DeepThaw v2.2

DeepThaw v2.2

Since there were quite a lot of updates, we skipped version 2.1 and went straight to version 2.2.

Now it can support
Deep Freeze Standard 7.73.020.0000-9.0.020.5760
Deep Freeze Server Standard 7.73.070.0000-9.0.070.5760 (The tool will directly recognize it as Deep Freeze Standard)
Deep Freeze Enterprise 8.32.220.0000-10.20.220.5844
Deep Freeze Server Enterprise 8.32.270.0000-10.20.270.5844 (The tool will directly recognize it as Deep Freeze Enterprise)

Reboot Restore Rx Standard\Reboot Restore Rx Enterprise 0.0.0.0-13.0.0.0
Rollback Rx Professional 0.0.0.0-12.9.0.0
Rollback Rx Server 0.0.0.0-12.7.0.0

On Windows 7 64-bit and later systems

Note: The file “DeepThaw_Kernel.sys” and "DeepThaw_ForInjection.dll" included in the archive are dependencies of this tool; without them, the tool will not run. You must ensure that “DeepThaw.exe” "DeepThaw_ForInjection.dll" “DeepThaw_Kernel.sys“ are placed in the same directory and that their filenames are not changed, otherwise the tool will fail to operate.

Additionally, to ensure the driver loads properly, the DeepThaw_Kernel.sys file included in this tool is signed with an expired certificate. Therefore, it may be flagged by antivirus software (especially Windows Defender) as a false positive.

Disclaimer: This tool is intended for research and learning purposes only. Do not use it for any illegal activities. The author shall not be held responsible for any consequences arising from illegal use of this tool.

Changelog:
1.Improved and re-enabled Force Mode
2.The “Disable Password Verification of Reboot Restore Rx (Rollback Rx)” feature now supports Windows 7
3.Rewrote driver loading
4.Improved version verification

Note: Please download the corresponding tool according to the operating system version you are using; otherwise, the tool will not work.
For Example:
If you are using Windows 10/11 64-bit, please download DeepThaw_v2.2_x64_ForWin10AndGreater.zip.
If you are using Windows 7/8.x 64-bit, please download DeepThaw_v2.2_x64_ForWin7.8.x.zip.

If the tool fails to open, please download and install the runtime from https://www.microsoft.com/en-us/download/details.aspx?id=48145.
For earlier versions of Deep Freeze, please use the “MeltdownDFC.exe” tool under Assets (I didn’t make this tool). It can directly reveal the passwords for Deep Freeze Enterprise 5.x–8.31 and Standard 6.00–7.72.

现在能支持
Windows 7 64位 及以后系统下的
Deep Freeze Standard 7.73.020.0000-9.0.020.5760
Deep Freeze Server Standard 7.73.070.0000-9.0.070.5760 (工具会直接识别为 Deep Freeze Standard)
Deep Freeze Enterprise 8.32.220.0000-10.20.220.5844
Deep Freeze Server Enterprise 8.32.270.0000-10.20.270.5844 (工具会直接识别为 Deep Freeze Enterprise)

Reboot Restore Rx Standard\Reboot Restore Rx Enterprise 0.0.0.0-13.0.0.0
Rollback Rx Professional 0.0.0.0-12.9.0.0
Rollback Rx Server 0.0.0.0-12.7.0.0

注意：压缩包中的"DeepThaw_Kernel.sys""DeepThaw_ForInjection.dll"是本工具的依赖，没有它工具将无法运行。你必须确保“DeepThaw.exe”""DeepThaw_ForInjection.dll""“DeepThaw_Kernel.sys”在同一目录下，且不能改名，否则工具无法运行

另外，为了正常加载驱动，本工具的“DeepThaw_Kernel.sys”使用了过期的签名进行签名，因此可能会被杀毒软件（点名Windows Defender）误报

声明：本工具仅作研究和学习使用，切勿用于非法用途。若因用于非法用途而造成损失，一切后果与本工具作者无关

更新日志：
1.改进并重新启用了强制模式
2.功能"Disable Password Verification of Reboot Restore Rx (Rollback Rx)"支持了Windows 7
3.驱动加载的重写
4.版本验证的完善

注意：请按照你使用的操作系统版本下载对应的工具，否则工具无法奏效
例如：如果你使用的系统是Windows 10/11 64位系统，请下载“DeepThaw_v2.2_x64_ForWin10AndGreater.zip”
如果你使用的系统是Windows 7/8.x 64位系统，请下载“DeepThaw_v2.2_x64_ForWin7.8.x.zip”

