Edit C:\Windows\System32\drivers\rootmdm.sys
MZ? ?? ? @ ? ? ? ?!?L?!This program cannot be run in DOS mode. $ ??? ? ? ? ? ? ? ? ? ? 8? ? ? 8? ? ? 8? ? ? 8? ? ? 8? ? ? 8? ? ? Rich? ? PE d? ?R ? " H ? z? ` Hb ( p @ ? ? ! `! ? .text ? h.rdata D @ H.data 0 @ ?.pdata ? @ @ HPAGE ? P `INIT ? ` ?.rsrc p & @ B.reloc H ? , @ B H?(H?@L?H?H?t?CH?? HH?(H?% H?8 ?07 ??3?? ?7 ??(?? ??(I?3?3?? ? ??(??$WH? H?@H?H??@0?x8 tEH?? ?8u H?? H?@?I0uH?@E3?3?P ? ?H??0?m ???@03??$8H? _??$WH? H?@A?H??I0uH?@E3?3?? ?H??0H?$0H? _H?% ?H?(H?@?I0uH?@E3?3?? H?(???$WH? H?H??P H?H?H?$0H? _?N ??????????ff ? H; i uH?f???u??? ?? ?)??????(M?8H?I?? ? H?(??@SH? A? H?L?D?L?A??tA?McP?L?c?#?c??H??HK??t ?????3??H? [??????????????????????????????????L?H+?? I?OsXM?I?t D H? H?I??????tf ? ? H????A?u???fffff ? ?????H?rp??tL+?Bo?I??I?I? ? I? ?o ?oL H? fA?I????O???fffffff ? ffffff ? ?t? I??H???u?? ? ?????????H? r? D @H?? ???? ? ?o ?oL f?f?H?@?oD ?oL ???????? I? s?? $ M?I???????? ? ???????I??OsOM?I?tH? ??I???u??tf ? ? ?H????u???fffff ? ???H??tH??tL+???oD?@???I?I? ? I? ?oD ?oL ?? fAf I???T???fffffff ? ffffff ? ?t??? I???u?? ? ?????????H? ??w? H?? D @???? ? ?oD ?oL ??????@?oD ?o f?f? ???? I? s?? $ M?I?????????????I?r,?I?I?I?Gs`M?I??????u??t D A??I???fffffff ? fffffff ? fffffff ? ? ??tL+??H??I?M?I?I?t I?J? ??I??? O? ????H?H?H?H? H?(H?0H?8H?@I????t A??I??????? t l Q u e r y R e g i s t r y V a l u e s E x L ?c ? ? ? ? ? d d 2d Dd bd zd ? ? ? ? ? e $e 6e Ne be te ? ? ? ? ? f &f >f Vf nf ?R $ ?! ? ? 0 RSDS?i??7L? ??* rootmdm.pdb " 4( " p`P ? (B d 4 r p t 4 P d T 4 Rp 4 Rp d T 4 ???p d 4 2 p B 4 ?p 4 2p 4 2p 4 2p 20 2?-?+ ? ??? J P" P l ?" l ? ?" ? " # $ F ?" H r # ? ? ?" ? D 4# ? ? 0# ? ? @# P Q \" Q ? p" ? ? ?" ? qU ?" tU 4W ?" 4W ? ?" ? tX ?" ` ? 0" L?I?I?WH?@I?H?A? I??3?? ?$( ?$ ? ????? H?$`H??0 H?$`H?@H?? H?H?? ??x8H?$`H?????H? H?u0H?? H?t3????H?? ? ??$`??????>H?$`H?(?0?????4 H?@E3?3?C0 ?8 ?q??H?X?o??3??$PH?$XH?@_?H?$H?$UH?$??? H?H?3??????H??3????? ? ?A?MDMf?????H???u ? ?! ? L?wH?D??????3???? D?pH??!??? H?wH?? H? ??H??????E? H??H?? ? H??<??H??*??L???H?? @HD ??H?$ E3???w??\??H?w ?x^?? A?MDMf? ?f?????H?H?u? ?.D?3?????H?E H?? ??H??????3?3???????L?$? I?I?I?]???@H? ?CH?? HH?%n???H?$H?$H?$ WH?0L?? H?@H?A?? H?;?? ? 3??? ??? ????? ??? ? ?8?CH?? HH? H??????K0?tH?@E3?3?3??$ ?)??H?? H?t3????H?? H? ? ??H?X? ??H???????! H? H?? H?8??03???r???? 3?w09s4? ? ?_0??? ??? ?t#?? 3?C8?0H? H?? H? H? H?? L?? ? ?H? H?? H?? H?? ?? I?? H??? H???? I?3?H,?? I??0?? H??????? 3?w0H? I?HH?? ?CH??i??H?$HH?$PH?$XH?0_??$WH?0H?@H?H?? ??t ??D!K0???H??u(HcBH?$( L? *??D?? ?H?$ ?q??? D???k??H??j???CH?? HH? H?H?$@H?0_H?%O?????$H?$H?$WAVAWH?? H?