If enabled, the Windows OS tries to locate the “autorun.inf ” file in the root directory of the newly connected device. It checks the registry to determine if the autorun function is enabled for the associated drive. The Windows shell then processes the WM_DEVICECHANGE messages and sends an interrupt request. At the same time, the Windows Explorer process will display the autoplay window that gives the user options for what to do with the inserted media. Applications will receive this message when the newly inserted device is ready for use.

This message is sent after a new device or a removable media has been inserted. Another event that is useful to us is DBT_DEVICEARRIVAL. The ByVal wParam As Long, _ parameter of this message contains code that defines exactly what event occurred. Public Declare Function CallWindowProc Lib 'user32' Alias 'CallWindowProcA' (ByVal lpPrevWndFunc As Long, _ To view this interaction, you can trap this message using the following API: So, in this case, the window at the topmost position receives the message first and then the remaining windows receive it in succession. The z-order simply refers to the placement of Windows on the screen. This message is sent to all the top-level Windows according to their z-order. Whenever removable media is inserted or detached from a computer, a WM_DEVICECHANGE message is sent to all running applications. This is the same concept the U3 creators intended to exploit when their drives are inserted. In the meantime, it is important to understand that when the autorun feature in Windows is enabled, by either default or manual adjustments, Windows Explorer will read the contents of the autorun.inf file and automatically initiate any instructions it finds. These options will be covered in greater detail in the later sections of this chapter. This file should be located in the root of the disk and can contain a number of customizable command-line options. Nearly all data that is shipped on a CD/DVD has some type of autorun capabilities built into it.Ī file named autorun.inf is responsible for the automagic that occurs when a CD/DVD is inserted into a computer. The primary purpose of autorun is to provide automation for software installations and multimedia applications. In this section, we will describe how autorun interacts with the Windows application program interface (API) in order to activate a program automatically.

In the “Defending against This Attack” section of Chapter 1, “USB Hacksaw,” we touched on autorun/autoplay, the default settings, and manual manipulation techniques. Brian Anderson, Barbara Anderson, in Seven Deadliest USB Attacks, 2010 Autorun

Autorun menu