NtLoadUnloadKey.c File Reference

#include "precomp.h"
#include <debug.h>

Include dependency graph for NtLoadUnloadKey.c:

Go to the source code of this file.

Macros
#define	REG_CREATED_NEW_KEY   1
#define	REG_OPENED_EXISTING_KEY   2
#define	REG_FORCE_UNLOAD   1
#define	NDEBUG

Functions
static	NTSTATUS (NTAPI *pNtUnloadKey2)(POBJECT_ATTRIBUTES
static BOOLEAN	RetrieveCurrentModuleNTDirectory (OUT PUNICODE_STRING NtPath)
static NTSTATUS	CreateRegKey (OUT PHANDLE KeyHandle, IN HANDLE RootKey OPTIONAL, IN PUNICODE_STRING KeyName, IN ULONG CreateOptions, OUT PULONG Disposition OPTIONAL)
static NTSTATUS	CreateProtoHive (OUT PHANDLE KeyHandle)
static VOID	DestroyProtoHive (IN HANDLE KeyHandle)
static NTSTATUS	OpenDirectoryByHandleOrPath (OUT PHANDLE RootPathHandle, IN HANDLE RootDirectory OPTIONAL, IN PUNICODE_STRING RootPath OPTIONAL)
static NTSTATUS	CreateRegistryFile (IN HANDLE RootDirectory OPTIONAL, IN PUNICODE_STRING RootPath OPTIONAL, IN PCWSTR RegistryKey, IN HANDLE ProtoKeyHandle)
static NTSTATUS	MyDeleteFile (IN HANDLE RootDirectory OPTIONAL, IN PUNICODE_STRING RootPath OPTIONAL, IN PCWSTR FileName, IN BOOLEAN ForceDelete)
static NTSTATUS	ConnectRegistry (IN HANDLE RootKey OPTIONAL, IN PCWSTR RegMountPoint, IN HANDLE RootDirectory OPTIONAL, IN PUNICODE_STRING RootPath OPTIONAL, IN PCWSTR RegistryKey)
static NTSTATUS	DisconnectRegistry (IN HANDLE RootKey OPTIONAL, IN PCWSTR RegMountPoint, IN ULONG Flags)
	START_TEST (NtLoadUnloadKey)

Variables
static	ULONG

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 18 of file NtLoadUnloadKey.c.

REG_CREATED_NEW_KEY

#define REG_CREATED_NEW_KEY   1

Definition at line 11 of file NtLoadUnloadKey.c.

REG_FORCE_UNLOAD

#define REG_FORCE_UNLOAD   1

Definition at line 14 of file NtLoadUnloadKey.c.

REG_OPENED_EXISTING_KEY

#define REG_OPENED_EXISTING_KEY   2

Definition at line 12 of file NtLoadUnloadKey.c.

Function Documentation

ConnectRegistry()

static NTSTATUS ConnectRegistry ( IN HANDLE RootKey  OPTIONAL, IN PCWSTR  RegMountPoint, IN HANDLE RootDirectory  OPTIONAL, IN PUNICODE_STRING RootPath  OPTIONAL, IN PCWSTR  RegistryKey  )

static

Definition at line 324 of file NtLoadUnloadKey.c.

{
    NTSTATUS Status;
    HANDLE RootPathHandle;
    UNICODE_STRING KeyName, FileName;
    OBJECT_ATTRIBUTES KeyObjectAttributes;
    OBJECT_ATTRIBUTES FileObjectAttributes;
 
    /* Open the root directory */
    Status = OpenDirectoryByHandleOrPath(&RootPathHandle, RootDirectory, RootPath);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("OpenDirectoryByHandleOrPath failed, Status 0x%08lx\n", Status);
        return Status;
    }
 
    RtlInitUnicodeString(&KeyName, RegMountPoint);
    InitializeObjectAttributes(&KeyObjectAttributes,
                               &KeyName,
                               OBJ_CASE_INSENSITIVE,
                               RootKey,
                               NULL);
 
    RtlInitUnicodeString(&FileName, RegistryKey);
    InitializeObjectAttributes(&FileObjectAttributes,
                               &FileName,
                               OBJ_CASE_INSENSITIVE,
                               (HANDLE)((ULONG_PTR)RootPathHandle & ~1), // Remove the opened-locally flag
                               NULL);
 
    /* Mount the registry hive in the registry namespace */
    Status = NtLoadKey(&KeyObjectAttributes, &FileObjectAttributes);
 
    /* Close the root directory (if opened locally), and return */
    if ((ULONG_PTR)RootPathHandle & 1) NtClose((HANDLE)((ULONG_PTR)RootPathHandle & ~1));
    return Status;
}

Referenced by START_TEST().

