Cool_Tools/ExplorerPatcher
1
0
Fork 0
mirror of https://github.com/valinet/ExplorerPatcher.git synced 2024-11-27 17:00:59 +01:00
Code Releases Wiki Activity

Minor fixes

Browse Source
This commit is contained in:
Valentin Radu 2021-08-31 04:31:06 +03:00
parent 5ce54410cc
commit 9afbc50cca
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ExplorerPatcher/dllmain.c
View File

@ -1386,7 +1386,7 @@ DWORD OpenStartOnCurentMonitorThread(LPVOID unused)
DWORD PlayStartupSound(DWORD x)
{
Sleep(1000);
Sleep(2000);
printf("Started \"Play startup sound\" thread.\n");
HRESULT hr = CoInitialize(NULL);

2
README.md
View File

@ -31,7 +31,7 @@ To uninstall, simply delete `dxgi.dll` from `%windir%`.
#### How does this work?
The mechanism the application gets loaded is by exploiting the DLL search order in Windows. I take advantage of the fact that Explorer is one of the few system processes located in `%windir%` and not in `%windir%\System32`, so it does not affect most apps. Also, `%windir%` is not in the search path. Read more about this technique [here](https://itm4n.github.io/windows-dll-hijacking-clarified/). The main advantage here is that you do not have to keep an extra process running in the memory; plus, due to the diverse nature of how Explorer is launched, hooking it can be difficult.
The mechanism the application gets loaded is by exploiting the DLL search order in Windows. I take advantage of the fact that Explorer is one of the few system processes located in `%windir%` and not in `%windir%\System32`, so it does not affect most apps. Also, `%windir%` is not first in the search path. Read more about this technique [here](https://itm4n.github.io/windows-dll-hijacking-clarified/). The main advantage here is that you do not have to keep an extra process running in the memory; plus, due to the diverse nature of how Explorer is launched, hooking it can be difficult.
I picked `dxgi.dll` because it is not on the `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs` list, because it has few exports and is loaded very early by Explorer, when calling the `DXGIDeclareAdapterRemovalSupport()` function.