Click here to Skip to main content
Click here to Skip to main content

Hide String value from Regedit by Hooking the RegEnumValueW API

, 5 Dec 2001
Rate this:
Please Sign up or sign in to vote.
This Article shows how to hide a string value from Regedit
<!-- Download Links --> <!-- Add the rest of your HTML here -->

Introduction

This Article Explains how to hide a registry string from regedit by hooking the RegEnumValueW API, In this article there is a Function that hooks APIs called HookAPICalls. I am not the author of that function - I got it from some website whose name I forget. Thanks to the author of that function. The function that replaces the RegEnumValueW is given below .

LONG MyRegEnumValue(HKEY hKey,           
                    DWORD dwIndex,       
                    LPWSTR lpValueName,  
                    LPDWORD lpcValueName,
                    LPDWORD lpReserved,  
                    LPDWORD lpType,      
                    LPBYTE lpData,       
                    LPDWORD lpcbData)
{
   LONG ret;

   RegEnumValueWtype oldfn=(RegEnumValueWtype)RegDLL_Hooks.Functions [0].OrigFn;

   char ss[10];
   ret=oldfn(hKey,dwIndex,lpValueName,lpcValueName,lpReserved,lpType,lpData,lpcbData);
   WideCharToMultiByte(CP_ACP, 0,lpValueName,
                            -1,
                            ss,
                            10,
                            NULL, NULL);
   if (strstr(ss,"hirosh")!=NULL)
      return 1;
   else
      return ret;
}

This function simply checks the string "hirosh" from the lpValueName and if found it will return a 1. That means the the function has not completed successfully, so regedit will not display any string that contains the word "hirosh". 

API hooking is a powerful tool. To use this we can also hide files, processed from OS. However, I don't know which APIs must be hooked to achieve this. If anybody knows this please help me. 

I check this program on Windows XP. regedit is OK but when I take msconfig it displays an error. I don't know what is the problem so if anybody knows this please help me. I am not experienced in API hooking so I am just experiment with this.

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here

Share

About the Author

H. Joseph

United States United States
No Biography provided

Comments and Discussions

 
GeneralWindows 2003 Platform Pinmembertocsjung13-Jul-05 23:08 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Mobile
Web04 | 2.8.141022.2 | Last Updated 6 Dec 2001
Article Copyright 2001 by H. Joseph
Everything else Copyright © CodeProject, 1999-2014
Terms of Service
Layout: fixed | fluid