劫持程序的命令来运行记事本

Question

I have a utility programs's EXE file, when i run this file there is a winform only and there is button when we click on it, it run windows's notepad. Now I want to hijack this program's command to run notepad and instead of running notepad I want to run MS Word. I know C# and VB.NET. What I need to do this ?

Answer 1

You can try to add in folder with this program your own program called notepad.exe that should do only one thing: run word.

If you want to do it programatically in C then you should read this page - maybe it helps: Intercepted: Windows Hacking via DLL Redirection

Answer 2

You can use a trick to replace programs with another by making changes to the registry. This will work even if the program you are running uses absolute paths to run notepad. It overrides any instance of the running program with the chosen one no matter where it resides. And you won't have to patch the file. The key you'd be interested in is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Add a key with the name of the program and add a Debugger string with the path to the program you want to replace it with. Of course you need to have permissions to make the necessary modifications. This page explains how you can replace Windows Notepad with another program. You can apply the same process here.

---

Though you'll probably not want to have this permanent change, so you can write up a program to temporarily add/change the key, run your program then change it back. Here's a complete one I just whipped up to temporarily replace Notepad with Word for a demonstration. Seems to work perfectly fine (though as always, use at your own risk). Just make all the necessary changes to fit your situation.

using System.Diagnostics;
using Microsoft.Win32;

namespace ProgramLauncher
{
    class Program
    {
        // change the following constants as needed
        const string PROGRAM_NAME = @"notepad.exe";
        const string REPLACEMENT_PATH = @"C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE";
        const string RUNNING_PATH = @"C:\Windows\notepad.exe";

        // root key
        const string KEY = @"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options";

        static void Main(string[] args)
        {
            using (var rootKey = Registry.LocalMachine.OpenSubKey(KEY, RegistryKeyPermissionCheck.ReadWriteSubTree))
            {
                var oldPath = default(string);
                var needsRestoration = false;
                try
                {
                    oldPath = BackupKey(rootKey, PROGRAM_NAME, REPLACEMENT_PATH);
                    needsRestoration = true;
                    Process.Start(RUNNING_PATH).WaitForExit();
                }
                finally
                {
                    if (needsRestoration)
                        RestoreKey(rootKey, PROGRAM_NAME, oldPath);
                }
            }
        }

        static string BackupKey(RegistryKey rootKey, string programName, string newPath)
        {
            Debug.Assert(rootKey != null);
            Debug.Assert(!string.IsNullOrEmpty(programName));
            Debug.Assert(!string.IsNullOrEmpty(newPath) && System.IO.File.Exists(newPath));
            if (newPath.Contains(" "))
                newPath = string.Format("\"{0}\"", newPath);

            using (var programKey = rootKey.CreateSubKey(programName, RegistryKeyPermissionCheck.ReadWriteSubTree))
            {
                var oldDebugger = programKey.GetValue("Debugger") as string;
                programKey.SetValue("Debugger", newPath, RegistryValueKind.String);
                return oldDebugger;
            }
        }

        static void RestoreKey(RegistryKey rootKey, string programName, string oldPath)
        {
            Debug.Assert(rootKey != null);
            Debug.Assert(!string.IsNullOrEmpty(programName));

            if (oldPath != null)
            {
                using (var programKey = rootKey.OpenSubKey(programName, RegistryKeyPermissionCheck.ReadWriteSubTree))
                    programKey.SetValue("Debugger", oldPath);
            }
            else
            {
                rootKey.DeleteSubKey(programName);
            }
        }
    }
}