filenamesubinacl.exe.deploy
size290304 (0x46e00)
md553cdbb093b0aee9fd6cf1cbd25a95077
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
9321792
1533104
484502
7721441
93331029
10297
95331015
96331020
9433101
9033101

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x40ca0f5b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x44a00
SizeOfInitializedData0xe600
SizeOfUninitializedData0
AddressOfEntryPoint0x3e1d3
BaseOfCode0x1000
BaseOfData0x46000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion5.2
SubsystemVersion4.0
Reserved10
SizeOfImage0x55000
SizeOfHeaders0x400
CheckSum0x54a57
Subsystem3
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.1 EXE

Sections

namevavsizeraw sizeflags
.text0x10000x449000x44a00R-X CODE
.data0x460000xd44c0x1000RW- IDATA
.rsrc0x540000xe880x1000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x43d900x154
RESOURCE0x540000xe88
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x14c00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x1ba080x40
Bound_IAT00
IAT0x10000x4b4
Delay_IAT00
CLR_Header00
typenamesizecp
STRING#115580
STRING#29280
STRING#31240
VERSION#18440
idlangstring
11033To avoid infinite loop, SubInacl doesn't process registry key with *
21033/stat /nostat - Create a new screen buffer to monitor statistics
31033/samobject support added
41033/cleandeletesids=domain[=owner|group|sacl\dacl] added
51033/subdir=dironly,fileonly was not working on sub levels
61033/offlinecachesam added
71033RegOpenKeyEx uses the REG_OPTION_RESTORE_BACKUP option.
81033call SetSecurityDescriptorControl correctly
91033fix minor bugs 658051,658600
101033/findsid displays the ACL field machting the Domainccount
111033/cluster issue is solved. Security Descriptor file share parameter is also updated
121033/sddl support added - Fix issue with /offlinesam in a Workgroup - SubInacl /sub c:modifed to be SubInacl /sub c:.*
131033Unicode support
141033Full Unicode support - /displaycachesid to dump cache sids
151033Fix invalid Sid problem
161033/sdeny /sgrant support
171033/error broken
181033 "QueryServiceSecurityObject replaces by GetSecurityObject and bug /clean /alternate"
191033 Fix on CobjPrinter::QuerySecurityDescriptor
201033SubIO Read broken with large ASCII files
211033/playfile is broken if playfile contains several +file with *
221033Fix playfile problem with +File c:.* , add /applyonly feature
301033/applyonly feature + Add manage Reparsepoint
311033/pathcopysecurity and /objectcopysecurity + bug /sddl sur descriptor control
321033Prefix bugs + /sallowdeny + bug SDDL and sacl
module_namehintordfunction_name
KERNEL32.dll926WriteConsoleOutputW
KERNEL32.dll242FormatMessageW
KERNEL32.dll49CloseHandle
KERNEL32.dll368GetLastError
KERNEL32.dll321GetCurrentProcess
KERNEL32.dll324GetCurrentThread
KERNEL32.dll310GetConsoleScreenBufferInfo
KERNEL32.dll440GetStdHandle
KERNEL32.dll805SetLastError
KERNEL32.dll626MultiByteToWideChar
KERNEL32.dll928WriteFile
KERNEL32.dll927WriteConsoleW
KERNEL32.dll770SetConsoleTextAttribute
KERNEL32.dll415GetProcAddress
KERNEL32.dll385GetModuleHandleW
KERNEL32.dll594LoadLibraryW
KERNEL32.dll353GetFileInformationByHandle
KERNEL32.dll83CreateFileW
KERNEL32.dll136DeviceIoControl
