost of the recorder) and adds two-week's worth of program guides, a season-pass feature that records all episodes of a show so you never miss your favorites, and artificial intelligence that finds and records programs you might enjoy. (A free limited version of TiVo's software that downloads electronic programming information for the next three days is integrated into these units at no added cost.)

I don't make this recommendation just because of TiVo's personalized recording features and friendly graphical interface. The reason I suggest going this route is that these recorders have an amazing capacity to automatically create navigational menus. All of the program data in TiVo's electronic program guide--as well as TiVo's visual menu navigation structure--conveniently transfers over to any disc you burn.

DVD recorders are typically limited in what they can do to label menus. When you record a disc, you end up with a generically labeled index, with thumbnails for each recording or "title" on the disc, and boring and uninformative labels like "Title 01" (with, perhaps, the time and date added for good measure). TiVo-enabled recorders, in contrast, provide disc menus with the series name, episode title, and even a program summary as well as the date and time of the recording. If you're recording to cheap write-once media, this feature is invaluable. If you're recording to rewritable media--which means you could conceivably edit the menu titles at some point--this capability is still a huge time-saver.

Avid videophiles who don't want to spring for TiVo should look for a DVD set-top unit with a high-capacity hard drive of 80GB or more and high-speed dubbing of at least 8X. So far, I've seen only one recorder with both high-speed dubbing capability and a high-capacity hard drive, but I imagine that more such units will be forthcoming--eventually.

Beware of units that bill themselves as having "high-speed" dubbing: In most cases, the manufacturer is using the term to denote recording speeds of 2X or 4X from the hard drive to DVD. Furthermore, some vendors are coming up with absurd-sounding dubbing speeds--for example, 32X, a number they derive based on how many hours' worth of recordings you can fit on a disc (8 hours at the lowest-quality recording mode), and the speed of the burner (4X in my example).

Where to start your search? I recommend browsing PC World's latest "Top 10 DVD Drives" chart:

http://www.pcworld.com/reviews/article/0,aid,118249,tk,box,00.asp


2. Allow Extra Time

If you're preparing to record a program, budget a few extra minutes to get the unit ready. Believe me, the seconds add up--as I learned during my recording marathon of the Athens Olympiad. You need to factor in up to 30 seconds for the recorder to boot, about 10 to 20 seconds for the disc to spin up, and at least another 30 to 45 seconds for the recorder to prepare the disc for recording (your unit might say "initialize" or "format"). That's all before you can hit Record.

And when you're through recording, expect to wait 30 to 60 seconds to regain control of the recorder after you hit Stop. With some models, the delay occurs after you hit Eject. Either way, that delay could mean you'll miss the beginning of the next gymnast's routine--and none of this takes into account disc finalization, which can take another 30 seconds to 3 minutes, depending upon the disc's format and how much of it you've used.

3. Finalize, Finalize, Finalize

Disc finalization is the process that closes the disc so it can be read in other devices, such as a DVD player, DVD recorder, or DVD-ROM drive. It's also a process that bites. There, I've said it.

Finalization is the dirty little secret of DVD recorders: It's a time-consuming extra step that users of the venerable VCR don't expect. And it requires more effort than it should, due to poor menu design on DVD recorders. I've yet to see a recorder that makes this step truly easy--all of them bury it under a setup or menu item, and all of them require far too many clicks and layers considering this is a N-E-C-E-S-S-A-R-Y step for every write-once DVD-R or DVD+R you burn.

I recommend finalizing your disc as soon you're through recording. Due to quality issues, you'll likely record only a maximum of 2 hours of television per disc, which means that no more than two weeks will pass between finalization sessions. This way, when you go back to a recorded disc, it will be ready to play in any DVD player--whether it's the $30 Costco special in your bedroom or your laptop's DVD-ROM drive.

Caution: You might think you don't need to finalize if you don't have more than one DVD player or drive, and you plan on playing your DVD on your own recorder only. But what happens when, inevitably, you upgrade your recorder to a swankier, newer model? Or, even worse, when the model you're using now isn't working five years down the line? Then what? You'll be left with a library full of unreadable discs. Although you might be able to recover the raw video data from an unfinalized disc using a program like Infinadyne's CD/DVD Diagnostic, the process is tedious and time-consuming. Also, don't count on scavenging a backup unit off EBay in a few years: As I've learned, discs may not be interchangeable, even between two recorder decks bearing the same model number from the same manufacturer.

