Archaeology | Hexacorn

Back in a day (90s/2000s), if you wanted an email, there were lots of (free) email providers available. With a minimum of effort one could sign up to as many free email services available at that time as possible. No mobile phone number required, no alternative email required, no geofencing/geoguarding. You just had to put your details in hoping the account name you chose has not been used before by someone else, and then you were set. I think my oldest ‘free’ surviving email account is around 20 years old now. I rarely use it, but it’s nice to have it.

Today, email ecosystem is very centralized: the market is basically shared by Google, Microsoft, and Apple (GMA), and then waaaay further is some legacy mail infra from the likes of Yahoo, AOL, plus, there is the more modern email infra available and ‘sponsored’ by some mobile network providers.

I decided to comb email data dumps to see if there is more to see. As a result, I came up with this long list of email domains (sometimes even pointing to providers) that still operate today, and the list is sorted by a kinda … popularity score. Don’t ask how I did that — the ugly truth is that there is no real science behind it and it’s probably sorted the wrong way. Please assume so while reviewing the list below.

What’s the purpose of generating such list today?

Curiosity, for one. We are so used to so many people using one of the GMA emails that sometimes it’s funny and refreshing to see someone still running their email BAU from AOL or Lycos (or even Hotmail, even if it is within the GMA space). Also, the GMA bubble is very limiting. Yes, come on. There are still many other email providers out there today and you don’t have to limit yourself to using infra and choices offered by one of these three amigos only…

History, is the second reason. Combing through these domains one can see how many of the ‘oldies’ survived to this date. I mentioned AOL, Lycos, but there is also Rambler, Libero, Rocketmail, 163, Tiscali, USA, Docomo, GMX, ONET, Netvigator, Telus, Sina, Wanadoo, Eircom, and so on and so forth. Whoaw… It’s actually impressive. They are still on, and many of them are not only on, but very alive and kicking ! There really is a strong need for more providers operating in every single space that GMA operate in to simply offer an alternative. Kudos to the brands that are fighting this monopoly, even if for selfish purposes!

Thirdly, the set includes typos, and I love these — many people incorrectly spelling ‘gmail’ as ‘gmai’ or ‘gamil’, ‘yahoo’ as ‘yaho’, ‘hotmail’ as ‘hotmai’- you can’t make this stuff up.

Here’s the list of domains I have collected:

