I want to intercept a given program before it runs and run my own program first
- User tries to open Dota 2.
- Because Dota 2 is on the blacklist, my script runs instead of Dota 2.
Windows' Image File Execution Options lets you cause your program to be run whenever an executable of your choice is started.
Suppose we want to run C:\My Folder\new app.exe whenever the user tries to start C:\Windows\old app.exe. To accomplish this, run the following command:
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\old app.exe" /v Debugger /d "C:\My Folder\new app.exe" /f
Note: If a key named old app.exe doesn't exist (likely), this command will create it.
This creates a new Registry key with the name of the program to be "hijacked" and creates a new string value named Debugger that has its data set to the path of the replacement executable. This can be any executable file, including .CMD batch scripts.
The change takes effect immediately. Now whenever an executable named old app.exe is run, Windows will start C:\My Folder\new app.exe instead.
To return everything to normal, delete the old app.exe key:
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\old app.exe" /f
Simply incorporate these commands into your script to accomplish your desired outcome.