CreateProtoHive()

static NTSTATUS CreateProtoHive ( OUT PHANDLE  KeyHandle )

static

Definition at line 73 of file NtLoadUnloadKey.c.

{
    NTSTATUS Status;
    UNICODE_STRING KeyName;
 
    RtlInitUnicodeString(&KeyName, L"\\Registry\\Machine\\SYSTEM\\$$$PROTO.HIV");
    Status = CreateRegKey(KeyHandle,
                          NULL,
                          &KeyName,
                          REG_OPTION_NON_VOLATILE,
                          NULL);
    if (!NT_SUCCESS(Status))
        return Status;
 
    NtFlushKey(KeyHandle);
    return Status;
}

Referenced by START_TEST().

CreateRegistryFile()

static NTSTATUS CreateRegistryFile ( IN HANDLE RootDirectory  OPTIONAL, IN PUNICODE_STRING RootPath  OPTIONAL, IN PCWSTR  RegistryKey, IN HANDLE  ProtoKeyHandle  )

static

Definition at line 159 of file NtLoadUnloadKey.c.

{
    NTSTATUS Status;
    HANDLE RootPathHandle, FileHandle;
    UNICODE_STRING FileName;
    OBJECT_ATTRIBUTES ObjectAttributes;
    IO_STATUS_BLOCK IoStatusBlock;
 
    /* Open the root directory */
    Status = OpenDirectoryByHandleOrPath(&RootPathHandle, RootDirectory, RootPath);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("OpenDirectoryByHandleOrPath failed, Status 0x%08lx\n", Status);
        return Status;
    }
 
    /* Create the file */
    RtlInitUnicodeString(&FileName, RegistryKey);
    InitializeObjectAttributes(&ObjectAttributes,
                               &FileName,
                               OBJ_CASE_INSENSITIVE,
                               (HANDLE)((ULONG_PTR)RootPathHandle & ~1), // Remove the opened-locally flag
                               NULL);
    Status = NtCreateFile(&FileHandle,
                          FILE_GENERIC_WRITE /* | DELETE */,
                          &ObjectAttributes,
                          &IoStatusBlock,
                          NULL,
                          FILE_ATTRIBUTE_NORMAL /* | FILE_FLAG_DELETE_ON_CLOSE */,
                          0,
                          FILE_OVERWRITE_IF,
                          FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,
                          NULL,
                          0);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("NtCreateFile(%wZ) failed, Status 0x%08lx\n", &FileName, Status);
        goto Cleanup;
    }
 
    /* Save the selected hive into the file */
    Status = NtSaveKeyEx(ProtoKeyHandle, FileHandle, REG_LATEST_FORMAT);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("NtSaveKeyEx(%wZ) failed, Status 0x%08lx\n", &FileName, Status);
    }
 
    /* Close the file, the root directory (if opened locally), and return */
    NtClose(FileHandle);
Cleanup:
    if ((ULONG_PTR)RootPathHandle & 1) NtClose((HANDLE)((ULONG_PTR)RootPathHandle & ~1));
    return Status;
}

Referenced by START_TEST().

CreateRegKey()

static NTSTATUS CreateRegKey ( OUT PHANDLE  KeyHandle, IN HANDLE RootKey  OPTIONAL, IN PUNICODE_STRING  KeyName, IN ULONG  CreateOptions, OUT PULONG Disposition  OPTIONAL  )

static

Definition at line 49 of file NtLoadUnloadKey.c.

{
    OBJECT_ATTRIBUTES ObjectAttributes;
 
    InitializeObjectAttributes(&ObjectAttributes,
                               KeyName,
                               OBJ_CASE_INSENSITIVE,
                               RootKey,
                               NULL);
    return NtCreateKey(KeyHandle,
                       KEY_ALL_ACCESS,
                       &ObjectAttributes,
                       0,
                       NULL,
                       CreateOptions,
                       Disposition);
}

Referenced by CreateProtoHive(), and START_TEST().

DestroyProtoHive()

static VOID DestroyProtoHive ( IN HANDLE  KeyHandle )

static

Definition at line 93 of file NtLoadUnloadKey.c.

{
    NtDeleteKey(KeyHandle);
    NtClose(KeyHandle);
}

Referenced by START_TEST().

