不是说了吗,类型是REG_EXPAND_SZ(你可以看看系统哪个带%..%变量的字串没有用REG_EXPAND_SZ的?),而不是常见的REG_SZ。REG_EXPAND_SZ导出来是HEX(2),字串是UNICODE编码的,所以"\"也不会自动转成"\\"。你把下面导进去看会不会自动运行,至于为何REG_SZ不能识别%...%只好去问比尔该死:)- Windows Registry Editor Version 5.00
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
- "记事本"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,\
- 25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6e,00,6f,\
- 00,74,00,65,00,70,00,61,00,64,00,2e,00,65,00,78,00,65,00,00,00
复制代码 上面那个字串其实就是:%SystemRoot%\system32\notepad.exe
[ 本帖最后由 netwinxp 于 2008-7-27 14:33 编辑 ] |