decryption of system files..

[saneeha.nust]

I want to decrypt the bootmgr file on my system.. I want to use the unprotect()
method... I need to know that is it possible to do it with unprotect(), being the
administrator of the machine.. And what should be given as the entropy value?

Should the entropy value be the salt that is present in the master key file???

Plz plz help...

[skatamatic]

Just to keep you from getting excited, I don't have your answer.

But really, that's a good thing. I don't think it would be a good idea to post on a publicly viewable, high traffic website like this a way in which a person can hack the windows OS in a way that is almost guaranteed to be with malicious intent. If that is not your intention, then I wish you the best of luck figuiring this out.

[saneeha.nust]

I dont have any malicious intent. I am a student and needs to find the answer
for a project of my MS course... If any one has any idea kindly let me know...

thanks in advance

[BobS0327]

The Windows Internals 5 book has some extensive info on the "bootmgr" which would probably be of some help to you. The link to the book is below;

http://technet.microsoft.com/en-us/sysinternals/bb963901

[saneeha.nust]

I have written bootmgr as an example for system file, It can be any other
system file...

My project is that I need to decrypt the ssl traffic. The ssl session key is
stored on the local machine in a file that is encrypted using the symmetric key of windows.. I need to find a way to decrypt the file..

there does not exist a malicious intend because the technique would involve user
password that is protected by SAM. and I know the password and it is not possible
for an attacker to detect SAM password...

[BobS0327]

You may want to check out OpenSSL. If the password is known, then OpenSSL has an option (unblock) decrypt the private key.

http://www.openssl.org/