The Blackhat Pirate: Windows

Showing posts with label Windows. Show all posts

Monday, April 5, 2021

Recover Permanently Lost/Deleted Files for Free On Windows 7/8/10

Click the below download link to download the software.

Friday, January 1, 2016

Switch Off The Thumbs.db Image Cache File in Windows

Thumbs.db is an image cache which makes thumbnail viewing faster. The file is automatically created in Windows Vista, 7 and 8 whenever images are encountered in a folder. It’s usually hidden but can appear, disappear and is often impossible to delete.

Fortunately, there’s an easy way to prevent further Thumbs.db hassle:

Ensure you’re logged in using an administrator account.
Hit Win+R, type gpedit.msc in the Run window and click OK. The Local Group Policy Editor will be launched.
Navigate through the tree to User Configuration > Administrative Templates > Windows Components > then either Windows Explorer (Windows Vista/7) or File Explorer (Windows 8).

In the right-hand pane, double-click “Turn off the caching of thumbnails in hidden thumbs.db files”.
Select Enabled (don’t make my mistake of choosing “Disabled” — you’re enabling the switching off of Thumbs.db. Not particularly intuitive, Microsoft!)

OK your way out and it’s job done — you’ll never be troubled by Thumbs.db files ever again!

Delete System Volume Information Folder From Pendrives

Copy the code below and save it as DelSysFiles.cmd, then run it.

@echo off

cls

color 1f

echo.

echo DELETE SYSTEM FILES AND FOLDERS FROM A DRIVE

echo ============================================

echo.

echo THIS COMMAND: %0 %1

echo.

echo USAGE: %0 (DRIVELETTER:)

echo.

if /i "%~d1"=="C:" echo BAD PARAMETER - DRIVE C: NOT ALLOWED! & pause & goto :eof

if not exist %~dpnx1nul echo Please use a DRIVE VOLUME LETTER not a file! & pause & goto :eof

if not exist "%~d1\System Volume Information" echo "System Volume information" does not exist on %~d1 & pause

echo.

echo Before running this, install TakeOwnership .reg fragment and Right-click - TakeOwnership on the file/folder

echo.

echo

echo.

echo STATUS

echo ======

call :show %1

echo.

set ask=

set /p ask=OK to delete these root system files and folders from %~d1 ? (Y/N) :

if not "%ask%"=="y" goto :eof

echo.

echo Resetting hidden\read-only\system attributes on all files - please wait...

if exist %~1\nul attrib -h -r -s %~d1\*.*

rmdir %~d1\"System Volume information" /S /Q 2> nul && echo dummy > %~d1\"System Volume information"

set FLD=%~d1\$RECYCLE.BIN

if exist %FLD% rmdir %FLD% /S /Q

set FL=%~d1\hiberfil.sys

if exist %FL% del %FL%

set FL=%~d1\swapfile.sys

if exist %FL% del %FL%

set FL=%~d1\pagefile.sys

if exist %FL% del %FL%

set FL=%~d1\RECYCLER

if exist %FL% del %FL%

:end

echo.

echo RESULT

echo ======

call :show %1

echo.

if "%SVI%_%SVIFILE%"=="1_" color cf

if "%SVI%_%SVIFILE%"=="1_" echo WARNING: SYSTEM VOLUME INFORMATION folder could not be deleted!

if "%SVI%_%SVIFILE%"=="1_" echo Please Right-Click on the folder and run "Take Ownership" and try again!

echo.

echo Finished!

pause

goto :eof

:show

set SVI=

set SVIFILE=

if exist %~d1\hiberfil.sys echo HIBERFIL.SYS EXISTS!

if exist %~d1\swapfile.sys echo SWAPFILE.SYS EXISTS!

if exist %~d1\pagefile.sys echo PAGEFILE.SYS EXISTS!

if exist %~d1\RECYCLER echo RECYCLER folder EXISTS!

if exist %~d1\$RECYCLE.BIN echo $RECYCLE.BIN folder EXISTS!

if exist "%~d1\System Volume Information" set SVI=1

if "%SVI%"=="1" find "dummy" "%~d1\System Volume Information" > nul 2> nul && set SVIFILE=YES

if "%SVI%_%SVIFILE%"=="1_YES" echo dummy SYSTEM VOLUME INFORMATION file EXISTS!

if "%SVI%_%SVIFILE%"=="1_" echo SYSTEM VOLUME INFORMATION folder EXISTS!

goto :eof

@echo off

color 1f

echo.

