This project is supposed to redirect all file/registry calls of process to seperated file system/registry location.

• WFRR.exe

  • EasyHook
  • Newtonsoft.Json
  • log4net

  To update dependencies, use nuget to download packages and copy binaries to 3rdparty folder.

  nuget install .\BuildCfg\Packages.config -OutputDirectory packages
  

• Reg2JSON.py

  • python 2.x

• RegOpenKey(Ex)
• RegCreateKey(Ex)
• RegDeleteKey(Ex)
• CreateFileW
• DeleteFileW
• CopyFileW

• .NET 4.5.2+/VS2015+

  # In MSBuild Command Prompt for VS2015/VS2017 #
  
  >.\Build.bat
  

• Source: source registry path.
• Destination: target registry path which you want to redirect to.

{
    "Mapping": [
        {
            "Source": "",
            "Destination": ""
        },
        {
            "Source": "",
            "Destination": ""
        }
    ],
    "VRegRedirected": ""
}

• Source: source directory path.
• Destination: target directory path which you want to redirect to.

{
    "Mapping": [
        {
            "Source": "",
            "Destination": ""
        },
        {
            "Source": "",
            "Destination": ""
        }
    ]
}

Please put V_REG.json and V_FS.json in the same location as WFRR.exe.

Usage: WFRR.exe [OPTIONS]

Options:
  -e, --exe=VALUE            the executable file to launch and inject.
  -a, --arg=VALUE            the arguments of executable file to launch and
                               inject.
  -n, --pname=VALUE          the name of process want to inject.
  -i, --pid=VALUE            the id of process want to inject.
      --all                  inject file hook and registry hook.
      --file                 inject file hook only.
      --reg                  inject registry hook only.
  -b, --bg                   runs in background.
      --no-console-log       disable console logging.
      --no-file-log          disable file logging.
  -h, --help                 show help messages.

Log file WFRR.log will be generated in same location of WFRR.exe and will be useful if you encounter issues.

Current supported Hooks may be not covered all File System/Registry operations. You probably need to implement additional hooks to cover them. To know which API calls haven't be hooked, process monitor is your good friend to monitor program operations.

The pre-compiled binaries were built and tested on Windows 10. If you want to use this software on Windows 7, it would be better to sync code and build binaries on Windows 7 instead of using pre-compiled binaries. This will avoid some issues.