-
Notifications
You must be signed in to change notification settings - Fork 5
/
Copy pathurl_search_hook.cpp
61 lines (51 loc) · 1.81 KB
/
url_search_hook.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
BOOL EnumUrlSearchHook( AUTORUN_CALLBACK pfnCallback, LPVOID lpParam )
{
CHKey hKey;
DWORD dwResult = RegOpenKeyEx( HKEY_CURRENT_USER,
"Software\\Microsoft\\Internet Explorer\\URLSearchHooks",
0, KEY_QUERY_VALUE, (PHKEY)&hKey );
if( ERROR_SUCCESS != dwResult ) {
SetLastError( dwResult );
return FALSE;
}
DWORD cValue = 0;
dwResult = RegQueryInfoKey( hKey.GetHandle(), NULL, NULL, 0, NULL, NULL,NULL, &cValue, NULL, NULL, NULL, NULL );
if( ERROR_SUCCESS != dwResult ) {
SetLastError( dwResult );
return FALSE;
}
for( DWORD i=0; i < cValue; i++ ) {
AUTORUN_ITEM Item = {0};
DWORD cbBuffer = sizeof( Item.Name );
dwResult = RegEnumValue( hKey.GetHandle(), i, Item.Name, &cbBuffer, NULL, NULL, NULL, NULL );
if( ERROR_SUCCESS != dwResult ) {
SetLastError( dwResult );
return FALSE;
}
CHKey hSubKey;
char szSubKey[128] ={0};
strncpy( szSubKey, "CLSID\\", sizeof( szSubKey ) - 1 );
strncat( szSubKey, Item.Name, sizeof( szSubKey ) - strlen( szSubKey ) - 1 );
strncat( szSubKey, "\\InprocServer32", sizeof( szSubKey ) - strlen( szSubKey ) - 1 );
DWORD dwResult = RegOpenKeyEx( HKEY_CLASSES_ROOT, szSubKey, 0, KEY_QUERY_VALUE, (PHKEY)&hSubKey );
if( ERROR_SUCCESS != dwResult ) {
SetLastError( dwResult );
return FALSE;
}
cbBuffer = sizeof( Item.ImagePath );
dwResult = RegQueryValueEx( hSubKey.GetHandle(), "", 0, NULL ,(UCHAR*)Item.ImagePath, &cbBuffer );
if( ERROR_SUCCESS != dwResult ) {
SetLastError( dwResult );
return FALSE;
}
//替换Systemroot
char Buffer[512] = {0};
ExpandEnvironmentStrings( Item.ImagePath, Buffer, sizeof( Buffer) - 1 );
strncpy( Item.ImagePath, Buffer, sizeof( Item.ImagePath ) - 1 );
if( !pfnCallback( AUTORUN_URL_SEARCH_HOOK, &Item, lpParam ) ) {
SetLastError( ERROR_CANCELLED );
return FALSE;
}
}
return TRUE;
}