echo DELETE SYSTEM FILES AND FOLDERS FROM A DRIVE

echo ============================================

echo.

echo THIS COMMAND: %0 %1

echo.

echo USAGE: %0 (DRIVELETTER:)

echo.

if /i "%~d1"=="C:" echo BAD PARAMETER - DRIVE C: NOT ALLOWED! & pause & goto :eof

if not exist %~dpnx1nul echo Please use a DRIVE VOLUME LETTER not a file! & pause & goto :eof

if not exist "%~d1\System Volume Information" echo "System Volume information" does not exist on %~d1 & pause

echo.

echo Before running this, install TakeOwnership .reg fragment and Right-click - TakeOwnership on the file/folder

echo.

echo

echo.

echo STATUS

echo ======

call :show %1

echo.

set ask=

set /p ask=OK to delete these root system files and folders from %~d1 ? (Y/N) :

if not "%ask%"=="y" goto :eof

echo.

echo Resetting hidden\read-only\system attributes on all files - please wait...

if exist %~1\nul attrib -h -r -s %~d1\*.*

rmdir %~d1\"System Volume information" /S /Q 2> nul && echo dummy > %~d1\"System Volume information"

set FLD=%~d1\$RECYCLE.BIN

if exist %FLD% rmdir %FLD% /S /Q

set FL=%~d1\hiberfil.sys

if exist %FL% del %FL%

set FL=%~d1\swapfile.sys

if exist %FL% del %FL%

set FL=%~d1\pagefile.sys

if exist %FL% del %FL%

set FL=%~d1\RECYCLER

if exist %FL% del %FL%

:end

echo.

echo RESULT

echo ======

call :show %1

echo.

if "%SVI%_%SVIFILE%"=="1_" color cf

if "%SVI%_%SVIFILE%"=="1_" echo WARNING: SYSTEM VOLUME INFORMATION folder could not be deleted!

if "%SVI%_%SVIFILE%"=="1_" echo Please Right-Click on the folder and run "Take Ownership" and try again!

echo.

echo Finished!

pause

goto :eof

:show

set SVI=

set SVIFILE=

if exist %~d1\hiberfil.sys echo HIBERFIL.SYS EXISTS!

if exist %~d1\swapfile.sys echo SWAPFILE.SYS EXISTS!

if exist %~d1\pagefile.sys echo PAGEFILE.SYS EXISTS!

if exist %~d1\RECYCLER echo RECYCLER folder EXISTS!

if exist %~d1\$RECYCLE.BIN echo $RECYCLE.BIN folder EXISTS!

if exist "%~d1\System Volume Information" set SVI=1

if "%SVI%"=="1" find "dummy" "%~d1\System Volume Information" > nul 2> nul && set SVIFILE=YES

if "%SVI%_%SVIFILE%"=="1_YES" echo dummy SYSTEM VOLUME INFORMATION file EXISTS!

if "%SVI%_%SVIFILE%"=="1_" echo SYSTEM VOLUME INFORMATION folder EXISTS!

goto :eof

Wednesday, December 9, 2015

RAR Password Unlocker

RAR Password Unlocker is proved to be a helpful tool when you forgot WinRAR/RAR password and cannot open the RAR archives. It can remove RAR password at high speed via 3 attack options: Brute-force, Brute-force with user-defined Mask and Dictionary. By using advanced search algorithm, multiple-core CPUs etc, this RAR password recovery tool enables you enjoy faster recovery speed than other similar programs.

Key Features

Powerful Recovery Ability: Recover forgotten passwords from RAR archives encrypted by WinRAR 4.01 and its previous versions, no matter whether you encrypted file names or not.

High Password Recovery Speed: Recover forgotten RAR password at high speed, regardless of your encrypted RAR archive size. Support multi-core CPUs and SSE to accelerate password recovery process significantly. In the case of multi-core CPU, the more CPU cores you have, the faster recovery speed you will enjoy. Program Priority is available to allocate more CPU power to RAR Password Unlocker and speed up the recovery speed efficiently.

Three Efficient Recovery Options:

Brute-force Attack - Try all possible password combinations when you have no idea about it.Brute-force Attack with Mask - Greatly reduce the recovery time by specifying the forgotten password length, character set, etc. (High Recommended)
Dictionary Attack – Recover lost RAR password by trying the password combinations in the built-in dictionary as a password. Self-created dictionary is also supported.

Auto-save Recovery State:Automatically save the recovery state every 15 minutes by default so that you can resume the RAR password recovery process after the former interruption or stop. And the auto-save time interval can be changed as you wish.