如果工具无法打开，请在 https://www.microsoft.com/zh-cn/download/details.aspx?id=48145 下载运行库并将其安装
对于较早期的Deep Freeze，请使用Assets下的“MeltdownDFC.exe”工具(这个工具不是我做的)。它可以直接查看DeepFreeze Enterprise 5.x-8.31, Standard 6.00-7.72的密码

PS: 如果你有兴趣，可以加入QQ群聊1041587773。反馈问题还是交流讨论都是允许的

DeepThaw v2.0

DeepThaw v2.0

Now it can support
Deep Freeze Standard 7.73.020.0000-9.0.020.5760
Deep Freeze Enterprise 8.32.220.0000-10.20.220.5844
Deep Freeze Server series 7.73.xxx.0000-9.0.xxx.5760 (The tool will directly recognize it as Deep Freeze Standard.)

Reboot Restore Rx Standard\Reboot Restore Rx Enterprise 0.0.0.0-13.0.0.0
Rollback Rx Professional 0.0.0.0-12.9.0.0
Rollback Rx Server 0.0.0.0-12.7.0.0

On Windows 7 64-bit and later systems

Note: The file “DeepThaw_Kernel.sys” and "DeepThaw_ForInjection.dll" included in the archive are dependencies of this tool; without them, the tool will not run. You must ensure that “DeepThaw.exe” "DeepThaw_ForInjection.dll" “DeepThaw_Kernel.sys“ are placed in the same directory and that their filenames are not changed, otherwise the tool will fail to operate.

Additionally, to ensure the driver loads properly, the DeepThaw_Kernel.sys file included in this tool is signed with an expired certificate. Therefore, it may be flagged by antivirus software (especially Windows Defender) as a false positive.

Disclaimer: This tool is intended for research and learning purposes only. Do not use it for any illegal activities. The author shall not be held responsible for any consequences arising from illegal use of this tool.

Changelog:
1.Added support for the entire Reboot Restore Rx and Rollback Rx product lines.
2.Added support for the latest version of Deep Freeze Enterprise.
3.Temporarily disabled "Force Mode".
4.Rewrote of driver loading.

Note: Please download the corresponding tool according to the operating system version you are using; otherwise, the tool will not work.
For Example:
If you are using Windows 10/11 64-bit, please download DeepThaw_v2.0_x64_ForWin10AndGreater.zip.
If you are using Windows 7/8.x 64-bit, please download DeepThaw_v2.0_x64_ForWin7.8.x.zip.

现在能支持
Windows 7 64位 及以后系统下的
Deep Freeze Standard 7.73.020.0000-9.0.020.5760
Deep Freeze Enterprise 8.32.220.0000-10.20.020.5844
Deep Freeze Server series 7.73.xxx.0000-9.0.xxx.5760 (工具会直接将其识别为Deep Freeze Standard)

Reboot Restore Rx Standard\Reboot Restore Rx Enterprise 0.0.0.0-13.0.0.0
Rollback Rx Professional 0.0.0.0-12.9.0.0
Rollback Rx Server 0.0.0.0-12.7.0.0

注意：压缩包中的"DeepThaw_Kernel.sys""DeepThaw_ForInjection.dll"是本工具的依赖，没有它工具将无法运行。你必须确保“DeepThaw.exe”""DeepThaw_ForInjection.dll""“DeepThaw_Kernel.sys”在同一目录下，且不能改名，否则工具无法运行

另外，为了正常加载驱动，本工具的“DeepThaw_Kernel.sys”使用了过期的签名进行签名，因此可能会被杀毒软件（点名Windows Defender）误报

声明：本工具仅作研究和学习使用，切勿用于非法用途。若因用于非法用途而造成损失，一切后果与本工具作者无关

更新日志：
1.支持了Reboot Restore Rx和Rollback Rx全系
2.支持了最新版的Deep Freeze Enterprise
3.暂时地禁用了"Force Mode"
4.重写了驱动加载

注意：请按照你使用的操作系统版本下载对应的工具，否则工具无法奏效
例如：如果你使用的系统是Windows 10/11 64位系统，请下载“DeepThaw_v2.0_x64_ForWin10AndGreater.zip”
如果你使用的系统是Windows 7/8.x 64位系统，请下载“DeepThaw_v2.0_x64_ForWin7.8.x.zip”

PS: 如果你有兴趣，可以加入QQ群聊1041587773。反馈问题还是交流讨论都是允许的

DeepThaw v1.6

DeepThaw v1.6
Currently, this tool supports unfreezing Deep Freeze on Windows 7/8.x/10/11 64‑bit systems.
Note: The file “DeepThaw_Kernel.sys” included in the archive is a dependency of this tool; without it, the tool will not run. You must ensure that “DeepThaw.exe” and “DeepThaw_Kernel.sys“ are placed in the same directory and that their filenames are not changed, otherwise the tool will fail to operate.

