Jump to content

fairly challenging question...


Recommended Posts

Okay i'll start from the begininning. My friends and i were trying to make a program that ads extra security to windows by having a user validation program run instead of the windows log on screensaver which runs whether you're logged on or not. Since windows banned exes from being replaced with the logon.scr file in the registry key, we replaced that with a batch file that ran the exe file for us. Pefect! ran like we wanted and the exe ran before any users were logged on. However, the program runs under the SYSTEM name and therefore hotkeys are disabled. I'm trying to figure out what process service or whatever causes the user hotkeys to work. If any of you have signed on the system account before, you'll that none of the natural hotkeys work anyway (such as alt + ctrl + delete). Just to double check myself however i told system to run explorer.exe first... No good... Anyway, i was comparing the processes but didn't find anything.

SO! in conclusion, what does auto it/windows use to identify hotkeys of all sorts. I'm not sure if this is the right place for this question so please do not flame me for this since i am new but learning quickly. Is this even possible?

Any help would be greatly appreciated, I've been working on this for a while but haven't had any break throughs.

Thanks,

Trey

Link to comment
Share on other sites

there is an api for this to register them with the os (kernel explorer.exe ?). its been a while since i tried registering a hot key. the last time ended up in lot of wasted code becuase i was trying to use hot key to manipulate the gina, and there is a "windows rule" from doing whatever it was i was attempting to do. at any rate the function call is obvious and i think it starts with Register.....

Link to comment
Share on other sites

1. rename a EXE file to .scr and voila, you got a screensaver (works the other way around, too). Screensaver are started with parameter /s when they're supposed to "save" the screen.

2. to catch CTRL+ALT+DELETE you'd need to manipulate gina which includes writing a dll meaning you've got no chance to do this with AutoIt.

What I'd suggest is: let the normal winlogon take place just like usual (maybe even with autologin enabled, so that winlogon is basically skipped if you've got enough trust in your skills), but tell winlogon to use a different shell (not explorer.exe). And of course block the call to taskmanager until you've verified the user.

The shell and the task manager can be modified by changing registry keys. AFAIR they're in HKCU and HKLM under \Software\Microsoft\Windows NT\Winlogon

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...