ReactOS  0.4.14-dev-838-g99f979d
ntapi.c File Reference
#include "ntoskrnl.h"
#include "debug.h"
Include dependency graph for ntapi.c:

Go to the source code of this file.

Macros

#define NDEBUG
 
#define PRODUCT_ACTIVATION_VERSION   7749
 

Functions

VOID ReleaseCapturedObjectAttributes (_In_ POBJECT_ATTRIBUTES CapturedObjectAttributes, _In_ KPROCESSOR_MODE AccessMode)
 
NTSTATUS ProbeAndCaptureObjectAttributes (_Out_ POBJECT_ATTRIBUTES CapturedObjectAttributes, _Out_ PUNICODE_STRING ObjectName, _In_ KPROCESSOR_MODE AccessMode, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ BOOLEAN CaptureSecurity)
 
static NTSTATUS CmpConvertHandleToKernelHandle (_In_ HANDLE SourceHandle, _In_opt_ POBJECT_TYPE ObjectType, _In_ ACCESS_MASK DesiredAccess, _In_ KPROCESSOR_MODE AccessMode, _Out_ PHANDLE KernelHandle)
 
NTSTATUS NTAPI NtCreateKey (OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG TitleIndex, IN PUNICODE_STRING Class OPTIONAL, IN ULONG CreateOptions, OUT PULONG Disposition OPTIONAL)
 
NTSTATUS NTAPI NtOpenKey (OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes)
 
NTSTATUS NTAPI NtDeleteKey (IN HANDLE KeyHandle)
 
NTSTATUS NTAPI NtEnumerateKey (IN HANDLE KeyHandle, IN ULONG Index, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT PVOID KeyInformation, IN ULONG Length, OUT PULONG ResultLength)
 
NTSTATUS NTAPI NtEnumerateValueKey (IN HANDLE KeyHandle, IN ULONG Index, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, OUT PVOID KeyValueInformation, IN ULONG Length, OUT PULONG ResultLength)
 
NTSTATUS NTAPI NtQueryKey (IN HANDLE KeyHandle, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT PVOID KeyInformation, IN ULONG Length, OUT PULONG ResultLength)
 
NTSTATUS NTAPI NtQueryValueKey (IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, OUT PVOID KeyValueInformation, IN ULONG Length, OUT PULONG ResultLength)
 
NTSTATUS NTAPI NtSetValueKey (IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN ULONG TitleIndex, IN ULONG Type, IN PVOID Data, IN ULONG DataSize)
 
NTSTATUS NTAPI NtDeleteValueKey (IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName)
 
NTSTATUS NTAPI NtFlushKey (IN HANDLE KeyHandle)
 
NTSTATUS NTAPI NtLoadKey (IN POBJECT_ATTRIBUTES KeyObjectAttributes, IN POBJECT_ATTRIBUTES FileObjectAttributes)
 
NTSTATUS NTAPI NtLoadKey2 (IN POBJECT_ATTRIBUTES KeyObjectAttributes, IN POBJECT_ATTRIBUTES FileObjectAttributes, IN ULONG Flags)
 
NTSTATUS NTAPI NtLoadKeyEx (IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile, IN ULONG Flags, IN HANDLE TrustClassKey)
 
NTSTATUS NTAPI NtNotifyChangeKey (IN HANDLE KeyHandle, IN HANDLE Event, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CompletionFilter, IN BOOLEAN WatchTree, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN Asynchronous)
 
NTSTATUS NTAPI NtInitializeRegistry (IN USHORT Flag)
 
NTSTATUS NTAPI NtCompactKeys (IN ULONG Count, IN PHANDLE KeyArray)
 
NTSTATUS NTAPI NtCompressKey (IN HANDLE Key)
 
NTSTATUS NTAPI NtLockProductActivationKeys (IN PULONG pPrivateVer, IN PULONG pSafeMode)
 
NTSTATUS NTAPI NtLockRegistryKey (IN HANDLE KeyHandle)
 
NTSTATUS NTAPI NtNotifyChangeMultipleKeys (IN HANDLE MasterKeyHandle, IN ULONG Count, IN POBJECT_ATTRIBUTES SlaveObjects, IN HANDLE Event, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CompletionFilter, IN BOOLEAN WatchTree, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN Asynchronous)
 
NTSTATUS NTAPI NtQueryMultipleValueKey (IN HANDLE KeyHandle, IN OUT PKEY_VALUE_ENTRY ValueList, IN ULONG NumberOfValues, OUT PVOID Buffer, IN OUT PULONG Length, OUT PULONG ReturnLength)
 
NTSTATUS NTAPI NtQueryOpenSubKeys (IN POBJECT_ATTRIBUTES TargetKey, OUT PULONG HandleCount)
 
NTSTATUS NTAPI NtQueryOpenSubKeysEx (IN POBJECT_ATTRIBUTES TargetKey, IN ULONG BufferLength, IN PVOID Buffer, IN PULONG RequiredSize)
 
NTSTATUS NTAPI NtRenameKey (IN HANDLE KeyHandle, IN PUNICODE_STRING ReplacementName)
 
NTSTATUS NTAPI NtReplaceKey (IN POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE Key, IN POBJECT_ATTRIBUTES ReplacedObjectAttributes)
 
NTSTATUS NTAPI NtRestoreKey (IN HANDLE KeyHandle, IN HANDLE FileHandle, IN ULONG RestoreFlags)
 
NTSTATUS NTAPI NtSaveKey (IN HANDLE KeyHandle, IN HANDLE FileHandle)
 
NTSTATUS NTAPI NtSaveKeyEx (IN HANDLE KeyHandle, IN HANDLE FileHandle, IN ULONG Flags)
 
NTSTATUS NTAPI NtSaveMergedKeys (IN HANDLE HighPrecedenceKeyHandle, IN HANDLE LowPrecedenceKeyHandle, IN HANDLE FileHandle)
 
NTSTATUS NTAPI NtSetInformationKey (IN HANDLE KeyHandle, IN KEY_SET_INFORMATION_CLASS KeyInformationClass, IN PVOID KeyInformation, IN ULONG KeyInformationLength)
 
NTSTATUS NTAPI NtUnloadKey (IN POBJECT_ATTRIBUTES KeyObjectAttributes)
 
NTSTATUS NTAPI NtUnloadKey2 (IN POBJECT_ATTRIBUTES TargetKey, IN ULONG Flags)
 
NTSTATUS NTAPI NtUnloadKeyEx (IN POBJECT_ATTRIBUTES TargetKey, IN HANDLE Event)
 

Variables

BOOLEAN CmBootAcceptFirstTime = TRUE
 
BOOLEAN CmFirstTime = TRUE
 
ULONG InitSafeBootMode
 

Macro Definition Documentation

◆ NDEBUG

#define NDEBUG

Definition at line 13 of file ntapi.c.

◆ PRODUCT_ACTIVATION_VERSION

#define PRODUCT_ACTIVATION_VERSION   7749

Definition at line 1380 of file ntapi.c.

Function Documentation

◆ CmpConvertHandleToKernelHandle()

static NTSTATUS CmpConvertHandleToKernelHandle ( _In_ HANDLE  SourceHandle,
_In_opt_ POBJECT_TYPE  ObjectType,
_In_ ACCESS_MASK  DesiredAccess,
_In_ KPROCESSOR_MODE  AccessMode,
_Out_ PHANDLE  KernelHandle 
)
static

Definition at line 195 of file ntapi.c.

201 {
203  PVOID Object;
204 
205  *KernelHandle = NULL;
206 
207  /* NULL handle is valid */
208  if (SourceHandle == NULL)
209  return STATUS_SUCCESS;
210 
211  /* Get the object pointer */
214  ObjectType,
215  AccessMode,
216  &Object,
217  NULL);
218  if (!NT_SUCCESS(Status))
219  return Status;
220 
221  /* Create a kernel handle from the pointer */
224  NULL,
226  ObjectType,
227  KernelMode,
228  KernelHandle);
229 
230  /* Dereference the object */
232  return Status;
233 }
ObjectType
Definition: metafile.c:80
HANDLE KernelHandle
Definition: legacy.c:24
LONG NTSTATUS
Definition: precomp.h:26
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
_In_ HANDLE SourceHandle
Definition: obfuncs.h:429
NTSTATUS NTAPI ObOpenObjectByPointer(IN PVOID Object, IN ULONG HandleAttributes, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PHANDLE Handle)
Definition: obhandle.c:2739
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
Definition: mmfuncs.h:396
smooth NULL
Definition: ftsmooth.c:416
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
static IUnknown Object
Definition: main.c:512
Status
Definition: gdiplustypes.h:24
_In_ PIO_STACK_LOCATION _Inout_ PFILE_OBJECT _Inout_ PVCB _Outptr_result_maybenull_ PDCB _In_ PDCB _In_ PDIRENT _In_ ULONG _In_ ULONG _In_ PUNICODE_STRING _In_ PACCESS_MASK DesiredAccess
Definition: create.c:4157
return STATUS_SUCCESS
Definition: btrfs.c:2938
#define OBJ_KERNEL_HANDLE
Definition: winternl.h:231

Referenced by NtLoadKeyEx(), NtSaveKeyEx(), NtSaveMergedKeys(), and NtUnloadKey2().

◆ NtCompactKeys()

NTSTATUS NTAPI NtCompactKeys ( IN ULONG  Count,
IN PHANDLE  KeyArray 
)

Definition at line 1364 of file ntapi.c.

1366 {
1367  UNIMPLEMENTED;
1368  return STATUS_NOT_IMPLEMENTED;
1369 }
#define STATUS_NOT_IMPLEMENTED
Definition: ntstatus.h:225
#define UNIMPLEMENTED
Definition: debug.h:114

◆ NtCompressKey()

NTSTATUS NTAPI NtCompressKey ( IN HANDLE  Key)

Definition at line 1373 of file ntapi.c.

1374 {
1375  UNIMPLEMENTED;
1376  return STATUS_NOT_IMPLEMENTED;
1377 }
#define STATUS_NOT_IMPLEMENTED
Definition: ntstatus.h:225
#define UNIMPLEMENTED
Definition: debug.h:114

◆ NtCreateKey()

NTSTATUS NTAPI NtCreateKey ( OUT PHANDLE  KeyHandle,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_ATTRIBUTES  ObjectAttributes,
IN ULONG  TitleIndex,
IN PUNICODE_STRING Class  OPTIONAL,
IN ULONG  CreateOptions,
OUT PULONG Disposition  OPTIONAL 
)

Definition at line 240 of file ntapi.c.

247 {
250  CM_PARSE_CONTEXT ParseContext = {0};
251  HANDLE Handle;
252  PAGED_CODE();
253 
254  DPRINT("NtCreateKey(Path: %wZ, Root %x, Access: %x, CreateOptions %x)\n",
255  ObjectAttributes->ObjectName, ObjectAttributes->RootDirectory,
257 
258  /* Ignore the WOW64 flag, it's not valid in the kernel */
260 
261  /* Check for user-mode caller */
262  if (PreviousMode != KernelMode)
263  {
264  /* Prepare to probe parameters */
265  _SEH2_TRY
266  {
267  /* Check if we have a class */
268  if (Class)
269  {
270  /* Probe it */
271  ParseContext.Class = ProbeForReadUnicodeString(Class);
272  ProbeForRead(ParseContext.Class.Buffer,
273  ParseContext.Class.Length,
274  sizeof(WCHAR));
275  }
276 
277  /* Probe the key handle */
279  *KeyHandle = NULL;
280 
281  /* Probe object attributes */
283  sizeof(OBJECT_ATTRIBUTES),
284  sizeof(ULONG));
285 
286  if (Disposition)
288  }
290  {
291  /* Return the exception code */
293  }
294  _SEH2_END;
295  }
296  else
297  {
298  /* Save the class directly */
299  if (Class) ParseContext.Class = *Class;
300  }
301 
302  /* Setup the parse context */
303  ParseContext.CreateOperation = TRUE;
304  ParseContext.CreateOptions = CreateOptions;
305 
306  /* Do the create */
309  PreviousMode,
310  NULL,
312  &ParseContext,
313  &Handle);
314 
315  _SEH2_TRY
316  {
317  /* Return data to user */
319  if (Disposition) *Disposition = ParseContext.Disposition;
320  }
322  {
323  /* Get the status */
325  }
326  _SEH2_END;
327 
328  DPRINT("Returning handle %x, Status %x.\n", Handle, Status);
329 
330  /* Return status */
331  return Status;
332 }
#define ProbeForWriteUlong(Ptr)
Definition: probe.h:36
NTSTATUS NTAPI ObOpenObjectByName(IN POBJECT_ATTRIBUTES ObjectAttributes, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN OUT PVOID ParseContext, OUT PHANDLE Handle)
Definition: obhandle.c:2529
static const WCHAR Class[]
Definition: cfgmgr.c:39
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
Definition: conport.c:35
#define TRUE
Definition: types.h:120
#define KEY_WOW64_RES
Definition: cmtypes.h:47
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
LONG NTSTATUS
Definition: precomp.h:26
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
ULONG CreateOptions
Definition: cm.h:484
_In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Reserved_ ULONG _In_opt_ PUNICODE_STRING _In_ ULONG _Out_opt_ PULONG Disposition
Definition: cmfuncs.h:50
#define PAGED_CODE()
Definition: video.h:57
_SEH2_TRY
Definition: create.c:4250
ULONG Disposition
Definition: cm.h:485
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
smooth NULL
Definition: ftsmooth.c:416
void DPRINT(...)
Definition: polytest.cpp:61
_In_ HANDLE Handle
Definition: extypes.h:390
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
UNICODE_STRING Class
Definition: cm.h:483
#define _SEH2_YIELD(STMT_)
Definition: pseh2_64.h:8
__wchar_t WCHAR
Definition: xmlstorage.h:180
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define ProbeForWriteHandle(Ptr)
Definition: probe.h:43
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE _In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Out_ PIO_STATUS_BLOCK _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_ ULONG _In_ ULONG CreateOptions
Definition: fltkernel.h:1230
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:102
Status
Definition: gdiplustypes.h:24
_SEH2_END
Definition: create.c:4424
_In_ PIO_STACK_LOCATION _Inout_ PFILE_OBJECT _Inout_ PVCB _Outptr_result_maybenull_ PDCB _In_ PDCB _In_ PDIRENT _In_ ULONG _In_ ULONG _In_ PUNICODE_STRING _In_ PACCESS_MASK DesiredAccess
Definition: create.c:4157
#define ProbeForReadUnicodeString(Ptr)
Definition: probe.h:77
unsigned int ULONG
Definition: retypes.h:1
#define CmpKeyObjectType
Definition: ObTypes.c:132
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12
BOOLEAN CreateOperation
Definition: cm.h:489