Strongly recommended when using Force Mode:
Restart your system once before running this tool, to minimize any interference from other programs with the file system.
Place the tool on a path that is not frozen (e.g., a USB drive), and then execute it.

Additionally, to ensure the driver loads properly, the DeepThaw_Kernel.sys file included in this tool is signed with an expired certificate. Therefore, it may be flagged by antivirus software (especially Windows Defender) as a false positive.

Disclaimer: This tool is intended for research and learning purposes only. Do not use it for any illegal activities. The author shall not be held responsible for any consequences arising from illegal use of this tool.

Changelog:
1.Fixed an issue where the frozen status detection for the Workstation version displayed incorrectly.
2.In Normal Mode, version detection has been further refined (more granular).
3.Fixed a potential misdetection between the Workstation and Standard versions.
4.Updated inappropriate labels/prompts in the UI.
5.Added support for Windows 7 and Windows 8.x 64-bit editions.

Note: Please download the corresponding tool according to the operating system version you are using; otherwise, the tool will not work.
For Example:
If you are using Windows 10/11 64-bit, please download DeepThaw_v1.6_x64_ForWin10AndGreater.zip.
If you are using Windows 7/8.x 64-bit, please download DeepThaw_v1.6_x64_ForWin7.8.x.zip.

本工具目前支持解除DeepFreeze在Windows 7/8.x/10/11 64位系统上的冻结
注意：压缩包中的"DeepThaw_Kernel.sys"是本工具的依赖，没有它工具将无法运行。你必须确保“DeepThaw.exe”与“DeepThaw_Kernel.sys”两个文件在同一目录下，且不能改名，否则工具无法运行

强烈建议在使用强制模式时：
1.运行本工具之前先重启一遍系统，以最大限度排除其他程序对文件系统的干扰
2.将本工具放置在一个没有被冻结的路径（例如U盘），再运行

另外，为了正常加载驱动，本工具的“DeepThaw_Kernel.sys”使用了过期的签名进行签名，因此可能会被杀毒软件（点名Windows Defender）误报

声明：本工具仅作研究和学习使用，切勿用于非法用途。若因用于非法用途而造成损失，一切后果与本工具作者无关

更新日志：
1.修复了检测Workstation版本冻结状态时候显示错误的问题
2.正常模式下，版本检测更加的细化
3.修复了Workstation版和Standard版之间可能检测错误的问题
4.对UI中不恰当的标语进行了更新
5.添加了对Windows 7和Windows 8.x 64位的支持

注意：请按照你使用的操作系统版本下载对应的工具，否则工具无法奏效
例如：如果你使用的系统是Windows 10/11 64位系统，请下载“DeepThaw_v1.6_x64_ForWin10AndGreater.zip”
如果你使用的系统是Windows 7/8.x 64位系统，请下载“DeepThaw_v1.6_x64_ForWin7.8.x.zip”

DeepThaw v1.4

DeepThaw v1.4
Currently, this tool only supports unfreezing Deep Freeze on Windows 10/11 64‑bit systems.
Note: The file “DeepThaw_Kernel.sys” included in the archive is a dependency of this tool; without it, the tool will not run. You must ensure that “DeepThaw.exe” and “DeepThaw_Kernel.sys“ are placed in the same directory and that their filenames are not changed, otherwise the tool will fail to operate.

Strongly recommended when using Force Mode:
Restart your system once before running this tool, to minimize any interference from other programs with the file system.
Place the tool on a path that is not frozen (e.g., a USB drive), and then execute it.

Additionally, to ensure the driver loads properly, the DeepThaw_Kernel.sys file included in this tool is signed with an expired certificate. Therefore, it may be flagged by antivirus software (especially Windows Defender) as a false positive.

Disclaimer: This tool is intended for research and learning purposes only. Do not use it for any illegal activities. The author shall not be held responsible for any consequences arising from illegal use of this tool.

Changelog:
1.Updated Normal Mode (supporting version ranges that are not supported by Deep Freeze Password Viewer Meltdown).
2.Updated some Chinese text.
3.Changed the method used in v1.3 to Force Mode.

