LONG WINAPI Mine_RegCreateKeyExW(HKEY a0, LPCWSTR a1, DWORD a2, LPWSTR a3, DWORD a4, REGSAM a5, LPSECURITY_ATTRIBUTES a6, PHKEY a7, LPDWORD a8) { if (CFilterMapper2::m_pFilterMapper2) { *a7 = FAKEHKEY; return ERROR_SUCCESS; } return Real_RegCreateKeyExW(a0, a1, a2, a3, a4, a5, a6, a7, a8); }
LONG WINAPI Mine_RegCreateKeyExW(HKEY a0, LPCWSTR a1, DWORD a2, LPWSTR a3, DWORD a4, REGSAM a5, LPSECURITY_ATTRIBUTES a6, PHKEY a7, LPDWORD a8) { TRACE_SVP5(L"Mine_RegCreateKeyExW %s" , a1); if(a1 && ( wcsstr(a1, L"MtContain.CMtContainer") || wcsstr(a1, L"Media Type\\Extensions\\.mk") || _wcsicmp(a1, L"Media Type\\{E436EB83-524F-11CE-9F53-0020AF0BA770}\\{49952F4C-3EDC-4A9B-8906-1DE02A3D4BC2}") == 0 || _wcsicmp(a1, L"Media Type\\Extensions\\.csf") == 0 || wcsstr(a1, L"SOFTWARE\\Microsoft\\MediaPlayer\\Player\\Extensions\\") )){ TRACE_SVP5(L"FAKING IT" ); *a7 = FAKEHKEY; return ERROR_SUCCESS; } if(CFilterMapper2::m_pFilterMapper2) {*a7 = FAKEHKEY; return ERROR_SUCCESS;} return Real_RegCreateKeyExW(a0, a1, a2, a3, a4, a5, a6, a7, a8); }
LSTATUS APIENTRY RegTree::RegCreateKeyExW(HKEY hKey, LPCWSTR lpSubKey, DWORD Reserved, LPWSTR lpClass, DWORD dwOptions, REGSAM samDesired, LPSECURITY_ATTRIBUTES lpSecurityAttributes, PHKEY phkResult, LPDWORD lpdwDisposition) { RegPath path; if (ResolveKey(hKey, lpSubKey, path)) { RegNode *node = CreateKey(path, lpdwDisposition); if (node != NULL) { *phkResult = node->AsKey(); return ERROR_SUCCESS; } else return ERROR_ACCESS_DENIED; } else return Real_RegCreateKeyExW(hKey, lpSubKey, Reserved, lpClass, dwOptions, samDesired, lpSecurityAttributes, phkResult, lpdwDisposition); }
// RegCreateKeyExW 替换 LONG WINAPI Replace_RegCreateKeyExW(HKEY hKey,LPCWSTR lpSubKey,DWORD Reserved,LPWSTR lpClass,DWORD dwOptions,REGSAM samDesired, LPSECURITY_ATTRIBUTES lpSecurityAttributes,PHKEY phkResult,LPDWORD lpdwDisposition) { LONG nRet; __try { nRet = Real_RegCreateKeyExW(hKey, lpSubKey, Reserved, lpClass, dwOptions, samDesired, lpSecurityAttributes, phkResult, lpdwDisposition); if(!HOOK_RegCreateKeyEx) return nRet; if(GetCurrentProcessId() == ExplorerPID) return nRet; if(GetCurrentProcessId() == RegMonPID) return nRet; if((PID == 0) || ((GetCurrentProcessId() == PID) && (PID>0)) ) { if(lpSubKey == NULL) return nRet; COPYDATASTRUCT data; PARAMS params ; memset(¶ms,0,sizeof(PARAMS)); params.PID = GetCurrentProcessId(); params.hKey = hKey; memcpy(params.buf1, lpSubKey, wcslen(lpSubKey)*2); params.result = nRet; data.cbData = sizeof(PARAMS); data.lpData = (void *)¶ms; data.dwData = TYPE_RegCreateKeyExW; SendMessage(g_hWnd, WM_COPYDATA, (WPARAM)g_hWnd, (LPARAM)&data); } }__finally { }; return nRet; }