Registry.c File Reference

#include "fltmgr.h"
#include "fltmgrint.h"
#include <debug.h>

Include dependency graph for Registry.c:

Go to the source code of this file.

Macros
#define	NDEBUG
#define	REG_SERVICES_KEY   L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\"
#define	REG_PATH_LENGTH   512

Functions
NTSTATUS	FltpOpenFilterServicesKey (_In_ PFLT_FILTER Filter, _In_ ACCESS_MASK DesiredAccess, _In_opt_ PUNICODE_STRING SubKey, _Out_ PHANDLE Handle)
NTSTATUS	FltpReadRegistryValue (_In_ HANDLE KeyHandle, _In_ PUNICODE_STRING ValueName, _In_opt_ ULONG Type, _Out_writes_bytes_(BufferSize) PVOID Buffer, _In_ ULONG BufferSize, _Out_opt_ PULONG BytesRequired)

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 14 of file Registry.c.

REG_PATH_LENGTH

#define REG_PATH_LENGTH   512

Definition at line 21 of file Registry.c.

REG_SERVICES_KEY

#define REG_SERVICES_KEY   L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\"

Definition at line 20 of file Registry.c.

Function Documentation

FltpOpenFilterServicesKey()

NTSTATUS FltpOpenFilterServicesKey	(	_In_ PFLT_FILTER	Filter,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_opt_ PUNICODE_STRING	SubKey,
		_Out_ PHANDLE	Handle
	)

Definition at line 28 of file Registry.c.

{
    OBJECT_ATTRIBUTES ObjectAttributes;
    UNICODE_STRING ServicesKey;
    UNICODE_STRING Path;
    WCHAR Buffer[REG_PATH_LENGTH];
 
    /* Setup a local buffer to hold the services key path */
    Path.Length = 0;
    Path.MaximumLength = REG_PATH_LENGTH;
    Path.Buffer = Buffer;
 
    /* Build up the serices key name */
    RtlInitUnicodeString(&ServicesKey, REG_SERVICES_KEY);
    RtlCopyUnicodeString(&Path, &ServicesKey);
    RtlAppendUnicodeStringToString(&Path, &Filter->Name);
 
    if (SubKey)
    {
        /* Tag on any child key */
        RtlAppendUnicodeToString(&Path, L"\\");
        RtlAppendUnicodeStringToString(&Path, SubKey);
    }
 
    InitializeObjectAttributes(&ObjectAttributes,
                               &Path,
                               OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE,
                               NULL,
                               NULL);
 
    /* Open and return the key handle param*/
    return ZwOpenKey(Handle, DesiredAccess, &ObjectAttributes);
}

Referenced by GetFilterAltitude().

FltpReadRegistryValue()

NTSTATUS FltpReadRegistryValue	(	_In_ HANDLE	KeyHandle,
		_In_ PUNICODE_STRING	ValueName,
		_In_opt_ ULONG	Type,
		_Out_writes_bytes_(BufferSize) PVOID	Buffer,
		_In_ ULONG	BufferSize,
		_Out_opt_ PULONG	BytesRequired
	)

Definition at line 67 of file Registry.c.

{
    PKEY_VALUE_PARTIAL_INFORMATION Value = NULL;
    ULONG ValueLength = 0;
    NTSTATUS Status;
 
    PAGED_CODE();
 
    /* Get the size of the buffer required to hold the string */
    Status = ZwQueryValueKey(KeyHandle,
                             ValueName,
                             KeyValuePartialInformation,
                             NULL,
                             0,
                             &ValueLength);
    if (Status != STATUS_BUFFER_TOO_SMALL && Status != STATUS_BUFFER_OVERFLOW)
    {
        return Status;
    }
 
    /* Allocate the buffer */
    Value = (PKEY_VALUE_PARTIAL_INFORMATION)ExAllocatePoolWithTag(PagedPool,
                                                                  ValueLength,
                                                                  FM_TAG_TEMP_REGISTRY);
    if (Value == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto Quit;
    }
 
    /* Now read in the value */
    Status = ZwQueryValueKey(KeyHandle,
                             ValueName,
                             KeyValuePartialInformation,
                             Value,
                             ValueLength,
                             &ValueLength);
    if (!NT_SUCCESS(Status))
    {
        goto Quit;
    }
 
    /* Make sure we got the type expected */
    if (Value->Type != Type)
    {
        Status = STATUS_INVALID_PARAMETER;
        goto Quit;
    }
 
    if (BytesRequired)
    {
        *BytesRequired = Value->DataLength;
    }
 
    /* Make sure the caller buffer is big enough to hold the data */
    if (!BufferSize || BufferSize < Value->DataLength)
    {
        Status = STATUS_BUFFER_TOO_SMALL;
        goto Quit;
    }
 
    /* Copy the data into the caller buffer */
    RtlCopyMemory(Buffer, Value->Data, Value->DataLength);
 
Quit:
 
    if (Value)
        ExFreePoolWithTag(Value, FM_TAG_TEMP_REGISTRY);
 
    return Status;
}

Referenced by GetFilterAltitude().