该版本已经过时，请到https://github.com/TimBlack422/DeepThaw/releases 下载最新版

本工具目前只支持解除DeepFreeze在Windows 10/11 64位系统上的冻结
注意：压缩包中的"DeepThaw_Kernel.sys"是本工具的依赖，没有它工具将无法运行。你必须确保“DeepThaw.exe”与“DeepThaw_Kernel.sys”两个文件在同一目录下，且不能改名，否则工具无法运行

强烈建议在使用强制模式时：
1.运行本工具之前先重启一遍系统，以最大限度排除其他程序对文件系统的干扰
2.将本工具放置在一个没有被冻结的路径（例如U盘），再运行

另外，为了正常加载驱动，本工具的“DeepThaw_Kernel.sys”使用了过期的签名进行签名，因此可能会被杀毒软件（点名Windows Defender）误报

声明：本工具仅作研究和学习使用，切勿用于非法用途。若因用于非法用途而造成损失，一切后果与本工具作者无关

更新日志：
1.更新了正常模式(支持的版本范围为DeepFreeze密码查看器Meltdown所不支持的范围)
2.更新了部分中文
3.将v1.3所使用的方法更新为了强制模式

DeepThaw v1.3

DeepThaw v1.3
Currently, this tool only supports unfreezing Deep Freeze on Windows 10/11 64‑bit systems.
Note: The file “DeepThaw_Kernel.sys” included in the archive is a dependency of this tool; without it, the tool will not run. You must ensure that “DeepThaw.exe” and “DeepThaw_Kernel.sys“ are placed in the same directory and that their filenames are not changed, otherwise the tool will fail to operate.

Strong recommendations:
Restart your system once before running this tool, to minimize any interference from other programs with the file system.
Place the tool on a path that is not frozen (e.g., a USB drive), and then execute it.

Additionally, to ensure the driver loads properly, the DeepThaw_Kernel.sys file included in this tool is signed with an expired certificate. Therefore, it may be flagged by antivirus software (especially Windows Defender) as a false positive.

Disclaimer: This tool is intended for research and learning purposes only. Do not use it for any illegal activities. The author shall not be held responsible for any consequences arising from illegal use of this tool.

Changelog:
1.Used minifilter to restrict file read/write (implementing item 5 of the TO‑DO list).
2.In IOCTL_DISABLE_DEEPFRZ, adjusted the order of registry writes and hooking of the DeepFrz driver object.
3.Added OS version verification.

本工具目前只支持解除DeepFreeze在Windows 10/11 64位系统上的冻结
注意：压缩包中的"DeepThaw_Kernel.sys"是本工具的依赖，没有它工具将无法运行。你必须确保“DeepThaw.exe”与“DeepThaw_Kernel.sys”两个文件在同一目录下，且不能改名，否则工具无法运行
强烈建议：
1.运行本工具之前先重启一遍系统，以最大限度排除其他程序对文件系统的干扰
2.将本工具放置在一个没有被冻结的路径（例如U盘），再运行

另外，为了正常加载驱动，本工具的“DeepThaw_Kernel.sys”使用了过期的签名进行签名，因此可能会被杀毒软件（点名Windows Defender）误报

声明：本工具仅作研究和学习使用，切勿用于非法用途。若因用于非法用途而造成损失，一切后果与本工具作者无关

更新日志：
1.使用minifilter限制了文件的读写（实现了TO-DO list的第五点）
2.在IOCTL_DISABLE_DEEPFRZ中，调整了注册表写入以及挂钩DeepFrz驱动对象的顺序
3.加入了操作系统版本验证

DeepThaw_v1.2

DeepThaw v1.2
Currently, this tool only supports unfreezing Deep Freeze on Windows 10/11 64‑bit systems.
Note: The file “DeepThaw_Kernel.sys” included in the archive is a dependency of this tool; without it, the tool will not run. You must ensure that “DeepThaw.exe” and “DeepThaw_Kernel.sys“ are placed in the same directory and that their filenames are not changed, otherwise the tool will fail to operate.

Strong recommendations:
Restart your system once before running this tool, to minimize any interference from other programs with the file system.
Place the tool on a path that is not frozen (e.g., a USB drive), and then execute it.

Additionally, to ensure the driver loads properly, the DeepThaw_Kernel.sys file included in this tool is signed with an expired certificate. Therefore, it may be flagged by antivirus software (especially Windows Defender) as a false positive.

Disclaimer: This tool is intended for research and learning purposes only. Do not use it for any illegal activities. The author shall not be held responsible for any consequences arising from illegal use of this tool.

Changelog:
By modifying the dispatching logic of the IRP Dispatcher, we have improved the tool's stability in certain complex environments.

