NirBlog

I originally planned  to start the first day of this new year with “Happy New Year” greeting for my users (Which I added in the title of this post) and a list  of new utilities that will be released in the incoming year.

However, because there are already many existing utilities that I have to update, the  planning and development process  of new utilities is much slower than before.

Currently, there are 2 new utilities that are in development process and other ideas for utilities that are still in ‘planned’ status and I still don’t know whether they are going to be created.

Here’s the list of the 2 new utilities and some of the ‘planned’ utilities:

1. WhatIsHang (In development): Sometimes, a Windows software hangs, the user interface doesn’t respond anymore, and you cannot find out what is cause for the problem (In fact, even my own utilities may hang in some circumstances).
   This new utility will try to detect the software that is currently hang, and it’ll display some information that may allow the user to understand what exactly cause the software to hang.
   

   WhatIsHang

   In the above example, I tried to open Notepad with a file on a network drive that cannot be accessed (z:\temp\temp.ini)  and Notepad stopped responding. The prototype of WhatIsHang detected that notepad doesn’t respond, and displayed the ‘z:\temp\temp.ini’ filename string that was found in the stack, which is really the cause of the problem.
   I’m also considering to create a similar utility for detecting application crash problems.

2. Password Security Scanner (In development): As you probably know, I already have some unique utilities that can extract passwords that are stored by the operating system and other applications. As opposed to all my other tools, this utility won’t display the passwords at all, but instead, it’ll display general information about the security of the password: Password Length, Password  Strength, Number of  numeric/lowercase/uppercase characters, and more…
   The idea behind this tool is to allow one person to check whether other people (family members, friends,  or employees) use passwords that are secured enough (and warn them if they are not), but without having the ethics  problem of watching the passwords of others.
   

   Password Security Scanner

3. Network statistics utility (planned): Many people requested to add more information into my CurrPorts utility, like number of sent/received packets,   total packets size, and so on. However, this information cannot be added without a using device driver. Also, CurrPorts is only designed to display TCP/UDP information, while there are other types of network packets that won’t be displayed by CurrPorts.The new  network statistics utility (If I’ll really create it) will capture every packet on your network adapter with WinPCap driver or with Microsoft Network Monitor Driver. it’ll detect the protocol, addresses, and ports of the packet, and  then it’ll be updated in the statistics table that will display the number of packets, data size, data speed, and other information for every protocol/network address.
4. Wireless networks statistics utility (planned): A utility that will capture all wireless raw packets while the wireless card is in ‘Monitor Mode’ and will display general statistics about the wireless activity in your area, including number of packets, packets size, packets encryption, and so on.
   The main problem with creating this utility is that ‘Monitor Mode’ is only supported starting from Windows 7/Vista (with Microsoft Network Monitor Driver), so if I develop it, many Windows XP users won’t be able to use it.  And… as far as I know, WinPCap driver cannot capture raw wireless packets under Windows, unless you use their AirPcap product, which is very expensive.
5. Simple Network Inventory Tool (planned):  a simple tool that will collect basic hardware/software information from multiple computer on your network, like disk size, memory, processor name, Windows service pack/version, IE version, Firefox version, and so on… and it’ll display it in a simple flat table to easily view and compare the software/hardware that you currently have on your computers.
6. Password Recovery from external drive (planned):   I  constantly  get requests from people that their old drive cannot boot anymore and they want to extract their passwords from it. Some of my password recovery tools can already do that, and others cannot.
   I’m considering to create one tool that will be able to extract most types of passwords from external drive, but… because Microsoft made a significant change in their password encryption starting from Windows 7, my current code cannot extract the passwords of Windows 7 from extenal drive, and upgrading my code to work with Windows 7 might be a long process.

BulletsPassView is a new utility that reveals the passwords stored behind the bullets on any version of Windows, starting from Windows 2000, and up to Windows 7/Vista/2008.

This utility is the successor of my old Asterisk Logger utility, which doesn’t work on Windows  7/Vista/2008 and has some other limitations.

BulletsPassView also has some other advantages over the old  Asterisk Logger tool:

• BulletsPassView doesn’t reveal the password inside the password text-box itself. The password is only displayed in the main window of BulletsPassView, while the password text-box continues to display bullets.
• BulletsPassView also reveals the passwords stored in the password text-box of Internet Explorer.

• BulletsPassView supports command-line options to save the current opened password boxes into text/html/csv/xml file.
• BulletsPassView is a unicode application, which insures that passwords with non-English characters will be extracted properly.

You can download the new BulletsPassView utility from here.

BulletsPassView

MyEventViewer utility has a new ‘Auto Refresh’ feature that allows you to watch newly created events at the moment they are created, without the need to refresh the events list.

You can activate the ‘Auto Refresh’ mode from ‘Auto Refresh’ option under the Options menu, as displayed in the following screenshot. You can choose to check for new events every 1, 3, 5, or 10 seconds.

Auto Refresh

You can find the latest version of MyEventViewer utility in this page.

The following new commands were added to the new version (2.45) of NirCmd. You can download the latest version of NirCmd from this Web page.

1. trayballoon: Allows you to easily displays a balloon with the desired text, title, and icon in the system tray of Windows.
   Example of using this command:
   nircmd.exe trayballoon “Hello” “This is the text that will be appear inside the balloon !” “shell32.dll,-154” 10000
2. sendkeypress: This command is a new alternative for the sendkey command. sendkeypress is much easier to use if you want to send multiple key press combinations.
   Example of using this command:
   nircmd.exe sendkeypress ctrl+shift+esc alt+tab
   (This command will send ctrl+shift+esc keys combination and then alt+tab keys combination)
3. clonefiletime: This command simply clones the file date/time information into one or more files.
4. setconsolemode – Set the console mode (only for nircmdc.exe) – full screen mode or console window mode.
5. setconsolecolor – Allows you to set the foreground and background color of the console window text.
6. consolewrite – Simply write text into the stdout.
7. debugwrite – Write text into the debug output.

