{"id":9101,"date":"2024-03-03T00:33:23","date_gmt":"2024-03-03T00:33:23","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=9101"},"modified":"2024-12-25T23:19:00","modified_gmt":"2024-12-25T23:19:00","slug":"1-little-known-secret-of-explorer-exe","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2024\/03\/03\/1-little-known-secret-of-explorer-exe\/","title":{"rendered":"1 little known secret of explorer.exe"},"content":{"rendered":"\n<p>Windows Explorer is a beast. It does so many things when it starts that it hurts&#8230;<\/p>\n\n\n\n<p>Sometimes, literally.<\/p>\n\n\n\n<p>One of the things it checks during its startup routine is the comparison of the Registry value HKEY_CURRENT_USER\\Control Panel\\Appearance\\SchemeLangID and the result of the call to GetUserDefaultUILanguage API. If they do not match, it attempts to load a &#8216;desk.cpl&#8217; library and call its UpdateCharsetChanges function.<\/p>\n\n\n\n<p>So&#8230;.<\/p>\n\n\n\n<p>We can create a dodgy desk.cpl, copy explorer.exe to the same folder, kill all the explorer.exe instances, and then make sure the Registry value doesn&#8217;t match the result of the call to GetUserDefaultUILanguage API. Then we can run explorer.exe from that folder and the lame lolbin magic happens:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/03\/explored_desked.png\"><img decoding=\"async\" loading=\"lazy\" width=\"622\" height=\"357\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/03\/explored_desked.png\" alt=\"\" class=\"wp-image-9102\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/03\/explored_desked.png 622w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/03\/explored_desked-300x172.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/03\/explored_desked-500x287.png 500w\" sizes=\"(max-width: 622px) 100vw, 622px\" \/><\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Windows Explorer is a beast. It does so many things when it starts that it hurts&#8230; Sometimes, literally. One of the things it checks during its startup routine is the comparison of the Registry value HKEY_CURRENT_USER\\Control Panel\\Appearance\\SchemeLangID and the result &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2024\/03\/03\/1-little-known-secret-of-explorer-exe\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[126,56,64],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9101"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=9101"}],"version-history":[{"count":2,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9101\/revisions"}],"predecessor-version":[{"id":9104,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9101\/revisions\/9104"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=9101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=9101"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=9101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}