KERNEL32.dll274GetCompressedFileSizeW
KERNEL32.dll355GetFileSizeEx
KERNEL32.dll278GetComputerNameW
KERNEL32.dll914WideCharToMultiByte
KERNEL32.dll643OpenProcess
KERNEL32.dll361GetFullPathNameW
KERNEL32.dll204FindClose
KERNEL32.dll219FindNextFileW
KERNEL32.dll211FindFirstFileW
KERNEL32.dll182ExitProcess
KERNEL32.dll186ExpandEnvironmentStringsW
KERNEL32.dll272GetCommandLineW
KERNEL32.dll747SetConsoleCtrlHandler
KERNEL32.dll690ReadFile
KERNEL32.dll367GetLargestConsoleWindowSize
KERNEL32.dll381GetModuleFileNameW
KERNEL32.dll246FreeLibrary
KERNEL32.dll195FileTimeToSystemTime
KERNEL32.dll194FileTimeToLocalFileTime
KERNEL32.dll669QueryDosDeviceW
KERNEL32.dll688ReadConsoleW
KERNEL32.dll453GetSystemTime
KERNEL32.dll476GetTickCount
KERNEL32.dll744SetConsoleActiveScreenBuffer
KERNEL32.dll601LocalFree
KERNEL32.dll855SystemTimeToFileTime
KERNEL32.dll769SetConsoleScreenBufferSize
KERNEL32.dll71CreateConsoleScreenBuffer
KERNEL32.dll672QueryPerformanceCounter
KERNEL32.dll325GetCurrentThreadId
KERNEL32.dll322GetCurrentProcessId
KERNEL32.dll455GetSystemTimeAsFileTime
KERNEL32.dll858TerminateProcess
KERNEL32.dll875UnhandledExceptionFilter
KERNEL32.dll838SetUnhandledExceptionFilter
MFC42u.DLL861
MFC42u.DLL800
MFC42u.DLL540
MFC42u.DLL535
MFC42u.DLL3658
MFC42u.DLL823
MFC42u.DLL538
MFC42u.DLL2836
MFC42u.DLL825
MFC42u.DLL2910
MFC42u.DLL858
MFC42u.DLL5446
MFC42u.DLL6390
MFC42u.DLL2099
MFC42u.DLL5436
MFC42u.DLL6379
MFC42u.DLL4199
MFC42u.DLL5679
MFC42u.DLL4273
MFC42u.DLL6279
MFC42u.DLL6278
MFC42u.DLL5706
MFC42u.DLL1863
MFC42u.DLL5826
MFC42u.DLL3722
MFC42u.DLL542
MFC42u.DLL802
MFC42u.DLL5597
MFC42u.DLL6563
MFC42u.DLL3898
MFC42u.DLL2036
MFC42u.DLL5830
MFC42u.DLL2440
MFC42u.DLL537
MFC42u.DLL2756
MFC42u.DLL2755
MFC42u.DLL2810
MFC42u.DLL940
MFC42u.DLL925
MFC42u.DLL922
MFC42u.DLL941
MFC42u.DLL942
MFC42u.DLL924
MFC42u.DLL536
MFC42u.DLL4197
MFC42u.DLL927
MFC42u.DLL4124
MFC42u.DLL4272
msvcrt.dll740malloc
msvcrt.dll840wprintf
msvcrt.dll295_getch
msvcrt.dll832wcsstr
msvcrt.dll564_wcsicmp
msvcrt.dll826wcsncat
msvcrt.dll773sprintf
msvcrt.dll819wcschr
msvcrt.dll638_wtoi
msvcrt.dll93__RTDynamicCast
msvcrt.dll726iswprint
msvcrt.dll753printf
msvcrt.dll204_c_exit
msvcrt.dll253_exit
msvcrt.dll827wcsncmp
msvcrt.dll799swscanf
msvcrt.dll830wcsrchr
msvcrt.dll809towupper
msvcrt.dll458_purecall
msvcrt.dll828wcsncpy
msvcrt.dll820wcscmp
msvcrt.dll671fclose
msvcrt.dll595_wfopen
msvcrt.dll490_setmode
msvcrt.dll688fread
msvcrt.dll697fwrite
msvcrt.dll693fseek
msvcrt.dll798swprintf
msvcrt.dll689free
msvcrt.dll85__CxxFrameHandler
msvcrt.dll72_CxxThrowException
msvcrt.dll79_XcptFilter
msvcrt.dll207_cexit
msvcrt.dll668exit
msvcrt.dll171__winitenv
msvcrt.dll170__wgetmainargs
msvcrt.dll322_initterm
msvcrt.dll160__setusermatherr
msvcrt.dll189_adjust_fdiv
msvcrt.dll133__p__commode
msvcrt.dll138__p__fmode
msvcrt.dll158__set_app_type
msvcrt.dll244_except_handler3
msvcrt.dll17public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll53void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll111__dllonexit
msvcrt.dll445_onexit
msvcrt.dll822wcscpy
msvcrt.dll825wcslen
msvcrt.dll818wcscat
msvcrt.dll221_controlfp
msvcirt.dll149public: class ostream & __thiscall ostream::operator<<(void const *)