DisconnectRegistry()

static NTSTATUS DisconnectRegistry ( IN HANDLE RootKey  OPTIONAL, IN PCWSTR  RegMountPoint, IN ULONG  Flags  )

static

Definition at line 371 of file NtLoadUnloadKey.c.

{
    UNICODE_STRING KeyName;
    OBJECT_ATTRIBUTES ObjectAttributes;
 
    RtlInitUnicodeString(&KeyName, RegMountPoint);
    InitializeObjectAttributes(&ObjectAttributes,
                               &KeyName,
                               OBJ_CASE_INSENSITIVE,
                               RootKey,
                               NULL);
    if (!pNtUnloadKey2)
    {
        win_skip("NtUnloadKey2 unavailable, using NtUnloadKey. Flags %lu\n", Flags);
        return NtUnloadKey(&ObjectAttributes);
    }
    return pNtUnloadKey2(&ObjectAttributes, Flags);
}

Referenced by START_TEST().

MyDeleteFile()

static NTSTATUS MyDeleteFile ( IN HANDLE RootDirectory  OPTIONAL, IN PUNICODE_STRING RootPath  OPTIONAL, IN PCWSTR  FileName, IN BOOLEAN  ForceDelete  )

static

Definition at line 221 of file NtLoadUnloadKey.c.

{
    NTSTATUS Status;
    HANDLE RootPathHandle;
    UNICODE_STRING NtPath;
    OBJECT_ATTRIBUTES ObjectAttributes;
    IO_STATUS_BLOCK IoStatusBlock;
    HANDLE FileHandle;
    FILE_DISPOSITION_INFORMATION FileDispInfo;
    BOOLEAN RetryOnce = FALSE;
 
    /* Open the root directory */
    Status = OpenDirectoryByHandleOrPath(&RootPathHandle, RootDirectory, RootPath);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("OpenDirectoryByHandleOrPath failed, Status 0x%08lx\n", Status);
        return Status;
    }
 
    /* Open the directory name that was passed in */
    RtlInitUnicodeString(&NtPath, FileName);
    InitializeObjectAttributes(&ObjectAttributes,
                               &NtPath,
                               OBJ_CASE_INSENSITIVE,
                               RootPathHandle,
                               NULL);
 
Retry: /* We go back there once if RetryOnce == TRUE */
    Status = NtOpenFile(&FileHandle,
                        DELETE | FILE_READ_ATTRIBUTES |
                        (RetryOnce ? FILE_WRITE_ATTRIBUTES : 0),
                        &ObjectAttributes,
                        &IoStatusBlock,
                        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
                        FILE_NON_DIRECTORY_FILE | FILE_OPEN_FOR_BACKUP_INTENT);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("NtOpenFile failed with Status 0x%08lx\n", Status);
        return Status;
    }
 
    if (RetryOnce)
    {
        FILE_BASIC_INFORMATION FileInformation;
 
        Status = NtQueryInformationFile(FileHandle,
                                        &IoStatusBlock,
                                        &FileInformation,
                                        sizeof(FILE_BASIC_INFORMATION),
                                        FileBasicInformation);
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("NtQueryInformationFile failed with Status 0x%08lx\n", Status);
            NtClose(FileHandle);
            return Status;
        }
 
        FileInformation.FileAttributes = FILE_ATTRIBUTE_NORMAL;
        Status = NtSetInformationFile(FileHandle,
                                      &IoStatusBlock,
                                      &FileInformation,
                                      sizeof(FILE_BASIC_INFORMATION),
                                      FileBasicInformation);
        NtClose(FileHandle);
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("NtSetInformationFile failed with Status 0x%08lx\n", Status);
            return Status;
        }
    }
 
    /* Ask for the file to be deleted */
    FileDispInfo.DeleteFile = TRUE;
    Status = NtSetInformationFile(FileHandle,
                                  &IoStatusBlock,
                                  &FileDispInfo,
                                  sizeof(FILE_DISPOSITION_INFORMATION),
                                  FileDispositionInformation);
    NtClose(FileHandle);
 
    if (!NT_SUCCESS(Status))
        DPRINT1("Deletion of file '%S' failed, Status 0x%08lx\n", FileName, Status);
 
    // FIXME: Check the precise value of Status!
    if (!NT_SUCCESS(Status) && ForceDelete && !RetryOnce)
    {
        /* Retry once */
        RetryOnce = TRUE;
        goto Retry;
    }
 
    /* Return result to the caller */
    return Status;
}

Referenced by START_TEST().