Referenced by AddHotkeySettings(), AddKbLayoutsToRegistry(), BasepMoveFileDelayed(), CmInitSystem1(), CmpCreateControlSet(), CmpCreateHardwareProfile(), CmpInitializeHardwareConfiguration(), CmpInitializeMachineDependentConfiguration(), CmpInitializeRegistryNode(), CmpSetVersionData(), create_key(), create_registry_key(), CreateKeyTest(), CreateNestedKey(), CreateRegistryKeyHandle(), CreateRegKey(), CreateSymLinkKey(), DeleteSymLinkKey(), InitFunctionPtrs(), InitializeUserModePnpManager(), InstallDriver(), LsapCreateDatabaseKeys(), LsapCreateDbObject(), LsapSetObjectAttribute(), RegInitializeRegistry(), RegpCopyTree(), SdbRegisterDatabaseEx(), SdbUnregisterDatabase(), SetActiveComputerNameToRegistry(), SetMountedDeviceValue(), SetUserGeoID(), SetValueTest1(), SetValueTest2(), START_TEST(), test2(), test3(), test6(), test7(), Test_KeyFullInformation(), and TestCreateOpen_().

◆ NtDeleteKey()

NTSTATUS NTAPI NtDeleteKey ( IN HANDLE  KeyHandle)

Definition at line 408 of file ntapi.c.

409 {
410  PCM_KEY_BODY KeyObject;
412  REG_DELETE_KEY_INFORMATION DeleteKeyInfo;
413  REG_POST_OPERATION_INFORMATION PostOperationInfo;
414  PAGED_CODE();
415  DPRINT("NtDeleteKey(KH 0x%p)\n", KeyHandle);
416 
417  /* Verify that the handle is valid and is a registry key */
419  DELETE,
422  (PVOID*)&KeyObject,
423  NULL);
424  if (!NT_SUCCESS(Status)) return Status;
425 
426  /* Setup the callback */
427  PostOperationInfo.Object = (PVOID)KeyObject;
428  DeleteKeyInfo.Object = (PVOID)KeyObject;
430  if (NT_SUCCESS(Status))
431  {
432  /* Check if we are read-only */
433  if ((KeyObject->KeyControlBlock->ExtFlags & CM_KCB_READ_ONLY_KEY) ||
434  (KeyObject->KeyControlBlock->ParentKcb->ExtFlags & CM_KCB_READ_ONLY_KEY))
435  {
436  /* Fail */
438  }
439  else
440  {
441  /* Call the internal API */
442  Status = CmDeleteKey(KeyObject);
443  }
444 
445  /* Do post callback */
446  PostOperationInfo.Status = Status;
447  CmiCallRegisteredCallbacks(RegNtPostDeleteKey, &PostOperationInfo);
448  }
449 
450  /* Dereference and return status */
451  ObDereferenceObject(KeyObject);
452  return Status;
453 }
Definition: cmtypes.h:856
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
LONG NTSTATUS
Definition: precomp.h:26
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
#define CM_KCB_READ_ONLY_KEY
Definition: cm.h:61
#define PAGED_CODE()
Definition: video.h:57
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
smooth NULL
Definition: ftsmooth.c:416
void DPRINT(...)
Definition: polytest.cpp:61
void * PVOID
Definition: retypes.h:9
struct _CM_KEY_CONTROL_BLOCK * KeyControlBlock
Definition: cm.h:229
NTSTATUS Status
Definition: cmtypes.h:858
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145
Status
Definition: gdiplustypes.h:24
#define CmpKeyObjectType
Definition: ObTypes.c:132
NTSTATUS CmiCallRegisteredCallbacks(IN REG_NOTIFY_CLASS Argument1, IN PVOID Argument2)
Definition: cmhook.c:59
NTSTATUS NTAPI CmDeleteKey(IN PCM_KEY_BODY KeyBody)
Definition: cmapi.c:1824
PVOID Object
Definition: cmtypes.h:857
#define DELETE
Definition: nt_native.h:57

Referenced by DeleteKeyTest(), DeleteSymLinkKey(), DestroyProtoHive(), do_reg_operation(), InitFunctionPtrs(), LsapRegDeleteKey(), LsapRegDeleteSubKey(), RegCleanupRegistry(), RegDeleteKeyExW(), RegInitializeRegistry(), SampRegDeleteKey(), SdbUnregisterDatabase(), START_TEST(), test2(), test3(), test7(), and Test_KeyFullInformation().

◆ NtDeleteValueKey()

NTSTATUS NTAPI NtDeleteValueKey ( IN HANDLE  KeyHandle,
IN PUNICODE_STRING  ValueName 
)

Definition at line 994 of file ntapi.c.

996 {
998  PCM_KEY_BODY KeyObject;
999  REG_DELETE_VALUE_KEY_INFORMATION DeleteValueKeyInfo;
1000  REG_POST_OPERATION_INFORMATION PostOperationInfo;
1002  UNICODE_STRING ValueNameCopy;
1003 
1004  PAGED_CODE();
1005 
1006  /* Verify that the handle is valid and is a registry key */
1008  KEY_SET_VALUE,
1010  PreviousMode,
1011  (PVOID*)&KeyObject,
1012  NULL);
1013  if (!NT_SUCCESS(Status))
1014  return Status;
1015 
1016  /* Capture the string */
1018  if (!NT_SUCCESS(Status))
1019  goto Quit;
1020 
1021  /* Make sure the name is aligned properly */
1022  if ((ValueNameCopy.Length & (sizeof(WCHAR) - 1)))
1023  {
1024  /* It isn't, so we'll fail */
1026  goto Quit;
1027  }
1028 
1029  /* Don't touch read-only keys */
1030  if (KeyObject->KeyControlBlock->ExtFlags & CM_KCB_READ_ONLY_KEY)
1031  {
1032  /* Fail */
1034  goto Quit;
1035  }
1036 
1037  /* Do the callback */
1038  DeleteValueKeyInfo.Object = (PVOID)KeyObject;
1039  DeleteValueKeyInfo.ValueName = ValueName;
1041  &DeleteValueKeyInfo);
1042  if (NT_SUCCESS(Status))
1043  {
1044  /* Call the internal API */
1045  Status = CmDeleteValueKey(KeyObject->KeyControlBlock, ValueNameCopy);
1046 
1047  /* Do the post callback */
1048  PostOperationInfo.Object = (PVOID)KeyObject;
1049  PostOperationInfo.Status = Status;
1051  &PostOperationInfo);
1052  }
1053 
1054 Quit:
1055  if (ValueNameCopy.Buffer)
1056  ReleaseCapturedUnicodeString(&ValueNameCopy, PreviousMode);
1057 
1058  /* Dereference and return status */
1059  ObDereferenceObject(KeyObject);
1060  return Status;
1061 }
static __inline NTSTATUS ProbeAndCaptureUnicodeString(OUT PUNICODE_STRING Dest, IN KPROCESSOR_MODE CurrentMode, IN const UNICODE_STRING *UnsafeSrc)
Definition: probe.h:142
Definition: cmtypes.h:856
#define KEY_SET_VALUE
Definition: nt_native.h:1017
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
LONG NTSTATUS
Definition: precomp.h:26
NTSTATUS NTAPI CmDeleteValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN UNICODE_STRING ValueName)
Definition: cmapi.c:916
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
#define CM_KCB_READ_ONLY_KEY
Definition: cm.h:61
#define PAGED_CODE()
Definition: video.h:57
_In_ PUNICODE_STRING ValueName
Definition: cmfuncs.h:264
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
smooth NULL
Definition: ftsmooth.c:416
void * PVOID
Definition: retypes.h:9
struct _CM_KEY_CONTROL_BLOCK * KeyControlBlock
Definition: cm.h:229
static __inline VOID ReleaseCapturedUnicodeString(IN PUNICODE_STRING CapturedString, IN KPROCESSOR_MODE CurrentMode)
Definition: probe.h:239
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
NTSTATUS Status
Definition: cmtypes.h:858
__wchar_t WCHAR
Definition: xmlstorage.h:180
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
Status
Definition: gdiplustypes.h:24
#define CmpKeyObjectType
Definition: ObTypes.c:132
NTSTATUS CmiCallRegisteredCallbacks(IN REG_NOTIFY_CLASS Argument1, IN PVOID Argument2)
Definition: cmhook.c:59
PVOID Object
Definition: cmtypes.h:857

Referenced by CmpSetVersionData(), DeleteSymLinkKey(), DeleteValueTest(), InitFunctionPtrs(), LsapRegDeleteValue(), RegDeleteKeyValueW(), RegDeleteValueA(), RegDeleteValueW(), RtlApplyRXact(), RtlInitializeRXact(), SampRegDeleteValue(), SdbDeletePermLayerKeys(), SmpLoadDataFromRegistry(), START_TEST(), and test7().

◆ NtEnumerateKey()

NTSTATUS NTAPI NtEnumerateKey ( IN HANDLE  KeyHandle,
IN ULONG  Index,
IN KEY_INFORMATION_CLASS  KeyInformationClass,
OUT PVOID  KeyInformation,
IN ULONG  Length,
OUT PULONG  ResultLength 
)

Definition at line 457 of file ntapi.c.

463 {
466  PCM_KEY_BODY KeyObject;
467  REG_ENUMERATE_KEY_INFORMATION EnumerateKeyInfo;
468  REG_POST_OPERATION_INFORMATION PostOperationInfo;
469  PAGED_CODE();
470  DPRINT("NtEnumerateKey() KH 0x%p, Index 0x%x, KIC %d, Length %lu\n",
472 
473  /* Reject classes we don't know about */
477  {
478  /* Fail */
480  }
481 
482  /* Verify that the handle is valid and is a registry key */
486  PreviousMode,
487  (PVOID*)&KeyObject,
488  NULL);
489  if (!NT_SUCCESS(Status)) return Status;
490 
491  if (PreviousMode != KernelMode)
492  {
493  _SEH2_TRY
494  {
496  ProbeForWrite(KeyInformation,
497  Length,
498  sizeof(ULONG));
499  }
501  {
502  /* Dereference and return status */
503  ObDereferenceObject(KeyObject);
505  }
506  _SEH2_END;
507  }
508 
509  /* Setup the callback */
510  PostOperationInfo.Object = (PVOID)KeyObject;
511  EnumerateKeyInfo.Object = (PVOID)KeyObject;
512  EnumerateKeyInfo.Index = Index;
513  EnumerateKeyInfo.KeyInformationClass = KeyInformationClass;
514  EnumerateKeyInfo.Length = Length;
515  EnumerateKeyInfo.ResultLength = ResultLength;
516 
517  /* Do the callback */
519  if (NT_SUCCESS(Status))
520  {
521  /* Call the internal API */
523  Index,
525  KeyInformation,
526  Length,
527  ResultLength);
528 
529  /* Do the post callback */
530  PostOperationInfo.Status = Status;
532  }
533 
534  /* Dereference and return status */
535  ObDereferenceObject(KeyObject);
536  DPRINT("Returning status %x.\n", Status);
537  return Status;
538 }
#define ProbeForWriteUlong(Ptr)
Definition: probe.h:36
IN CINT OUT PVOID IN ULONG OUT PULONG ResultLength
Definition: conport.c:47
Definition: cmtypes.h:856
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
_In_ ULONG _In_ KEY_INFORMATION_CLASS KeyInformationClass
Definition: zwfuncs.h:166
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
LONG NTSTATUS
Definition: precomp.h:26
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:143
#define PAGED_CODE()
Definition: video.h:57
_SEH2_TRY
Definition: create.c:4250
KEY_INFORMATION_CLASS KeyInformationClass
Definition: cmtypes.h:742
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
smooth NULL
Definition: ftsmooth.c:416
void DPRINT(...)
Definition: polytest.cpp:61
void * PVOID
Definition: retypes.h:9
struct _CM_KEY_CONTROL_BLOCK * KeyControlBlock
Definition: cm.h:229
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
NTSTATUS Status
Definition: cmtypes.h:858
#define _SEH2_YIELD(STMT_)
Definition: pseh2_64.h:8
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
static const UCHAR Index[8]
Definition: usbohci.c:18
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:101
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
Status
Definition: gdiplustypes.h:24
_SEH2_END
Definition: create.c:4424
unsigned int ULONG
Definition: retypes.h:1
#define CmpKeyObjectType
Definition: ObTypes.c:132
NTSTATUS CmiCallRegisteredCallbacks(IN REG_NOTIFY_CLASS Argument1, IN PVOID Argument2)
Definition: cmhook.c:59
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12
NTSTATUS NTAPI CmEnumerateKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN ULONG Index, IN KEY_INFORMATION_CLASS KeyInformationClass, IN PVOID KeyInformation, IN ULONG Length, IN PULONG ResultLength)
Definition: cmapi.c:1735
PVOID Object
Definition: cmtypes.h:857
#define KEY_ENUMERATE_SUB_KEYS
Definition: nt_native.h:1019

