How can I disable safe mode in Windows 7 and crash Windows with a hotkey?

Question

• Is there a way to disable safe mode in Windows 7?

In XP, I can modify the following keys to disable safe mode, which causes BSOD and reboot.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network]

Unlike XP, Windows 7 prevents users from editing, renaming or deleting such registry keys. It gives error message, "Error Renaming Key, The Registry Editor cannot rename Minimal. Error while renaming key."

I HAVE TESTED IT. An enemy can get into safe mode (using decoy password) then do 101 stuffs like bypassing/disabling startup items, hexing the last password used to setup hidden volume. I spent weeks trying to find solution (not to mention the fake answers) but all in vain.

• Is there a freeware to intentionally crash our system via hotkey while still logged on?

Bestcrypt has the emergency crash hotkey but it's part of the package which is not free. Thus, I'm trying to find free way to crash (possibly going into BSOD and reboot).

Also, I heard about the MBR killer virus some time ago. How can I get it for use on my own computer.. preferably in a password compressed zip to release it when decompressed? I think it's good for Truecrypt last line of defense.

Solution 1

Force a crash from the keybaord

You must ensure the following three settings before the keyboard can cause a system crash:

If you wish a crash dump file to be written, you must enable such dump files, choose the path and file name, and select the size of the dump file. For more information, see Enabling a Kernel-Mode Dump File.

With PS/2 keyboards, you must enable the keyboard-initiated crash in the registry. In the registry key

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\i8042prt\Parameters, create a value named CrashOnCtrlScroll, and set it equal to a REG_DWORD value of 0x01.

With USB keyboards, you must enable the keyboard-initiated crash in the registry. In the registry key

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\kbdhid\Parameters, create a value named CrashOnCtrlScroll, and set it equal to a REG_DWORD value of 0x01.

You must restart the system for these settings to take effect.

After this is completed, the keyboard crash can be initiated by using the following hotkey sequence: Hold down the rightmost CTRL key, and press the SCROLL LOCK key twice.

The system then calls KeBugCheck and issues bug check 0xE2 (MANUALLY_INITIATED_CRASH). Unless crash dumps have been disabled, a crash dump file is written at this point.

If a kernel debugger is attached to the crashed machine, the machine will break into the kernel debugger after the crash dump file has been written.

source of Information

.

To change the registry keys you may need to change the permissions of the key first, I have no way of knowing what negative affects this may cause, use at your own risk. Backup the key first, Export the key before you change it, label it so you know what it is.

Right click on the key in registry editor and select permissions, make changes in there like you would for any other windows file.

Do some reading on how to properly change permissions before you change anything, making the wrong permissions changes can have disastrous consequences.

.

Or try this free utility http://guino.home.insightbb.com/nosafemode.html

Solution 2

You want to forcefully disable Windows' failsafes?

While I understand the question, I don't think it's necessary. TrueCrypt's full system drive encryption covers you for most of your requirements. You need to enter the password before the Windows boot loader even runs. With customising the password entry prompt, you can fake a non-responsive hard drive at that screen.

As for crashing Windows using a hotkey, I don't know of any, but I'm sure something exists.

Comments

[surfasb]

Odd, but safe mode forces me to type a password. . .

[desperado]

I'm actually referring to anti-forensics. I'VE TESTED IT on decoy volume. An enemy can get into safe mode (using decoy password) then do 101 stuffs like bypassing/disabling startup items, hexing the last password used to setup hidden volume.

[Admin]

I'm not convinced. You can embed a second TrueCrypt volume inside the first one. Be that as it may, it's a given that physical access to a machine means it can be owned. It sounds like you're trying to get around this, and that's not possible in my opinion.

[surfasb]

Yeah, Safe mode makes me use a password. Now if you enabled the built in admin account, that's a different story. . .