Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account


Photo

Replace a System Program without Modifying System Files or Permissions

- - - - -

  • Please log in to reply
No replies to this topic

#1
selyb

selyb

    Newbie

  • Member
  • 30 posts
  • Joined 21-November 04

How to Replace a System Program without Modifying System Files or Permissions


If you like to use replacements for system programs like notepad.exe or calc.exe then this is for you. This will show you how to use a popular replacement for notepad.exe or any other exe by using "Image File Execution Options" key in your registry.

You must have Administrator privileges to edit the registry key and these settings affect all users but this is very simple, does NOT involve taking over file permissions, does NOT involve replacement of any files, and is VERY easily reversible.

This works for Windows NT/2K/XP/Server 2K3/Vista/Server 2K8/Win7

KNOWN ISSUES:
1) If you use this to replace example.exe, ANY program named example.exe located anywhere will execute the replacement instead of itself.
2) If you used 'App Paths' to point to a different executable, then it bypasses this method since windows doesn't try to run the original exe
3) On x64 systems, the key for 32-bit apps is
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options


DESCRIPTION:
The 'Image File Execution Options' registry key is used by the NT family originally for debugging applications. Conveniently, we can use this method to run another command and pass the name of the executable to it instead. The problem is that you need some way to execute a command but skip one argument since most applications are not aware that one parameter is meaningless.
Here I show several examples of how to accomplish this

DETAILS:
Under the registry key
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
create a subkey with the name of the exe you want replaced.
Add a string value called Debugger.
Modify Debugger with the command you want run.

When any user tries to run any executable with the name of the subkey, Windows executes the Debugger command with path\name of the original exe and all command line parameters appended. (Did that make sense?)

TEST:
Create a subkey named 'notepad.exe'
Add the string value Debugger
Double click Debugger and enter
cmd /k echo
when you double click on c:\some.txt the command that is executed is
cmd /k echo "C:\windows\system32\notepad.exe" c:\some.txt


Full Tutorial and example scripts Here: http://www.vistax64....ermissions.html

Edited by selyb, 30 August 2009 - 05:35 PM.



How to remove advertisement from MSFN



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users



How to remove advertisement from MSFN