You are here

Home » Forums » Development Forums » Portable App Development

[Solved] Using registry virtualization to bypass admin privilege requirements

6 posts / 0 new
Log in or register to post comments
Last post
December 4, 2016 - 3:27am
#1
XJDHDR
Offline
Last seen: 1 month 3 days ago
Joined: 2014-12-31 09:15
[Solved] Using registry virtualization to bypass admin privilege requirements

I am hoping someone can help me improve a portable app I am creating.

I am trying to create a portable application loader for a game called Emperor: Battle for Dune. My biggest issue ATM is that the game relies on some registry entries that are written to HKLM (in fact, the game crashes on start if one particular key value isn't present). Writing to this hive requires admin privileges in Vista and later (if UAC is enabled) and so I have to run my PAL with admin privileges to make this work.

The PAL I have created is currently working exactly how it should. I am wondering though if I can improve things by setting up my PAL so that it doesn't need admin privileges to run the game (installing it can require admin privileges though). The idea I came up with was to have my PAL read and write registry values to the virtual store (HKCU\Software\Classes\VirtualStore\MACHINE\), install some dummy registry keys in HKLM (by install, I mean I double-clicked on the registry file with these dummy keys and added the keys to the registry) and thus, the game would read the values in the virtual store and I don't need admin privileges to run it.

Unfortunately, I've tested my idea and it isn't working. I'm convinced that the game isn't using the virtual store at all. With the dummy registry values, the game crashes on start. With the dummy values replaced with the correct values, the game starts but shows other evidence of not using the virtual store (eg. graphics setting are set to low quality rather than the highest settings defined in the registry).

Is what I am asking for possible? If so, can anyone help me get it working?

Here is my appinfo launcher.ini:

[Launch]
ProgramExecutable=Emperor\EMPEROR.exe
SinglePortableAppInstance=true
SplashTime=100
LaunchAppAfterSplash=true
;RunAsAdmin=force
RunAsAdmin2000=none
RunAsAdminXP=none
RunAsAdmin2003=none

[Activate]
Registry=true

[RegistryKeys]
;EmpBfD=HKLM\SOFTWARE\Wow6432Node\Westwood\Emperor
EmpBfD=HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor

[RegistryValueWrite]
;HKLM\SOFTWARE\Wow6432Node\Westwood\Emperor\InstallPath=REG_SZ:%PAL:AppDir%\Emperor\Emperor.EXE
;HKLM\SOFTWARE\Wow6432Node\Westwood\Emperor\FolderPath=REG_SZ:%PAL:AppDir%\Start Menu\Westwood\Emperor - Battle For Dune
;HKLM\SOFTWARE\Wow6432Node\Westwood\Emperor\HTMLPath=REG_SZ:%PAL:AppDir%\Emperor\Data\HTML
HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\InstallPath=REG_SZ:%PAL:AppDir%\Emperor\Emperor.EXE
HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\FolderPath=REG_SZ:%PAL:AppDir%\Start Menu\Westwood\Emperor - Battle For Dune
HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\HTMLPath=REG_SZ:%PAL:AppDir%\Emperor\Data\HTML

[RegistryCleanupIfEmpty]
1=HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Game
2=HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Graphics
3=HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Movies
4=HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Multiplayer
5=HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Network
6=HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Sound
7=HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\URL
8=HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options
9=HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor
10=HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood
11=HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node
12=HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE
13=HKCU\Software\Classes\VirtualStore\MACHINE
14=HKCU\Software\Classes\VirtualStore
;15=HKLM\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Game
;16=HKLM\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Graphics
;17=HKLM\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Movies
;18=HKLM\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Multiplayer
;19=HKLM\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Network
;20=HKLM\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Sound
;21=HKLM\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\URL
;22=HKLM\SOFTWARE\Wow6432Node\Westwood\Emperor\Options
;23=HKLM\SOFTWARE\Wow6432Node\Westwood\Emperor
;24=HKLM\SOFTWARE\Wow6432Node\Westwood

