« Posts under Think

TracemasterVue Simple Client Install

Have you ever wanted to simply install the TracemasterVue client to a system easily without all the hassle of downloading the app via the URL?  Well, if the answer is Yes then here are the instructions to accomplish it. I have tested this with version C.03.01.02.

This is purely informational, but it does work and is currently working in the environment I support.

1)  Install the required .NET components for the TracemasterVue client.

2) Install Adobe Reader Version 8 or 10. These are the only 2 versions that are supported by the client.

3) Copy the \\<TRACEMASTER>\C$\TracemasterVue\Bin folder to your local client.  Let’s say C:\Program Files\TMVueClient

4) Register the PDFDocScout.dll.

  • Open an Administrator Command Prompt
  • Navigate to C:\Program Files\TMVueClient
  • regsvr32 PDFDocScout.dll

5) Modify the EMSClientapp.exe.config

  • Notepad C:\Program Files\TMVueClient\EMSClientApp.exe.config
  • Locate a line that starts with <add key=”ServerIP” value=”xxx.xxx.xxx.xxx” />
  • Modify the line and replace the xxx.xxx.xxx.xxx with the IP address of your TraceMasterVue Server.  You can use the Full Qualified Domain Name instead of the IP.
  • Again, search for a line that starts with <add key=”ServerIP” value=”xxx.xxx.xxx.xxx” />
  • Again, modify the line and replace the xxx.xxx.xxx.xxx with the IP address of your TraceMasterVue Server.  You can use the Full Qualified Domain Name instead of the IP.
  • Save the File.

6) Create a shortcut on the “All Users” desktop to launch C:\Program Files\TMVue Client\EMSClientApp.exe.

These instructions will work for publishing the TMVue Client application in Citrix as well.  For Step 6 you just need to publish the EMSClientApp.exe located in the C:\Program Files\TMVue Client folder.

 

Unetixs DICOM MultiLab – DICOM Server on a stick

Have you ever wanted to created DICOM files with your Unetixs DICOM MultiLab without transmitting them to a networked DICOM server?

Yes! This is the preferred workflow for our vascular technologist that use the Unetixs device in the field on a daily basis. By providing a DICOM server and storage on an encrypted USB device, the technologists do not have to lug the Unetixs device into the medical center to transfer their DICOM studies. All they need is their encrypted USB device with a simple DICOM server configured to also be a storage device.

Background
I attempted to find out how the Unetixs MultiLab was creating DICOM files. Well it appears that the DICOM files are built on the fly and are not stored anywhere on the device. I used tools like Sysinternals Filemon to monitor the files being accessed and created during some testing and transmission. I was unable to locate a DICOM based file, so I am assuming that the DICOM file is being generated (or a DICOM wrapper is being applied) in memory. Since I was unable to write a script to pull any DICOM files off the Unetixs device I decided to look for DICOM servers that can run in a small footprint. I found a nice utility, dcmqrscp.exe, which is included in the DICOM Toolkit, DCMTK 3.6.0 for Windows (32 bit), found at http://dcmtk.org/dcmtk.php.en.

After testing the theory that I could run this environment on a USB device I quickly started to write a wrapper around dcmqrscp.exe to provide all of the necessary parameters and environment to successfully run this server from a USB device.

Environment
I created a folder on the USB device called DCMUNET under that folder there are 2 folders a BIN and a DATA file. The Bin folder contains the executable, script, template, and configuration file required to run the script from the USB device. The DATA folder contains the transferred DICOM images.

The BIN folder consists of the following:
dcmqrscp.tpl – Is a dcmqrscp.exe template configuration file that will be used to create a dcmqrscp.cfg file each time the USBDICM.VBS is executed.

USBDICM.VBS – The main wrapper to start and stop the DICOM server. Once the script runs, it checks to see if dcmqrscp.exe is running. If it is not running, the script reads the dcmqrscp.tpl file in to memory, replaces known tags with correct known run time values, and generates a dcmqrscp.cfg. Once the dcmqrscp.cfg file is generated the dcmqrscp.exe is executed.  If the executable is running, the process is killed and the user is allowed to eject the USB at this time.

dcmqrscp.exe – Is the DICOM Server executable from the DICOM Toolkit, DCMTK 3.6.0 for Windows (32 bit).

dcmqrscp.cfg – Configuration files required to successfully run the dcmqrscp.exe from the USB device. This file is generated every time USBDICM.VBS is executed since the USB drive letter can change between USB devices and Unetixs devices.

In addition, in the root of the USB device is a batch script that can be double clicked on to make the whole experience better for the vascular technologist by giving them an easy way to start/stop the server. This script is called @USB DICOM Server.bat.

The ZIP archive below contains the files required to run your DICOM server. The dcmqrscp.exe is not included in the archive; it can be obtained at http://dcmtk.org/dcmtk.php.en.

ZIP archive: DICOM Server on a Stick

LANDesk SoftMon Monitoring Information

LANDesk Softmon.exe monitors application execution and logs usage information in the registry. The following information is logged to the registry: Current Duration, Current User, First Started, Last Duration, Last Started, Total Duration, and Total Runs. This information is useful to determine application usage and location of said applications.

The monitor information can be found in the following registry key:
[HKEY_LOCAL_MACHINE\SOFTWARE\LANDesk\ManagementSuite\WinClient\SoftwareMonitoring\MonitorLog\]

Each log entry receives a new key, an example would be C:/Program Files/Microsoft Office/OFFICE11/EXCEL.EXE.

Under this application name key you may see the following registry values, not all values are available:
Current Duration
Current User
First Started
Last Duration
Last Started
Total Duration
Total Runs

Unfortunately, if an application is no longer available the usage information still lives on in the registry. This may give you inaccurate usage information if you solely rely on this data. I would recommend checking to see if the application still exists in the path specified by the key to determine if the application is still available on the PC.

How do you determine Last Duration?
1) Extract the Last Duration REG_BINARY value in Hex.
Example: 20 F2 96 1E A6 00 00 00
2) Open Windows Calculator in Scientific mode and choose Hex and Qword radio buttons
3) Enter the Hex from right to left into the calculator:
00 00 00 a6 1E 96 F2 20
4) Click the Dec radio to switch the decimal.
5) Divide the decimal number by 10,000,000
You will now have the Last Duration in seconds. In this example the result will be 71347.778 seconds.

How do you determine Total Duration?
1) Extract the Total Duration REG_BINARY value in Hex.
Example: 10 B1 AD D9 CB 09 00 00
2) Open Windows Calculator in Scientific mode and choose Hex and Qword radio buttons
3) Enter the Hex from right to left into the calculator:
00 00 09 CB D9 AD B1 10
4) Click the Dec radio to switch the decimal.
5) Divide the decimal number by 10,000,000
You will now have the Total Duration in seconds. In this example the result will be 1077113.505 seconds.

How do you determine Current Duration?
1) Extract the Current Duration REG_BINARY value in Hex.
Example: 80 97 6A 76 2F 00 00 00
2) Open Windows Calculator in Scientific mode and choose Hex and Qword radio buttons
3) Enter the Hex from right to left into the calculator:
00 00 00 2F 76 6A 97 80
4) Click the Dec radio to switch the decimal.
5) Divide the decimal number by 10,000,000
You will now have the Current Duration in seconds. In this example the result will be 20385.016 seconds.

How do you determine Last Started?
1) Extract the Last Started REG_BINARY value in Hex.
Example: 40 4D C8 A0 55 45 CC 01
2) Open Windows Calculator in Scientific mode and choose Hex and Qword radio buttons
3) Enter the Hex from right to left into the calculator:
01 CC 45 55 A0 C8 4D 40
4) Click the Dec radio to switch the decimal.
5) Use this decimal number in a Filetime converter utility to get the date and time.
I found a useful converter at: http://www.silisoftware.com/tools/date.php
The input format is filetime and key the decimal into the date field.
6) Click convert and you have the Last Started date.

How do you determine First Started?
1) Extract the First Started REG_BINARY value in Hex.
Example: 50 0D CE 02 00 09 CC 01
2) Open Windows Calculator in Scientific mode and choose Hex and Qword radio buttons
3) Enter the Hex from right to left into the calculator:
01 CC 09 00 02 CE 0D 50
4) Click the Dec radio to switch the decimal.
5) Use this decimal number in a Filetime converter utility to get the date and time.
I found a useful converter at: http://www.silisoftware.com/tools/date.php
The input format is filetime and key the decimal into the date field.
6) Click convert and you have the First Started date.

How do you determine the Current User?
1) Extract the Current User REG_SZ value in a string value.

How do you determine Total Runs?
1) Extract the Total Runs REG_DWORD in a decimal value to get the total number of executions.

You may be asking why I would go through so much trouble to determine the usage of an application on a computer. Well, I come from the background that if you can keep a computer clean that it will perform the best. By using this information, I can determine if the application needs to be reinstalled on a replacement PC or if it needs to be uninstalled on a current PC. By using this information you may find how and when a user uses an application.

** Note this information is provide for educational purposes only. **

Philips Zymed Site Encryption

I am in the process of upgrading the Philips Zymed Holter system including a new Central Link. I have a list of site codes, user id, and passwords for all my locations, but since I was not the originator of the document and could not verify the passwords were entered correctly in the spreadsheet I set out to decrypt the password and site information. The Philips Zymed Central Link software stores the site information in the registry for version 2.8 and in a configuration files under “all users” on version 2.9.

On my version 2.8 system I found the key located in the registry located under the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Zymed\. I exported the entire Zymed sub key structure. You will see a value labeled RemoteConfig under HKEY_LOCAL_MACHINE\SOFTWARE\Zymed\Zybit Central\0.1\Configure. You will see a hex encoded string. Using my 17 years of experience, I started by looking for a pattern in the hex encoded string and found a pattern.

I started to decipher the encryption by adding a new site to my site list and providing a known key sequence to the description and password. I entered the entire alphabet in uppercase and lowercase. I noted the offset in the letter that was entered and the encoded hex value that it produced. I noted all of the values entered and went a head with replacing all of the values in the registry export with the known values. After going through a few iterations of the offsets you start to see the site code, descriptions, and password being revealed.

After more evaluation the encoding algorithm is simply an offset within a byte. To decrypt a value you simply need to know a little subtraction and hex to ASCII conversion. The base of the encryption starts with 255 (FF) as it’s offset. You take the a sample value like BE and subtract it from FF. So it is FF-BE=41 HEX or 65 ASCII. This is the value A.

Needless to say, I was able to successfully verify my spreadsheet full of site information before I migrated to the new server.

You may be asking yourself why didn’t you just export and re-import the registry? It is because version 2.9 does not store the RemoteConfig in the registry anymore.

** Note this information is provide for educational purposes only. **