How the PE registry modifies

Sometimes we need to add some information to the PE registry, how to add it? Let me tell you.

Use Regsnap to trace and analyze the contents of the software to be added to the registry in a standard Windows environment, and then export the registry modification entries and overwrite the batch processing files in the directory where the software resides.

For example, after tracking the registration information of ACDSEE This program, keep it in:

X:programs graphic Image Acdseeacdsee.cmd

It is recommended that you save the software you want to add by referencing the X:programs graphics image ACDSee This program, in the same way that the main assembly is stored in the same directory (including the icon files that may be used) for later maintenance of the changes. and refer to the ACDSEE. CMD This registration batch format and style creates your own application's registration batch file.

Note: To ensure that the PE environment and the standard Windows environment invoke these scripts can be run, so we want to detect the actual path of the program or the letter.

When you create a batch, the first two lines are the variables that are used to detect the current directory location, and which you want to keep and refer to:

SET var0=%0

for/f "delims="%%i in ("%var0%") do Set op=%%~dpi

The effect of the above two lines is to use the%op% as the partition number to use in the add-in path in subsequent batches by detecting the path where the current batch is located to get the disk character of the partition. %op% is related only to the disk you are in, not to the path, so you have to add a detailed path to the%op% after the letter variable is in your batch. Like what:

REG ADD hkcracdc_jifshellacdseeencommand/ve/t reg_sz/d ""%op%acdsee. EXE "/V"/f>nul

The above command adds a registration information to the registry.

Note: When Set op=%%~dpi in the path detection command above, the variable%op% no longer need to add "". Like the%op%acdsee above. Exe.

You can also use Set op=%%~di, which, compared to the above, simply changes the ~dpi to ~di, and the variable is not extended to the current path, but only to the current letter. So if you use this, you have to add the full path to the program after the variable. Like what:

%op%programstotalcmdruntc. Exe