Extremely Easy and Safe Operation:With easy and intuitive interface, this enhanced RAR password recovery program allows you to easily and safely recover RAR password in 3 simple steps. No computer skills required and no any loss or damage to your RAR file. Moreover, it can automatically shut down your computer after recovery.

System Requirements:

OS: Windows 7/ Vista/XP/2008/2003/2000
CPU: 1 GHz processor (2.4 GHz is recommended)
RAM: 512 MB (1 GB is recommended)
Hard Disk: 11 MB of free space

Install Notes:

Install the program and do not run.
Copy the crack "RAR Password Unlocker.exe" to prog dir, i.e. "C:\Program Files\RAR Password Unlocker\", and replace the original.

Download Now

If you still dont get it watch here:

Road Rash

Road Rash is the name of a motorcycle-racing video game series by Electronic Arts in which the player participates in violent, illegal street races. The series started on the Sega Genesis and made its way to various other systems over the years. The game's title is based on the slang term for the severe friction burns that can occur in a motorcycle fall where skin comes into contact with the ground at high speed.

Read the txt file given in the downloaded rar file.

Download Now

Tuesday, December 8, 2015

Resource Hacker - Edit System Files (Dll, Exe, Cpl etc.)

Resource Hacker™ has been designed to be the complete resource editing tool: compiling, viewing, decompiling and recompiling resources for both 32bit and 64bit Windows executables. Resource Hacker™ can open any type of Windows executable (*.exe; *.dll; *.scr; *.mui etc) so that individual resources can be added modified or deleted within these files. Resource Hacker™ can create and compile resource script files (*.rc), and edit resource files (*.res) too.

Download Latest Resource Hacker

Hide / Show Specific Control Panel Applets / Icons in Windows

1. Type regedit in RUN dialog box and press Enter. Now go to:

HKEY_CURRENT_USER\Control Panel\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\

2. Under this key create a new key with the name don't load , so the new path will be:

HKEY_CURRENT_USER\Control Panel\don't load

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\don't load

3. Now in right-side pane, create new String value. Set its name to the file name of the applet which you want to hide, e.g. if you want to hide Display applet then set its name to Desk.cpl now set its value to no to hide it. If you want to show it again, either set its value to yes or simply delete the String value.

To use the above mentioned method, you'll need to know the .CPL file name of the desired applet. You can search for .CPL in Windows Search or you can use help of following list which contains .cpl file names of almost all default Control Panel applets:

CPL File Name	Applet Name
Access.cpl	Accessibility
Appwiz.cpl	Add or Remove Programs
Bthprops.cpl	Bluetooth Devices
Desk.cpl	Display
Hdwwiz.cpl	Add New Hardware
Inetcpl.cpl	Internet Options
Intl.cpl	Regional and Language Options
Joy.cpl	Game Controllers
Keymgr.cpl	Stored User Names and Passwords
Liccpa.cpl	Licensing
Main.cpl	Mouse
Mlcfg32.cpl	Mail
Mmsys.cpl	Sound and Audio Devices
Ncpa.cpl	Network Connections
Nusrmgr.cpl	User Accounts
Nwc.cpl	Netware client connectivity
Odbccp32.cpl	ODBC Data Source Administrator
Powercfg.cpl	Power Options
Sysdm.cpl	System
Telephon.cpl	Phone and Modem Options
Timedate.cpl	Date and Time
Sapi.cpl	Speech
Wuaucpl.cpl	Automatic Updates
Wscui.cpl	Security Center or Action Center

Update Any Windows Offline

Note: though I’m showing this in Windows 10, this procedure also works with previous versions like Windows 7, 8, and 8.1.

To update a Windows machine offline you first need to download all the available updates to a location you can readily access, like a USB drive. To do that we are going to use a free and portable application called Portable Update.

Portable Update is a windows-base tool for updating a Microsoft Windows computer in a isolated environment.

This is useful in many circumstances:

When the computer reside on a secure lan isolated from internet;
When the computer to update doesn’t have access or can't use a proxy server;
When is necessary to completely update a fresh-formatted computer with the last update before to connect it to network;
When the computer doesn’t have an hardware network connection at all;
When the network connection speed is too low or it is necessary to update the computer very quickly;
In all the other cases when is mandatory to have the complete control on the updating process without connecting the computer to the network.

Download Portable Update

Download Missing Files (If Any)

Force Windows To Rename A File/Folder Which Has A Special Character

Notice the dot at the end of the folder names, this is an invalid character.