[DirectoriesMove]
Saves=%PAL:AppDir%\Emperor\DATA\saves

Here is the registry file I am using with the Virtual Store values and keys:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor]
"Name"="Emperor"
"InstallPath"="E:\\Games\\EA\\EmpPort\\App\\Emperor\\Emperor.EXE"
"FolderPath"="E:\\Games\\EA\\EmpPort\\App\\Start Menu\\Westwood\\Emperor - Battle For Dune"
"HTMLPath"="E:\\Games\\EA\\EmpPort\\App\\Emperor\\Data\\HTML"
"SKU"=dword:00001f00
"Version"=dword:00010009
"Serial"="(snip)"

[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options]

[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Game]
"AutoSaveName"="AutoSave"
"GameSpeed"="4"
"Insider"=""
"IntroPlayed"="0"
"MouseSpeed"="55"
"ScrollRate"="8"
"ShowTargetLines"="1"
"Tooltips"="1"

[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Graphics]
"GraphicsLOD"="4"
"ColorDepth"="32"
"Shadows"="1"
"ModelLOD"="2"
"TextureLOD"="0"
"TerrainLOD"="2"
"EffectLOD"="2"
"ScreenWidth"="1440"
"ScreenHeight"="1080"
"MultiTexture"="1"
"HardwareTL"="1"
"AltDevice"="0"
"ShadowQuality"="2"
"LimitFrameRate"="0"
"LimitTo16BitTex"="0"

[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Movies]
"MovieListCount"="0"

[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Multiplayer]
"AutoLoginChoice"="NoAutoRadioButton"
"FilterLanguage"="1"
"Persona"=" - - "
"Server"=" - - "
"House"="0"
"SubHouse1"="3"
"SubHouse2"="5"
"HasSetQM"="0"
"LastLoginNickname"=""
"ServerListCount"="0"
"Locale"="0"

[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Network]
"SocketNumber"="0"
"DestinationNetwork"="0"
"NetworkCard"="10.43.86.100"

[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Sound]
"Sound"="1"
"MusicVolume"="15"
"SoundVolume"="20"
"VoiceVolume"="20"

[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\WOW6432Node\Westwood\Emperor\URL]
"Ladder"="http://westwood.ea.com/westwoodonline/tournaments/emperor-ingame/index.html"
"LadderX"="http://westwood.ea.com/westwoodonline/tournaments/emperor-ingame/index.html"
"NetStatus"="http://www.westwood.ea.com/westwoodonline/embedded/emperor/networkstatus..."
"NetStatusX"="http://www.westwood.ea.com/westwoodonline/embedded/emperor/networkstatus..."
"Signup"="http://games2.westwood.com/cgi-bin/cgiclient?register&request=expand_tem..."
"SignupX"="http://games2.westwood.com/cgi-bin/cgiclient?register&request=expand_tem..."
"BattleClans"="http://battleclans.westwood.com/cgi-bin/cgiclient?dunesquad&request=expa..."
"BattleClansX"="http://battleclans.westwood.com/cgi-bin/cgiclient?dunesquad&request=expa..."
"News"="http://www.westwood.ea.com/westwoodonline/embedded/emperor/news/index.shtml"
"NewsX"="http://www.westwood.ea.com/westwoodonline/embedded/emperor/news/index.shtml"
"Insider"="http://games2.westwood.com/cgi-bin/cgiclient?register_insider&request=ex..."
"InsiderX"="http://games2.westwood.com/cgi-bin/cgiclient?register_insider&request=ex..."

Finally, this is the dummy registry file I'm using to try make the game read values from the virtual store:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Game]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Graphics]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Movies]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Multiplayer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Network]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Westwood\Emperor\Options\Sound]

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Westwood\Emperor\URL]

Top
December 15, 2016 - 4:38am
YoursTruly
YoursTruly's picture
Offline
Last seen: 1 year 4 months ago
Joined: 2015-08-07 07:58
Hi XJDHDR,

Hi XJDHDR,

well in generall its possible.
You have three possible ways and none of them are easy:

1. decompile the programm and change the registry calls to some file
2. hook into process to simulate registry as file
3. by pass registry calls

Remarks:
1. This way is not easy since you need a good decompiler and recompile the game also you can use the assembler way but for most games and programs this way is even not legal. Except its your own Application.