NTSTATUS()

static NTSTATUS ( NTAPI *  pNtUnloadKey2 )

static

OpenDirectoryByHandleOrPath()

static NTSTATUS OpenDirectoryByHandleOrPath ( OUT PHANDLE  RootPathHandle, IN HANDLE RootDirectory  OPTIONAL, IN PUNICODE_STRING RootPath  OPTIONAL  )

static

Definition at line 101 of file NtLoadUnloadKey.c.

{
    NTSTATUS Status;
    OBJECT_ATTRIBUTES ObjectAttributes;
    IO_STATUS_BLOCK IoStatusBlock;
 
    *RootPathHandle = NULL;
 
    /*
     * RootDirectory and RootPath cannot be either both NULL
     * or both non-NULL, when being specified.
     */
    if ((!RootDirectory && !RootPath) ||
        ( RootDirectory &&  RootPath))
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    if (!RootDirectory && RootPath)
    {
        /* Open the root directory path */
        InitializeObjectAttributes(&ObjectAttributes,
                                   RootPath,
                                   OBJ_CASE_INSENSITIVE,
                                   NULL,
                                   NULL);
        Status = NtOpenFile(RootPathHandle,
                            // FILE_TRAVERSE is needed to be able to use the handle as RootDirectory for future InitializeObjectAttributes calls.
                            FILE_LIST_DIRECTORY | FILE_ADD_FILE /* | FILE_ADD_SUBDIRECTORY */ | FILE_TRAVERSE | SYNCHRONIZE,
                            &ObjectAttributes,
                            &IoStatusBlock,
                            FILE_SHARE_READ | FILE_SHARE_WRITE,
                            FILE_SYNCHRONOUS_IO_NONALERT | FILE_DIRECTORY_FILE /* | FILE_OPEN_FOR_BACKUP_INTENT */);
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("NtOpenFile(%wZ) failed, Status 0x%08lx\n", RootPath, Status);
            return Status;
        }
 
        /* Mark the handle as being opened locally */
        *RootPathHandle = (HANDLE)((ULONG_PTR)*RootPathHandle | 1);
    }
    else if (RootDirectory && !RootPath)
    {
        *RootPathHandle = RootDirectory;
    }
    // No other cases possible
 
    return STATUS_SUCCESS;
}

Referenced by ConnectRegistry(), CreateRegistryFile(), and MyDeleteFile().

RetrieveCurrentModuleNTDirectory()

static BOOLEAN RetrieveCurrentModuleNTDirectory ( OUT PUNICODE_STRING  NtPath )

static

Definition at line 31 of file NtLoadUnloadKey.c.

{
    WCHAR ModulePath[MAX_PATH];
    PWSTR PathSep;
 
    /* Retrieve the current path where the test is running */
    GetModuleFileNameW(NULL, ModulePath, _countof(ModulePath));
    PathSep = wcsrchr(ModulePath, L'\\');
    if (!PathSep)
        PathSep = ModulePath + wcslen(ModulePath);
    *PathSep = UNICODE_NULL;
 
    /* Convert the path to NT format and work with it for now on */
    return RtlDosPathNameToNtPathName_U(ModulePath, NtPath, NULL, NULL);
}

Referenced by START_TEST().

START_TEST()

START_TEST

(

NtLoadUnloadKey

)

Definition at line 394 of file NtLoadUnloadKey.c.

{
    typedef struct _HIVE_LIST_ENTRY
    {
        PCWSTR HiveName;
        PCWSTR RegMountPoint;
    } HIVE_LIST_ENTRY;
 
    static const HIVE_LIST_ENTRY RegistryHives[] =
    {
        { L"TestHive1", L"\\Registry\\Machine\\TestHive1" },
        { L"TestHive2", L"\\Registry\\Machine\\TestHive2" },
    };
 
    NTSTATUS Status;
    UNICODE_STRING NtTestPath;
    UNICODE_STRING KeyName;
    HANDLE KeyHandle;
    ULONG Disposition;
    UINT i;
    BOOLEAN PrivilegeSet[2] = {FALSE, FALSE};
    WCHAR PathBuffer[MAX_PATH];
 
    pNtUnloadKey2 = (PVOID)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtUnloadKey2");
 
    /* Retrieve our current directory */
    RetrieveCurrentModuleNTDirectory(&NtTestPath);
 
    /* Acquire restore privilege */
    Status = RtlAdjustPrivilege(SE_RESTORE_PRIVILEGE, TRUE, FALSE, &PrivilegeSet[0]);
    if (!NT_SUCCESS(Status))
    {
        skip("RtlAdjustPrivilege(SE_RESTORE_PRIVILEGE) failed (Status 0x%08lx)\n", Status);
        /* Exit prematurely here.... */
        // goto Cleanup;
        RtlFreeUnicodeString(&NtTestPath);
        return;
    }
 
