
PassPass (bypass the Windows account password)
PassPass allows you to bypass a local Windows user account password on XP through to Windows 10 (E2B v1.87+). It does NOT allow you to bypass the password entry for a Windows email account logon.
YouTube demo (old version) here.
See also the UtilMan hack method here which does not require you to modify any files on the Windows system.
PassPass comes from an idea developed by WindowsGate and Astr0baby's tutorial, Wonko The Sane (for the grub4dos Windows dll version detection batch code) and Holmes.Sherlock (for writing the original grub4dos dll patch code).
A grub4dos version of PassPass for E2B is included in the E2B \_ISO\docs folder.
A Windows executable version called PEPassPass.exe is also available from the E2B Alternate Downloads Area - Other Files folder (written by boulcat and Ner0)
It works by patching some code bytes in the Windows DLL file which handles user authorisation at logon.
How to use PassPass
1. (optional) If possible, boot to WinPE or linux from a USB drive and make backup copies of:
- \Windows\System32\msv1_0.dll
- \Windows\System32\NtlmShared.dll (if Windows 10/Server 2016)
This is so that if you break Windows by patching these dlls, you can restore them again, if necessary.
The same dll file is backed-up by E2B later - this is just an extra step to be super-safe and is optional.
2. Boot from the E2B USB drive and run PassPass and choose the Windows installation you want to patch
3. Use the Backup option to keep a copy of the DLL. Note: make a note of what volume and DLL this is, in case you need to restore it later.
4. Use the Patch option to patch the DLL
5. Boot from the HDD to Windows - any password should now be accepted for any user account. Note that once logged in, some operations may not work correctly because the DLL has been patched. So it is best to create a new account with a new password, unpatch the DLL and then log-in using that new account...
Create a new Admin user account (and set a password), e.g. Name=New, Password=windows.
6. Boot from the E2B USB drive and run PassPass, select the same Windows OS again and use UnPatch to restore the original DLL (or you can use the Restore DLL option if you previously made a backup - make sure that you restore the same DLL and volume that you backed up in Step 3).
7. Reboot and log in to the New account (for normal behaviour), do what you want (e.g. change other account passwords), then boot to one of the other accounts and delete the new user account when finished making changes.
If anything goes wrong, restore the DLL file copy that you made in Step 1 using WinPE (or linux) or by using the E2B Restore option.
How to add PassPass to your E2B USB drive
Simply copy the \_ISO\docs\PassPass folder to the \_ISO\UTILITIES folder.
You should now have a \_ISO\UTILITIES\PassPass folder present containing PPass.g4b, PassPass.bak and PassPass.mnu.
You can now patch the Windows DLL on any volume in the system. The user password for any Windows local account will then not be required.
Note: You may be warned that more than one patch location exists. This is normal for some DLLs (e.g. Windows 8).
If you have any problems, please report them to me (the OS version number and MD5 hash of the DLL is required as well as the OS name, DLL filename and 32/64-bitness).
Recommended for Easy2Boot (fastest flash drive!)