本工具目前只支持解除DeepFreeze在Windows 10/11 64位系统上的冻结
注意：压缩包中的"DeepThaw_Kernel.sys"是本工具的依赖，没有它工具将无法运行。你必须确保“DeepThaw.exe”与“DeepThaw_Kernel.sys”两个文件在同一目录下，且不能改名，否则工具无法运行
强烈建议：
1.运行本工具之前先重启一遍系统，以最大限度排除其他程序对文件系统的干扰
2.将本工具放置在一个没有被冻结的路径（例如U盘），再运行

另外，为了正常加载驱动，本工具的“DeepThaw_Kernel.sys”使用了过期的签名进行签名，因此可能会被杀毒软件（点名Windows Defender）误报

声明：本工具仅作研究和学习使用，切勿用于非法用途。若因用于非法用途而造成损失，一切后果与本工具作者无关

更新日志：
通过修改IRP Dispatcher的分发逻辑，增强了工具在某些复杂环境下的稳定性

DeepThaw v1.1

DeepThaw v1.1
Currently, this tool only supports unfreezing Deep Freeze on Windows 10/11 64‑bit systems.
Note: The file “DeepThaw_Kernel.sys” included in the archive is a dependency of this tool; without it, the tool will not run. You must ensure that “DeepThaw.exe” and “DeepThaw_Kernel.sys“ are placed in the same directory and that their filenames are not changed, otherwise the tool will fail to operate.

Strong recommendations:
Restart your system once before running this tool, to minimize any interference from other programs with the file system.
Place the tool on a path that is not frozen (e.g., a USB drive), and then execute it.

Additionally, to ensure the driver loads properly, the DeepThaw_Kernel.sys file included in this tool is signed with an expired certificate. Therefore, it may be flagged by antivirus software (especially Windows Defender) as a false positive.

Disclaimer: This tool is intended for research and learning purposes only. Do not use it for any illegal activities. The author shall not be held responsible for any consequences arising from illegal use of this tool.

Changelog:
Enhanced the stability of the tool in complex environments.

本工具目前只支持解除DeepFreeze在Windows 10/11 64位系统上的冻结
注意：压缩包中的"DeepThaw_Kernel.sys"是本工具的依赖，没有它工具将无法运行。你必须确保“DeepThaw.exe”与“DeepThaw_Kernel.sys”两个文件在同一目录下，且不能改名，否则工具无法运行
强烈建议：
1.运行本工具之前先重启一遍系统，以最大限度排除其他程序对文件系统的干扰
2.将本工具放置在一个没有被冻结的路径（例如U盘），再运行

另外，为了正常加载驱动，本工具的“DeepThaw_Kernel.sys”使用了过期的签名进行签名，因此可能会被杀毒软件（点名Windows Defender）误报

声明：本工具仅作研究和学习使用，切勿用于非法用途。若因用于非法用途而造成损失，一切后果与本工具作者无关

更新日志：
增强了工具在复杂环境下的稳定性

DeepThaw v1.0

DeepThaw v1.0

Currently, this tool only supports unfreezing Deep Freeze on Windows 10/11 64‑bit systems.
Note: The file “DeepThaw_Kernel.sys” included in the archive is a dependency of this tool; without it, the tool will not run. You must ensure that “DeepThaw.exe” and “DeepThaw_Kernel.sys“ are placed in the same directory and that their filenames are not changed, otherwise the tool will fail to operate.

Strong recommendations:
Restart your system once before running this tool, to minimize any interference from other programs with the file system.
Place the tool on a path that is not frozen (e.g., a USB drive), and then execute it.

Additionally, to ensure the driver loads properly, the DeepThaw_Kernel.sys file included in this tool is signed with an expired certificate. Therefore, it may be flagged by antivirus software (especially Windows Defender) as a false positive.

Disclaimer: This tool is intended for research and learning purposes only. Do not use it for any illegal activities. The author shall not be held responsible for any consequences arising from illegal use of this tool.

本工具目前只支持解除DeepFreeze在Windows 10/11 64位系统上的冻结
注意：压缩包中的"DeepThaw_Kernel.sys"是本工具的依赖，没有它工具将无法运行。你必须确保“DeepThaw.exe”与“DeepThaw_Kernel.sys”两个文件在同一目录下，且不能改名，否则工具无法运行
强烈建议：
1.运行本工具之前先重启一遍系统，以最大限度排除其他程序对文件系统的干扰
2.将本工具放置在一个没有被冻结的路径（例如U盘），再运行

另外，为了正常加载驱动，本工具的“DeepThaw_Kernel.sys”使用了过期的签名进行签名，因此可能会被杀毒软件（点名Windows Defender）误报

声明：本工具仅作研究和学习使用，切勿用于非法用途。若因用于非法用途而造成损失，一切后果与本工具作者无关