0
我正在调查Windows 2008上的C：\ Windows \ System32 \ SystemPropertiesAdvanced.exe如何在更新系统环境变量时与explorer.exe进行交互。当以这种方式更新环境变量时，explorer.exe将动态更新其环境块以获取更改。我知道有多种方式来远程注入环境变量，但对SystemPropertiesAdvanced.exe使用的实现感到好奇。SystemPropertiesAdvanced.exe（特别是SYSDM）的实施细节
当我在更新环境变量后按下SystemPropertiesAdvanced对话框中的OK按钮时，会创建一个新线程。调试这个线程我来关注下面几行：
WINSTA!WinStationBSMWorkerThread:
75b292bc 8bff mov edi,edi
75b292be 55 push ebp
75b292bf 8bec mov ebp,esp
75b292c1 51 push ecx
75b292c2 8365fc00 and dword ptr [ebp-4],0
75b292c6 53 push ebx
75b292c7 56 push esi
75b292c8 8b7508 mov esi,dword ptr [ebp+8]
75b292cb 837e4000 cmp dword ptr [esi+40h],0
75b292cf 57 push edi
75b292d0 0f95c0 setne al
75b292d3 50 push eax
75b292d4 ff763c push dword ptr [esi+3Ch]
75b292d7 8d4624 lea eax,[esi+24h]
75b292da ff7638 push dword ptr [esi+38h]
75b292dd ff7628 push dword ptr [esi+28h]
75b292e0 50 push eax
75b292e1 ff7620 push dword ptr [esi+20h] ds:0023:00404468={SYSDM!szUserEnv (6b3ec434)}
75b292e4 8d4614 lea eax,[esi+14h]
75b292e7 ff761c push dword ptr [esi+1Ch]
75b292ea ff7618 push dword ptr [esi+18h]
75b292ed 50 push eax
75b292ee ff7610 push dword ptr [esi+10h]
75b292f1 ff760c push dword ptr [esi+0Ch]
75b292f4 ff7608 push dword ptr [esi+8]
75b292f7 ff7604 push dword ptr [esi+4]
75b292fa ff36 push dword ptr [esi]
75b292fc e821fdffff call WINSTA!WinStationBroadcastSystemMessageWorker (75b29022)
75b29301 8d7e44 lea edi,[esi+44h]
75b29304 57 push edi
75b29305 894508 mov dword ptr [ebp+8],eax
75b29308 ff15d810b275 call dword ptr [WINSTA!_imp__EnterCriticalSection (75b210d8)]
75b2930e 33db xor ebx,ebx
75b29310 43 inc ebx
75b29311 837e3000 cmp dword ptr [esi+30h],0
75b29315 0f85663d0000 jne WINSTA!WinStationBSMWorkerThread+0x5b (75b2d081)
75b2931b 57 push edi
75b2931c 895e2c mov dword ptr [esi+2Ch],ebx
75b2931f ff15d410b275 call dword ptr [WINSTA!_imp__LeaveCriticalSection (75b210d4)]
75b29325 837dfc00 cmp dword ptr [ebp-4],0
75b29329 0f85683d0000 jne WINSTA!WinStationBSMWorkerThread+0x7c (75b2d097)
75b2932f 8b4508 mov eax,dword ptr [ebp+8]
75b29332 5f pop edi
75b29333 5e pop esi
75b29334 5b pop ebx
75b29335 c9 leave
75b29336 c20400 ret 4
我相信调用WINSTA WinStationBroadcastSystemMessageWorker是一些如何让Explorer.exe的知道，它应该拿起这些新的环境变量。有趣的是，调试器将75b292e1处的引用标识为SYSDM！szUserEnv。
也许不是你的标准查询，但也许有其他反向工程师在那里。 :) [在100rep我将设置“标签”正确]
干杯