Replacing Notepad with PN via Image File Execution Options

03 Nov 2009

A user opened a bug asking me to look into a new way of replacing notepad.exe with PN. Previous methods have involved a small program that pretends to be notepad.exe but actually launches PN. This has a number of problems:

1. Replacing system files like notepad.exe on modern Windows is much harder due to System File Protection

2. Many tools expect notepad.exe to hang around until you save the file, meaning they can pick up the changes when you’re done. The notepad.exe replacement exited having launched PN so didn’t work well with this.

The new technique involves using something called Image File Execution Options. This is a set of registry settings used to make Windows run a debugger automatically when a program is launched. We can piggyback on this to run PN instead of notepad when it’s launched.

Steps

1. Create this Registry Key:

   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ Image File Execution Options\notepad.exe

2. Add a string value called “Debugger”, set the value to:

   c:\Program Files\Programmer’s Notepad\pn.exe –allowmulti -z

The –allowmulti deals with the second problem listed above, making sure that even if PN is already running a new instance is started – this means that the calling process can wait for PN to exit. The –z tells PN to ignore the next parameter, which when using Image File Execution Options is the process name that we’re replacing – the full path to notepad.exe in this case.

This is only available in the lastest 2.1 testing release for now (1117), but should be ready to try. Let me know how you get on.

Note that if you’re on 64-bit Windows you’ll need the following Registry Key instead:

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\
CurrentVersion\Image File Execution Options