When this happens you can’t delete the folder because windows will complain with the following message: "This is no longer located in … Verify the item’s location and try again".

To Fix This:

dir /X *parent directory name*

You need to use the MVC4~1 SPECS~1 WCFSERV~1 handles to rename each of the folders or files.

rename MVC4~1 "mvc4"

(Notice the dot is gone)

You can now delete this folder.

Display Full Size Album Art In Windows Media Player

Notes:

Before starting this process, make sure you are comfortable with editing the Registry; back up the Registry first in case you make a mistake.
These instructions are for Windows 7, but once you’re in the Registry of your Windows operating system they should work for earlier versions of WMP too; however, I haven’t tested these instructions on earlier Windows operating systems, so do this at your own risk.

STEPS TO EDIT THE REGISTRY:

Close Windows Media Player if it is open.
In Windows 7, click the Start button and type Run in the search box.
Select Run from the Programs list. This opens the Run dialog box.
Type regedit in the Open field, then click OK.

If asked about allowing access, click Yes. The Registry Editor window opens.

In the left pane, expand these nodes: Computer >HKEY_CURRENT_USER > Software > Microsoft > Media Player > Preferences.

Click on the Preferences node to display the settings in the right pane.

In a blank area on the right pane, right-click and select New > DWORD (32-bit) Value.

New Value #1 is added at the end of the long list of settings.

Change this name to PlayerModeAlbumArtSelected.
Double-click to open PlayerModeAlbumArtSelected.
Type 0 (zero) as the Value data then click OK.

Still in the settings list, find the entry for ShowAlbumArt. Double-click it to open it and set its value to 1. Click OK.

You should now have two added/revised settings entries — one for PlayerModeAlbumArtSelected with a value set to 0 and one for ShowAlbumArt with its value set to 1 (see yellow highlighted lines in the screen shot below).

Close the Registry Editor window.
Re-open Windows Media Player — your album art should now show at full size.

Friday, November 13, 2015

Recover Files on Flash/External/Hard Drive that Changed to Shortcuts

If you connected your flash drive to an infected computer, all your existing files may get converted into shortcuts. The file names will be weird. But if you check the space usage, you will find that the data is still there. No need to worry!

I have a solution.
Just follow simple steps below:

Connect your pen/flash/external drive to your computer.

Go to My Computers and check what drive it is assigned for example F: or G: drive. Lets assume its G: (replace it with correct letter as applicable in your case).

Click on “Start” –>”Run”–> type cmd and hit OK. This will start command prompt.

Enter the following command and hit “Enter”.

attrib -H -R -S /S /D G:\*.*

Monday, November 2, 2015

Enable "God Mode" In Windows 10

The feature first appeared in Windows 7, but in case you were not aware of it, “God Mode,” which is a hidden menu allowing you to access all available configuration parameters in one simple location, is still available in Windows 10.

The only thing your need to do to activate “God Mode” is to create a new folder on you desktop (right click your desktop -> New -> Folder) and then assign this name to it: GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

That’s all you need to do! Create a new folder and assign with the name:

And here’s what you’ll find in it: (As you can see, now you can access all these important parameters is now just a click away!)

That’s all, enjoy!

Hide Secret Data In Txt Files Using Cmd

Open command prompt and type the following syntax:

notepad AnyFileName.txt:SecretData.txt

Here “AnyFileName” is the actual filename of the text file while “SecretData.txt” is the hidden stream contained within AnyFileName.

A window will popup asking for your confirmatoin. Click Yes.

A notepad editor will appear. You can now type the sensitive data that you want to hide.

Go to File -> Save to save the file.

You can add more than one hidden stream in the same file. Simply type the same command (but with different stream name) to add the new stream.

Notice that the main file name is “AnyFileName.txt” and there are no clues from the exterior that it contains a hidden file within it.

How do I access the hidden data?

To read the hidden stream from command prompt type the syntax below:

more < FileName.txt:StreamName.txt

For instance in our example the command should be
more < AnyFileName.txt:SecretData.txt

How do I detect the hidden file if I've forgotten the file name?

Yes you can detect the hidden files using the application Stream.exe. This application will monitor all the files with the stream file name if they exist.

For instance the syntax of detecting the hidden stream is

streams.exe AnyFileName.txt

If you want to delete just the stream from the file then type this command:

streams.exe -d AnyFileName.txt

This command will delete all the streams from the file AnyFileName.txt.

The above process is very handy to store some private text data in your system. Unless the other users of your PC are tech savvy or hackers, the chances are they will never notice your little secrets.