Hızlı yanıt: kod örneği
The purpose of the "debugger" key is to automatically launch a debugger and pass the original commandline to the desired debugger. It also sets a flag on the win32 function CreateProcess that indicates this is a debugging session. It is implied that the debugger will then call CreateProcess after modifying the arguments appropriately.turns intomydebugger could then call something like this:So the solution to abusing this registry key is to make the fake debugger that can manipulate the commandline the way you desire. It should be a simple process that just parses the commandline and replaces the notepad.exe with notepad2.exe. Then you need to point the registry to that .exe
>notepad.exe "\document1.txt">mydebugger.exe notepad.exe "\document1.txt"BOOL res = CreateProcess( NULL, L"notepad.exe \"\\document1.txt\", NULL, NULL, FALSE, cFlags, env, NULL, startupInfo, procInfo&);