2. Technically more easy than 1.) but will be considered as virus by most Anti-Virus programs and I am not sure if it will avoid question for admin rights

3.) This will be the most common way but is not really possible for portable use. You can read the discussion: https://portableapps.com/node/16465

BR
YoursTruly

Top
December 30, 2016 - 6:13am
XJDHDR
Offline
Last seen: 1 month 3 days ago
Joined: 2014-12-31 09:15
Solution discovered

I recently decided to examine the feasibility of decompiling the game's EXE to make changes to it. Unfortunately, decompilers are not very good ATM (or at least the free ones I tried). I did discover that disassembling an EXE is much easier and definitely possible. I then posted a question on Stack Exchange to see if anyone could point me in the right direction:
https://reverseengineering.stackexchange.com/questions/14257/modify-prog...

To my pleasant surprise, I discovered that it isn't as difficult as I thought. As stated in the answers to my question, forcing a program to use a different registry hive simply involves loading the EXE into a disassembler, searching the assembly code for RegCreateKey and RegOpenKey then changing the first parameter of these commands from 0x80000002 to 0x80000001.

Furthermore, the changes can be done using a hex editor so you technically don't even need a disassembler at all. I still used one though to make sure I wasn't damaging legitimate HKLM hive access as well as finding the addresses of the parameters I did need to change.

Top
March 23, 2019 - 2:51am
(Reply to #3)
Andhika24kd
Offline
Last seen: 4 months 1 week ago
Joined: 2018-06-28 07:13
More detailed explanations?

I'm sorry for asking on an old thread, but will you give a more detailed explanations? Which disassembler program do you use? And if I don't use the disassembler how do I do it using a hex editor? I cannot find 'RegCreateKey' on some (or most) executable files when using hex editor (HxD) and even if I found it, then what?

Top
November 18, 2021 - 10:02pm
(Reply to #4)
XJDHDR
Offline
Last seen: 1 month 3 days ago
Joined: 2014-12-31 09:15
Hi Andhika24kd

Hi Andhika24kd

I can certainly do that. My disassembler of choice is IDA Pro v7.0 (note the version, 7.0 is free whereas 7.1 currently isn't). And you won't find 'RegCreateKey' in HxD because, as I said, you need to search the assembly code for that command, not the binary that hex editors see. Next, did you read the contents of the Stack Exchange link I posted? I ask because this post will basically assume that you have.

Basically, you first want to always make a backup of any EXEs you modify. Next, my workflow is that you would open IDA, load the EXE you want to modify into it and let it do the disassembly. It should then be in flowchart view after that, at which point I get out of that view by pressing Space. After that, do a text search (Alt + T) for the word RegCreateKey or RegOpenKey. You can also tick "Show all occurrences" for a list of every location where that word was found. You can then double-click on a search result to jump to it's location.

Now, what you are looking for is something like this picture: https://xjdhdr.github.io/images_-_shared/redirect_HKLM_to_HKCU_instructions/IDA%20Pro%20Disassembly%20view.png The green boxes show the block of code you are looking for: a bunch of "Push <something>" commands followed by a "Call RegOpen/CreateKey" command. The specific part that interests you is the command in the red boxes. This push command tells the RegOpen/CreateKey function which registry hive it is accessing; 80000002h being the HKEY_LOCAL_MACHINE hive.

Next, I note the number to the left of the "push registry hive" command (00415235 and 00415260) and subtract 400000 from them. This gives you the address of the data that needs to be modified. Next, open the file in a hex editor and navigate to the address you calculated. You are looking for something like this picture: https://xjdhdr.github.io/images_-_shared/redirect_HKLM_to_HKCU_instructions/HxD%20hex%20view.png The red box is what you are looking for, with 6802000080 meaning the HKEY_LOCAL_MACHINE hive. To change this to the HKEY_CURRENT_USER hive, change the "02" into a "01".

If you want to do this without a disassembler (which I don't recommend), use the hex editor's search function to search for the hex values "6802000080" and change the "02" into a "01". After that, thoroughly test your EXE to ensure that registry access is the only thing you changed.

Top
June 10, 2019 - 7:47am
(Reply to #5)
Andhika24kd
Offline
Last seen: 4 months 1 week ago
Joined: 2018-06-28 07:13
Thanks for the detailed explanation

And sorry for the (very) late reply, I didn't get any notification

Top
Log in or register to post comments