Si es en el Registro podes poner un bp en la api: RegOpenKeyExa
The RegOpenKeyEx function opens the specified key.
LONG RegOpenKeyEx(
HKEY hKey, // handle of open key
LPCTSTR lpSubKey, // address of name of subkey to open
DWORD ulOptions, // reserved
REGSAM samDesired, // security access mask
PHKEY phkResult // address of handle of open key
);
Si es un archivo ini podes poner un bp en la api WritePrivateProfileString
The WritePrivateProfileString function copies a string into the specified section of the specified initialization file.
This function is provided for compatibility with 16-bit Windows-based applications. WIn32-based applications should store initialization information in the registry.
BOOL WritePrivateProfileString(
LPCTSTR lpAppName, // pointer to section name
LPCTSTR lpKeyName, // pointer to key name
LPCTSTR lpString, // pointer to string to add
LPCTSTR lpFileName // pointer to initialization filename
);
A esto lo haces en el ollydbg.
The RegOpenKeyEx function opens the specified key.
LONG RegOpenKeyEx(
HKEY hKey, // handle of open key
LPCTSTR lpSubKey, // address of name of subkey to open
DWORD ulOptions, // reserved
REGSAM samDesired, // security access mask
PHKEY phkResult // address of handle of open key
);
Si es un archivo ini podes poner un bp en la api WritePrivateProfileString
The WritePrivateProfileString function copies a string into the specified section of the specified initialization file.
This function is provided for compatibility with 16-bit Windows-based applications. WIn32-based applications should store initialization information in the registry.
BOOL WritePrivateProfileString(
LPCTSTR lpAppName, // pointer to section name
LPCTSTR lpKeyName, // pointer to key name
LPCTSTR lpString, // pointer to string to add
LPCTSTR lpFileName // pointer to initialization filename
);
A esto lo haces en el ollydbg.