How to obtain a user logon name and password under WINDOWS 2000

First, the principle

Interactive login support in nt/2000 is implemented by Winlogon calling the Gina DLL, and the GINA DLL provides an interactive interface to provide authentication requests for user login. Winlogon interacts with the Gina DLL, which defaults to MSGINA.DLL (under the System32 directory). Microsoft also provides us with interfaces, and we can write our own Gina DLL instead of MSGINA.DLL.

3 desktops are created when Winlogon is initialized:

(1), Winlogon Desktop: The main display of Windows security interface, such as you press the Ctrl+alt+del, landing interface, etc.

(2), application desktop: We usually see the interface with my Computer

(3), screen Protection Desktop: screen protection display interface.

By default, Gina displays the login dialog box, and the user enters the username and password. So to get a username and password, you can write a new Gina DLL that provides the function WlxLoggedOutSAS that the interface calls Msgina.dll.

Second, the realization of the program

GINA DLL to output the following functions (Winlogon will Call):

(Table i) List of GINA functions

Function	Describe
Wlxactivateusershell	Activate user shell
Wlxdisplaylockednotice	Allow Gina DLL to display lock information
Wlxdisplaysasnotice	Winlogon calls this function when no user is logged in
Wlxdisplaystatusmessage	Winlogon Call this function to display with a state information
Wlxgetconsoleswitchcredentials	Winlogon calls this function to read the trust information of the currently logged in user and transparently upload them to the target session
Wlxgetstatusmessage	Winlogon call this function to get the current state information
Wlxinitialize	Initializes a GINA DLL for the specified window position
Wlxislockok	Verifying workstation normal lockdown
Wlxislogoffok	Verify logoff is normal
WlxLoggedOnSAS	The user has logged in and the workstation is not locked and if a SAS event is received at this time, Winlogon calls this function
WlxLoggedOutSAS	No user logged in, if the SAS event is received at this time, then Winlogon calls this function, this indicates the logon attempt should be made.
Wlxlogoff	Notify Gina DLL when requesting logoff operation
Wlxnegotiate	Indicates whether the current Winlogon version can use the Gina DLL
Wlxnetworkproviderload	Winlogon calls this function after the network service provider has been loaded to collect identity and authentication information
Wlxremovestatusmessage	Winlogon Call this function to tell Gina DLL to stop displaying state information
Wlxscreensavernotify	Allow Gina to interact with screen saver operations
Wlxshutdown	Winlogon calls this function before shutting down, allowing Gina to implement any shutdown tasks, such as exiting the smart card from the reader
Wlxstartapplication	Call this function when the system needs to start the application in the context of the user
Wlxwkstalockedsas	When a workstation is locked and if a SAS is received, Winlogon calls this function