How to Replace a System Program without Modifying System Files or Permissions
If you like to use replacements for system programs like notepad.exe or calc.exe then this is for you. This will show you how to use a popular replacement for notepad.exe or any other exe by using "Image File Execution Options" key in your registry.
You must have Administrator privileges to edit the registry key and these settings affect all users but this is very simple, does NOT involve taking over file permissions, does NOT involve replacement of any files, and is VERY easily reversible.
This works for Windows NT/2K/XP/Server 2K3/Vista/Server 2K8/Win7
1) If you use this to replace example.exe, ANY program named example.exe located anywhere will execute the replacement instead of itself.
2) If you used 'App Paths' to point to a different executable, then it bypasses this method since windows doesn't try to run the original exe
3) On x64 systems, the key for 32-bit apps is
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
The 'Image File Execution Options' registry key is used by the NT family originally for debugging applications. Conveniently, we can use this method to run another command and pass the name of the executable to it instead. The problem is that you need some way to execute a command but skip one argument since most applications are not aware that one parameter is meaningless.
Here I show several examples of how to accomplish this
Under the registry key
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optionscreate a subkey with the name of the exe you want replaced.
Add a string value called Debugger.
Modify Debugger with the command you want run.
When any user tries to run any executable with the name of the subkey, Windows executes the Debugger command with path\name of the original exe and all command line parameters appended. (Did that make sense?)
Create a subkey named 'notepad.exe'
Add the string value Debugger
Double click Debugger and enter
cmd /k echowhen you double click on c:\some.txt the command that is executed is
cmd /k echo "C:\windows\system32\notepad.exe" c:\some.txt
Full Tutorial and example scripts Here: http://www.vistax64....ermissions.html
Edited by selyb, 30 August 2009 - 05:35 PM.