4. Don't Abuse Your Discs

It's easy to leave discs out of their cases, lying around or stacking up as you swap 'em out for a new one. But avoid that temptation--the dust will damage your discs, and you increase the chances of accidental scratches and scuffs.

Also, avoid leaving your recorded DVDs near a sunny window. The disc's dye layer is susceptible to light and heat; if either affects the disc, its data may become unreadable.

Finally, clean your discs carefully. Use a lint-free cloth, compressed air, or a liquid cleanser intended for use with DVD media. Dust and other airborne particles can scratch your disc, which could result in data loss. When cleaning with a lint-free cloth, stroke from the inside of the hub to the outside of the disc. Never use a circular motion from the inside out; and never use a tissue, paper towel, or other random rag.

For more on how to treat your discs, read
"Ten Tips for Durable DVDs":

http://www.pcworld.com/howto/article/0,aid,113716,tk,box,00.asp


5. Choose Your Media--and Labels--Wisely

A cheap spindle of media is tempting, but then you have to buy cases separately. And what cases to buy? Small plastic jewel cases? DVD movie-size cases? The combinations can be frustrating, at best.

Spindles are indeed affordable, but don't buy them without buying cases, too--and keep both stashed near your TV and DVD recorder setup, so you can easily grab a disc from the recorder and place it into its case. Otherwise, it's way too easy for stacks of discs to pile up--a no-no, as I note in tip 4.

Also, consider buying discs that come in oversized movie-style plastic cases. You'll pay a little more, but the convenience is worth it. Plus, you'll get a cardstock insert that you can use to create handwritten labels. If you get a high-speed dubbing unit, make sure you buy media that matches the recorder's speed.

If you do buy spindle media, keep in mind that the cases you buy in bulk may not have an insert on which you can scribble. If the case lack inserts, improvise with a piece of letter-size paper, folded over or cut up to fit accordingly. Spend a little more money, and you can get cardstock inserts.

There are a host of labeling software options out there to help you craft your labels. Read the following two "Burning Questions" columns for a comprehensive review of the subject:

"The Joy of Labeling":

http://www.pcworld.com/reviews/article/0,aid,114423,tk,box,00.asp


"Is Labeling Software Worth the Hassle?":

http://www.pcworld.com/reviews/article/0,aid,114848,tk,box,00.asp


But all of these options are going to require you to move your labeling operation over to the PC--something that may not work into your recording work flow.

Other PC-based labeling options include printable media that you can use with an inkjet printer. I'd stay away from adhesive labels, though: They're difficult to apply evenly, and could cause problems if the disc is poorly manufactured.

If you're trying to keep your labeling efforts nearer to your TV, I'd suggest using water-based pens to write on the discs, and on the label inserts, too, while you're at it. Another possibility: If your handwriting is barely better than chicken scrawl, then it's worth buying a battery-operated labeler, such as those offered by Brother or Casio. Both companies offer half-inch-wide labels that fit well along the spine of a DVD movie case.

A step-by-step guide to installing FreeBSD 5. It assumes moderate experience with linux and leaves you with a fully updated FreeBSD system.


FreeBSD Installation



A. 5.x vs 4.x
The first thing to understand about FreeBSD is that there are two lines of development. The -STABLE branch is marked with a 4.x version number and the most recent version is 4.10. It is well tested and very solid, but does not include the most recent technology. The -CURRENT branch, marked with a 5.x version, is the "unstable" branch. However, it is nicely stable at the moment and is coming along quite well. Most users should go with 5.x and these instructions are only valid for that tree.

NOTE: DragonFlyBSD ( www.dragonflybsd.org ) is a continuation of the 4.x line. It uses lock-less (no mutexes) SMP support and a Light Weight Kernel Threading system. It has a lot of promise and is developing at a breakneck pace, but it should still be thought of as "R/D."



B. Getting Media
I am not going to say much about this. There are links to various ftp mirrors at www.freebsd.org and the directory structure is fairly self-explanatory. There are however several choices for ISO. You should choose the miniinst ISO. It is small and will include everything you need for the base system.