??6ostream@@QAEAAV0@PBX@Z

msvcirt.dll259class ostream_withassign cout

?cout@@3Vostream_withassign@@A

MSVCP60.dll2204class std::basic_ostream<unsigned short, struct std::char_traits<unsigned short> > std::wcout

?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A

MSVCP60.dll1572public: class std::basic_ostream<unsigned short, struct std::char_traits<unsigned short> > & __thiscall std::basic_ostream<unsigned short, struct std::char_traits<unsigned short> >::flush(void)

?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ

MSVCP60.dll691class std::basic_ostream<unsigned short, struct std::char_traits<unsigned short> > & __cdecl std::operator<<(class std::basic_ostream<unsigned short, struct std::char_traits<unsigned short> > &, unsigned short const *)

??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBG@Z

MSVCP60.dll243public: __thiscall std::basic_ifstream<unsigned short, struct std::char_traits<unsigned short> >::basic_ifstream<unsigned short, struct std::char_traits<unsigned short> >(void)

??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@XZ

MSVCP60.dll1830public: void __thiscall std::basic_ifstream<unsigned short, struct std::char_traits<unsigned short> >::open(char const *, int)

?open@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXPBDH@Z

MSVCP60.dll939public: void __thiscall std::basic_ifstream<unsigned short, struct std::char_traits<unsigned short> >::`vbase destructor'(void)

??_D?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ

MSVCP60.dll1283public: void __thiscall std::basic_ifstream<unsigned short, struct std::char_traits<unsigned short> >::close(void)

?close@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ

MSVCP60.dll457public: virtual __thiscall std::basic_stringstream<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >::~basic_stringstream<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >(void)

??1?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UAE@XZ

MSVCP60.dll2202class std::basic_istream<unsigned short, struct std::char_traits<unsigned short> > std::wcin

?wcin@std@@3V?$basic_istream@GU?$char_traits@G@std@@@1@A

MSVCP60.dll1632public: class std::basic_istream<unsigned short, struct std::char_traits<unsigned short> > & __thiscall std::basic_istream<unsigned short, struct std::char_traits<unsigned short> >::getline(unsigned short *, int)

?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGH@Z

MSVCP60.dll247protected: __thiscall std::basic_ios<unsigned short, struct std::char_traits<unsigned short> >::basic_ios<unsigned short, struct std::char_traits<unsigned short> >(void)

??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ

MSVCP60.dll315public: __thiscall std::basic_stringstream<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >::basic_stringstream<unsigned short, struct std::char_traits<unsigned short>, class std::allocator<unsigned short> >(int)

??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z

MSVCP60.dll437public: virtual __thiscall std::basic_ios<unsigned short, struct std::char_traits<unsigned short> >::~basic_ios<unsigned short, struct std::char_traits<unsigned short> >(void)

??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ

MSVCP60.dll488public: __thiscall std::_Winit::~_Winit(void)

??1_Winit@std@@QAE@XZ

MSVCP60.dll484public: __thiscall std::ios_base::Init::~Init(void)

??1Init@ios_base@std@@QAE@XZ

MSVCP60.dll384public: __thiscall std::_Winit::_Winit(void)

??0_Winit@std@@QAE@XZ

MSVCP60.dll377public: __thiscall std::ios_base::Init::Init(void)

??0Init@ios_base@std@@QAE@XZ

MSVCP60.dll2201class std::basic_ostream<unsigned short, struct std::char_traits<unsigned short> > std::wcerr

?wcerr@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A

MSVCP60.dll644class std::basic_istream<unsigned short, struct std::char_traits<unsigned short> > & __cdecl std::operator>>(class std::basic_istream<unsigned short, struct std::char_traits<unsigned short> > &, unsigned short *)

??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@PAG@Z

MSVCP60.dll673public: class std::basic_ostream<unsigned short, struct std::char_traits<unsigned short> > & __thiscall std::basic_ostream<unsigned short, struct std::char_traits<unsigned short> >::operator<<(void const *)