SanDisk Extreme SDCZ880-128G-G46
- Home
- Start & Intro
- Quick Setup Guide >>>
- DOWNLOADS >>>
- YouTube videos
- Tutorials and How To's
-
Make a USB Drive >>>
- Make a multi-partition E2B USB drive using RMPrepUSB
- Use an existing USB HDD for E2B
- Use LINUX to make an E2B drive + defrag
- How to Update E2B
- How to make a WINHELPER USB Flash Drive (fix 'Required DVD drive driver is missing')
- Multiple partitions on a USB Flash drive
- Using other partitions or drives
- Backup/Restore/Copy (clone) any E2B USB drive
- Make and burn an E2B DVD
- Using E2B with a Zalman/IODD
- Add E2B to your own grub4dos USB drive
- How to remove E2B
- E2B Menu System
- UEFI booting from E2B
-
How to add Payload Files and Use E2B >>>
- Make files CONTIGUOUS
- File Extensions recognised by E2B
- UEFI+MBR and how to make .imgPTN files
- MakePartImage and how to change the CSM Menu
- UEFI-Multiboot and rEFInd
- Using SWITCH_E2B with .imgPTN files
- Using the \_ISO\AUTO folder
-
WINDOWS payloads >>
- E2B USB HDD - Installing Windows with a 'WinHelper' drive
- Windows XP Install ISOs
- Install XP 32-bit + disk drivers (DPMS)
- Windows XP 64-bit
- Install XP using WinPE (one step process)
- Add XP Install ISOs using WinSetupFromUSB
- Windows Vista/7 Install ISOs
- UEFI boot from Windows 7 Install ISOs
- Windows 8/10 Install ISOs
- Unattended Installs
- XMLtoE2B.exe (Unattend.XML files)
- Adding >4GB Windows Install ISOs using .imgPTN files
- Automating Windows Installs from .imgPTN files
- Split_WinISO
- Add Windows ISOs to partition 2
- Windows AIO ISOs
- WindowsToGo
- WinNTSetup
- WinLite10 XML files
- SDI_CHOCO (install drivers, apps and updates) >>
- .VHD and .WIM files
- PassPass (bypass the Windows Password)
- Hack Windows Account Passwords (UtilMan.exe)
- Windows 2000
- Windows 98
- Multipoint Server
- Add the latest XP drivers (DPMS)
- Add a Windows Install menu entry
- LINUX payloads >>
- MSDart ERD ISOs
- WinBuilder, Medicat, Gandalf and WinPE ISOs
- Hirens/Strelec/DLC/F4 ISOs
- DOS (MS-DOS and FreeDOS)
- HAIKU
- MAC OS X
- FreeBSD
- MOVE_IMGPTN
- List of tested ISOs\payloads (with instructions)
-
Configure E2B >>>
- Menu settings (quick reference)
- E2B Menu Demo
- E2B_Editor
- E2B files and folders explained
- MyE2B.cfg - E2B configuration file >>
- Change the payload menu entries and help text using a .txt file
- Change the order of the menu entries
- Change the background wallpaper
- Different background wallpaper for each menu
- Default Menu and Timeout
- Change the Language, Headings, Menu and text
- Changing the default E2B menu entry order
- 'Change File Extension' prompt (Auto-Suggest)
- Change the Keyboard Layout
- About .mnu files
- Sample .mnu files
- PimpMyDrive.cmd
- Reduce the E2B messages
- Add a new Sub-Menu folder
- Stamps, Animation and Tunes
- Draw lines and boxes on the screen
- Write text/time/date to the menu screen
- Global Hotkeys
- Themes (Skins)
- Fonts
- Speeding up E2B (inc. FASTLOAD)
- One Single Menu
- The E2B F1 Help menu
- Add your own Help Menu
- Add Help text files (.help)
- Add Windows Install ISOs to the Main Menu
- Change the Windows Install Menu
- Passwords and Security
- Hide Payloads and Menu Entries
- Guest Mode
- GFX Boot Menus
- Dual Booting
- Change the CSM .imgPTN Menu
- Configure Clover
- Right-to-Left Languages
- Create new language files
- How to modify LOADISO.CMD (Repair message)
- Count number of boots
- UEFI - useful things know!
-
FAQ, Info, TroubleShooting, QEMU and Virtual Machines >>>
- 'File Not Contiguous' and 'Too Many Fragments' Errors
- 137GB 'BAD BIOS' bug
- TroubleShooting E2B
- E2B Error Messages
- Grub4dos Error Numbers
- Common problems with payload files
- Repair a corrupt E2B drive
- Known Issues and Bugs
- Slow and buggy BIOSes
- How E2B Works
- QEMU and Virtual Machines >>
- Using VBOX with a WinHelper USB drive
- Debugging E2B
- CONTIG.ISO
- ISOBOOT
- WIMBOOT (iPXE)
- grub4dos
- Useful resources
- Removable v. Fixed
- Gallery
- Guestbook
- Forum
- Blog
- a1ive grub2 File Manager (MBR+UEFI)
- Add Ventoy
- Site Map
- eBooks
- Contact Me >>>
- Donate
- Licensing
- Privacy policy (GDPR)
- Bespoke design service
- Grub2 Menu System (UEFI_GRUB2_PTN2)