Is there a way to ensure the dll get injected when the pc boot into safe mode?
Will it work when:
1. Installing a service, which inject the dll
2. Adding that service to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network
Or is there another way?
Hooking in safe mode?
To be honest, I've no idea. I've never even checked how safe mode behaves. My personal opinion is that the user expects more or less all complicated software to be disabled in safe mode, so that there's no danger of crashes or anything. So my thinking always was that hooking shouldn't really be used in safe mode. But that's just me, of course...
From what i know safe mode will only load system services/drivers on a minimal level. Your hook will therefore fail unless each user will modify their safe mode boot settings, or if you can somehow modify a loaded service to spawn your hook which unfortunately there is not much public information and would involve directly patching a specific service or require the users to install the custom service.
Of what would you need this for and i can see if i can brainstorm any ideas.
Of what would you need this for and i can see if i can brainstorm any ideas.