    /* Acquire backup privilege */
    Status = RtlAdjustPrivilege(SE_BACKUP_PRIVILEGE, TRUE, FALSE, &PrivilegeSet[1]);
    if (!NT_SUCCESS(Status))
    {
        skip("RtlAdjustPrivilege(SE_BACKUP_PRIVILEGE) failed (Status 0x%08lx)\n", Status);
        RtlAdjustPrivilege(SE_RESTORE_PRIVILEGE, PrivilegeSet[0], FALSE, &PrivilegeSet[0]);
        /* Exit prematurely here.... */
        // goto Cleanup;
        RtlFreeUnicodeString(&NtTestPath);
        return;
    }
 
    /* Create the template proto-hive */
    Status = CreateProtoHive(&KeyHandle);
    if (!NT_SUCCESS(Status))
    {
        skip("CreateProtoHive() failed to create the proto-hive; Status 0x%08lx\n", Status);
        goto Cleanup;
    }
 
    /* Create two registry hive files from it */
    for (i = 0; i < _countof(RegistryHives); ++i)
    {
        Status = CreateRegistryFile(NULL, &NtTestPath,
                                    RegistryHives[i].HiveName,
                                    KeyHandle);
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("CreateRegistryFile(%S) failed, Status 0x%08lx\n", RegistryHives[i].HiveName, Status);
            /* Exit prematurely here.... */
            break;
        }
    }
 
    /* That is now done, remove the proto-hive */
    DestroyProtoHive(KeyHandle);
 
    /* Exit prematurely here if we failed */
    if (!NT_SUCCESS(Status))
        goto Cleanup;
 
 
/***********************************************************************************************/
 
 
    /* Now, mount the first hive */
    Status = ConnectRegistry(NULL, RegistryHives[0].RegMountPoint,
                             NULL, &NtTestPath,
                             RegistryHives[0].HiveName);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("ConnectRegistry('%wZ\\%S', '%S') failed, Status 0x%08lx\n",
                &NtTestPath, RegistryHives[0].HiveName, RegistryHives[0].RegMountPoint, Status);
    }
 
    /* Create or open a key inside the mounted hive */
    StringCchPrintfW(PathBuffer, _countof(PathBuffer), L"%s\\%s", RegistryHives[0].RegMountPoint, L"MyKey_1");
    RtlInitUnicodeString(&KeyName, PathBuffer);
 
    KeyHandle = NULL;
    Status = CreateRegKey(&KeyHandle,
                          NULL,
                          &KeyName,
                          REG_OPTION_NON_VOLATILE,
                          &Disposition);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("CreateRegKey(%wZ) failed (Status %lx)\n", &KeyName, Status);
    }
    else
    {
        DPRINT1("CreateRegKey(%wZ) succeeded to %s the key (Status %lx)\n",
                &KeyName,
                Disposition == REG_CREATED_NEW_KEY ? "create" : /* REG_OPENED_EXISTING_KEY */ "open",
                Status);
    }
 
    /* The key handle must be valid here */
    Status = NtFlushKey(KeyHandle);
    ok_ntstatus(Status, STATUS_SUCCESS);
 
    /* Attempt to unmount the hive, with the handle key still opened */
    Status = DisconnectRegistry(NULL, RegistryHives[0].RegMountPoint, 0); // Same as NtUnloadKey(&ObjectAttributes);
    DPRINT1("Unmounting '%S' %s\n", RegistryHives[0].RegMountPoint, NT_SUCCESS(Status) ? "succeeded" : "failed");
    ok_ntstatus(Status, STATUS_CANNOT_DELETE);
 
    /* The key handle should still be valid here */
    Status = NtFlushKey(KeyHandle);
    ok_ntstatus(Status, STATUS_SUCCESS);
 
    /* Force-unmount the hive, with the handle key still opened */
    Status = DisconnectRegistry(NULL, RegistryHives[0].RegMountPoint, REG_FORCE_UNLOAD);
    DPRINT1("Force-unmounting '%S' %s\n", RegistryHives[0].RegMountPoint, NT_SUCCESS(Status) ? "succeeded" : "failed");
    ok_hex(Status, STATUS_SUCCESS);
 
