	Pwdump4 FAQ
		-- bingle

Q1: what's the output SRV> & LSA> means ?

A1: the program involve 3 parts(if local 2 parts): main interactive with user(pwdump4.exe),
 pwservice(pwdump4.exe) run remotely, thread in lsass.exe in remote target(lsaExt.dll).
SRV> is the output of pwservice(pwdump4.exe) prompt.
LSA> is the thread in lsass.exe prompt. but the result of dump without LSA> for l0pht use.


Q2: what's error code means ?

A2: because remote thread in lsass.exe must 1st duplicate the pipe handle in pwdump4.exe 
to output result & error message, but if error occurred before duplicate, the error infor
 cannot send to user's main program pwdump4.exe. so the pwdump4.exe detect the error code
 and output it to user.

-1(ERROR_LOAD_LSADLL) load LsaExt.dll failed, maybe lsass.exe cannot access LsaExt.dll
-2(ERROR_LOAD_HASHFUNC) load function GetHash() in LsaExt.dll failed, maybe incorrect
  version of LsaExt.dll.
-3(ERROR_INVALID_PARAM) will not occur this, if so, tell me.
-4(ERROR_DUP_PIPE) duplicate pipe handle in process pwdump4.exe failed.
-5(ERROR_NO_CONNECT) process lsass.exe cannot open sam database.
-6(ERROR_LOAD_SAMDLL) load system dll samsrv.dll failed.
-7(ERROR_LOAD_SAMFUNC) not all function samsrv.dll can be load.
-8(ERROR_OPEN_PROCESS) process lsass.exe cannot open process pwdump4.exe to duplicate
  handle.


Q3: when i run pwdump4 on the remote computer like:
  C:\>\\192.168.0.1\share\pwdump4.exe /l, it will failed, and return -1(SRV>Thread code: 
dump thread return -1.), why it cannot load the LsaExt.dll(it's exist), even if i copy
 it to C:\winnt\system32, that's no use ?

A3: pwdump4.exe doesn't use the LsaExt.dll directly, it inject a thread into lsass.exe 
to load LsaExt.dll and run a function to do hash dump. The LsaExt.dll must in the same 
folder with pwdump4.exe, for pwdump4.exe just let the remote thread to load LsaExt.dll 
at same path of pwdump4.exe. When the pwdump4.exe at the share of remote computer, the 
lsass process are also to load the dll in the same share, in your condition it's 
\\192.168.0.1\share\LsaExt.dll, but the lsass.exe(in LOCAL_SYSTEM account) cannot access
 the share \\192.168.0.1\share\, although u can, so -1(load LsaExt.dll failed). And u 
copy LsaExt.dll to your system32 have no use.

  To do, just copy them two in local.

					2002/2