I'm going to work with Python 3, mainly interested in Windows for a start. If it makes a difference, then Windows 10 specifically.

Example of what I want to happen:

  1. User starts my script.
  2. User decides to blacklist the game Dota 2.
  3. User tries to open Dota 2.
  4. Because Dota 2 is on the blacklist, my script runs instead of Dota 2.
  5. After my script is done, Dota 2 either runs or doesn't run, depending on what my script chooses. This will ultimately be controlled by User.
  6. User closes my script.
  7. User tries to open Dota 2.
  8. Dota 2 opens right away without interruptions.

The last three lines is to signify that there needs to be a way of turning it on and off, so not a permanent solution. My base assumption is that once I know how to do the first part, the second part will be easy. I still put it in there for clarification.

I really just want to know how to gain access to intercepting the programs.

  1. User tries to open Dota 2.
  2. Because Dota 2 is on the blacklist, my script runs instead of Dota 2.

Windows' Image File Execution Options lets you cause your program to be run whenever an executable of your choice is started.

Suppose we want to run C:\My Folder\new app.exe whenever the user tries to start C:\Windows\old app.exe. To accomplish this, run the following command:

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\old app.exe" /v Debugger /d "C:\My Folder\new app.exe" /f

Note: If a key named old app.exe doesn't exist (likely), this command will create it.

This creates a new Registry key with the name of the program to be "hijacked" and creates a new string value named Debugger that has its data set to the path of the replacement executable. This can be any executable file, including .CMD batch scripts.

The change takes effect immediately. Now whenever an executable named old app.exe is run, Windows will start C:\My Folder\new app.exe instead.

To return everything to normal, delete the old app.exe key:

reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\old app.exe" /f

Simply incorporate these commands into your script to accomplish your desired outcome.

  • Just quick question(s), what if the app we want to run isn't in C:\Windows? What if it's on another hard disc or in another folder of C? Does this also work for things that aren't really applications, like files? – GoodDay Apr 22 '17 at 2:41
  • @GoodDay You can point this to any location you want, so long as it's accessible to all users that will run it. You have to point to something that's executable. If in doubt, just do a quick test with your desired file. Since the changes take effect immediately it's easy to test your settings. – Twisty Impersonator Apr 22 '17 at 2:44
  • I'm sorry I don't get it, you wrote: C:\Windows\old app.exe, that indicates to me that we're working in `C:\Windows` at a minimum. And when I went into the regedit to check, maybe I'm missing something, but I can't really find everything that I'm looking for. – GoodDay Apr 22 '17 at 3:07
  • Well of course that was an example. You could set the data for the Debugger value to C:\My Folder\MyScript.cmd if you wanted to and it will work. Does that help? – Twisty Impersonator Apr 22 '17 at 3:10
  • Ok, let's make an example, I think it will be clear for me then: Let's say the app I want to intercept is in K:\programs\test\old_app.exe , then what do I do? – GoodDay Apr 22 '17 at 3:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.