Recently an old application server arrived at the office. The server was running NT 4 and MS SQL server. We needed to get the machine running to do some reverse engineering of the code and database, however the administrator password had been lost. The original developer had moved out of state and didn’t have records, nor did the owner. It seemed that the only choice left was to hack into the machine.

I started with various failed attempts to recover the password using boot disks that grab info from the SAM database and crack the passwords. Since this was older hardware with an old drive array configuration, though, several of these recovery disks couldn’t recognize the drive. One program did see the drive and recover the SAM information but was unable to crack the password.

I do think that strategy would have eventually worked. But, I decided it would be easier to re-set the password instead of recovering it. There is an old trick with NT and 2000 machines if you have physical access the the machine where you replace login.scr with cmd.exe.

First you boot from an NTFS boot disk. The NTFS boot disk above gives you a windows DOS prompt with full read/write access to the drives on the server, though you are not technically authenticated as a user on the system.  C:\winnt\system32\login.scr is the screensaver executable that Windows runs automatically at the login prompt. You can use this hack to fool Windows into opening up a DOS shell with system priviledges. At the boot disk command prompt enter the following to backup and replace login.scr with cmd.exe:


copy c:\winnt\system32\login.scr login.bak
copy c:\winnt\system32\cmd.exe login.scr


Now that login.scr was replaced, remove the boot disk and re-boot to the NT login prompt. I waited until Windows launched login.scr (default is 15 minutes) and a DOS command window opened right on top of the login prompt. The following DOS command changes the Administrator password:


net user Administrator mynewpass


The password is now changed. Finally, I gave the old Microsoft 3-finger salute (ctrl+alt+del) and logged on using the username/password I just created. Woot!

WARNING: If this is a domain controller or using active directory, I have read that this trick is not advisable and may cause you some file permission headaches.

Share This

Update: The proof of concept that I did here was actually implemented as a feature into Parallels version 2.5. Did my idea inspire them or where they already working on it…? The world may never know! My humble idea had it’s 15 minutes of fame on the social network sites. Alas, this hack is no longer necesary for launching Windows applications. However, it still may be interesting and useful as a crude messaging system between the host and guest OS. With that I present the original article:

With the latest version of Parallels coherence mode you can run Windows apps yet have the Windows OS itself transparent. This creates the visual effect that you are running Windows apps within OSX. The coherence feature is still a little rough but it got my gears spinning and I saw some amazing possibilities. The illusion doesn’t seem quite complete to me without being able to launch Windows apps from the Dock. I created this simple app as a proof of concept that it could be easily done. It’s simple but it works!

You can try it out for yourself: Download docksync_v01.zip

The app requires .NET Framework 2.0 which you can install from Windows Update

Update: Grab Matt’s add-on DockSyncOSX and you can drag/drop Windows Shortcuts!

Demo Video

How does it work?

Obviously there is some communication between OSX and Windows already through parallels. But, not having access to that API, I decided to create a simple app on the Windows side that basically monitors a shared directory. On the OSX side, you simply create a specially crafted text file in that directory to send a command over to Windows. Any OSX method to generate a text file can be used. Just to keep things simple, I used a shell script that can be executed by double-clicking an icon. The result is crude but it works and hopefully might inspire someone to take it a little further.

Here’s a screenshot of the Windows app that’s monitoring for commands:

This is being released with no license so use the code at your own risk. If you have any suggestions or updates, please post them here. In particular if you know of an cleaner way to trigger the creation of the task file on the OSX side, that would be cool. Preferably something that people can create and edit without having to compile.

Download docksync_v01.zip

Share This

All of us who are into the Windows on OSX thing via bootcamp, parallels, VMWare, etc have been hearing of a mysterious ability to actually run windows applications right there on the OSX desktop. How would this be done - will Apple write some sort of API wrapper to run Windows Applications? Will bootcamp mysteriously merge with OSX? What does this all mean?

Well I have seen the future. And it is not quite what I was expecting.

I’ve been playing around with the latest beta version of Parallels, which is now available for download from the parallels forums. There’s a surprising amount of new feature for a minor version update, but one that I found strange and interesting is a feature called “Coherence Mode.” Coherence mode is supposed to allow you to run windows applications right on the OSX desktop.

As you can see from the screenshot, it really does visually look like you are running a windows application right there on the desktop. Since you can drag your mouse around and grab various windows in either Windows or OSX, it really does somewhat feel like the apps are running in OSX too… kinda! What Parallels seems to have done is basically to have windows running over the top of OSX, but visually hide the actual desktop. So, it is more or less just a visual trick. One wierd thing that you’ll notice from the screenshot is that the windows taskbar is floating just above the OSX dock. I’m sure Apple fanboys will struggle to keep their lunch down at the sight of it! Even I find it a ugly.

In addition to the Coherence Mode feature, Parallels now supports drag-n-drop between the two operating systems. This feature works really great. Though it is again some amount of visual trickery again, since files could be easily copied through the virtual shared directories. You can’t drag a file from a windows app to a mac app - now that would be cool! But, it’s seamless and this is a really nice feature.

All in all, I think they are on the right track. If they can get the drag-n-drop working a little better when in coherence mode, perhaps even dragging and dropping between applications, that would really make it feel like the windows app is truly running in OSX.

Share This