调用 IRtlKey

调用 IRtlKey

 

 

void GetInterfaceAndObject(LPWSTR pszKey, IRtlKey **pIKey, CKey **pKey)

{

    IRtlSystemIsolationLayer *pSystem = NULL;

    RtlGetSystem(0, NULL, &pSystem);

    unsigned long r = 2;

    LUNICODE_STRING key, ntKey = { 0 };

    RtlInitLUnicodeString(&key, pszKey);

    RtlConvertWin32RegistryPathToNtRegistryPath(&key, &ntKey);

    pSystem->OpenRegistryKey(1, 0xF003F, ntKey, pIKey, &r);

    //unsigned long,    flag0 - 4

    //ACCESS_MASK,  DesiredAccessF003F

    //_LUNICODE_STRING const &,

    // attribues,       4

    //IRtlFile **,  创建的接口对象

    //unsigned long *   返回值

    if (pIKey)

        *pKey = *(CKey **)(pIKey);

}

 

IRtlKey *pIKey = NULL;

CKey *pKey = NULL;

//HKEY_LOCAL_MACHINE\\SYSTEM

//ACCESS DENIED Desired Access: All Access

GetInterfaceAndObject(L"HKCU\\CSITEST", &pIKey, &pKey);

 

LUNICODE_STRING *KeyName = new LUNICODE_STRING();

pIKey->GetName(2, KeyName);

标志值只能为2 或 3，但结果一样。