Windows内核-注册表操作（一）

最新推荐文章于 2024-08-17 14:27:30 发布
原创最新推荐文章于 2024-08-17 14:27:30 发布 · 1.1k 阅读
0 ·
CC 4.0 BY-SA版权
windows驱动编程专栏收录该内容
39 篇文章
订阅专栏
本文详细介绍了一个Windows内核模式驱动程序如何实现对注册表的操作，包括创建、打开、设置和查询键值，以及枚举子键和键值等关键功能。
///////////////////////////////////////////////////////////////////////////////
///
/// Copyright (c) 2014 - <company name here>
///
/// Original filename: RegOper.cpp
/// Project          : RegOper
/// Date of creation : 2014-06-20
/// Author(s)        : <author name(s)>
///
/// Purpose          : <description>
///
/// Revisions:
///  0000 [2014-06-20] Initial revision.
///
///////////////////////////////////////////////////////////////////////////////

// $Id$

#ifdef __cplusplus
extern "C" {
#endif
#include <ntddk.h>
#include <string.h>
#ifdef __cplusplus
}; // extern "C"
#endif

#define  M_REG_PATH L"\\REGISTRY\\MACHINE\\SOFTWARE\\WorldWang"
HANDLE g_hReg = NULL;


VOID DriverUnload(
    IN PDRIVER_OBJECT		DriverObject
    )
{
	KdPrint(("DriverUnload..."));
}

void mCloseReg()
{

	if (g_hReg)
	{
		ZwClose(g_hReg);
		g_hReg = NULL;
	}

}



NTSTATUS mCreateKey()
{

	NTSTATUS status = STATUS_SUCCESS;
	OBJECT_ATTRIBUTES obj;
	UNICODE_STRING usKey;
	RtlInitUnicodeString(&usKey,M_REG_PATH);

	ULONG uDisp;
	
	InitializeObjectAttributes(
		&obj,
		&usKey,
		OBJ_CASE_INSENSITIVE,
		NULL,
		NULL);

	status =  ZwCreateKey(
		&g_hReg,
		KEY_ALL_ACCESS,
		&obj,
		0,
		NULL,
		REG_OPTION_NON_VOLATILE,
		&uDisp);

	if (NT_SUCCESS(status))
	{
		if (uDisp == REG_CREATED_NEW_KEY)
		{
			KdPrint(("zwCreateKey ..REG_CREATED_NEW_KEY"));
		}else if (uDisp == REG_OPENED_EXISTING_KEY)
		{
			KdPrint(("zwCreateKey ..REG_OPENED_EXISTING_KEY"));
		}
	}else
	{
		KdPrint(("zwCreateKey error"));
		return status;
	}

	
}


NTSTATUS mOpenKey()
{

	NTSTATUS status = STATUS_SUCCESS;
	UNICODE_STRING usRegPath;
	OBJECT_ATTRIBUTES obj;
	RtlInitUnicodeString(&usRegPath,M_REG_PATH);

		InitializeObjectAttributes(
		&obj,
		&usRegPath,
		OBJ_CASE_INSENSITIVE,
		g_hReg,
		NULL);


	status = ZwOpenKey(&g_hReg,
		KEY_ALL_ACCESS,
		&obj);

	if (NT_SUCCESS(status))
	{
		if (status == STATUS_INVALID_HANDLE)
		{
			KdPrint(("ZwOpenKey STATUS_INVALID_HANDLE"));
		}else if (status == STATUS_ACCESS_DENIED)
		{
			KdPrint(("ZwOpenKey STATUS_ACCESS_DENIED"));
		}
		
	}else
	{
		KdPrint(("zwOpenKey error"));
		return status;
	}

	return status;

}

NTSTATUS mSetValueKey()
{
	NTSTATUS status = STATUS_SUCCESS;
	UNICODE_STRING usValueName;
	ULONG uData = 123321;


	UNICODE_STRING usSzName;
	PWCHAR szStr = L"his is a sz Data.123";

	RtlInitUnicodeString(&usSzName,L"szName");




	RtlInitUnicodeString(&usValueName,L"DWORDName");

	
	 status = ZwSetValueKey(g_hReg,
		 &usValueName,
		 0,
		REG_DWORD,
		&uData,
		sizeof(ULONG));
	 if (!NT_SUCCESS(status))
	 {
		 KdPrint(("ZwSetValueKey Dword Error"));
	 }


	 status = ZwSetValueKey(g_hReg,
		 &usSzName,
		 0,
		 REG_SZ,
		szStr,
		 wcslen(szStr)*sizeof(WCHAR)+2);

	 if (!NT_SUCCESS(status))
	 {
		 KdPrint(("ZwSetValueKey sz Error"));
	 }


	 return status;