@H?H?????? ? ??H?X?????4 t ?" ?? H?# L?H?? I?& M?L?? ??????y?0? H? ????H?$`E3?3?M??H?H?$PH?$@H?$`E3??$8?$0 ?$( H?$ E3?, + ????H?H?u? ?LH?? I?H??? ????= u H?$ H?$`E3?3?3?????$P?u?7 ?3??y#3??H?t?9??3?? H?t)?)???!?C4H??LH? D?LA:?O??D?LH?8 H?X???????D?H?H????H?????L?$? I? I?(I?0I?A_A^_??$H?$WH? H?@H??x??H?X??t???K43??H?t????3?? H?t?p??H?X?n???p???0 H?8 ?H?????H?$0H?$83?? _???$WH?PH?H?H?$0E3?3????L?? H? j??I? H?I???I???I???I??? I???(I???0I???? H?? H???$0??H???????= uH?$ H?$0E3?3?3?*???0H?$`H?P_??????? t t a c h e d T o ????? ???????\ D o s D e v i c e s \ H?$UVWH?$?? H????H3?? ?$4 ?$0 ?$8 H??H?? A?MDMH?????H?H?? H?$P3?? ???D?3??H????D?H?H????? H?u ???$`H?$8H?$hH?$4?$XH?$xH?n ?$pH???$0??H??M?U??$4???$@H????H??&??H?$@???L?$PH?H?? ?HD???H?$ E3??? ?$8 ?$0 3??????H?0H? ???H?pH?H????? H?hH??????????H?pH????H?? H?6??H?H H?@??H? H????H?( 3?? H3????H?$@ H? _^]???%??H?tH?2?-?+ H;? H?H???? ?)???????? r e a k O n E n t r y ???D e b u g F l a g s ?pb |f ?c ? ? ? ? ? d d 2d Dd bd zd ? ? ? ? ? e $e 6e Ne be te ? ? ? ? ? f &f >f Vf nf ? ExAllocatePoolWithTag 'RtlQueryRegistryValues xMmGetSystemRoutineAddress ?RtlInitUnicodeString ? ExFreePoolWithTag 7IofCallDriver 8IofCompleteRequest =IoCreateDevice UIoDeleteDevice IoAttachDeviceToDeviceStack ?KeInitializeSpinLock ?KeInitializeEvent ? ExInitializeResourceLite ?IoOpenDeviceRegistryKey HZwClose "RtlAppendUnicodeToString !RtlAppendUnicodeStringToString 1KeWaitForSingleObject XIoDetachDevice ? ExDeleteResourceLite ?PoRequestPowerIrp ?PoSetPowerState ?PoStartNextPowerIrp ]PoCallDriver uKeEnterCriticalRegion | ExAcquireResourceExclusiveLite ~IoGetDeviceObjectPointer PObfReferenceObject $IoBuildDeviceIoControlRequest NObfDereferenceObject ? ExReleaseResourceLite ?KeLeaveCriticalRegion KeSetEvent ntoskrnl.exe ? 0 ? H `p ? ?4 V S _ V E R S I O N _ I N F O ?? @?% @?%? S t r i n g F i l e I n f o ? 0 4 0 9 0 4 B 0 L C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n n # F i l e D e s c r i p t i o n L e g a c y N o n - P n p M o d e m D e v i c e D r i v e r r ) F i l e V e r s i o n 6 . 3 . 9 6 0 0 . 1 6 3 8 4 ( w i n b l u e _ r t m . 1 3 0 8 2 1 - 1 6 2 3 ) 8 I n t e r n a l N a m e R O O T M D M . S Y S ? . L e g a l C o p y r i g h t ? M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . @ O r i g i n a l F i l e n a m e R O O T M D M . S Y S j % P r o d u c t N a m e M i c r o s o f t ? W i n d o w s ? O p e r a t i n g S y s t e m B P r o d u c t V e r s i o n 6 . 3 . 9 6 0 0 . 1 6 3 8 4 D V a r F i l e I n f o $ T r a n s l a t i o n ? ???
Ms-Dos/Windows
Unix
Write backup
jsp File Browser version 1.2 by
www.vonloesch.de