C. Starting Installation
After, the CD boots up you will enter the...ahh.....majestic sysinstall. You can safely ignore most of the options and just choose a standard installation. Most of the install process is pretty easy and anyone who has some experience with linux or unix will be able to handle it without much stress. However, creating partitions and dealing with drives will seem very odd to your standard linux user.




D. Hard Disc Management in FreeBSD
Ok, the first thing to get used to here is that IDE drives are not hda, hdb...etc. They are ad0, ad1 and so forth. SCSI discs are da0, da1...and so on. There is one other thing that is going to freak some people out. You create slices, not partitions, on the disc and then create partitions within those slices. For example, the first partition in the first slice on the first IDE disc would be ad0s1a. Just accept it.




E. Partitioning
Sysinstall will lead you through the partitioning and its fairly easy to understand. The first part will ask you to choose a disc or discs to partition and then will show you a "slice editor." This is where you will create your slice. I advise you to only make one. While multiple slices are easy to deal with, it just adds complication. If this is not your first installation of a BSD type OS, then you can ignore me and why are you reading this again?

After creating your slice, you will be prompted to choose the drive(s) to install an MBR on. The FreeBSD boot loader is nothing to write home about, but it tends towards working. After this step, you can create partitions. There is not much to say here. At the top of the screen it will show your slice(s) and when one of them is selected you can use the controls to create a partition on it. You will need at least a root and swap partition. On the non-swap partitions it is usually a good idea to enable soft-updates.



F. Distribution Sets
This is a simple section, select minimal.




G. Continue Installation
The rest of this is pretty simple. Make sure you install from the CD and not the Internet. The bulk of the install is now done. After it copies files to your disc, it will start the configuration process. This is all pretty self-evident, but there are a couple things you should know.




Network Configuration

Don't be scared by the names, in *BSD devices are named after their drivers. There is also a short description after the name, so you should be able to choose the right one. The rest of the network config is easy, just follow the prompts.




System Console Configuration

You can pretty much ignore this, you may want to look around for your own knowledge and of course you could pick a nice screen saver here, but other then that I would leave it alone for now.




Time Zone

All I have to say here is that if you live in the US, after you choose "America - North and South" hit the end key. The US is at the bottom of the list and hitting end is the quickest way there.




Linux

Say no, we will do this later and with an updated linux_base.




Mouse

OK, welcome to the wonderful and amazing world of moused. Answer the first question truthfully, and then you can tweak the settings in the "Please configure your mouse" dialog. Whatever you do, be sure to enable the daemon. Also, for most users that is all you will have to do. You can safely ignore the other options.




Package Installation

At this point, the installer will ask you to install binary packages. Say no. These binaries are out of date and not included on our CD.



Of users and roots

This isn't the most thrilling section, add a user when it asks you to and set a root password after that. The only thing I have to say about this process is when the new user dialog comes up leave the "Group:" box unchanged and add "wheel" to the Member groups. You also might want to set your shell to /bin/tcsh. As for setting the root password, if you can't handle that we have bigger problems.



Rebooting

Ok, next it will ask if you would like to visit the general config area. Select no and you will be brought back to the main menu. Exit the install, reboot without the CD in and enjoy the boot messages.




H. The Real Post-Install
At this point, I am going to assume that you are now looking at a login prompt and thinking "my my...FreeBSD boots quite quickly doesn't it." Well, our task is not done yet...there is a reason we did a minimal install. We are going to do most of it ourselves. First, lets upgrade to -CURRENT. This isn't a practice I would usually recommend, but 5.x is close to being tagged stable and -CURRENT is rather solid at the moment. First, I need to explain how things are done in the BSD world.


Sup?


CVS up; you up; we all CVSUP. Cvsup is a very interesting program that I am not going to explain in detail here. All you really need to know is that it updates source trees. You see, that is the thing. You may be used to /usr/src not doing much. In BSD it has a job, it holds the source for the entire base system. However, we did a minimal install and no source is there. It wouldn't be up2date anyway. So, lets fix that. Login as root and type the following: pkg_add -r cvsup-without-gui


pkg_add is the binary installer for FreeBSD and the -r argument tells it to fetch binaries from the net. It will also fetch any deps that you might need. Switch to another console while this is happening and login as root. Do the following:



cd /etc

cp /usr/share/examples/etc/make.conf /etc/make.conf

cp /usr/share/examples/cvsup/standard-supfile /usr

cp /usr/share/examples/cvsup/ports-supfile /usr


chmod u+w /etc/make.conf /usr/standard-supfile /usr/ports-supfile



What was that? Well here is the rundown. Make.conf is the file that controls the building of programs from source on FreeBSD and the supfiles tell cvsup where to get the source for the base system and the ports system, also where to put said source. They come out of /usr/share/examples without the write bit set and that gets annoying. So we set that. Now switch back to the first console and type rehash. This tells tcsh to check its path for new programs. Now, edit the standard supfile that is in /usr. You can either use ee or vi. I like vi. Scroll down to the line that looks a bit odd. It will be something like:




