I wrote a small code that should replace the value in the registry, everything runs without errors, but the value in the registry does not change. The program started, executed and nothing happened ... Help me figure out what my mistake is ... Here is the program code:

#include "stdafx.h" #include <windows.h> #include <winuser.h> #include <iostream> #include <conio.h> int main(int argc, _TCHAR* argv[]) { LONG lResult; HKEY hKey; PCTSTR lpSubKey = TEXT("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"); lResult = RegOpenKeyEx(HKEY_LOCAL_MACHINE,lpSubKey,0,KEY_SET_VALUE,&hKey); if (lResult != ERROR_SUCCESS) { printf("Key not found.\n"); return FALSE; } PCTSTR lpName = TEXT("Shell"); PCTSTR lpValueEx = "vl.exe"; lResult = RegSetValueEx(hKey,lpName,0,REG_SZ,(LPBYTE)lpValueEx,(DWORD)(lstrlen(lpValueEx) + 1)*sizeof(TCHAR)); if (lResult != ERROR_SUCCESS) { printf("Function fails.\n"); return FALSE; } lResult = RegCloseKey(hKey); return 0; } И это Π½Π° Π²Ρ‹Π²ΠΎΠ΄Π΅ (Win32). Π—Π°Π³Ρ€ΡƒΠΆΠ΅Π½ΠΎ "C:\Windows\SysWOW64\ntdll.dll". НСвозмоТно Π½Π°ΠΉΡ‚ΠΈ ΠΈΠ»ΠΈ ΠΎΡ‚ΠΊΡ€Ρ‹Ρ‚ΡŒ PDB-Ρ„Π°ΠΉΠ». "a.exe" (Win32). Π—Π°Π³Ρ€ΡƒΠΆΠ΅Π½ΠΎ "C:\Windows\SysWOW64\kernel32.dll". НСвозмоТно Π½Π°ΠΉΡ‚ΠΈ ΠΈΠ»ΠΈ ΠΎΡ‚ΠΊΡ€Ρ‹Ρ‚ΡŒ PDB-Ρ„Π°ΠΉΠ». "a.exe" (Win32). Π—Π°Π³Ρ€ΡƒΠΆΠ΅Π½ΠΎ "C:\Windows\SysWOW64\KernelBase.dll". НСвозмоТно Π½Π°ΠΉΡ‚ΠΈ ΠΈΠ»ΠΈ ΠΎΡ‚ΠΊΡ€Ρ‹Ρ‚ΡŒ PDB-Ρ„Π°ΠΉΠ». "a.exe" (Win32). Π—Π°Π³Ρ€ΡƒΠΆΠ΅Π½ΠΎ "C:\Windows\SysWOW64\advapi32.dll". НСвозмоТно Π½Π°ΠΉΡ‚ΠΈ ΠΈΠ»ΠΈ ΠΎΡ‚ΠΊΡ€Ρ‹Ρ‚ΡŒ PDB-Ρ„Π°ΠΉΠ». "a.exe" (Win32). Π—Π°Π³Ρ€ΡƒΠΆΠ΅Π½ΠΎ "C:\Windows\SysWOW64\msvcrt.dll". НСвозмоТно Π½Π°ΠΉΡ‚ΠΈ ΠΈΠ»ΠΈ ΠΎΡ‚ΠΊΡ€Ρ‹Ρ‚ΡŒ PDB-Ρ„Π°ΠΉΠ». "a.exe" (Win32). Π—Π°Π³Ρ€ΡƒΠΆΠ΅Π½ΠΎ "C:\Windows\SysWOW64\sechost.dll". НСвозмоТно Π½Π°ΠΉΡ‚ΠΈ ΠΈΠ»ΠΈ ΠΎΡ‚ΠΊΡ€Ρ‹Ρ‚ΡŒ PDB-Ρ„Π°ΠΉΠ». "a.exe" (Win32). Π—Π°Π³Ρ€ΡƒΠΆΠ΅Π½ΠΎ "C:\Windows\SysWOW64\rpcrt4.dll". НСвозмоТно Π½Π°ΠΉΡ‚ΠΈ ΠΈΠ»ΠΈ ΠΎΡ‚ΠΊΡ€Ρ‹Ρ‚ΡŒ PDB-Ρ„Π°ΠΉΠ». "a.exe" (Win32). Π—Π°Π³Ρ€ΡƒΠΆΠ΅Π½ΠΎ "C:\Windows\SysWOW64\sspicli.dll". НСвозмоТно Π½Π°ΠΉΡ‚ΠΈ ΠΈΠ»ΠΈ ΠΎΡ‚ΠΊΡ€Ρ‹Ρ‚ΡŒ PDB-Ρ„Π°ΠΉΠ». "baner.exe" (Win32). Π—Π°Π³Ρ€ΡƒΠΆΠ΅Π½ΠΎ "C:\Windows\SysWOW64\cryptbase.dll". НСвозмоТно Π½Π°ΠΉΡ‚ΠΈ ΠΈΠ»ΠΈ ΠΎΡ‚ΠΊΡ€Ρ‹Ρ‚ΡŒ PDB-Ρ„Π°ΠΉΠ». "a.exe" (Win32). Π—Π°Π³Ρ€ΡƒΠΆΠ΅Π½ΠΎ "C:\Windows\SysWOW64\msvcp120d.dll". НСвозмоТно Π½Π°ΠΉΡ‚ΠΈ ΠΈΠ»ΠΈ ΠΎΡ‚ΠΊΡ€Ρ‹Ρ‚ΡŒ PDB-Ρ„Π°ΠΉΠ». "a.exe" (Win32). Π—Π°Π³Ρ€ΡƒΠΆΠ΅Π½ΠΎ "C:\Windows\SysWOW64\msvcr120d.dll". НСвозмоТно Π½Π°ΠΉΡ‚ΠΈ ΠΈΠ»ΠΈ ΠΎΡ‚ΠΊΡ€Ρ‹Ρ‚ΡŒ PDB-Ρ„Π°ΠΉΠ».

But I think it does not influence

  • What is the problem with your conclusion? Well, you do not have Microsoft pdb, so what? --- But to write to HKLM not from under the rue nobody will give you, with what rights do you run? - VladD 4:27
  • @VladD tried to run exe from the administrator, but again to no avail, or do I not understand correctly?) This topic is new to me, so I don’t know much, but really want to implement such a program. - Zine
  • one
    @LaKO: Hmm, you have 64-bit Windows, right? Then maybe you fell victim to WOW64 redirection: msdn.microsoft.com/en-us/library/windows/desktop/… - VladD
  • @VladD But it is possible, but I don’t know what to do, and the list provided by the link does not have my key ... - Zine
  • @VladD Thanks for the tip-off, searched the Internet, rummaged in the registry and found where to redirect, you just had to change the platform to 64 bit .... - Zine

2 answers 2

Syswow64

but the value in the registry does not change

Looking for the wrong place. You're from a 32-bit program trying to change the "64-bit" registry branch. Such changes are written to a special branch where all 32-bit applications are redirected. It is in it that one must look at the meaning. This can be done either by looking at the corresponding branch in its real path, or by running 32-bit regedit.

     PCTSTR lpValueEx = TEXT("vl.exe"); lResult = RegSetValueEx( hKey, lpName, 0, REG_SZ, (LPBYTE)lpValueEx, (DWORD)(_tcslen(lpValueEx) + 1)*sizeof(TCHAR) );

    REG_SZ
    A null-terminated string. It depends on the Unicode or ANSI string.

    • To no avail ... - Zine