}


NTSTATUS mQueryValueKey()
{
	NTSTATUS  status  = STATUS_SUCCESS;
	UNICODE_STRING usValueName;
	UNICODE_STRING usSzName;

	ULONG uSize;
	PKEY_VALUE_PARTIAL_INFORMATION kvpi;


	RtlInitUnicodeString(&usSzName,L"szName");
	RtlInitUnicodeString(&usValueName,L"DWORDName");


	status = ZwQueryValueKey(g_hReg,
	&usValueName,
	KeyValuePartialInformation,
	NULL,
	0,
	&uSize);

	if (status == STATUS_OBJECT_PATH_NOT_FOUND)
	{
		KdPrint(("ZwQueryValueKey STATUS_OBJECT_PATH_NOT_FOUND"));
		return status;
	}

	kvpi = (PKEY_VALUE_PARTIAL_INFORMATION)ExAllocatePool(PagedPool,uSize);


	status = ZwQueryValueKey(g_hReg,
		&usValueName,
		KeyValuePartialInformation,
		kvpi,
		uSize,//sizeof(KEY_VALUE_PARTIAL_INFORMATION),
		&uSize);

	if (status == STATUS_OBJECT_PATH_NOT_FOUND || uSize == 0)
	{
		KdPrint(("ZwQueryValueKey STATUS_OBJECT_PATH_NOT_FOUND"));
		return status;
	}

	if (kvpi->Type == REG_DWORD && kvpi->DataLength == sizeof(ULONG))
	{
		PULONG pUvalue = (PULONG)kvpi->Data;
		KdPrint(("pUValue:%d",*pUvalue));
	}


	ExFreePool(kvpi);
	kvpi = NULL;

	//////////////////////////////////////////////////////////////////////////
	uSize = 0;
	status = ZwQueryValueKey(g_hReg,
		&usSzName,
		KeyValuePartialInformation,
		NULL,
		0,
		&uSize);

	if (status == STATUS_OBJECT_PATH_NOT_FOUND)
	{
		KdPrint(("ZwQueryValueKey STATUS_OBJECT_PATH_NOT_FOUND"));
		return status;
	}

	kvpi = (PKEY_VALUE_PARTIAL_INFORMATION)ExAllocatePool(PagedPool,uSize);


	status = ZwQueryValueKey(g_hReg,
		&usSzName,
		KeyValuePartialInformation,
		kvpi,
		uSize,//sizeof(KEY_VALUE_PARTIAL_INFORMATION),
		&uSize);

	if (status == STATUS_OBJECT_PATH_NOT_FOUND || uSize == 0)
	{
		KdPrint(("ZwQueryValueKey STATUS_OBJECT_PATH_NOT_FOUND"));
		return status;
	}

	if (kvpi->Type == REG_SZ)
	{
		PWCHAR pSZ = (PWCHAR)kvpi->Data;
		KdPrint(("pSZ:%S",pSZ));
	}


	ExFreePool(kvpi);

return status;

}




NTSTATUS mEnumSubKey()
{
	
		NTSTATUS  status;
		HANDLE hdlEnumSubKey = NULL;
		OBJECT_ATTRIBUTES oa;
		UNICODE_STRING usReg;

		RtlInitUnicodeString(&usReg,L"\\Registry\\MACHINE");


		InitializeObjectAttributes(
			&oa,
			&usReg,
			OBJ_CASE_INSENSITIVE,
			NULL,
			NULL
			);


		status = ZwOpenKey(&hdlEnumSubKey,KEY_ALL_ACCESS,&oa);
		if (!NT_SUCCESS(status))
		{
			KdPrint(("ZwOpenKey error.."));
			return status;
		}
		

		PKEY_FULL_INFORMATION pkfi;
		ULONG uSize = 0;


		status = ZwQueryKey(
			hdlEnumSubKey,
			KeyFullInformation,
			NULL,
			0,
			&uSize);
		
		pkfi = (PKEY_FULL_INFORMATION)ExAllocatePool(PagedPool,uSize);


		status = ZwQueryKey(
			hdlEnumSubKey,
			KeyFullInformation,
			pkfi,
			uSize,
			&uSize);


		if (!NT_SUCCESS(status))
		{
			return status;
		}

		for (int i=0;i<pkfi->SubKeys;i++)
		{


			PKEY_BASIC_INFORMATION  pkbi = NULL;
			ULONG uLength = 0;

