Hi,
Following a discussion initiated here, I decided to give a go to a native windows application that would modify the registry in the early stage of the booting process.
A native app is an app that will be launched as soon as the kernel initialization is completed.
It will be launched (in user mode) by the session manager (smss.exe) thru the registry key HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\BootExecute (run at every boot) or HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\setupexecute (run once only).
A native app can only use NT API functions (ntdll.dll) and not the Windows API functions.
The challenges for a developper :
-Compile the binary with subsystem = native
-Retrieve the command line
-Parse the command line in unicode/pointer world
-Code without the "nice and easy" windows API's
While doing some mad googling to address the above challenges, I end up on a post on reboot.pro (all roads lead to reboot.pro) where I realised Joakim had already done a great job.
Anyway, I'll post my work here (binary and source code in delphi).
Joakim's tool relies on a file when mine takes parameters on the command line but apart from that they do pretty much the same.
Mine is still early alpha but I might add more command line switches in the future to bring more features (handle files, etc ...).
I also was greatly inspired by this (italian) article here.
Possible usages :
nativereg createkey \Registry\Machine\SYSTEM\Setup key1 nativereg createvalue \Registry\Machine\SYSTEM\Setup\key1 test1 toto REG_SZ nativereg createvalue \Registry\Machine\SYSTEM\Setup\key1 test2 112233AABBCC REG_BINARY nativereg createvalue \Registry\Machine\SYSTEM\Setup\key1 test3 666 REG_DWORD nativereg deletevalue \Registry\Machine\SYSTEM\Setup\key1 test1 nativereg deletekey \Registry\Machine\SYSTEM\Setup\key1
The tool is 32 bits (a 64 bits may come later).
It should be working on XP and up.
Regards,
Erwan