◆ NtEnumerateValueKey()

NTSTATUS NTAPI NtEnumerateValueKey ( IN HANDLE  KeyHandle,
IN ULONG  Index,
IN KEY_VALUE_INFORMATION_CLASS  KeyValueInformationClass,
OUT PVOID  KeyValueInformation,
IN ULONG  Length,
OUT PULONG  ResultLength 
)

Definition at line 542 of file ntapi.c.

548 {
551  PCM_KEY_BODY KeyObject;
552  REG_ENUMERATE_VALUE_KEY_INFORMATION EnumerateValueKeyInfo;
553  REG_POST_OPERATION_INFORMATION PostOperationInfo;
554 
555  PAGED_CODE();
556 
557  DPRINT("NtEnumerateValueKey() KH 0x%p, Index 0x%x, KVIC %d, Length %lu\n",
559 
560  /* Reject classes we don't know about */
566  {
567  /* Fail */
569  }
570 
571  /* Verify that the handle is valid and is a registry key */
575  PreviousMode,
576  (PVOID*)&KeyObject,
577  NULL);
578  if (!NT_SUCCESS(Status)) return Status;
579 
580  if (PreviousMode != KernelMode)
581  {
582  _SEH2_TRY
583  {
585  ProbeForWrite(KeyValueInformation,
586  Length,
587  sizeof(ULONG));
588  }
590  {
591  /* Dereference and return status */
592  ObDereferenceObject(KeyObject);
594  }
595  _SEH2_END;
596  }
597 
598  /* Setup the callback */
599  PostOperationInfo.Object = (PVOID)KeyObject;
600  EnumerateValueKeyInfo.Object = (PVOID)KeyObject;
601  EnumerateValueKeyInfo.Index = Index;
602  EnumerateValueKeyInfo.KeyValueInformationClass = KeyValueInformationClass;
603  EnumerateValueKeyInfo.KeyValueInformation = KeyValueInformation;
604  EnumerateValueKeyInfo.Length = Length;
605  EnumerateValueKeyInfo.ResultLength = ResultLength;
606 
607  /* Do the callback */
609  &EnumerateValueKeyInfo);
610  if (NT_SUCCESS(Status))
611  {
612  /* Call the internal API */
614  Index,
616  KeyValueInformation,
617  Length,
618  ResultLength);
619 
620  /* Do the post callback */
621  PostOperationInfo.Status = Status;
623  }
624 
625  /* Dereference and return status */
626  ObDereferenceObject(KeyObject);
627  return Status;
628 }
#define ProbeForWriteUlong(Ptr)
Definition: probe.h:36
IN CINT OUT PVOID IN ULONG OUT PULONG ResultLength
Definition: conport.c:47
Definition: cmtypes.h:856
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
NTSTATUS NTAPI CmEnumerateValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN ULONG Index, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, IN PVOID KeyValueInformation, IN ULONG Length, IN PULONG ResultLength)
Definition: cmapi.c:1192
LONG NTSTATUS
Definition: precomp.h:26
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:143
#define PAGED_CODE()
Definition: video.h:57
_SEH2_TRY
Definition: create.c:4250
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
smooth NULL
Definition: ftsmooth.c:416
void DPRINT(...)
Definition: polytest.cpp:61
void * PVOID
Definition: retypes.h:9
struct _CM_KEY_CONTROL_BLOCK * KeyControlBlock
Definition: cm.h:229
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
NTSTATUS Status
Definition: cmtypes.h:858
#define _SEH2_YIELD(STMT_)
Definition: pseh2_64.h:8
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
static const UCHAR Index[8]
Definition: usbohci.c:18
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:101
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
Status
Definition: gdiplustypes.h:24
_SEH2_END
Definition: create.c:4424
#define KEY_QUERY_VALUE
Definition: nt_native.h:1016
unsigned int ULONG
Definition: retypes.h:1
KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass
Definition: cmtypes.h:754
#define CmpKeyObjectType
Definition: ObTypes.c:132
NTSTATUS CmiCallRegisteredCallbacks(IN REG_NOTIFY_CLASS Argument1, IN PVOID Argument2)
Definition: cmhook.c:59
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12
PVOID Object
Definition: cmtypes.h:857
_In_ ULONG _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass
Definition: cmfuncs.h:93

Referenced by EnumerateValueTest(), InitializeFmIfsOnce(), NLS_RegEnumValue(), RegEnumValueW(), RegpCopyTree(), test1(), test2(), test3(), and test9().

◆ NtFlushKey()

NTSTATUS NTAPI NtFlushKey ( IN HANDLE  KeyHandle)

Definition at line 1065 of file ntapi.c.

1066 {
1067  NTSTATUS Status;
1068  PCM_KEY_BODY KeyObject;
1069  PAGED_CODE();
1070 
1071  /* Get the key object */
1073  0,
1076  (PVOID*)&KeyObject,
1077  NULL);
1078  if (!NT_SUCCESS(Status)) return Status;
1079 
1080  /* Lock the registry */
1081  CmpLockRegistry();
1082 
1083  /* Lock the KCB */
1085 
1086  /* Make sure KCB isn't deleted */
1087  if (KeyObject->KeyControlBlock->Delete)
1088  {
1089  /* Fail */
1091  }
1092  else
1093  {
1094  /* Call the internal API */
1095  Status = CmFlushKey(KeyObject->KeyControlBlock, FALSE);
1096  }
1097 
1098  /* Release the locks */
1099  CmpReleaseKcbLock(KeyObject->KeyControlBlock);
1101 
1102  /* Dereference the object and return status */
1103  ObDereferenceObject(KeyObject);
1104  return Status;
1105 }
NTSTATUS NTAPI CmFlushKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN BOOLEAN ExclusiveLock)
Definition: cmapi.c:1938
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
LONG NTSTATUS
Definition: precomp.h:26
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
#define CmpAcquireKcbLockShared(k)
Definition: cm_x.h:121
#define PAGED_CODE()
Definition: video.h:57
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
smooth NULL
Definition: ftsmooth.c:416
#define STATUS_KEY_DELETED
Definition: ntstatus.h:599
FORCEINLINE VOID CmpReleaseKcbLock(PCM_KEY_CONTROL_BLOCK Kcb)
Definition: cm_x.h:169
struct _CM_KEY_CONTROL_BLOCK * KeyControlBlock
Definition: cm.h:229
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
VOID NTAPI CmpUnlockRegistry(VOID)
Definition: cmsysini.c:1993
Status
Definition: gdiplustypes.h:24
#define CmpKeyObjectType
Definition: ObTypes.c:132
VOID NTAPI CmpLockRegistry(VOID)
Definition: cmsysini.c:1907

Referenced by CreateProtoHive(), InitFunctionPtrs(), RegCleanupRegistry(), RegFlushKey(), RegInitializeRegistry(), RtlApplyRXact(), SetActiveComputerNameToRegistry(), SetComputerNameToRegistry(), START_TEST(), and test5().

◆ NtInitializeRegistry()

NTSTATUS NTAPI NtInitializeRegistry ( IN USHORT  Flag)

Definition at line 1298 of file ntapi.c.

1299 {
1300  BOOLEAN SetupBoot;
1302  PAGED_CODE();
1303 
1304  /* Always do this as kernel mode */
1305  if (KeGetPreviousMode() == UserMode)
1306  return ZwInitializeRegistry(Flag);
1307 
1308  /* Enough of the system has booted by now */
1309  Ki386PerfEnd();
1310 
1311  /* Validate flag */
1313 
1314  /* Check if boot was accepted */
1316  {
1317  /* Only allow once */
1320 
1321  /* Get the control set accepted */
1323  if (Flag)
1324  {
1325  /* Save the last known good boot */
1327 
1328  /* Notify HAL */
1329  HalEndOfBoot();
1330 
1331  /* Enable lazy flush */
1333  CmpLazyFlush();
1334  return Status;
1335  }
1336 
1337  /* Otherwise, invalid boot */
1338  return STATUS_INVALID_PARAMETER;
1339  }
1340 
1341  /* Check if this was a setup boot */
1342  SetupBoot = (Flag == CM_BOOT_FLAG_SETUP ? TRUE : FALSE);
1343 
1344  /* Make sure we're only called once */
1345  if (!CmFirstTime) return STATUS_ACCESS_DENIED;
1346  CmFirstTime = FALSE;
1347 
1348  /* Lock the registry exclusively */
1350 
1351  /* Initialize the hives and lazy flusher */
1352  CmpCmdInit(SetupBoot);
1353 
1354  /* Save version data */
1356 
1357  /* Release the registry lock */
1359  return STATUS_SUCCESS;
1360 }
#define TRUE
Definition: types.h:120
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
#define CM_BOOT_FLAG_ACCEPTED
Definition: cmtypes.h:153
#define KeGetPreviousMode()
Definition: ketypes.h:1107
LONG NTSTATUS
Definition: precomp.h:26
BOOLEAN CmpHoldLazyFlush
Definition: cmlazy.c:24
NTSTATUS NTAPI CmpSaveBootControlSet(IN USHORT ControlSet)
Definition: cmcontrl.c:268
#define PAGED_CODE()
Definition: video.h:57
unsigned char BOOLEAN
VOID NTAPI CmpLockRegistryExclusive(VOID)
Definition: cmsysini.c:1894
#define HalEndOfBoot
Definition: haltypes.h:296
FORCEINLINE VOID Ki386PerfEnd(VOID)
Definition: ke.h:893
VOID NTAPI CmpUnlockRegistry(VOID)
Definition: cmsysini.c:1993
Definition: xml2sdb.h:79
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145
#define CM_BOOT_FLAG_MAX
Definition: cmtypes.h:154
BOOLEAN CmFirstTime
Definition: ntapi.c:17
NTSYSAPI NTSTATUS NTAPI ZwInitializeRegistry(_In_ USHORT Flag)
Status
Definition: gdiplustypes.h:24
BOOLEAN CmBootAcceptFirstTime
Definition: ntapi.c:16
VOID NTAPI CmpLazyFlush(VOID)
Definition: cmlazy.c:158
VOID NTAPI CmpSetVersionData(VOID)
Definition: cmsysini.c:2116
#define CM_BOOT_FLAG_SETUP
Definition: cmtypes.h:152
return STATUS_SUCCESS
Definition: btrfs.c:2938
VOID NTAPI CmpCmdInit(IN BOOLEAN SetupBoot)
Definition: cmlazy.c:234

Referenced by RunUSetup(), SmpLoadDataFromRegistry(), and WinMain().

◆ NtLoadKey()

NTSTATUS NTAPI NtLoadKey ( IN POBJECT_ATTRIBUTES  KeyObjectAttributes,
IN POBJECT_ATTRIBUTES  FileObjectAttributes 
)

Definition at line 1109 of file ntapi.c.

1111 {
1112  /* Call the newer API */
1113  return NtLoadKeyEx(KeyObjectAttributes, FileObjectAttributes, 0, NULL);
1114 }
NTSTATUS NTAPI NtLoadKeyEx(IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile, IN ULONG Flags, IN HANDLE TrustClassKey)
Definition: ntapi.c:1128
smooth NULL
Definition: ftsmooth.c:416

Referenced by ConnectRegistry(), RegLoadKeyW(), and test8().

◆ NtLoadKey2()

NTSTATUS NTAPI NtLoadKey2 ( IN POBJECT_ATTRIBUTES  KeyObjectAttributes,
IN POBJECT_ATTRIBUTES  FileObjectAttributes,
IN ULONG  Flags 
)

Definition at line 1118 of file ntapi.c.

1121 {
1122  /* Call the newer API */
1123  return NtLoadKeyEx(KeyObjectAttributes, FileObjectAttributes, Flags, NULL);
1124 }
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170
NTSTATUS NTAPI NtLoadKeyEx(IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile, IN ULONG Flags, IN HANDLE TrustClassKey)
Definition: ntapi.c:1128
smooth NULL
Definition: ftsmooth.c:416

◆ NtLoadKeyEx()

NTSTATUS NTAPI NtLoadKeyEx ( IN POBJECT_ATTRIBUTES  TargetKey,
IN POBJECT_ATTRIBUTES  SourceFile,
IN ULONG  Flags,
IN HANDLE  TrustClassKey 
)

Definition at line 1128 of file ntapi.c.

1132 {
1133  NTSTATUS Status;
1135  OBJECT_ATTRIBUTES CapturedTargetKey;
1136  OBJECT_ATTRIBUTES CapturedSourceFile;
1137  UNICODE_STRING TargetKeyName, SourceFileName;
1138  HANDLE KmTargetKeyRootDir = NULL, KmSourceFileRootDir = NULL;
1139  PCM_KEY_BODY KeyBody = NULL;
1140 
1141  PAGED_CODE();
1142 
1143  /* Validate flags */
1144  if (Flags & ~REG_NO_LAZY_FLUSH)
1145  return STATUS_INVALID_PARAMETER;
1146 
1147  /* Validate privilege */
1149  {
1150  DPRINT1("Restore Privilege missing!\n");
1152  }
1153 
1154  /* Block APCs */
1156 
1157  /* Check for user-mode caller */
1158  if (PreviousMode != KernelMode)
1159  {
1160  /* Prepare to probe parameters */
1161  _SEH2_TRY
1162  {
1163  /* Probe target key */
1164  ProbeForRead(TargetKey,
1165  sizeof(OBJECT_ATTRIBUTES),
1166  sizeof(ULONG));
1167 
1168  /* Probe source file */
1169  ProbeForRead(SourceFile,
1170  sizeof(OBJECT_ATTRIBUTES),
1171  sizeof(ULONG));
1172  }
1174  {
1175  /* Return the exception code */
1177  _SEH2_YIELD(goto Quit);
1178  }
1179  _SEH2_END;
1180  }
1181 
1182  /* Probe and capture the target key attributes, including the security */
1183  Status = ProbeAndCaptureObjectAttributes(&CapturedTargetKey,
1184  &TargetKeyName,
1185  PreviousMode,
1186  TargetKey,
1187  TRUE);
1188  if (!NT_SUCCESS(Status))
1189  goto Quit;
1190 
1191  /*
1192  * Probe and capture the source file attributes, but not the security.
1193  * A proper security context is built by CmLoadKey().
1194  */
1195  Status = ProbeAndCaptureObjectAttributes(&CapturedSourceFile,
1196  &SourceFileName,
1197  PreviousMode,
1198  SourceFile,
1199  FALSE);
1200  if (!NT_SUCCESS(Status))
1201  {
1202  ReleaseCapturedObjectAttributes(&CapturedTargetKey, PreviousMode);
1203  goto Quit;
1204  }
1205 
1206  /* Make sure the target key root directory handle is a kernel handle */
1209  KEY_READ,
1210  PreviousMode,
1211  &KmTargetKeyRootDir);
1212  if (!NT_SUCCESS(Status))
1213  goto Cleanup;
1214  CapturedTargetKey.RootDirectory = KmTargetKeyRootDir;
1215  CapturedTargetKey.Attributes |= OBJ_KERNEL_HANDLE;
1216 
1217  /* Make sure the source file root directory handle is a kernel handle */
1220  FILE_TRAVERSE,
1221  PreviousMode,
1222  &KmSourceFileRootDir);
1223  if (!NT_SUCCESS(Status))
1224  goto Cleanup;
1225  CapturedSourceFile.RootDirectory = KmSourceFileRootDir;
1226  CapturedSourceFile.Attributes |= OBJ_KERNEL_HANDLE;
1227 
1228  /* Check if we have a trust class */
1229  if (TrustClassKey)
1230  {
1231  /* Reference it */
1232  Status = ObReferenceObjectByHandle(TrustClassKey,
1233  0,
1235  PreviousMode,
1236  (PVOID*)&KeyBody,
1237  NULL);
1238  }
1239 
1240  /* Call the internal API */
1241  Status = CmLoadKey(&CapturedTargetKey,
1242  &CapturedSourceFile,
1243  Flags,
1244  KeyBody);
1245 
1246  /* Dereference the trust key, if any */
1247  if (KeyBody) ObDereferenceObject(KeyBody);
1248 
1249 Cleanup:
1250  /* Close the local kernel handles */
1251  if (KmSourceFileRootDir)
1252  ObCloseHandle(KmSourceFileRootDir, KernelMode);
1253  if (KmTargetKeyRootDir)
1254  ObCloseHandle(KmTargetKeyRootDir, KernelMode);
1255 
1256  /* Release the captured object attributes */
1257  ReleaseCapturedObjectAttributes(&CapturedSourceFile, PreviousMode);
1258  ReleaseCapturedObjectAttributes(&CapturedTargetKey, PreviousMode);
1259 
1260 Quit:
1261  /* Bring back APCs */
1263 
1264  /* Return status */
1265  return Status;
1266 }
#define STATUS_PRIVILEGE_NOT_HELD
Definition: DriverTester.h:9
NTSTATUS NTAPI CmLoadKey(IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile, IN ULONG Flags, IN PCM_KEY_BODY KeyBody)
Definition: cmapi.c:2004
#define TRUE
Definition: types.h:120
#define KEY_READ
Definition: nt_native.h:1023
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
LONG NTSTATUS
Definition: precomp.h:26
BOOLEAN NTAPI SeSinglePrivilegeCheck(IN LUID PrivilegeValue, IN KPROCESSOR_MODE PreviousMode)
Definition: priv.c:524
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
VOID ReleaseCapturedObjectAttributes(_In_ POBJECT_ATTRIBUTES CapturedObjectAttributes, _In_ KPROCESSOR_MODE AccessMode)
Definition: ntapi.c:27
#define PAGED_CODE()
Definition: video.h:57
_SEH2_TRY
Definition: create.c:4250
#define FILE_TRAVERSE
Definition: nt_native.h:643
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
NTSTATUS ProbeAndCaptureObjectAttributes(_Out_ POBJECT_ATTRIBUTES CapturedObjectAttributes, _Out_ PUNICODE_STRING ObjectName, _In_ KPROCESSOR_MODE AccessMode, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ BOOLEAN CaptureSecurity)
Definition: ntapi.c:53
smooth NULL
Definition: ftsmooth.c:416
static NTSTATUS CmpConvertHandleToKernelHandle(_In_ HANDLE SourceHandle, _In_opt_ POBJECT_TYPE ObjectType, _In_ ACCESS_MASK DesiredAccess, _In_ KPROCESSOR_MODE AccessMode, _Out_ PHANDLE KernelHandle)
Definition: ntapi.c:195
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
#define _SEH2_YIELD(STMT_)
Definition: pseh2_64.h:8
const LUID SeRestorePrivilege
Definition: priv.c:39
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
Definition: obhandle.c:3376
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:102
#define KeEnterCriticalRegion()
Definition: ke_x.h:83
#define REG_NO_LAZY_FLUSH
Definition: nt_native.h:1093
static const WCHAR Cleanup[]
Definition: register.c:80
POBJECT_TYPE IoFileObjectType
Definition: iomgr.c:36
Status
Definition: gdiplustypes.h:24
_SEH2_END
Definition: create.c:4424
#define KeLeaveCriticalRegion()
Definition: ke_x.h:114
#define DPRINT1
Definition: precomp.h:8
HANDLE RootDirectory
Definition: umtypes.h:184
unsigned int ULONG
Definition: retypes.h:1
#define CmpKeyObjectType
Definition: ObTypes.c:132
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12
#define OBJ_KERNEL_HANDLE
Definition: winternl.h:231

Referenced by NtLoadKey(), and NtLoadKey2().

◆ NtLockProductActivationKeys()

NTSTATUS NTAPI NtLockProductActivationKeys ( IN PULONG  pPrivateVer,
IN PULONG  pSafeMode 
)

Definition at line 1384 of file ntapi.c.

1386 {
1388 
1390  _SEH2_TRY
1391  {
1392  /* Check if the caller asked for the version */
1393  if (pPrivateVer != NULL)
1394  {
1395  /* For user mode, probe it */
1396  if (PreviousMode != KernelMode)
1397  {
1398  ProbeForWriteUlong(pPrivateVer);
1399  }
1400 
1401  /* Return the expected version */
1402  *pPrivateVer = PRODUCT_ACTIVATION_VERSION;
1403  }
1404 
1405  /* Check if the caller asked for safe mode mode state */
1406  if (pSafeMode != NULL)
1407  {
1408  /* For user mode, probe it */
1409  if (PreviousMode != KernelMode)
1410  {
1411  ProbeForWriteUlong(pSafeMode);
1412  }
1413 
1414  /* Return the safe boot mode state */
1415  *pSafeMode = InitSafeBootMode;
1416  }
1417  }
1419  {
1421  }
1422  _SEH2_END;
1423 
1424  return STATUS_SUCCESS;
1425 }
#define ProbeForWriteUlong(Ptr)
Definition: probe.h:36
#define PRODUCT_ACTIVATION_VERSION
Definition: ntapi.c:1380
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
_SEH2_TRY
Definition: create.c:4250
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
smooth NULL
Definition: ftsmooth.c:416
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
#define _SEH2_YIELD(STMT_)
Definition: pseh2_64.h:8
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
_SEH2_END
Definition: create.c:4424
ULONG InitSafeBootMode
Definition: init.c:68
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12
return STATUS_SUCCESS
Definition: btrfs.c:2938

◆ NtLockRegistryKey()

NTSTATUS NTAPI NtLockRegistryKey ( IN HANDLE  KeyHandle)

Definition at line 1429 of file ntapi.c.

1430 {
1431  UNIMPLEMENTED;
1432  return STATUS_NOT_IMPLEMENTED;
1433 }
#define STATUS_NOT_IMPLEMENTED
Definition: ntstatus.h:225
#define UNIMPLEMENTED
Definition: debug.h:114

◆ NtNotifyChangeKey()

NTSTATUS NTAPI NtNotifyChangeKey ( IN HANDLE  KeyHandle,
IN HANDLE  Event,
IN PIO_APC_ROUTINE ApcRoutine  OPTIONAL,
IN PVOID ApcContext  OPTIONAL,
OUT PIO_STATUS_BLOCK  IoStatusBlock,
IN ULONG  CompletionFilter,
IN BOOLEAN  WatchTree,
OUT PVOID  Buffer,
IN ULONG  Length,
IN BOOLEAN  Asynchronous 
)

Definition at line 1270 of file ntapi.c.

1280 {
1281  /* Call the newer API */
1283  0,
1284  NULL,
1285  Event,
1286  ApcRoutine,
1287  ApcContext,
1288  IoStatusBlock,
1290  WatchTree,
1291  Buffer,
1292  Length,
1293  Asynchronous);
1294 }
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE _In_opt_ PVOID ApcContext
Definition: iofuncs.h:719
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN WatchTree
Definition: fltkernel.h:2239
NTSTATUS NTAPI NtNotifyChangeMultipleKeys(IN HANDLE MasterKeyHandle, IN ULONG Count, IN POBJECT_ATTRIBUTES SlaveObjects, IN HANDLE Event, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CompletionFilter, IN BOOLEAN WatchTree, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN Asynchronous)
Definition: ntapi.c:1437
_In_ SYSTEM_POWER_STATE _In_ ULONG _In_ BOOLEAN Asynchronous
Definition: ntpoapi.h:303
smooth NULL
Definition: ftsmooth.c:416
Definition: bufpool.h:45
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:101
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE ApcRoutine
Definition: iofuncs.h:719
static OUT PIO_STATUS_BLOCK IoStatusBlock
Definition: pipe.c:75
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG CompletionFilter
Definition: fltkernel.h:2239

Referenced by InitFunctionPtrs(), and RegNotifyChangeKeyValue().

◆ NtNotifyChangeMultipleKeys()

NTSTATUS NTAPI NtNotifyChangeMultipleKeys ( IN HANDLE  MasterKeyHandle,
IN ULONG  Count,
IN POBJECT_ATTRIBUTES  SlaveObjects,
IN HANDLE  Event,
IN PIO_APC_ROUTINE ApcRoutine  OPTIONAL,
IN PVOID ApcContext  OPTIONAL,
OUT PIO_STATUS_BLOCK  IoStatusBlock,
IN ULONG  CompletionFilter,
IN BOOLEAN  WatchTree,
OUT PVOID  Buffer,
IN ULONG  Length,
IN BOOLEAN  Asynchronous 
)

Definition at line 1437 of file ntapi.c.

1449 {
1451  return STATUS_NOT_IMPLEMENTED;
1452 }
#define UNIMPLEMENTED_ONCE
Definition: debug.h:138
#define STATUS_NOT_IMPLEMENTED
Definition: ntstatus.h:225

Referenced by NtNotifyChangeKey().

◆ NtOpenKey()

NTSTATUS NTAPI NtOpenKey ( OUT PHANDLE  KeyHandle,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_ATTRIBUTES  ObjectAttributes 
)

Definition at line 336 of file ntapi.c.

339 {
340  CM_PARSE_CONTEXT ParseContext = {0};
341  HANDLE Handle;
344  PAGED_CODE();
345  DPRINT("NtOpenKey(Path: %wZ, Root %x, Access: %x)\n",
346  ObjectAttributes->ObjectName, ObjectAttributes->RootDirectory, DesiredAccess);
347 
348  /* Ignore the WOW64 flag, it's not valid in the kernel */
350 
351  /* Check for user-mode caller */
352  if (PreviousMode != KernelMode)
353  {
354  /* Prepare to probe parameters */
355  _SEH2_TRY
356  {
357  /* Probe the key handle */
359  *KeyHandle = NULL;
360 
361  /* Probe object attributes */
363  sizeof(OBJECT_ATTRIBUTES),
364  sizeof(ULONG));
365  }
367  {
368  /* Return the exception code */
370  }
371  _SEH2_END;
372  }
373 
374  /* Just let the object manager handle this */
377  PreviousMode,
378  NULL,
380  &ParseContext,
381  &Handle);
382 
383  /* Only do this if we succeeded */
384  if (NT_SUCCESS(Status))
385  {
386  _SEH2_TRY
387  {
388  /* Return the handle to caller */
389  *KeyHandle = Handle;
390  }
392  {
393  /* Get the status */
395  }
396  _SEH2_END;
397  }
398 
399  DPRINT("Returning handle %x, Status %x.\n", Handle, Status);
400 
401  /* Return status */
402  return Status;
403 }
NTSTATUS NTAPI ObOpenObjectByName(IN POBJECT_ATTRIBUTES ObjectAttributes, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN OUT PVOID ParseContext, OUT PHANDLE Handle)
Definition: obhandle.c:2529
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
Definition: conport.c:35
#define KEY_WOW64_RES
Definition: cmtypes.h:47
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
LONG NTSTATUS
Definition: precomp.h:26
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
#define PAGED_CODE()
Definition: video.h:57
_SEH2_TRY
Definition: create.c:4250
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
smooth NULL
Definition: ftsmooth.c:416
void DPRINT(...)
Definition: polytest.cpp:61
_In_ HANDLE Handle
Definition: extypes.h:390
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
#define _SEH2_YIELD(STMT_)
Definition: pseh2_64.h:8
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define ProbeForWriteHandle(Ptr)
Definition: probe.h:43
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:102
Status
Definition: gdiplustypes.h:24
_SEH2_END
Definition: create.c:4424
_In_ PIO_STACK_LOCATION _Inout_ PFILE_OBJECT _Inout_ PVCB _Outptr_result_maybenull_ PDCB _In_ PDCB _In_ PDIRENT _In_ ULONG _In_ ULONG _In_ PUNICODE_STRING _In_ PACCESS_MASK DesiredAccess
Definition: create.c:4157
unsigned int ULONG
Definition: retypes.h:1
#define CmpKeyObjectType
Definition: ObTypes.c:132
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12

Referenced by AddCodepageToRegistry(), AddFontsSettingsToRegistry(), BaseComputeProcessDllPath(), BasepIsProcessAllowed(), BaseSrvIsVdmAllowed(), CmGetSystemDriverList(), CmpCreateControlSet(), CmpInitializeMachineDependentConfiguration(), CmpSetSystemValues(), CreateBaseAcls(), DeleteKeyTest(), DeleteSymLinkKey(), DeleteValueTest(), do_enumeratekey(), DumpRegistryData(), EnumerateKeyTest(), EnumerateValueTest(), GetComputerIdentifier(), GetComputerNameFromRegistry(), GetCPFileNameFromRegistry(), GetDisplayIdentifier(), GetDllList(), GetDosDevicesProtection(), GetRegInt(), GetTimeouts(), InitFunctionPtrs(), InitializeFmIfsOnce(), InitializeUserModePnpManager(), InstallDevice(), IsAcpiComputer(), IsShimInfrastructureDisabled(), LsapCreateDbObject(), LsapGetObjectAttribute(), LsapOpenDbObject(), LsapRegDeleteSubKey(), LsapRegOpenKey(), NLS_RegOpenKey(), NtOpenObject(), open_classes_key(), OpenClassesRootKey(), OpenCurrentConfigKey(), OpenLocalMachineKey(), OpenRegistryKeyHandle(), OpenUsersKey(), ProcessDisplayRegistry(), ProcessLocaleRegistry(), RegCleanupRegistry(), RegCopyTreeW(), RegDeleteKeyExW(), RegDeleteKeyValueW(), RegInitializeRegistry(), registry_callback(), RegOpenKeyExW(), RegOpenUserClassesRoot(), RegpCopyTree(), RegReplaceKeyW(), RegSetKeyValueA(), RegSetKeyValueW(), SampRegDeleteKey(), SampRegOpenKey(), SdbpOpenKey(), SetActiveComputerNameToRegistry(), SetComputerNameToRegistry(), SetDefaultPagefile(), SetGeoID(), SetMountedDeviceValue(), SetRosSpecificInfo(), SmLookupSubsystem(), SmpCreateDynamicEnvironmentVariables(), SmpLoadDataFromRegistry(), SmpQueryRegistrySosOption(), SmpTranslateSystemPartitionInformation(), START_TEST(), test1(), test2(), test3(), test5(), test8(), test9(), Test_KeyFullInformation(), Test_KeyNameInformation(), TestCreateOpen_(), and UnhandledExceptionFilter().

◆ NtQueryKey()

NTSTATUS NTAPI NtQueryKey ( IN HANDLE  KeyHandle,
IN KEY_INFORMATION_CLASS  KeyInformationClass,
OUT PVOID  KeyInformation,
IN ULONG  Length,
OUT PULONG  ResultLength 
)

Definition at line 632 of file ntapi.c.

637 {
640  PCM_KEY_BODY KeyObject;
641  REG_QUERY_KEY_INFORMATION QueryKeyInfo;
642  REG_POST_OPERATION_INFORMATION PostOperationInfo;
643  OBJECT_HANDLE_INFORMATION HandleInfo;
644  PAGED_CODE();
645  DPRINT("NtQueryKey() KH 0x%p, KIC %d, Length %lu\n",
647 
648  /* Reject invalid classes */
655  {
656  /* Fail */
658  }
659 
660  /* Check if just the name is required */
662  {
663  /* Ignore access level */
665  0,
667  PreviousMode,
668  (PVOID*)&KeyObject,
669  &HandleInfo);
670  if (NT_SUCCESS(Status))
671  {
672  /* At least a single bit of access is required */
673  if (!HandleInfo.GrantedAccess)
674  {
675  /* No such luck */
676  ObDereferenceObject(KeyObject);
678  }
679  }
680  }
681  else
682  {
683  /* Get a reference */
687  PreviousMode,
688  (PVOID*)&KeyObject,
689  NULL);
690  }
691 
692  /* Quit on failure */
693  if (!NT_SUCCESS(Status)) return Status;
694 
695  if (PreviousMode != KernelMode)
696  {
697  _SEH2_TRY
698  {
700  ProbeForWrite(KeyInformation,
701  Length,
702  sizeof(ULONG));
703  }
705  {
706  /* Dereference and return status */
707  ObDereferenceObject(KeyObject);
709  }
710  _SEH2_END;
711  }
712 
713  /* Setup the callback */
714  PostOperationInfo.Object = (PVOID)KeyObject;
715  QueryKeyInfo.Object = (PVOID)KeyObject;
717  QueryKeyInfo.KeyInformation = KeyInformation;
718  QueryKeyInfo.Length = Length;
719  QueryKeyInfo.ResultLength = ResultLength;
720 
721  /* Do the callback */
723  if (NT_SUCCESS(Status))
724  {
725  /* Call the internal API */
726  Status = CmQueryKey(KeyObject->KeyControlBlock,
728  KeyInformation,
729  Length,
730  ResultLength);
731 
732  /* Do the post callback */
733  PostOperationInfo.Status = Status;
734  CmiCallRegisteredCallbacks(RegNtPostQueryKey, &PostOperationInfo);
735  }
736 
737  /* Dereference and return status */
738  ObDereferenceObject(KeyObject);
739  return Status;
740 }
#define ProbeForWriteUlong(Ptr)
Definition: probe.h:36
IN CINT OUT PVOID IN ULONG OUT PULONG ResultLength
Definition: conport.c:47
KEY_INFORMATION_CLASS KeyInformationClass
Definition: cmtypes.h:765
Definition: cmtypes.h:856
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
_In_ ULONG _In_ KEY_INFORMATION_CLASS KeyInformationClass
Definition: zwfuncs.h:166
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
LONG NTSTATUS
Definition: precomp.h:26
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:143
#define PAGED_CODE()
Definition: video.h:57
_SEH2_TRY
Definition: create.c:4250
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
ACCESS_MASK GrantedAccess
Definition: iotypes.h:158
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
smooth NULL
Definition: ftsmooth.c:416
void DPRINT(...)
Definition: polytest.cpp:61
void * PVOID
Definition: retypes.h:9
struct _CM_KEY_CONTROL_BLOCK * KeyControlBlock
Definition: cm.h:229
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
NTSTATUS Status
Definition: cmtypes.h:858
#define _SEH2_YIELD(STMT_)
Definition: pseh2_64.h:8
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
NTSTATUS NTAPI CmQueryKey(_In_ PCM_KEY_CONTROL_BLOCK Kcb, _In_ KEY_INFORMATION_CLASS KeyInformationClass, _Out_opt_ PVOID KeyInformation, _In_ ULONG Length, _Out_ PULONG ResultLength)
Definition: cmapi.c:1615
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:101
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
Status
Definition: gdiplustypes.h:24
_SEH2_END
Definition: create.c:4424
#define KEY_QUERY_VALUE
Definition: nt_native.h:1016
unsigned int ULONG
Definition: retypes.h:1
#define CmpKeyObjectType
Definition: ObTypes.c:132
NTSTATUS CmiCallRegisteredCallbacks(IN REG_NOTIFY_CLASS Argument1, IN PVOID Argument2)
Definition: cmhook.c:59
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12
PVOID Object
Definition: cmtypes.h:857

Referenced by EnumerateKeyTest(), GetComputerIdentifier(), GetKeyName(), InitFunctionPtrs(), LsapRegQueryKeyInfo(), RegQueryInfoKeyW(), SampRegQueryKeyInfo(), test1(), test9(), Test_KeyFullInformation(), and Test_KeyNameInformation().

◆ NtQueryMultipleValueKey()

NTSTATUS NTAPI NtQueryMultipleValueKey ( IN HANDLE  KeyHandle,
IN OUT PKEY_VALUE_ENTRY  ValueList,
IN ULONG  NumberOfValues,
OUT PVOID  Buffer,
IN OUT PULONG  Length,
OUT PULONG  ReturnLength 
)

Definition at line 1456 of file ntapi.c.

1462 {
1463  UNIMPLEMENTED;
1464  return STATUS_NOT_IMPLEMENTED;
1465 }
#define STATUS_NOT_IMPLEMENTED
Definition: ntstatus.h:225
#define UNIMPLEMENTED
Definition: debug.h:114

◆ NtQueryOpenSubKeys()

NTSTATUS NTAPI NtQueryOpenSubKeys ( IN POBJECT_ATTRIBUTES  TargetKey,
OUT PULONG  HandleCount 
)

Definition at line 1469 of file ntapi.c.

1471 {
1473  PCM_KEY_BODY KeyBody = NULL;
1474  HANDLE KeyHandle;
1475  NTSTATUS Status;
1476  ULONG SubKeys;
1477 
1478  DPRINT("NtQueryOpenSubKeys()\n");
1479 
1480  PAGED_CODE();
1481 
1482  /* Get the processor mode */
1484 
1485  /* Check for user-mode caller */
1486  if (PreviousMode != KernelMode)
1487  {
1488  /* Prepare to probe parameters */
1489  _SEH2_TRY
1490  {
1491  /* Probe target key */
1492  ProbeForRead(TargetKey,
1493  sizeof(OBJECT_ATTRIBUTES),
1494  sizeof(ULONG));
1495 
1496  /* Probe handle count */
1497  ProbeForWriteUlong(HandleCount);
1498  }
1500  {
1501  /* Return the exception code */
1503  }
1504  _SEH2_END;
1505  }
1506 
1507  /* Open a handle to the key */
1508  Status = ObOpenObjectByName(TargetKey,
1510  PreviousMode,
1511  NULL,
1512  KEY_READ,
1513  NULL,
1514  &KeyHandle);
1515  if (NT_SUCCESS(Status))
1516  {
1517  /* Reference the key object */
1519  KEY_READ,
1521  PreviousMode,
1522  (PVOID*)&KeyBody,
1523  NULL);
1524 
1525  /* Close the handle */
1526  NtClose(KeyHandle);
1527  }
1528 
1529  /* Fail, if the key object could not be referenced */
1530  if (!NT_SUCCESS(Status))
1531  return Status;
1532 
1533  /* Lock the registry exclusively */
1535 
1536  /* Fail, if we did not open a hive root key */
1537  if (KeyBody->KeyControlBlock->KeyCell !=
1538  KeyBody->KeyControlBlock->KeyHive->BaseBlock->RootCell)
1539  {
1540  DPRINT("Error: Key is not a hive root key!\n");
1542  ObDereferenceObject(KeyBody);
1543  return STATUS_INVALID_PARAMETER;
1544  }
1545 
1546  /* Call the internal API */
1547  SubKeys = CmpEnumerateOpenSubKeys(KeyBody->KeyControlBlock,
1548  FALSE, FALSE);
1549 
1550  /* Unlock the registry */
1552 
1553  /* Dereference the key object */
1554  ObDereferenceObject(KeyBody);
1555 
1556  /* Write back the result */
1557  _SEH2_TRY
1558  {
1559  *HandleCount = SubKeys;
1560  }
1562  {
1564  }
1565  _SEH2_END;
1566 
1567  DPRINT("Done.\n");
1568 
1569  return Status;
1570 }
#define ProbeForWriteUlong(Ptr)
Definition: probe.h:36
NTSTATUS NTAPI ObOpenObjectByName(IN POBJECT_ATTRIBUTES ObjectAttributes, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN OUT PVOID ParseContext, OUT PHANDLE Handle)
Definition: obhandle.c:2529
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
#define KEY_READ
Definition: nt_native.h:1023
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
ULONG NTAPI CmpEnumerateOpenSubKeys(IN PCM_KEY_CONTROL_BLOCK RootKcb, IN BOOLEAN RemoveEmptyCacheEntries, IN BOOLEAN DereferenceOpenedEntries)
Definition: cmapi.c:2327
#define KeGetPreviousMode()
Definition: ketypes.h:1107
LONG NTSTATUS
Definition: precomp.h:26
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
#define PAGED_CODE()
Definition: video.h:57
_SEH2_TRY
Definition: create.c:4250
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
smooth NULL
Definition: ftsmooth.c:416
void DPRINT(...)
Definition: polytest.cpp:61
VOID NTAPI CmpLockRegistryExclusive(VOID)
Definition: cmsysini.c:1894
struct _CM_KEY_CONTROL_BLOCK * KeyControlBlock
Definition: cm.h:229
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
#define _SEH2_YIELD(STMT_)
Definition: pseh2_64.h:8
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
VOID NTAPI CmpUnlockRegistry(VOID)
Definition: cmsysini.c:1993
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
Definition: obhandle.c:3399
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:102
Status
Definition: gdiplustypes.h:24
_SEH2_END
Definition: create.c:4424
unsigned int ULONG
Definition: retypes.h:1
#define CmpKeyObjectType
Definition: ObTypes.c:132
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12

◆ NtQueryOpenSubKeysEx()

NTSTATUS NTAPI NtQueryOpenSubKeysEx ( IN POBJECT_ATTRIBUTES  TargetKey,
IN ULONG  BufferLength,
IN PVOID  Buffer,
IN PULONG  RequiredSize 
)

Definition at line 1574 of file ntapi.c.

1578 {
1579  UNIMPLEMENTED;
1580  return STATUS_NOT_IMPLEMENTED;
1581 }
#define STATUS_NOT_IMPLEMENTED
Definition: ntstatus.h:225
#define UNIMPLEMENTED
Definition: debug.h:114

◆ NtQueryValueKey()

NTSTATUS NTAPI NtQueryValueKey ( IN HANDLE  KeyHandle,
IN PUNICODE_STRING  ValueName,
IN KEY_VALUE_INFORMATION_CLASS  KeyValueInformationClass,
OUT PVOID  KeyValueInformation,
IN ULONG  Length,
OUT PULONG  ResultLength 
)

Definition at line 744 of file ntapi.c.

750 {
753  PCM_KEY_BODY KeyObject;
754  REG_QUERY_VALUE_KEY_INFORMATION QueryValueKeyInfo;
755  REG_POST_OPERATION_INFORMATION PostOperationInfo;
756  UNICODE_STRING ValueNameCopy;
757 
758  PAGED_CODE();
759 
760  DPRINT("NtQueryValueKey() KH 0x%p, VN '%wZ', KVIC %d, Length %lu\n",
762 
763  /* Reject classes we don't know about */
769  {
770  /* Fail */
772  }
773 
774  /* Verify that the handle is valid and is a registry key */
778  PreviousMode,
779  (PVOID*)&KeyObject,
780  NULL);
781  if (!NT_SUCCESS(Status))
782  return Status;
783 
784  if (PreviousMode != KernelMode)
785  {
786  _SEH2_TRY
787  {
789  ProbeForWrite(KeyValueInformation,
790  Length,
791  sizeof(ULONG));
792  }
794  {
795  /* Dereference and return status */
796  ObDereferenceObject(KeyObject);
798  }
799  _SEH2_END;
800  }
801 
802  /* Capture the string */
804  if (!NT_SUCCESS(Status))
805  goto Quit;
806 
807  /* Make sure the name is aligned properly */
808  if ((ValueNameCopy.Length & (sizeof(WCHAR) - 1)))
809  {
810  /* It isn't, so we'll fail */
812  goto Quit;
813  }
814 
815  /* Ignore any null characters at the end */
816  while ((ValueNameCopy.Length) &&
817  !(ValueNameCopy.Buffer[ValueNameCopy.Length / sizeof(WCHAR) - 1]))
818  {
819  /* Skip it */
820  ValueNameCopy.Length -= sizeof(WCHAR);
821  }
822 
823  /* Setup the callback */
824  PostOperationInfo.Object = (PVOID)KeyObject;
825  QueryValueKeyInfo.Object = (PVOID)KeyObject;
826  QueryValueKeyInfo.ValueName = &ValueNameCopy;
828  QueryValueKeyInfo.Length = Length;
829  QueryValueKeyInfo.ResultLength = ResultLength;
830 
831  /* Do the callback */
833  if (NT_SUCCESS(Status))
834  {
835  /* Call the internal API */
837  ValueNameCopy,
839  KeyValueInformation,
840  Length,
841  ResultLength);
842 
843  /* Do the post callback */
844  PostOperationInfo.Status = Status;
846  }
847 
848 Quit:
849  if (ValueNameCopy.Buffer)
851 
852  /* Dereference and return status */
853  ObDereferenceObject(KeyObject);
854  return Status;
855 }
static __inline NTSTATUS ProbeAndCaptureUnicodeString(OUT PUNICODE_STRING Dest, IN KPROCESSOR_MODE CurrentMode, IN const UNICODE_STRING *UnsafeSrc)
Definition: probe.h:142
#define ProbeForWriteUlong(Ptr)
Definition: probe.h:36
IN CINT OUT PVOID IN ULONG OUT PULONG ResultLength
Definition: conport.c:47
Definition: cmtypes.h:856
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
LONG NTSTATUS
Definition: precomp.h:26
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:143
#define PAGED_CODE()
Definition: video.h:57
_SEH2_TRY
Definition: create.c:4250
_In_ PUNICODE_STRING ValueName
Definition: cmfuncs.h:264
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass
Definition: cmtypes.h:777
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
smooth NULL
Definition: ftsmooth.c:416
void DPRINT(...)
Definition: polytest.cpp:61
void * PVOID
Definition: retypes.h:9
struct _CM_KEY_CONTROL_BLOCK * KeyControlBlock
Definition: cm.h:229
static __inline VOID ReleaseCapturedUnicodeString(IN PUNICODE_STRING CapturedString, IN KPROCESSOR_MODE CurrentMode)
Definition: probe.h:239
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
NTSTATUS Status
Definition: cmtypes.h:858
#define _SEH2_YIELD(STMT_)
Definition: pseh2_64.h:8
__wchar_t WCHAR
Definition: xmlstorage.h:180
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:101
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
Status
Definition: gdiplustypes.h:24
NTSTATUS NTAPI CmQueryValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN UNICODE_STRING ValueName, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, IN PVOID KeyValueInformation, IN ULONG Length, IN PULONG ResultLength)
Definition: cmapi.c:1075
_SEH2_END
Definition: create.c:4424
#define KEY_QUERY_VALUE
Definition: nt_native.h:1016
unsigned int ULONG
Definition: retypes.h:1
#define CmpKeyObjectType
Definition: ObTypes.c:132
NTSTATUS CmiCallRegisteredCallbacks(IN REG_NOTIFY_CLASS Argument1, IN PVOID Argument2)
Definition: cmhook.c:59
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12
PVOID Object
Definition: cmtypes.h:857
_In_ ULONG _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass
Definition: cmfuncs.h:93

◆ NtRenameKey()

NTSTATUS NTAPI NtRenameKey ( IN HANDLE  KeyHandle,
IN PUNICODE_STRING  ReplacementName 
)

Definition at line 1585 of file ntapi.c.

1587 {
1588  UNIMPLEMENTED;
1589  return STATUS_NOT_IMPLEMENTED;
1590 }
#define STATUS_NOT_IMPLEMENTED
Definition: ntstatus.h:225
#define UNIMPLEMENTED
Definition: debug.h:114

◆ NtReplaceKey()

NTSTATUS NTAPI NtReplaceKey ( IN POBJECT_ATTRIBUTES  ObjectAttributes,
IN HANDLE  Key,
IN POBJECT_ATTRIBUTES  ReplacedObjectAttributes 
)

Definition at line 1594 of file ntapi.c.

1597 {
1598  UNIMPLEMENTED;
1599  return STATUS_NOT_IMPLEMENTED;
1600 }
#define STATUS_NOT_IMPLEMENTED
Definition: ntstatus.h:225
#define UNIMPLEMENTED
Definition: debug.h:114

Referenced by RegReplaceKeyW().

◆ NtRestoreKey()

NTSTATUS NTAPI NtRestoreKey ( IN HANDLE  KeyHandle,
IN HANDLE  FileHandle,
IN ULONG  RestoreFlags 
)

Definition at line 1604 of file ntapi.c.

1607 {
1608  UNIMPLEMENTED;
1609  return STATUS_NOT_IMPLEMENTED;
1610 }
#define STATUS_NOT_IMPLEMENTED
Definition: ntstatus.h:225
#define UNIMPLEMENTED
Definition: debug.h:114

Referenced by RegRestoreKeyW().

◆ NtSaveKey()

NTSTATUS NTAPI NtSaveKey ( IN HANDLE  KeyHandle,
IN HANDLE  FileHandle 
)

Definition at line 1614 of file ntapi.c.

1616 {
1617  /* Call the extended API */
1619 }
#define REG_STANDARD_FORMAT
Definition: cmtypes.h:97
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
HANDLE FileHandle
Definition: stats.c:38
NTSTATUS NTAPI NtSaveKeyEx(IN HANDLE KeyHandle, IN HANDLE FileHandle, IN ULONG Flags)
Definition: ntapi.c:1623

Referenced by RegSaveKeyW(), and START_TEST().

◆ NtSaveKeyEx()

NTSTATUS NTAPI NtSaveKeyEx ( IN HANDLE  KeyHandle,
IN HANDLE  FileHandle,
IN ULONG  Flags 
)

Definition at line 1623 of file ntapi.c.

1626 {
1627  NTSTATUS Status;
1628  HANDLE KmFileHandle = NULL;
1629  PCM_KEY_BODY KeyObject;
1631 
1632  PAGED_CODE();
1633 
1634  DPRINT("NtSaveKeyEx(0x%p, 0x%p, %lu)\n", KeyHandle, FileHandle, Flags);
1635 
1636  /* Verify the flags */
1637  if ((Flags != REG_STANDARD_FORMAT)
1638  && (Flags != REG_LATEST_FORMAT)
1639  && (Flags != REG_NO_COMPRESSION))
1640  {
1641  /* Only one of these values can be specified */
1642  return STATUS_INVALID_PARAMETER;
1643  }
1644 
1645  /* Validate privilege */
1647  {
1649  }
1650 
1651  /* Make sure the target file handle is a kernel handle */
1655  PreviousMode,
1656  &KmFileHandle);
1657  if (!NT_SUCCESS(Status))
1658  goto Quit;
1659 
1660  /* Verify that the handle is valid and is a registry key */
1662  KEY_READ,
1664  PreviousMode,
1665  (PVOID*)&KeyObject,
1666  NULL);
1667  if (!NT_SUCCESS(Status))
1668  goto Quit;
1669 
1670  /* Call the internal API */
1671  Status = CmSaveKey(KeyObject->KeyControlBlock, KmFileHandle, Flags);
1672 
1673  /* Dereference the registry key */
1674  ObDereferenceObject(KeyObject);
1675 
1676 Quit:
1677  /* Close the local kernel handle */
1678  if (KmFileHandle)
1679  ObCloseHandle(KmFileHandle, KernelMode);
1680 
1681  return Status;
1682 }
#define STATUS_PRIVILEGE_NOT_HELD
Definition: DriverTester.h:9
#define REG_STANDARD_FORMAT
Definition: cmtypes.h:97
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
const LUID SeBackupPrivilege
Definition: priv.c:38
#define KEY_READ
Definition: nt_native.h:1023
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
NTSTATUS NTAPI CmSaveKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN HANDLE FileHandle, IN ULONG Flags)
Definition: cmapi.c:2637
LONG NTSTATUS
Definition: precomp.h:26
BOOLEAN NTAPI SeSinglePrivilegeCheck(IN LUID PrivilegeValue, IN KPROCESSOR_MODE PreviousMode)
Definition: priv.c:524
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
#define PAGED_CODE()
Definition: video.h:57
HANDLE FileHandle
Definition: stats.c:38
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
smooth NULL
Definition: ftsmooth.c:416
void DPRINT(...)
Definition: polytest.cpp:61
#define FILE_WRITE_DATA
Definition: nt_native.h:631
static NTSTATUS CmpConvertHandleToKernelHandle(_In_ HANDLE SourceHandle, _In_opt_ POBJECT_TYPE ObjectType, _In_ ACCESS_MASK DesiredAccess, _In_ KPROCESSOR_MODE AccessMode, _Out_ PHANDLE KernelHandle)
Definition: ntapi.c:195
struct _CM_KEY_CONTROL_BLOCK * KeyControlBlock
Definition: cm.h:229
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
#define REG_NO_COMPRESSION
Definition: cmtypes.h:99
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
Definition: obhandle.c:3376
#define REG_LATEST_FORMAT
Definition: cmtypes.h:98
POBJECT_TYPE IoFileObjectType
Definition: iomgr.c:36
Status
Definition: gdiplustypes.h:24
#define CmpKeyObjectType
Definition: ObTypes.c:132

Referenced by CreateRegistryFile(), and NtSaveKey().

◆ NtSaveMergedKeys()

NTSTATUS NTAPI NtSaveMergedKeys ( IN HANDLE  HighPrecedenceKeyHandle,
IN HANDLE  LowPrecedenceKeyHandle,
IN HANDLE  FileHandle 
)

Definition at line 1686 of file ntapi.c.

1689 {
1690  NTSTATUS Status;
1692  HANDLE KmFileHandle = NULL;
1693  PCM_KEY_BODY HighPrecedenceKeyObject = NULL;
1694  PCM_KEY_BODY LowPrecedenceKeyObject = NULL;
1695 
1696  PAGED_CODE();
1697 
1698  DPRINT("NtSaveMergedKeys(0x%p, 0x%p, 0x%p)\n",
1699  HighPrecedenceKeyHandle, LowPrecedenceKeyHandle, FileHandle);
1700 
1702 
1703  /* Validate privilege */
1705  {
1707  }
1708 
1709  /* Make sure the target file handle is a kernel handle */
1713  PreviousMode,
1714  &KmFileHandle);
1715  if (!NT_SUCCESS(Status))
1716  goto Quit;
1717 
1718  /* Verify that the handles are valid and are registry keys */
1719  Status = ObReferenceObjectByHandle(HighPrecedenceKeyHandle,
1720  KEY_READ,
1722  PreviousMode,
1723  (PVOID*)&HighPrecedenceKeyObject,
1724  NULL);
1725  if (!NT_SUCCESS(Status))
1726  goto Quit;
1727 
1728  Status = ObReferenceObjectByHandle(LowPrecedenceKeyHandle,
1729  KEY_READ,
1731  PreviousMode,
1732  (PVOID*)&LowPrecedenceKeyObject,
1733  NULL);
1734  if (!NT_SUCCESS(Status))
1735  goto Quit;
1736 
1737  /* Call the internal API */
1738  Status = CmSaveMergedKeys(HighPrecedenceKeyObject->KeyControlBlock,
1739  LowPrecedenceKeyObject->KeyControlBlock,
1740  KmFileHandle);
1741 
1742 Quit:
1743  /* Dereference the opened key objects */
1744  if (LowPrecedenceKeyObject)
1745  ObDereferenceObject(LowPrecedenceKeyObject);
1746  if (HighPrecedenceKeyObject)
1747  ObDereferenceObject(HighPrecedenceKeyObject);
1748 
1749  /* Close the local kernel handle */
1750  if (KmFileHandle)
1751  ObCloseHandle(KmFileHandle, KernelMode);
1752 
1753  return Status;
1754 }
#define STATUS_PRIVILEGE_NOT_HELD
Definition: DriverTester.h:9
const LUID SeBackupPrivilege
Definition: priv.c:38
#define KEY_READ
Definition: nt_native.h:1023
LONG NTSTATUS
Definition: precomp.h:26
BOOLEAN NTAPI SeSinglePrivilegeCheck(IN LUID PrivilegeValue, IN KPROCESSOR_MODE PreviousMode)
Definition: priv.c:524
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
#define PAGED_CODE()
Definition: video.h:57
HANDLE FileHandle
Definition: stats.c:38
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
smooth NULL
Definition: ftsmooth.c:416
void DPRINT(...)
Definition: polytest.cpp:61
#define FILE_WRITE_DATA
Definition: nt_native.h:631
static NTSTATUS CmpConvertHandleToKernelHandle(_In_ HANDLE SourceHandle, _In_opt_ POBJECT_TYPE ObjectType, _In_ ACCESS_MASK DesiredAccess, _In_ KPROCESSOR_MODE AccessMode, _Out_ PHANDLE KernelHandle)
Definition: ntapi.c:195
struct _CM_KEY_CONTROL_BLOCK * KeyControlBlock
Definition: cm.h:229
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
NTSTATUS NTAPI CmSaveMergedKeys(IN PCM_KEY_CONTROL_BLOCK HighKcb, IN PCM_KEY_CONTROL_BLOCK LowKcb, IN HANDLE FileHandle)
Definition: cmapi.c:2706
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
Definition: obhandle.c:3376
POBJECT_TYPE IoFileObjectType
Definition: iomgr.c:36
Status
Definition: gdiplustypes.h:24
#define CmpKeyObjectType
Definition: ObTypes.c:132

◆ NtSetInformationKey()

NTSTATUS NTAPI NtSetInformationKey ( IN HANDLE  KeyHandle,
IN KEY_SET_INFORMATION_CLASS  KeyInformationClass,
IN PVOID  KeyInformation,
IN ULONG  KeyInformationLength 
)

Definition at line 1758 of file ntapi.c.

1762 {
1763  UNIMPLEMENTED;
1764  return STATUS_NOT_IMPLEMENTED;
1765 }
#define STATUS_NOT_IMPLEMENTED
Definition: ntstatus.h:225
#define UNIMPLEMENTED
Definition: debug.h:114

◆ NtSetValueKey()

NTSTATUS NTAPI NtSetValueKey ( IN HANDLE  KeyHandle,
IN PUNICODE_STRING  ValueName,
IN ULONG TitleIndex  ,
IN ULONG  Type,
IN PVOID  Data,
IN ULONG  DataSize 
)

Definition at line 859 of file ntapi.c.

865 {
868  PCM_KEY_BODY KeyObject;
869  REG_SET_VALUE_KEY_INFORMATION SetValueKeyInfo;
870  REG_POST_OPERATION_INFORMATION PostOperationInfo;
871  UNICODE_STRING ValueNameCopy;
872 
873  PAGED_CODE();
874 
876 
877  /* Verify that the handle is valid and is a registry key */
881  PreviousMode,
882  (PVOID*)&KeyObject,
883  NULL);
884  if (!NT_SUCCESS(Status))
885  return Status;
886 
887  if (!DataSize)
888  Data = NULL;
889 
890  /* Probe and copy the data */
891  if ((PreviousMode != KernelMode) && (DataSize != 0))
892  {
894  if (!DataCopy)
895  {
896  /* Dereference and return status */
897  ObDereferenceObject(KeyObject);
899  }
900  _SEH2_TRY
901  {
903  RtlCopyMemory(DataCopy, Data, DataSize);
904  }
906  {
908  }
909  _SEH2_END;
910 
911  if (!NT_SUCCESS(Status))
912  {
913  /* Dereference and return status */
914  ExFreePoolWithTag(DataCopy, TAG_CM);
915  ObDereferenceObject(KeyObject);
916  return Status;
917  }
918  Data = DataCopy;
919  }
920 
921  /* Capture the string */
923  if (!NT_SUCCESS(Status))
924  goto Quit;
925 
926  DPRINT("NtSetValueKey() KH 0x%p, VN '%wZ', TI %x, T %lu, DS %lu\n",
927  KeyHandle, &ValueNameCopy, TitleIndex, Type, DataSize);
928 
929  /* Make sure the name is aligned, not too long, and the data under 4GB */
930  if ( (ValueNameCopy.Length > 32767) ||
931  ((ValueNameCopy.Length & (sizeof(WCHAR) - 1))) ||
932  (DataSize > 0x80000000))
933  {
934  /* Fail */
936  goto Quit;
937  }
938 
939  /* Ignore any null characters at the end */
940  while ((ValueNameCopy.Length) &&
941  !(ValueNameCopy.Buffer[ValueNameCopy.Length / sizeof(WCHAR) - 1]))
942  {
943  /* Skip it */
944  ValueNameCopy.Length -= sizeof(WCHAR);
945  }
946 
947  /* Don't touch read-only keys */
948  if (KeyObject->KeyControlBlock->ExtFlags & CM_KCB_READ_ONLY_KEY)
949  {
950  /* Fail */
952  goto Quit;
953  }
954 
955  /* Setup callback */
956  PostOperationInfo.Object = (PVOID)KeyObject;
957  SetValueKeyInfo.Object = (PVOID)KeyObject;
958  SetValueKeyInfo.ValueName = &ValueNameCopy;
959  SetValueKeyInfo.TitleIndex = TitleIndex;
960  SetValueKeyInfo.Type = Type;
961  SetValueKeyInfo.Data = Data;
962  SetValueKeyInfo.DataSize = DataSize;
963 
964  /* Do the callback */
966  if (NT_SUCCESS(Status))
967  {
968  /* Call the internal API */
969  Status = CmSetValueKey(KeyObject->KeyControlBlock,
970  &ValueNameCopy,
971  Type,
972  Data,
973  DataSize);
974 
975  /* Do the post-callback */
976  PostOperationInfo.Status = Status;
978  }
979 
980 Quit:
981  if (ValueNameCopy.Buffer)
983 
984  if ((PreviousMode != KernelMode) && Data)
986 
987  /* Dereference and return status */
988  ObDereferenceObject(KeyObject);
989  return Status;
990 }
static __inline NTSTATUS ProbeAndCaptureUnicodeString(OUT PUNICODE_STRING Dest, IN KPROCESSOR_MODE CurrentMode, IN const UNICODE_STRING *UnsafeSrc)
Definition: probe.h:142
Definition: cmtypes.h:856
NTSYSAPI VOID NTAPI RtlCopyMemory(VOID UNALIGNED *Destination, CONST VOID UNALIGNED *Source, ULONG Length)
#define STATUS_INSUFFICIENT_RESOURCES
Definition: udferr_usr.h:158
static ACCESS_MASK const OBJECT_ATTRIBUTES ULONG TitleIndex
Definition: reg.c:130
Type
Definition: Type.h:6
#define KEY_SET_VALUE
Definition: nt_native.h:1017
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
LONG NTSTATUS
Definition: precomp.h:26
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
#define CM_KCB_READ_ONLY_KEY
Definition: cm.h:61
#define PAGED_CODE()
Definition: video.h:57
_SEH2_TRY
Definition: create.c:4250
_In_ PUNICODE_STRING ValueName
Definition: cmfuncs.h:264
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
smooth NULL
Definition: ftsmooth.c:416
_In_ LPGUID _In_ PVOID Data
Definition: classpnp.h:778
void DPRINT(...)
Definition: polytest.cpp:61
void * PVOID
Definition: retypes.h:9
NTSTATUS NTAPI CmSetValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN PUNICODE_STRING ValueName, IN ULONG Type, IN PVOID Data, IN ULONG DataLength)
Definition: cmapi.c:644
struct _CM_KEY_CONTROL_BLOCK * KeyControlBlock
Definition: cm.h:229
static __inline VOID ReleaseCapturedUnicodeString(IN PUNICODE_STRING CapturedString, IN KPROCESSOR_MODE CurrentMode)
Definition: probe.h:239
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
NTSTATUS Status
Definition: cmtypes.h:858
__wchar_t WCHAR
Definition: xmlstorage.h:180
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
#define ExAllocatePoolWithTag(hernya, size, tag)
Definition: env_spec_w32.h:350
#define TAG_CM
Definition: cmlib.h:203
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:102
Status
Definition: gdiplustypes.h:24
_SEH2_END
Definition: create.c:4424
PUNICODE_STRING ValueName
Definition: cmtypes.h:711
#define CmpKeyObjectType
Definition: ObTypes.c:132
NTSTATUS CmiCallRegisteredCallbacks(IN REG_NOTIFY_CLASS Argument1, IN PVOID Argument2)
Definition: cmhook.c:59
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
#define ExFreePoolWithTag(_P, _T)
Definition: module.h:1099
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12
PVOID Object
Definition: cmtypes.h:857
return STATUS_SUCCESS
Definition: btrfs.c:2938
_In_ NDIS_STATUS _In_ ULONG _In_ USHORT _In_opt_ PVOID _In_ ULONG DataSize
Definition: ndis.h:4751

Referenced by AddCodepageToRegistry(), AddFontsSettingsToRegistry(), AddHotkeySettings(), AddKbLayoutsToRegistry(), BasepMoveFileDelayed(), CmpCreateControlSet(), CmpInitializeMachineDependentConfiguration(), CmpInitializeRegistryNode(), CmpSetSystemValues(), CmpSetVersionData(), CreateSymLinkKey(), do_reg_operation(), InitFunctionPtrs(), InstallDriver(), Phase1InitializationDiscard(), ProcessLocaleRegistry(), RegpCopyTree(), RegSetValueExW(), SdbRegisterDatabaseEx(), SdbSetPermLayerKeys(), SetActiveComputerNameToRegistry(), SetComputerNameToRegistry(), SetDefaultPagefile(), SetGeoID(), SetLocaleInfoW(), SetMountedDeviceValue(), SetUserGeoID(), SetValueTest1(), SetValueTest2(), SmpCreateDynamicEnvironmentVariables(), SmpTranslateSystemPartitionInformation(), START_TEST(), test2(), test3(), and test6().