gmail.com
yahoo.com
hotmail.com
aol.com
t-online.de
hotmail.fr
mail.ru
hotmail.co.uk
orange.fr
outlook.com
web.de
yahoo.fr
wanadoo.fr
live.com
gmx.de
yahoo.co.uk
comcast.net
yandex.ru
icloud.com
msn.com
att.net
alice.it
interia.pl
rediffmail.com
seznam.cz
live.fr
free.fr
arcor.de
ymail.com
qq.com
freenet.de
yahoo.com.br
wp.pl
sbcglobal.net
rambler.ru
hotmail.it
naver.com
libero.it
yahoo.in
live.co.uk
qatar.net.qa
hotmail.de
yahoo.co.jp
yahoo.de
onet.pl
terra.com.br
me.com
abv.bg
cox.net
rocketmail.com
163.com
hotmail.es
googlemail.com
interia.eu
sfr.fr
o2.pl
yahoo.co.id
yahoo.com.tw
ezweb.ne.jp
GMAIL.COM
verizon.net
aim.com
ig.com.br
eyou.com
yahoo.ca
bk.ru
yahoo.co.in
tiscali.it
usa.com
mail.com
op.pl
yahoo.it
btinternet.com
yahoo.es
bellsouth.net
outlook.fr
online.fr
bol.com.br
hanmail.net
list.ru
docomo.ne.jp
gmx.net
neuf.fr
charter.net
ziggo.nl
mac.com
live.it
inbox.ru
tiscali.co.uk
onet.eu
laposte.net
windowslive.com
live.ca
126.com
live.de
sina.com
aon.at
yahoo.com.ar
ntlworld.com
otenet.gr
freemail.hu
yahoo.com.mx
ticsali.it
uol.com.br
live.com.mx
21cn.com
email.cz
optonline.net
gmx.at
live.nl
nate.com
numericable.fr
shaw.ca
poczta.fm
tiscali.cz
hot.ee
outlook.es
yahoo.com.au
talktalk.net
yahoo.com.ph
aliceadsl.fr
Gmail.com
qip.ru
virgilio.it
sky.com
tin.it
earthlink.net
home.nl
juno.com
gazeta.pl
HOTMAIL.COM
gmx.com
yahoo.com.vn
softbank.ne.jp
suddenlink.net
tele2.nl
vp.pl
i.ua
hotmail.ca
ukr.net
blueyonder.co.uk
YAHOO.COM
live.com.au
bigpond.com
ya.com
hj.com
yahoo.com.hk
online.de
telefonica.net
email.com
yahoo.gr
hotmail.co
haijiao.com
netzero.com
bbox.fr
centrum.cz
telenet.be
citromail.hu
netzero.net
windstream.net
voila.fr
mail.dk
poczta.onet.pl
netvigator.com
taalim.ma
tlen.pl
yopmail.com
sympatico.ca
yeah.net
rogers.com
inbox.lv
bezeqint.net
noos.fr
daum.net
ya.ru
hotmail.co.jp
club-internet.fr
tim.it
hotmail.com.br
protonmail.com
mynet.com
gamil.com
outlook.de
yahoo.com.sg
km.ru
live.com.ar
hotmail.com.ar
homechoice.co.uk
temporary-mail.net
yandex.com
besttempmail.com
live.se
bigmir.net
sapo.pt
optusnet.com.au
videotron.ca
ig.com
upcmail.nl
yahoo.com.my
email.it
gmx.ch
email.ua
bluewin.ch
outlook.it
gmai.com
hotmail.ru
gmx.fr
pec.it
uol.com
yahoo.com.cn
post.cz
embarqmail.com
aliyun.com
outlook.com.br
ibest.com.br
mail.bg
virginmedia.com
cebridge.net
live.com.pt
yandex.ua
live.dk
Hotmail.com
roadrunner.com
facebook.com
walla.com
chasefreedomactivate.com
a1.net
gmail.com.br
sion.com
nexgo.de
avtoto.ru
wp.eu
hawaiiantel.net
mail.ua
azet.sk
tut.by
meta.ua
netscape.net
lycos.de
camperu.com.pe
skynet.be
telus.net
live.be
homecall.co.uk
tom.com
globo.com
live.cl
Yahoo.com
chello.nl
mannbdinfo.org
netvision.net.il
centrum.sk
ewetel.net
cogeco.ca
cdtm.de
mchsi.com
epost.de
hotmail.nl
hotmail.co.th
outlook.sa
gmail.co
hotmail.com.tr
nifty.com
dsl.pipex.com
buziaczek.pl
kakao.com
nifty.ne.jp
oi.com.br
portugalmail.pt
kaiqiu.cc
hotmail.se
guruku.id
hotmail.be
bigpond.net.au
AOL.COM
ua.fm
osnanet.de
frontier.com
intermedic.org
aol.co.uk
sina.cn
aruba.it
casema.nl
sina.com.cn
wanadoo.es
t-online.hu
telia.com
e-mail.ua
prodigy.net.mx
eircom.net
online.no
dodo.com.au
yahoo.ie
centurylink.net
int.pl
live.no
fastwebnet.it
atlas.cz
sunrise.ch
tampabay.rr.com
dr.com
xtra.co.nz
spoko.pl
cfl.rr.com
excite.com
ultimails.com
fibertel.com.ar
gcdetectivefree.com
montevideo.com.uy
volny.cz
inwind.it
lycos.com
ro.ru
webmail.co.za
kabelmail.de
q.com
mailinator.com
gmail.ru
virgin.net
gmil.com
live.jp
freemail.ru
btopenworld.com
popmailset.org
worldonline.cz
orange.es
insightbb.com
quicknet.nl
msa.hinet.net
yaho.de
rooseveltmail.com
autograf.pl
hotmail.cl
gmail.co.uk
gci.net
aol.de
iinet.net.au
hughes.net
mindspring.com
fkksol.com
lenta.ru
frontiernet.net
onlinehome.de
hotmail.gr
zoominternet.net
azmailz.com
poste.it
telkomsa.net
gmail.con
outlook.pt
sify.com
teletu.it
libertysurf.fr
kefgames.net
topnet.tn
autorambler.ru
pacbell.net
poczta.onet.eu
emailn.de
myfairpoint.net
sasktel.net
progiftstore.org
iol.ie
yahoo.ro
arnet.com.ar
modulonet.fr
btconnect.com
2980.com
planet.nl
y7mail.com
adelphia.net
singnet.com.sg
ybb.ne.jp
cs.com
hotmail.co.nz
cegetel.net
r7.com
e1.ru
nc.rr.com
yahoo.se
peoplepc.com
meantinc.com
neostrada.pl
uralweb.ru
lineone.net
gfgfgf.org
onetel.com
glaube.de
bex.net
quipo.it
websitebod.com
ptd.net
tpg.com.au
vodafone.de
sohu.com
cableone.net
outlook.co.uk
kpnmail.nl
hotmail.no
gmail.Com
admin.com
myrambler.ru
zoznam.sk
deped.gov.ph
fuse.net
gmial.com
protonmail.co.uk
gmal.com
centurytel.net
mybluelight.com
rochester.rr.com
ovi.com
twc.com
jazzfree.com
amorki.pl
theparryscope.com
fsmail.net
westmailer.com
hi-ho.ne.jp
wowway.com
myspace.com
hotmail.com.au
go2.pl
yahoo.co.nz
konto.pl
ewe.net
1337.no
net.hr
ameritech.net
xmailxz.com
hotil.it
tds.net
rcn.com
oranga.fr
swbell.net
yahoo.dk
co.uk
live.ie
varsat.net
talk21.com
mail.de
gmail.fr
example.com
carolina.rr.com
iCloud.com
bredband.net
hetnet.nl
mweb.co.za
pep4teens.de
bnr.ca
gmail.hu
yahoo.com.tr
9online.fr
aol.it
aol.fr
eresmas.com
mailref.net
andreagilardi.me
yahoo.co.kr
iprimus.com.au
optimum.net
gmx.co.uk
ono.com
websitebooty.com
pandora.be
walla.co.il
inbox.com
luukku.com
tiscali.fr
vetorial.net
ertemaik.com
movistar.es
usa.net
nycap.rr.com
www.facebook.com
skole.hr
yahoo.no
powerencry.com
brtph7ee.bnr.ca
nayobok.net
outlook.co.th
proton.me
internode.on.net
pchome.com.tw
eastlink.ca
pochta.ru
triad.rr.com
ligcorp.com
hotmail.dk
hotmail.ch
foxmail.com
localnet.com
bell.net
gamail.com
seed.net.tw
woh.rr.com
suiyoutalkblog.com
xs4all.nl
westnet.com.au
gmx.es
vip.qq.com
wo.cz
hotmai.com
blic.net
gmail.ca
mega.privacy.android.app
twcny.rr.com
ramireschat.com
indiatimes.com
gmail.net
o2.co.uk
asdfmailk.com
yahoo.net
Outlook.com
fteenet.de
chello.at
redinbox.org
onvol.net
austin.rr.com
vodafone.it
alice.de
google.com
OUTLOOK.COM
columbus.rr.com
live.at
atlanticbb.net
outlook.jp
tele2.fr
neo.rr.com
gmaill.com
rediff.com
emirates.net.ae
outlook.com.ar
myway.com
www.roblox.com
cinci.rr.com
m.dogspot.in
jtbank.ch
hotmails.com
ok.de
adinet.com.uy
QQ.com
cometoclmall.com
outlook.be
paran.com
upn.pe
wo.com.cn
zonnet.nl
sc.rr.com
o2online.de
hotmail.net
alice-dsl.net
bmersb17.bnr.ca
MAIL.RU
yahoo.pl
globomail.com
raj.freeuk.com
kc.rr.com
lantic.net
terra.es
zoho.com
supanet.com
mail.goo.ne.jp
cheapnet.it
vfemail.net
narod.ru
senati.pe
caiway.nl
vipmail.hu
hotmail.jp
netcabo.pt
mnet-online.de
snet.net
live.cn
vodamail.co.za