??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z

ADVAPI32.dll564SetSecurityDescriptorGroup
ADVAPI32.dll480RegGetKeySecurity
ADVAPI32.dll258GetNamedSecurityInfoW
ADVAPI32.dll306InitializeSecurityDescriptor
ADVAPI32.dll567SetSecurityDescriptorSacl
ADVAPI32.dll563SetSecurityDescriptorDacl
ADVAPI32.dll229GetAclInformation
ADVAPI32.dll228GetAce
ADVAPI32.dll305InitializeAcl
ADVAPI32.dll22AddAce
ADVAPI32.dll461RegConnectRegistryW
ADVAPI32.dll559SetNamedSecurityInfoW
ADVAPI32.dll568SetSecurityInfo
ADVAPI32.dll212EnumServicesStatusW
ADVAPI32.dll430OpenServiceW
ADVAPI32.dll507RegSetKeySecurity
ADVAPI32.dll487RegOpenKeyExW
ADVAPI32.dll464RegCreateKeyExW
ADVAPI32.dll457RegCloseKey
ADVAPI32.dll408MakeSelfRelativeSD
ADVAPI32.dll266GetSecurityDescriptorLength
ADVAPI32.dll555SetKernelObjectSecurity
ADVAPI32.dll453QueryUsersOnEncryptedFile
ADVAPI32.dll441QueryRecoveryAgentsOnEncryptedFile
ADVAPI32.dll223FreeEncryptionCertificateHashList
ADVAPI32.dll78ConvertSecurityDescriptorToStringSecurityDescriptorW
ADVAPI32.dll216EqualSid
ADVAPI32.dll334LookupPrivilegeValueW
ADVAPI32.dll28AdjustTokenPrivileges
ADVAPI32.dll434PrivilegeCheck
ADVAPI32.dll328LookupAccountSidW
ADVAPI32.dll277GetSidIdentifierAuthority
ADVAPI32.dll280GetSidSubAuthorityCount
ADVAPI32.dll279GetSidSubAuthority
ADVAPI32.dll431OpenThreadToken
ADVAPI32.dll426OpenProcessToken
ADVAPI32.dll565SetSecurityDescriptorOwner
ADVAPI32.dll270GetSecurityInfo
ADVAPI32.dll16AddAccessAllowedAce
ADVAPI32.dll307InitializeSid
ADVAPI32.dll245GetKernelObjectSecurity
ADVAPI32.dll263GetSecurityDescriptorControl
ADVAPI32.dll90CopySid
ADVAPI32.dll246GetLengthSid
ADVAPI32.dll267GetSecurityDescriptorOwner
ADVAPI32.dll265GetSecurityDescriptorGroup
ADVAPI32.dll5AccessCheck
ADVAPI32.dll409MapGenericMask
ADVAPI32.dll174DeleteAce
ADVAPI32.dll225FreeSid
ADVAPI32.dll215EqualPrefixSid
ADVAPI32.dll29AllocateAndInitializeSid
ADVAPI32.dll269GetSecurityDescriptorSacl
ADVAPI32.dll264GetSecurityDescriptorDacl
ADVAPI32.dll318IsValidSid
ADVAPI32.dll326LookupAccountNameW
ADVAPI32.dll80ConvertSidToStringSidW
ADVAPI32.dll475RegEnumKeyExW
ADVAPI32.dll492RegQueryInfoKeyW
ADVAPI32.dll428OpenSCManagerW
ADVAPI32.dll324LogonUserW
ADVAPI32.dll86ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll354LsaFreeMemory
ADVAPI32.dll340LsaClose
ADVAPI32.dll379LsaQueryInformationPolicy
ADVAPI32.dll371LsaOpenPolicy
VERSION.dll13VerQueryValueW
VERSION.dll3GetFileVersionInfoW
VERSION.dll2GetFileVersionInfoSizeW
NETAPI32.dll227NetShareSetInfo
NETAPI32.dll105NetApiBufferFree
NETAPI32.dll249NetWkstaGetInfo
NETAPI32.dll143NetGetAnyDCName
NETAPI32.dll206NetServerGetInfo
NETAPI32.dll242NetUserModalsGet
MPR.dll65WNetOpenEnumW
MPR.dll29WNetEnumResourceW
MPR.dll17WNetCloseEnum
WINSPOOL.DRV27ClosePrinter
WINSPOOL.DRV97EnumPrintersW
WINSPOOL.DRV121GetPrinterW
WINSPOOL.DRV126OpenPrinterW
WINSPOOL.DRV156SetPrinterW
CLUSAPI.dll5CloseCluster
CLUSAPI.dll11CloseClusterResource
CLUSAPI.dll12ClusterCloseEnum
CLUSAPI.dll46ClusterResourceControl
CLUSAPI.dll100OpenClusterResource
CLUSAPI.dll14ClusterEnum
CLUSAPI.dll32ClusterOpenEnum
CLUSAPI.dll95OpenCluster
ole32.dll58CoInitialize
ole32.dll17CoCreateInstanceEx
USER32.dll728wsprintfW
SAMLIB.dll50SamSetSecurityObject
SAMLIB.dll29SamLookupNamesInDomain
SAMLIB.dll33SamOpenUser
SAMLIB.dll30SamOpenAlias
SAMLIB.dll32SamOpenGroup
SAMLIB.dll31SamOpenDomain
SAMLIB.dll6SamCloseHandle
SAMLIB.dll18SamEnumerateGroupsInDomain
SAMLIB.dll19SamEnumerateUsersInDomain
SAMLIB.dll16SamEnumerateAliasesInDomain
SAMLIB.dll20SamFreeMemory
SAMLIB.dll7SamConnect
SAMLIB.dll39SamQuerySecurityObject
ntdll.dll684RtlInitUnicodeString
ntdll.dll775RtlNtStatusToDosError
SHELL32.dll7CommandLineToArgvW

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionSubInAcl
FileVersion5.2.3790.1180
InternalNameSubInAcl.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameSubInAcl.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion5.2.3790.1180

VS_FIXEDFILEINFO

FileVersion5.2.3790.1180
ProductVersion5.2.3790.1180
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags8
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0290304EXE06/11/2004 20:00:27#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK