{"id":9008,"date":"2023-12-29T21:57:39","date_gmt":"2023-12-29T21:57:39","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=9008"},"modified":"2024-12-25T23:19:45","modified_gmt":"2024-12-25T23:19:45","slug":"1-little-known-secret-of-fsquirt-exe","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2023\/12\/29\/1-little-known-secret-of-fsquirt-exe\/","title":{"rendered":"1 little known secret of fsquirt.exe"},"content":{"rendered":"\n

The program in the title of this post is not very well-known. It’s being used for some random Bluetooth stuff that not too many PC users care about (okay, it’s a bit of a stretch, but I guess it’s really not very well-known).<\/p>\n\n\n\n

How do you make a use of a binary no one cares about?<\/p>\n\n\n\n

When I first looked at fsquirt.exe<\/em>‘s command line arguments, I immediately thought of using it in my Beyond Good Ol’ Run key<\/a><\/em> series as it was really a perfect candidate – until I discovered that despite behaving in a predictable way, delivering what I needed it to, I could not write the new post in that series, because the intended trick simply didn’t work.<\/p>\n\n\n\n

I know it sounds dramatic, but this is a nature of the research. <\/p>\n\n\n\n

I still wanted to make a triumph of the discovery though, so here we are…<\/p>\n\n\n\n

When you run fsquirt.exe<\/em> with the -Register<\/em> argument it will create a LNK file c:\\Users\\<user>\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK<\/em> that will lead Explorer to add the following item under your Send To<\/em> Explorer submenu:<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Running it with -UnRegister<\/em> argument will remove this entry.<\/p>\n\n\n\n

But here’s the secret…<\/p>\n\n\n\n

Run:<\/p>\n\n\n\n

c:\\windows\\System32\\fsquirt.exe -Register<\/pre>\n\n\n\n
To ensure that this LNK file is created:<\/p>\n\n\n\n
c:\\Users\\<user>\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK<\/pre>\n\n\n\n
Add a legitimate Run entry pointing to the LNK created in last step:<\/p>\n\n\n\n
reg add \"hkcu\\software\\microsoft\\windows\\currentversion\\run\" \/v foo \/d \"c:\\Users\\<user>\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK\"<\/pre>\n\n\n\n
Copy c:\\windows\\System32\\fsquirt.exe<\/em> to a different folder f.ex. c:\\test<\/em> by running a command like this:<\/p>\n\n\n\n
copy c:\\windows\\System32\\fsquirt.exe c:\\test<\/pre>\n\n\n\n
Re-register it to a different location:<\/p>\n\n\n\n
c:\\test\\fsquirt.exe  -Register<\/em> <\/pre>\n\n\n\n
This will overwrite the LNK file above to point to c:\\test\\fsquirt.exe<\/em>.<\/p>\n\n\n\n
Overwrite c:\\test\\fsquirt.exe<\/em> with any executable of your choice – now you have an executable that will run anytime user logs on.<\/p>\n\n\n\n
It’s a classic bait and switch.<\/p>\n","protected":false},"excerpt":{"rendered":"
The program in the title of this post is not very well-known. It’s being used for some random Bluetooth stuff that not too many PC users care about (okay, it’s a bit of a stretch, but I guess it’s really … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[126,56,64],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9008"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=9008"}],"version-history":[{"count":4,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9008\/revisions"}],"predecessor-version":[{"id":9017,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9008\/revisions\/9017"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=9008"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=9008"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=9008"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}