Over the years I have made a lot of attempts to systematically extract Windows API information from various sources, but primarily, of course, from Microsoft help documentation available at different times, in different forms and file formats. If you need to ask… I really needed an ‘actionable’ dump of these for my API monitor, and I also wanted to have it all available for quick & dirty reference, for both coding and reversing purposes. Plus, as I will explain later, for other purposes. Unsurprisingly, this strange journey ended up being closely aligned with the never-ending changes to Microsoft help system, and it naturally ended up with me fighting a ‘lost by default’, bitter battle against the odds, for many years…

~20 years ago win32.hlp was THE file you needed and wanted. It included descriptions of many Windows API functions and was a gold mine when it came to understanding the myriads of parameters, return values, and context required to use most of these popular Windows APIs properly. Interestingly, one could decompile the content of that .hlp file into a super large RTF file. The result was a bit difficult to parse, but lots of textual data could be made accessible this way, kinda programmatically, and kinda easily.

HLP files were the WinHelp files. Microsoft Help system 1.0.

Next, if I remember correctly, some of the Microsoft DDKs started including .chm files. One could decompile these to get access to raw, yet kinda uniformly formatted HTML files, and these could be parsed, as well. I don’t recall this format really taking off too much though but I may be mistaken.

CHM files were the Microsoft Compiled HTML Help files. Microsoft Help system 1.x.

Then came the HxS files. I loved them very much, because these were JUICY. Decompiling them was not difficult, and as a result you would get lots of very nicely formatted data files for parsing. I think it was also the first time XML was used for windows API help, but again, I may be mistaken. I don’t have many of my working files left from these times, sadly.

HxS files were the Microsoft Help 2 files. Microsoft Help system 2.0.

