抢占最早开机时间条件:
1.关机回调最晚执行(可其他骚操作)
2.第一:System Reserved
第二:想要执行的模块
VOID
ChangeServiceGroupOrder(
__in PVOID Context
)
{
NTSTATUS Status = STATUS_UNSUCCESSFUL;
PKEY_VALUE_PARTIAL_INFORMATION ValueData = NULL;
ULONG ValueLength = 0;
PWSTR Current = NULL;
PWSTR NewCurrent = NULL;
UNICODE_STRING CurrentGroup = { 0 };
PVOID Buffer = NULL;
ULONG Size = 0, NumberCount = 0;
#define GROUPNAME L"XXXXSSSS"
UNICODE_STRING BaseString = RTL_CONSTANT_STRING(GROUPNAME);
BOOLEAN Exist = FALSE;
do
{
Status = reg::RKQueryValue(
L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ServiceGroupOrder",
L"List",
&ValueData,
&ValueLength
);
if (!NT_SUCCESS(Status))
{
break;
}
Buffer = ExAllocatePoolWithTag(
PagedPool,
(ValueData->DataLength + sizeof(WCHAR)) * 2 + wcslen(GROUPNAME) * 2 + sizeof(WCHAR),
'9977'
);
if (Buffer == NULL)
{
break;
}
RtlZeroMemory(Buffer, (ValueData->DataLength + sizeof(WCHAR)) * 2 + wcslen(GROUPNAME) * 2 + sizeof(WCHAR));
RtlCopyMemory(Buffer, ValueData->Data, ValueData->DataLength);
Current = (PWSTR)Buffer;
NewCurrent = (WCHAR*)((PUCHAR)Buffer + ValueData->DataLength + sizeof(WCHAR));
Size = ValueData->DataLength + sizeof(WCHAR) + wcslen(GROUPNAME) * 2 + sizeof(WCHAR);
while (Current < (PWSTR)((PUCHAR)Buffer + ValueData->DataLength + sizeof(WCHAR)))
{
if (*Current == UNICODE_NULL)
{
break;
}
RtlInitUnicodeString(&CurrentGroup, Current);
if (NumberCount == 1)
{
if (RtlCompareUnicodeString(&CurrentGroup, &BaseString, TRUE) == 0)
{
break;
}
RtlStringCbCatW(
NewCurrent,
Size,
BaseString.Buffer
);
*(PWSTR)((PUCHAR)NewCurrent + BaseString.Length) = UNICODE_NULL;
NewCurrent = (PWSTR)((PUCHAR)NewCurrent + BaseString.MaximumLength);
Size -= BaseString.MaximumLength;
}
else
{
if (NumberCount != 0 && RtlCompareUnicodeString(&CurrentGroup, &BaseString, TRUE) == 0)
{
Exist = TRUE;
Current = (PWSTR)((PUCHAR)Current + CurrentGroup.MaximumLength);
}
else
{
RtlStringCbCatW(
NewCurrent,
Size,
CurrentGroup.Buffer
);
*(PWSTR)((PUCHAR)NewCurrent + CurrentGroup.Length) = UNICODE_NULL;
NewCurrent = (PWSTR)((PUCHAR)NewCurrent + CurrentGroup.MaximumLength);
Size -= CurrentGroup.MaximumLength;
Current = (PWSTR)((PUCHAR)Current + CurrentGroup.MaximumLength);
}
}
NumberCount++;
}
if (NumberCount != 1)
{
reg::RKSetValue(
L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ServiceGroupOrder",
L"List",
REG_MULTI_SZ,
(WCHAR*)((PUCHAR)Buffer + ValueData->DataLength + sizeof(WCHAR)),
Exist ? ValueData->DataLength : ValueData->DataLength + wcslen(GROUPNAME) * 2 + sizeof(WCHAR)
);
}
} while (FALSE);
if (Buffer != NULL)
{
ExFreePoolWithTag(Buffer, '9977');
}
if (ValueData != NULL)
{
ExFreePool(ValueData);
}
}