Saturday, 17 December 2016

Add the NirLauncher utility to your E2B USB drive to launch portable NirSoft utilities + others

NirSoft make lots of very useful Windows utilities, most of which are portable.

Use the NirSoft NirLauncher to quickly select a suitable NirSoft utility.
The NirLauncher utility allows you to run any of the 200+ portable utilities from a USB drive.


They are not large utilities and the extracted files only takes up about 40MB in total.

The utilities are quite well known and very useful. For instance, under Windows, just click on the WebBrowserPassView menu item in the Password Recovery Utilities tab and you will be presented with a list of all the web sites and passwords that are stored for your account by IE, Chrome, FireFox and other browsers (no admin account password or UAC prompt as long as you are logged into the same Windows user account!). You can then save the list as a file (maybe save it to your dataShure PIN-encrypted flash drive) for safe keeping and future reference. This is a lot more convenient than having to use each browsers own password view form.

As some utilities cause one or more UAC prompts to be displayed, it is often more convenient to right-click on the NirLauncher.exe and use Run as Admin when not running under WinPE.

Note that some AV programs may object to some of the utilities and delete them or prevent them from running!

You can also add other utilities from SysInternals, Joe Tools and Piriform (untested).

One nice feature, is that you should be able to add your own favourite utilities by using Edit Mode - however I could not get this to work on my Win10 64-bit system. The drag-and-drop of an exe file did not seem to work.

Offline use

NirLauncher is a 32-bit application and will run on 32-bit WinPE. However, it does not run on 64-bit WinPE unless WoW64 support is included. You can however, run 64-bit NirSoft applications directly from the NirSoft\x64 folder. Note that many of the NirSoft utilities may not run well under a minimal WinPE environment.

To use NirLauncher when booting from a USB drive, you will need to boot to a WinPE that has extra Windows components added. As many of the utilities are 32-bit utilities, if you boot to a 64-bit WinPE, then that 64-bit WinPE build will also need WoW64 support to allow 32-bit programs to work.

Sergei Strelec WinPEs, Gandalf WinPEs or ChrisR WinBuilder WinPEs are all suitable (both 32-bit and 64-bit) and of course, Windows To Go OS's.

Note: If you are booting from an .imgPTN file to these WinPE OS's (MBR or UEFI boot), you can use the \e2b\SWITCH_E2B.exe utility to restore the E2B partition and gain access to the NirLauncher folder on the E2B drive.

Some of the NirSoft password utilities (e.g. ChromePass) can be used offline when booted to WinPE. However, for ChromePass, you will need to specify the Windows user account folder (e.g. \Users\User1) and the Windows user's account password, in order to view the web passwords. If you don't know the user account password, then it won't display the passwords (only the web user login name and site URL).

There are loads of other NirSoft utilities to experiment with, some will be more useful than others under an offline WinPE environment though.

NirLauncher Features

  • NirLauncher can be used from USB flash drive without need of any installation.
  • NirLauncher and all the utilities in the package are completely freeware, without any Spyware/Adware/Malware. This package doesn't contain any 3-party software, toolbars, Web browser plugins, or other unwanted surprises. It will not install any software on your system and it will not change your Web browser homepage or other settings on your system.
  • NirLauncher package includes variety of tools that you may need for your daily computer use, including utilities to recover lost passwords, to monitor your network, to view and extract cookies, cache, and other information stored by your Web browser, to search files in your system, and more...
  • For every utility in the package, you can easily run it, view the help file, or jump to the Web page of the utility.
  • When using it from USB flash drive, the configuration of every utility is saved into .cfg file on the flash drive.
  • On x64 systems, NirLauncher automatically run the x64 version of the utility, when there is a separated x64 version.
  • NirLauncher also allows to add more software packages in additional to the main NirSoft package.
NirSoft utilities can be used for 'information gathering ;-)' (especially when used with a Hak5 Rubber Ducky!) to quickly obtain user data from a Windows system - See RMPrepUSB Tutorial #59 (note the cmd file may be slightly out-of-date now as it does not use the WebBrowserPassView utility!).

WSCC

You may prefer the WSCC launcher, which includes an update manager...
The free-for-private-use WSCC application supports both NirSoft and SysInternals utilities, but some of the NirSoft utilities appear to be missing (e.g. browser password utilities). The auto-update feature looks handy though!

There is both a Windows 32-bit and 64-bit version. When you first run it under Windows, it will ask to 'Install' the utilities, but actually it does not install them onto Windows, it only downloads and extracts the files onto the specified (USB) drive for use as a portable app.

WSCC will not run under a minimal WinPE, but should work under a 'fuller' WinPE such as Sergei Strelec, Gandalf (which it tested OK on) or ChrisR WinPEs.