And then the Help files migrated one more time. This time to a local, online system…

http://127.0.0.1:47873/help/<version>/ms.help...

The address above was where all the juice was stored. By sending a set of additional requests one could enumerate all the pages, one by one, and many of these covered functions, methods, structures, etc… These could be then saved and parsed. Interestingly, while requesting all of these pages we were able to choose the format of the delivered pages, and XML was both a novelty at that time, and something we also wanted very much! That’s probably for the first time ever, the Windows API information was stored, and was made accessible in such consistent and parsable format to everyone who _knew_!

It was Microsoft Help Viewer aka Microsoft Help system 3.x.

Today API help is no longer that interesting (okay, it is a lie!), but thankfully, it is stored primarily online. Interestingly, after all the different formats from the past, it is now stored in a Markdown language format (*.md).

Now, the main reason I am writing about the history of help files is to bring your attention to msdocsviewer. This is a new IDA plugin written by Alexander Hanel. Once you install this plug-in, all you have to do is go to any Windows API referenced in a code you analyze in IDA and then press CTRL+SHIFT+Z. The panel with all the information about that ‘highlighted’ API will pop-up. You can dock that panel and then continue pressing CTRL+SHIFT+Z on other API functions to their see details as you go along. In my eyes, as of 2023, this is the best Windows API helper that has ever been written. Idascope was cool, Mandiant’s plug-in was cool, but now we have msdocsviewer and it’s TRULY COOL. It works like a charm and I highly recommend it.

I will end this post with a few data dumps.

List of APIs I extracted into a metadata between 2004-2007: 2004-2007_apis.zip.
List of APIs I extracted into a metadata in 2013: 2013_apis.zip.

You may think this is the end of the post, but it’s not. If you look at the file content of 2013_apis.zip/list_final8 you will notice one thing: not only I extracted function information that is typically available (a prototype), but I also tried to extract information about all the constants this or that particular function’s parameter or argument would refer to, hence f.ex. for CreateFile I would generate this information:

TITLE=CreateFile function
  FUN=CreateFile
    ARG=_In_      LPCTSTR lpFileName,
    ARG=_In_      DWORD dwDesiredAccess,
    ARG=_In_      DWORD dwShareMode,
    ARG=_In_opt_  LPSECURITY_ATTRIBUTES lpSecurityAttributes,
    ARG=_In_      DWORD dwCreationDisposition,
    ARG=_In_      DWORD dwFlagsAndAttributes,
    ARG=_In_opt_  HANDLE hTemplateFile
    RET=HANDLE WINAPI
      PAR=lpFileName  [in]
      PAR=dwDesiredAccess  [in]
      PAR=dwShareMode  [in]
      VALUES=
           VAL=0
           VAL=FILE_SHARE_DELETE
           VAL=FILE_SHARE_READ
           VAL=FILE_SHARE_WRITE
      PAR=lpSecurityAttributes  [in, optional]
      PAR=dwCreationDisposition  [in]
      VALUES=
           VAL=CREATE_ALWAYS
           VAL=CREATE_NEW
           VAL=OPEN_ALWAYS
           VAL=OPEN_EXISTING
           VAL=TRUNCATE_EXISTING
      PAR=dwFlagsAndAttributes  [in]
      PAR=hTemplateFile  [in, optional]
    LIB=Kernel32.lib
    DLL=Kernel32.dll
    HDR=FileAPI.h (include Windows.h); WinBase.h on Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP (include Windows.h)
    UNI=CreateFileW
    ANS=CreateFileA
    MINC=Windows XP
    MINS=Windows Server 2003

Do you see where it is heading?

Yes, I was writing all these parsers with one thing in my mind. If I can not only use this information to build a list of APIs, their arguments, their in/out properties, but ALSO reference constants they refer to, or expect, then I may be in a position to generate stubs for handling some of the hooked APIs in my sandbox that almost (with minor edits) can give me ‘string’ representations of immediate values, or boolean masks for most APIs!

And it worked! It was a HUGE helper at that time as I could just generate these stubs, edit them a bit, and within minutes I would be in a position to support yet another API w/o going through a painful process of analysing documentation of each API individually. And by ‘handling’ I mean adding code that was showing both decimal/hexadecimal values passed to, or returned by a function, but also showing their string equivalents, where applicable, as well. Of course I had to correct some of these automatically generated stubs, but it was far easier than doing everything from the scratch, for each and every API I wanted to hook.

And when I worked on my Frida monitor, I used the very same principle, hence some of the code covers constants pretty well. In my eyes, a good sandbox is the one that understands both arguments and result values well, and then present them to the user to better contextualize what is actually happening…

Hexacorn

Hexacorn

Category Archives: Archaeology

Email domains AD 2023

Hunting for Windows API prototypes and descriptions…