			ZwEnumerateKey(
				hdlEnumSubKey,
				i,
				KeyBasicInformation,
				NULL,
				0,
				&uLength);


			pkbi = (PKEY_BASIC_INFORMATION)ExAllocatePool(PagedPool,uLength);


			ZwEnumerateKey(
				hdlEnumSubKey,
				i,
				KeyBasicInformation,
				pkbi,
				uLength,
				&uLength);

			UNICODE_STRING usRes;
			usRes.Length = usRes.MaximumLength = pkbi->NameLength;
			usRes.Buffer = pkbi->Name;

			KdPrint(("ZwEnumerateKey::i:%d---%wZ\n",i,&usRes));

			ExFreePool(pkbi);
			pkbi = NULL;


		}


		ExFreePool(pkfi);
		pkfi = NULL;

	return STATUS_SUCCESS;
}

NTSTATUS mEnumSubKeyValue()
{
	NTSTATUS  status;
	HANDLE hdlEnumSubKey = NULL;
	OBJECT_ATTRIBUTES oa;
	UNICODE_STRING usReg;

	RtlInitUnicodeString(&usReg,L"\\Registry\\MACHINE\\SYSTEM\\WorldWang");


	InitializeObjectAttributes(
		&oa,
		&usReg,
		OBJ_CASE_INSENSITIVE,
		NULL,
		NULL
		);


	status = ZwOpenKey(&hdlEnumSubKey,KEY_ALL_ACCESS,&oa);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("ZwOpenKey error.."));
		return status;
	}


	PKEY_FULL_INFORMATION pkfi;
	ULONG uSize = 0;


	status = ZwQueryKey(
		hdlEnumSubKey,
		KeyFullInformation,
		NULL,
		0,
		&uSize);

	pkfi = (PKEY_FULL_INFORMATION)ExAllocatePool(PagedPool,uSize);


	status = ZwQueryKey(
		hdlEnumSubKey,
		KeyFullInformation,
		pkfi,
		uSize,
		&uSize);


	if (!NT_SUCCESS(status))
	{
		return status;
	}

	for (int i=0;i<pkfi->Values;i++)
	{


		PKEY_VALUE_BASIC_INFORMATION  pkvbi = NULL;
		ULONG uLength = 0;

		ZwEnumerateValueKey(
			hdlEnumSubKey,
			i,
			KeyValueBasicInformation,
			NULL,
			0,
			&uLength);


		pkvbi = (PKEY_VALUE_BASIC_INFORMATION)ExAllocatePool(PagedPool,uLength);


		ZwEnumerateValueKey(
			hdlEnumSubKey,
			i,
			KeyValueBasicInformation,
			pkvbi,
			uLength,
			&uLength);

		UNICODE_STRING usRes;
		usRes.Length = usRes.MaximumLength = pkvbi->NameLength;
		usRes.Buffer = pkvbi->Name;

		KdPrint(("ZwEnumerateValueKey::i:%d---%wZ\n",i,&usRes));

		ExFreePool(pkvbi);
		pkvbi = NULL;


	}


	ExFreePool(pkfi);
	pkfi = NULL;

	return STATUS_SUCCESS;
}


void mDeleteKeyValue()
{
	UNICODE_STRING usDwName;
	UNICODE_STRING usSzName;
	RtlInitUnicodeString(&usDwName,L"DWORDName");
	RtlInitUnicodeString(&usSzName,L"szName");
	
	ZwDeleteValueKey(g_hReg,&usDwName);
	ZwDeleteValueKey(g_hReg,&usSzName);

}

void mDeleteKey()
{
	NTSTATUS status = STATUS_SUCCESS;
	status = ZwDeleteKey(g_hReg);
	if (status == STATUS_ACCESS_DENIED)
	{
		KdPrint(("ZwDeleteKey  STATUS_ACCESS_DENIED.."));
	}else
	{
		KdPrint(("ZwDeleteKey  ok.."));
	}
}

#ifdef __cplusplus
extern "C" {
#endif
NTSTATUS DriverEntry(
    IN OUT PDRIVER_OBJECT   DriverObject,
    IN PUNICODE_STRING      RegistryPath
    )
{
	KdPrint(("DriverEntry..."));

   

	mOpenKey();
	mCreateKey();
	mCloseReg();

	mOpenKey();
	mSetValueKey();
	mQueryValueKey();
	mDeleteKeyValue();
	mDeleteKey();
	mCloseReg();
	//////////////////////////////////////////////////////////////////////////
	mEnumSubKey();

	mEnumSubKeyValue();


    DriverObject->DriverUnload = DriverUnload;
    return STATUS_SUCCESS;
}
#ifdef __cplusplus
}; // extern "C"
#endif