1 little known secret of regsvr32.exe, take two
2023-12-27 08:9:35 Author: www.hexacorn.com(查看原文) 阅读量:14 收藏

There is an archaic feature that regsvr32.exe leverages to autoregister libraries associated with file extensions.

For this to work, it expects an AutoRegister key to be present under the file extension handler with a default value pointing to the library f.ex:

file extension entry: txt -> txtfile
file handler: txtfile
autoregister entry: txtfile\AutoRegister\{Default}=<Library>

As such, one can use regsvr32.exe to load library of their choice without passing it as a command line argument to the program!

Let’s see an example for the txtfile:

reg add HKEY_CLASSES_ROOT\txtfile\AutoRegister /ve /d c:\test\bar.dll

echo > foo.txt

regsvr32 foo.txt

The AutoRegister feature requires the library supporting this feature to export a function called DllRegisterServerEx, but in my example I didn’t even bother as I just wanted to demo the DllMain Load…


文章来源: https://www.hexacorn.com/blog/2023/12/27/1-little-known-secret-of-regsvr32-exe-take-two/
如有侵权请联系:admin#unsafe.sh