    /* The key handle should not be valid anymore */
    Status = NtFlushKey(KeyHandle);
    if (Status != STATUS_KEY_DELETED    /* Win2k3 */ &&
        Status != STATUS_HIVE_UNLOADED  /* Win7+  */)
    {
        ok_ntstatus(Status, STATUS_KEY_DELETED);
    }
 
    /* The key handle should not be valid anymore */
    Status = NtDeleteKey(KeyHandle);
    ok_ntstatus(Status, STATUS_SUCCESS);
 
    /* Close by principle the handle, but should this fail? */
    Status = NtClose(KeyHandle);
    ok_ntstatus(Status, STATUS_SUCCESS);
 
 
/***********************************************************************************************/
 
 
    /* Now, mount the first hive, again */
    Status = ConnectRegistry(NULL, RegistryHives[0].RegMountPoint,
                             NULL, &NtTestPath,
                             RegistryHives[0].HiveName);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("ConnectRegistry('%wZ\\%S', '%S') failed, Status 0x%08lx\n",
                &NtTestPath, RegistryHives[0].HiveName, RegistryHives[0].RegMountPoint, Status);
    }
 
    /* Create or open a key inside the mounted hive */
    StringCchPrintfW(PathBuffer, _countof(PathBuffer), L"%s\\%s", RegistryHives[0].RegMountPoint, L"MyKey_2");
    RtlInitUnicodeString(&KeyName, PathBuffer);
 
    KeyHandle = NULL;
    Status = CreateRegKey(&KeyHandle,
                          NULL,
                          &KeyName,
                          REG_OPTION_NON_VOLATILE,
                          &Disposition);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("CreateRegKey(%wZ) failed (Status %lx)\n", &KeyName, Status);
    }
    else
    {
        DPRINT1("CreateRegKey(%wZ) succeeded to %s the key (Status %lx)\n",
                &KeyName,
                Disposition == REG_CREATED_NEW_KEY ? "create" : /* REG_OPENED_EXISTING_KEY */ "open",
                Status);
    }
 
    /* The key handle must be valid here */
    Status = NtFlushKey(KeyHandle);
    ok_ntstatus(Status, STATUS_SUCCESS);
 
    /* Delete the key, this should succeed */
    Status = NtDeleteKey(KeyHandle);
    ok_ntstatus(Status, STATUS_SUCCESS);
 
    /* Close the handle, this should succeed */
    Status = NtClose(KeyHandle);
    ok_ntstatus(Status, STATUS_SUCCESS);
 
    /* Attempt to unmount the hive (no forcing), this should succeed */
    Status = DisconnectRegistry(NULL, RegistryHives[0].RegMountPoint, 0); // Same as NtUnloadKey(&ObjectAttributes);
    DPRINT1("Unmounting '%S' %s\n", RegistryHives[0].RegMountPoint, NT_SUCCESS(Status) ? "succeeded" : "failed");
    ok_ntstatus(Status, STATUS_SUCCESS);
 
    /* Force-unmount the hive (it is already unmounted), this should fail */
    Status = DisconnectRegistry(NULL, RegistryHives[0].RegMountPoint, REG_FORCE_UNLOAD);
    DPRINT1("Force-unmounting '%S' %s\n", RegistryHives[0].RegMountPoint, NT_SUCCESS(Status) ? "succeeded" : "failed");
    ok_hex(Status, STATUS_INVALID_PARAMETER);
 
#if 0
    /* Close by principle the handle, but should this fail? */
    Status = NtClose(KeyHandle);
    ok_ntstatus(Status, STATUS_SUCCESS);
#endif
 
 
/***********************************************************************************************/
 
 
Cleanup:
 
    /* Destroy the hive files */
    for (i = 0; i < _countof(RegistryHives); ++i)
    {
        Status = MyDeleteFile(NULL, &NtTestPath,
                              RegistryHives[i].HiveName, TRUE);
        if (!NT_SUCCESS(Status))
            DPRINT1("MyDeleteFile(%S) failed, Status 0x%08lx\n", RegistryHives[i].HiveName, Status);
    }
 
    /* Remove restore and backup privileges */
    RtlAdjustPrivilege(SE_BACKUP_PRIVILEGE, PrivilegeSet[1], FALSE, &PrivilegeSet[1]);
    RtlAdjustPrivilege(SE_RESTORE_PRIVILEGE, PrivilegeSet[0], FALSE, &PrivilegeSet[0]);
 
    RtlFreeUnicodeString(&NtTestPath);
}

Variable Documentation

ULONG

ULONG

Definition at line 28 of file NtLoadUnloadKey.c.