*default host=CHANGE_THIS.FreeBSD.org



The "CHANGE_THIS" is where you put what cvsup server to use. Choose a number between 1 and 9, like 4, and put cvsup4 where CHANGE_THIS is. So it would end up being:




*default host=cvsup4.FreeBSD.org



Now exit your editor and run cvsup /usr/standard-supfile



If everything goes correctly, you will see a lot of text scrolling on the screen. If it says something about a bad connection, try another number.




Make.conf

Now 'tis the time for all good men (and women) to edit their make.conf . This is not difficult, in fact have a look around the file. It may be long, but it is pretty simple. Now, uncomment the CPU setting and the CFLAGS setting. Set the CPU to your CPU (there will be a list in the comments above the setting) and set the CFLAGS to -O2. (NOTE: If the base system fails to build, downgrade your CFLAGS back to -O).




Build Your World

When CVSUP finishes (it will be awhile...go get some coffee), cd to /usr/src and run make buildworld. That command will do exactly what it sounds like. It builds your world, or base system. While its doing that, lets get you a kernel. First, cd to /usr/src/sys/i386/conf then cp GENERIC to some file of your choosing. Any name you want. However, be aware that this is going to show up in a uname -a. Now, crack open your new file and take a look at what a FreeBSD kernel config is like. There are many things you can do here that will improve performance and subtract in size. However, lets keep it simple. Near the top of the file will be the name GENERIC. Change that to your new name. You can now look through the file and you will find several sections that are just for debugging. These will indeed add size and slow down the kernel a bit, but I would leave them for now. Go to the end of the file and make a new line. Add the following:




device pcm



This will add sound support to the kernel. Be aware that you don't need to do this, you can load binary modules at boot or after boot, but this way is easy and sound is used often. Save the file and exit. Go back to your buildworld console and when its done execute make buildkernel KERNCONF=YOUR_KERNEL_CONFIG_NAME



NOTE: NOT THE PATH OF THE KERNEL CONFIG..it knows to look in /usr/src/sys/i386/conf




Installing Your World

This isn't that difficult. First run make installkernel KERNCONF= your config name. Now here is the interesting part. Run mergemaster -p, this program looks through your etc and updates it to match the new /etc in /usr/src. It will display changed files to you, press q and it will give you options. Something like i (install), m (merge) etc. Pick merge and it will open a nice little screen that shows you one file on the right and one on the left. It will go section by section, showing the areas that have changed. Press r or l to choose which section to keep. Its pretty easy to see which section has new stuff and which does not. After the merge, it will prompt you with options for the newly merged file. One of these will be install and this is the one you want. In the latest current, most of what you will be showed is user and group files. Make sure you do select the sections with the new users and groups. After this is done, it will ask you a couple questions that you can say yes to. Now that your /etc is updated run make installworld then reboot.



NOTE: You usually don't need to run mergemaster. However, 5.2.1 is a pretty old release and -CURRENT has come a long way.




I. Ports

Welcome to running current. The rest is easy. cd back to /usr and edit the ports supfile the same way you did the standard one. Run cvsup on it and wait. After its done, you will have a full ports tree. There is not much left to say. You now have a working system and a fully updated one too. To install software from ports cd to /usr/ports/category/softwarename/ and run make install clean . If you want linux binary support, install the linux_base port. To find where it is cd to /usr/ports and run make search name=linux_base | less . Enable loading the kernel modules for linux binary support by editing /etc/rc.conf. Just add the line linux_enable="YES" to the file and your set. If this is a desktop system, I would recommend installing /usr/ports/x11/xorg and your choice of /usr/ports/x11/gnome2 or kde3. Have fun .





Get it from:

http://www.madpenguin.org/cms/?m=show&id=1853

This summary is not available. Please click here to view the post.