[AccessD] \decompile

Stuart McLachlan stuart at lexacorp.com.pg
Wed Apr 13 16:58:32 CDT 2022


On 13 Apr 2022 at 17:29, John Colby wrote:

> Paul, really cool version detection.
>...
> > > Rem Find the MSAccess executable

I just query the registry :)

   'Get Access location
        dwRetVal = RegOpenKeyEx(%HKEY_CLASSES_ROOT,PATHNAME$(EXTN,wsFIle),0,%key_query_value,hkey)
        dwRetVal = regqueryvalueex(hkey,"",0,%reg_sz,wszRetStr,256)
        dwRetVal = regclosekey(hkey)
        dwRetVal = RegOpenKeyEx(%HKEY_CLASSES_ROOT,wszRetStr & "\SHELL\Open\command" ,0,%key_query_value,hkey)
        dwRetVal = regqueryvalueex(hkey,"",0,%reg_sz,wszRetStr,256)
        dwRetVal = regclosekey(hkey)

wszRetStr now contains something like:
"C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE" /NOSTARTUP "%1" 
%2 %3 %4 %5 %6 %7 %8 %9



More information about the AccessD mailing list