|
|
楼主 |
发表于 2019-7-3 19:27:43
|
显示全部楼层
本帖最后由 slore 于 2019-7-3 21:10 编辑
SHGetValue, 读取注册表,然后WriteFile写到文件就好了。
完整的注册表PPN项目(其实支持任意注册表项目)保存到HEX文件,给你,含源码。
想导入的话,反过来,先ReadFile从HEX文件读取,然后SHSetValue更新注册表。
- #include<windows.h>
- #define BINARY_BUFF_SIZE (128 * 1024) // 128KB
- int main(int argc, char *argv[]) {
- DWORD type = 0, size = BINARY_BUFF_SIZE;
- char *data = (char *)malloc(size);
- char *subkey = "SYSTEM\\ControlSet001\\Control\\ProductOptions";
- char *regname = "ProductPolicy";
- char *filename = "pp_data.hex";
-
- HANDLE hFile = NULL;
- DWORD dwBytesToWrite = 0;
- DWORD dwBytesWritten = 0;
- BOOL bErrorFlag = FALSE;
- memset(data, 0, size);
- if (argc > 2) subkey = argv[2];
- if (argc > 3) regname = argv[3];
- if (SHGetValueA(HKEY_LOCAL_MACHINE, subkey,
- regname, &type, data, &size) != ERROR_SUCCESS) {
- printf("fail to read data.\n");
- return 1;
- }
- printf("data length = %d.\n", size);
- dwBytesToWrite = size;
- if (argc > 1) filename = argv[1];
- hFile = CreateFile(filename, GENERIC_WRITE, 0, NULL,
- CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
- if (!hFile) {
- printf("fail to open file.\n");
- return 1;
- }
- bErrorFlag = WriteFile(hFile, data, dwBytesToWrite, &dwBytesWritten, NULL);
- if (FALSE == bErrorFlag) {
- printf("fail to write to file.\n");
- }
- CloseHandle(hFile);
- return 0;
- }
复制代码
regbin.zip
(2.21 KB, 下载次数: 3)
各个项目的处理,我还是用lua脚本方便些。。。
你用PPN对于HEX文件拆解的工具的话,其实:
PP2HEX.bat
- cd /d "%~dp0"
- reg copy HKLM\System\CurrentControlSet\Control\ProductOptions HKCU\TEST\PP /f
- reg delete HKCU\TEST\PP /v ProductType /f
- reg delete HKCU\TEST\PP /v OSProductContentId /f
- reg delete HKCU\TEST\PP /v OSProductPfn /f
- reg delete HKCU\TEST\PP /v ProductSuite /f
- reg delete HKCU\TEST\PP /v SubscriptionPfnList /f
- reg save HKCU\TEST\PP PP.hiv
复制代码
从2024H开始截取 2028H保存的数据大小就行了。
另外,最后因为hiv文件是4K对齐,文件结尾多很多00 00 00 00 00 .. 00 00
3kb的x86不能再x64上用。用VS2015编译了个,可以。体积变成100kb了。
regbin_vs.zip
(115.13 KB, 下载次数: 4)
|
|