Hacker News Reader

Hacker News

Comment by unnouinceput | Hacker News Reader

Full thread

unnouinceput

2 points:

1 - article has wrong info. Under Windows 10 the name is ATMLIB.DLL. ATMFD.DLL is the name for older version of Windows

2 - rename it. Here is the script to be used under an elevated command prompt (change name accordingly if Win10):

cd "%windir%\system32"

takeown.exe /f atmfd.dll

icacls.exe atmfd.dll /save atmfd.dll.acl

icacls.exe atmfd.dll /grant Administrators:(F)

rename atmfd.dll x-atmfd.dll

cd "%windir%\syswow64"

takeown.exe /f atmfd.dll

icacls.exe atmfd.dll /save atmfd.dll.acl

icacls.exe atmfd.dll /grant Administrators:(F)

rename atmfd.dll x-atmfd.dll

View on HN

Please keep in mind that you need to localize 'Administrators' to make this work on non english systems. When deploying this, it would be better to replace the name with the groups sid. I am on mobile right now but some fellow hacker can surely provide them.

Looking up your local Administrator name:

wmic path win32_group where (LocalAccount=true AND SID="S-1-5-32-544") get Name

edit: that's just the name of the local Administrators group, here's how to get the Admin-accountname:

wmic useraccount where (domain='localhostname' and sid like 'S-1-5-21-%%-500') get sid /value

wmic useraccount where (domain='localhostname' and sid='sidfromfirstcommandhere') get name /value

Hmmmm,

That will just return the name of the built-in Administrators account. If you wanted to find all user accounts in the administrators group you could do:

powershell -c "$([ADSI]'WinNT://YOUR_MACHINE_NAME/Administrators,group').psbase.Invoke('Members') | foreach { $_.GetType().InvokeMember('ADspath', 'GetProperty', $null, $_, $null)}"

> 1 - article has wrong info. Under Windows 10 the name is ATMLIB.DLL. ATMFD.DLL is the name for older version of Windows

I don't think they have the wrong info. According to the MS advisory they linked (https://portal.msrc.microsoft.com/en-us/security-guidance/ad...) it would appear that ATMLIB.dll is not actually affected as there is no mention of it at all, only ATMFD.dll. Also implied by the advisroy is that ATMFD.dll is present on Windows 10 but only versions prior to 1709:

> Rename ATMFD.DLL

> Please note: ATMFD.DLL is not present in Windows 10 installalations starting with Windows 10, version 1709. Newer versions do not have this DLL.

As someone with no knowledge of windows, what’s with their naming scheme? Is this some DOS remnant? Without context the name alone would be reason to fail code review.

https://en.wikipedia.org/wiki/8.3_filename

ATMLIB is just a client library, it doesn't process any fonts itself, it's not the same thing as ATMFD.

In Windows 10, they changed it so the ATMFD code runs sandboxed in fontdrvhost.exe, and eventually removed it completely from the kernel, that's why atmfd.dll is not there on later editions.

Reply on news.ycombinator.com