Figure 2: Injected function for out-of-process COM servers
static DWORD WINAPI ThreadProc (PVOID parm) { HKEY hklm = 0; HKEY hkcr = 0; DWORD dwr=0; myparms* pp = (myparms*)parm; // load advapi32.dll HMODULE hadv = pp->fnload (pp->advdll); ProcGetProcAddress GetProc = (ProcGetProcAddress)(pp->fnGetProc); RegOver RegOverride = (RegOver)GetProc(hadv,pp->regover) ; RegCreate RegCreateK = (RegCreate)GetProc(hadv, pp->regcreate ) ; // Create our substitute keys long lc = RegCreateK (HKEY_CURRENT_USER, pp->kcr, 0, NULL, 0, KEY_ALL_ACCESS, NULL, &hkcr, &dwr); lc = RegOverride (HKEY_CLASSES_ROOT, hkcr); lc = RegCreateK(HKEY_CURRENT_USER, pp->klm, 0, NULL, 0, KEY_ALL_ACCESS, NULL, &hklm, &dwr); lc = RegOverride(HKEY_LOCAL_MACHINE, hklm); // Let the server run and register pp->fnResume (pp->hProcThread); // Wait for the server to finish pp->fnWaitFor (pp->hProcThread, 60000); return 0; } /* End of File */