From time to time I receive complaints from people who say that my VideoCacheView utility freezes (hangs) completely without even the ability the kill the process. Yesterday I finally found out what is exactly wrong, after this problem also occurred in my own system.

When a Java applet (and possibly some other components) is loaded into a Web page, it may create one or more pipe handles. These pipe handles caused VideoCacheView to hang while scanning the file handles to find the opened temporary .flv files.  So if one or more Web pages with  Java applets were opened when VideoCacheView scanned the .flv files, it switched into a ‘Freeze’ status until these Java Web pages were closed.

The new release of VideoCacheView (1.77) should solve this freeze problem. So if you experienced this problem in the past, you can try to download the new version and check if it solves the problem.

The new version of NirLauncher package (1.10.x) provides to ability to edit the software groups and shortcuts directly inside the NirLauncher application, which is much easier than editing the package file (.nlp) in a text editor.  However,  this feature is still in Beta, and there are some things that you cannot do with it. For example: you cannot change the order of software groups (tabs) and they’ll simply appear in the order that you added them.

Here’s some tips about how to use this edit feature:

• In order to enter into edit mode, go to the Options menu, and check the ‘Edit Mode’ menu item.
• After you switched to edit mode, some editing menu items under the ‘Launcher’ menu will be enabled.
• When you in edit mode, you can double-click on every software icon in order to edit the software information (.exe file, help file, description, and so on)
• In order to add new applications, simply select the desired software group, and then drag one or more .exe files from Explorer into the window of NirLauncher.  The .exe files must be located under the folder/subfolder of the package file, so the path of the .exe file will be relative.
• You can also use the other options under the Launcher menu to add/edit/remove software groups and to delete unwanted software shortcuts.
• Finally, after making your changes, you can use the ‘Save Package’ option in order to save the changes into the package file.
• Be aware that if you switch into another package when you in edit mode, your changes will be lost.

In addition to this editing feature, I also made some performances improvement, especially when loading a software group in the second time. For example: if you click the ‘All Utilities’ tab, and then click another tab, and then click the ‘All Utilities’ tab again. the second  ‘All Utilities’ loading process will be much faster.

Edit software information in NirLauncher

NirLauncher Edit Menu

RegFileExport is a new command-line utility for advanced users that allows you to easily extract keys and values from offline Registry file located on external hard-drive and export them into a standard .reg file of Windows.  RegFileExport doesn’t load the file into a Registry hive like RegEdit,  instead, it directly reads the Registry file and analyzes it.

RegFileExport may also be able to extract keys and values from the Registry file even if the Registry file is corrupted and cannot be loaded by Windows.

For more information about RegFileExport utility, click here.

RegFileExport

Here’s a list of utilities updates made in the last week:

• IPNetInfo and WhosIP: Both of these utilities were fixed to work with the changes made in ARIN WHOIS server.
• Mail PassView: Added ‘Secured’ column, which displays whether the mail server works in a secured connection, and ‘Server Port’ column, which displays the TCP port number on the server, if the server use non-standard port.
• WhatInStartup,  MyEventViewer, SpecialFoldersView, and others – Fixed a problem with the xml encoding that appeared in all my Unicode executable files.
• SniffPass: Added x64 build of SniffPass, which allows you to work with Microsoft Network Monitor Driver 3.x on 64-bit version of Windows.
• OutlookAttachView:  Added support for embedded message attachments (attachments of another message). These attachments are saved as .msg files that can be opened by Outlook.
• SmartSniff: Added ‘Automatically Scroll Down in Live Mode’ option, which allows you to automatically scroll down to the bottom of the TCP/IP streams list while capturing the network packets.
• NK2Edit: Added ‘NK2 Control Center’ which allows companies to watch the status and the location of Outlook AutoComplete files (NK2) in all computers.

URLStringGrabber is a new utility that scans all opened windows of Internet Explorer and grabs the URLs stored in them, including clickable links, images, script files, CSS files, RSS feeds, and flash (.swf) files.

The URLs list is displayed in table, and you can easily export some of the URLs or the entire URLs list into text, csv, html, or xml file. You can also copy the URLs list into the clipboard and paste them into Excel or other spreadsheet application.

For more information about this new utility, click here.

URLStringGrabber

The new version of RouterPassView utility provide a new feature that allows to grab L2TP/PPTP/PPPOE/DDNS passwords from the Web interface of your router. This feature only works with Internet Explorer, as well as it only works for routers that stores the real password inside the password field.

In order to use this feature, follow the instructions below:

1. Login into your router Web interface with Internet Explorer, and go to the password page that you wish to recover. This password page may look like this one:
   

   Router Password Page

   As you can see in the above screenshot, the password field is filled with bullets, but if this password field really contains the password, RouterPassView will be able to extract it and display it on the main window.

2. Go to the File menu, and choose ‘Grab Password From IE Window’ or simply press Ctrl+G
3. If the router Web page store the password in the password field, RouterPassView will display the hidden password:
   

   Router Password

   Be aware that some routers deliberately store wrong password in this field, and in for these routers, RouterPassView won’t be able to recover your real password.