◆ NtUnloadKey()

NTSTATUS NTAPI NtUnloadKey ( IN POBJECT_ATTRIBUTES  KeyObjectAttributes)

Definition at line 1769 of file ntapi.c.

1770 {
1771  return NtUnloadKey2(KeyObjectAttributes, 0);
1772 }
NTSTATUS NTAPI NtUnloadKey2(IN POBJECT_ATTRIBUTES TargetKey, IN ULONG Flags)
Definition: ntapi.c:1776

Referenced by DisconnectRegistry(), and RegUnLoadKeyW().

◆ NtUnloadKey2()

NTSTATUS NTAPI NtUnloadKey2 ( IN POBJECT_ATTRIBUTES  TargetKey,
IN ULONG  Flags 
)

Definition at line 1776 of file ntapi.c.

1778 {
1779  NTSTATUS Status;
1780  OBJECT_ATTRIBUTES CapturedTargetKey;
1782  HANDLE KmTargetKeyRootDir = NULL;
1783  CM_PARSE_CONTEXT ParseContext = {0};
1785  PCM_KEY_BODY KeyBody = NULL;
1786  ULONG ParentConv = 0, ChildConv = 0;
1787  HANDLE Handle;
1788 
1789  PAGED_CODE();
1790 
1791  /* Validate privilege */
1793  {
1794  DPRINT1("Restore Privilege missing!\n");
1796  }
1797 
1798  /* Check for user-mode caller */
1799  if (PreviousMode != KernelMode)
1800  {
1801  /* Prepare to probe parameters */
1802  _SEH2_TRY
1803  {
1804  /* Probe object attributes */
1805  ProbeForRead(TargetKey,
1806  sizeof(OBJECT_ATTRIBUTES),
1807  sizeof(ULONG));
1808 
1809  CapturedTargetKey = *TargetKey;
1810 
1811  /* Probe the string */
1812  ObjectName = ProbeForReadUnicodeString(CapturedTargetKey.ObjectName);
1813  ProbeForRead(ObjectName.Buffer,
1814  ObjectName.Length,
1815  sizeof(WCHAR));
1816 
1817  CapturedTargetKey.ObjectName = &ObjectName;
1818  }
1820  {
1821  /* Return the exception code */
1823  }
1824  _SEH2_END;
1825  }
1826  else
1827  {
1828  /* Save the target attributes directly */
1829  CapturedTargetKey = *TargetKey;
1830  }
1831 
1832  /* Make sure the target key root directory handle is a kernel handle */
1835  KEY_WRITE,
1836  PreviousMode,
1837  &KmTargetKeyRootDir);
1838  if (!NT_SUCCESS(Status))
1839  return Status;
1840  CapturedTargetKey.RootDirectory = KmTargetKeyRootDir;
1841  CapturedTargetKey.Attributes |= OBJ_KERNEL_HANDLE;
1842 
1843  /* Setup the parse context */
1844  ParseContext.CreateOperation = TRUE;
1846 
1847  /* Do the create */
1848  /* Open a local handle to the key */
1849  Status = ObOpenObjectByName(&CapturedTargetKey,
1851  KernelMode,
1852  NULL,
1853  KEY_WRITE,
1854  &ParseContext,
1855  &Handle);
1856  if (NT_SUCCESS(Status))
1857  {
1858  /* Reference the key object */
1860  KEY_WRITE,
1862  KernelMode,
1863  (PVOID*)&KeyBody,
1864  NULL);
1865 
1866  /* Close the handle */
1868  }
1869 
1870  /* Close the local kernel handle */
1871  if (KmTargetKeyRootDir)
1872  ObCloseHandle(KmTargetKeyRootDir, KernelMode);
1873 
1874  /* Return if a failure was encountered */
1875  if (!NT_SUCCESS(Status))
1876  return Status;
1877 
1878  /* Acquire the lock depending on flags */
1879  if (Flags == REG_FORCE_UNLOAD)
1880  {
1881  /* Lock registry exclusively */
1883  }
1884  else
1885  {
1886  /* Lock registry */
1887  CmpLockRegistry();
1888 
1889  /* Acquire the hive loading lock */
1891 
1892  /* Lock parent and child */
1893  if (KeyBody->KeyControlBlock->ParentKcb)
1894  ParentConv = KeyBody->KeyControlBlock->ParentKcb->ConvKey;
1895  else
1896  ParentConv = KeyBody->KeyControlBlock->ConvKey;
1897 
1898  ChildConv = KeyBody->KeyControlBlock->ConvKey;
1899 
1900  CmpAcquireTwoKcbLocksExclusiveByKey(ChildConv, ParentConv);
1901  }
1902 
1903  /* Check if it's being deleted already */
1904  if (KeyBody->KeyControlBlock->Delete)
1905  {
1906  /* Return appropriate status */
1908  goto Quit;
1909  }
1910 
1911  /* Check if it's a read-only key */
1912  if (KeyBody->KeyControlBlock->ExtFlags & CM_KCB_READ_ONLY_KEY)
1913  {
1914  /* Return appropriate status */
1916  goto Quit;
1917  }
1918 
1919  /* Call the internal API. Note that CmUnloadKey() unlocks the registry only on success. */
1920  Status = CmUnloadKey(KeyBody->KeyControlBlock, Flags);
1921 
1922  /* Check if we failed, but really need to succeed */
1924  {
1925  /* TODO: We should perform another attempt here */
1926  _SEH2_TRY
1927  {
1928  DPRINT1("NtUnloadKey2(%wZ): We want to force-unload the hive but couldn't unload it: Retrying is UNIMPLEMENTED!\n", TargetKey->ObjectName);
1929  }
1931  {
1932  }
1933  _SEH2_END;
1934  }
1935 
1936  /* If CmUnloadKey() failed we need to unlock registry ourselves */
1937  if (!NT_SUCCESS(Status))
1938  {
1939  if (Flags != REG_FORCE_UNLOAD)
1940  {
1941  /* Release the KCB locks */
1942  CmpReleaseTwoKcbLockByKey(ChildConv, ParentConv);
1943 
1944  /* Release the hive loading lock */
1946  }
1947 
1948  /* Unlock the registry */
1950  }
1951 
1952 Quit:
1953  /* Dereference the key */
1954  ObDereferenceObject(KeyBody);
1955 
1956  /* Return status */
1957  return Status;
1958 }
NTSTATUS NTAPI ObOpenObjectByName(IN POBJECT_ATTRIBUTES ObjectAttributes, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN OUT PVOID ParseContext, OUT PHANDLE Handle)
Definition: obhandle.c:2529
FORCEINLINE VOID ExAcquirePushLockExclusive(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1022
#define STATUS_PRIVILEGE_NOT_HELD
Definition: DriverTester.h:9
#define TRUE
Definition: types.h:120
LONG NTSTATUS
Definition: precomp.h:26
BOOLEAN NTAPI SeSinglePrivilegeCheck(IN LUID PrivilegeValue, IN KPROCESSOR_MODE PreviousMode)
Definition: priv.c:524
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
_In_ PVOID _Out_opt_ PULONG_PTR _Outptr_opt_ PCUNICODE_STRING * ObjectName
Definition: cmfuncs.h:62
#define CM_KCB_READ_ONLY_KEY
Definition: cm.h:61
ULONG CreateOptions
Definition: cm.h:484
VOID NTAPI CmpReleaseTwoKcbLockByKey(IN ULONG ConvKey1, IN ULONG ConvKey2)
Definition: cmsysini.c:2050
#define PAGED_CODE()
Definition: video.h:57
_SEH2_TRY
Definition: create.c:4250
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
FORCEINLINE VOID ExReleasePushLockExclusive(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1238
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
smooth NULL
Definition: ftsmooth.c:416
VOID NTAPI CmpLockRegistryExclusive(VOID)
Definition: cmsysini.c:1894
#define STATUS_KEY_DELETED
Definition: ntstatus.h:599
static NTSTATUS CmpConvertHandleToKernelHandle(_In_ HANDLE SourceHandle, _In_opt_ POBJECT_TYPE ObjectType, _In_ ACCESS_MASK DesiredAccess, _In_ KPROCESSOR_MODE AccessMode, _Out_ PHANDLE KernelHandle)
Definition: ntapi.c:195
struct _CM_KEY_CONTROL_BLOCK * KeyControlBlock
Definition: cm.h:229
#define KEY_WRITE
Definition: nt_native.h:1031
_In_ HANDLE Handle
Definition: extypes.h:390
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
#define _SEH2_YIELD(STMT_)
Definition: pseh2_64.h:8
const LUID SeRestorePrivilege
Definition: priv.c:39
__wchar_t WCHAR
Definition: xmlstorage.h:180
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
VOID NTAPI CmpUnlockRegistry(VOID)
Definition: cmsysini.c:1993
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145
#define REG_OPTION_BACKUP_RESTORE
Definition: nt_native.h:1066
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
#define STATUS_CANNOT_DELETE
Definition: shellext.h:71
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
Definition: obhandle.c:3376
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:102
EX_PUSH_LOCK CmpLoadHiveLock
Definition: cmdata.c:39
Status
Definition: gdiplustypes.h:24
NTSTATUS NTAPI CmUnloadKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN ULONG Flags)
Definition: cmapi.c:2194
#define REG_FORCE_UNLOAD
_SEH2_END
Definition: create.c:4424
#define ProbeForReadUnicodeString(Ptr)
Definition: probe.h:77
#define DPRINT1
Definition: precomp.h:8
PUNICODE_STRING ObjectName
Definition: umtypes.h:185
HANDLE RootDirectory
Definition: umtypes.h:184
unsigned int ULONG
Definition: retypes.h:1
#define CmpKeyObjectType
Definition: ObTypes.c:132
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12
VOID NTAPI CmpLockRegistry(VOID)
Definition: cmsysini.c:1907
#define OBJ_KERNEL_HANDLE
Definition: winternl.h:231
BOOLEAN CreateOperation
Definition: cm.h:489
VOID NTAPI CmpAcquireTwoKcbLocksExclusiveByKey(IN ULONG ConvKey1, IN ULONG ConvKey2)
Definition: cmsysini.c:2021

Referenced by DisconnectRegistry(), and NtUnloadKey().

◆ NtUnloadKeyEx()

NTSTATUS NTAPI NtUnloadKeyEx ( IN POBJECT_ATTRIBUTES  TargetKey,
IN HANDLE  Event 
)

Definition at line 1962 of file ntapi.c.

1964 {
1965  UNIMPLEMENTED;
1966  return STATUS_NOT_IMPLEMENTED;
1967 }
#define STATUS_NOT_IMPLEMENTED
Definition: ntstatus.h:225
#define UNIMPLEMENTED
Definition: debug.h:114

◆ ProbeAndCaptureObjectAttributes()

NTSTATUS ProbeAndCaptureObjectAttributes ( _Out_ POBJECT_ATTRIBUTES  CapturedObjectAttributes,
_Out_ PUNICODE_STRING  ObjectName,
_In_ KPROCESSOR_MODE  AccessMode,
_In_ POBJECT_ATTRIBUTES  ObjectAttributes,
_In_ BOOLEAN  CaptureSecurity 
)

Definition at line 53 of file ntapi.c.

59 {
62  // PSECURITY_QUALITY_OF_SERVICE SecurityQos;
63  PUNICODE_STRING LocalObjectName = NULL;
64 
65  /* Zero out the Capture Data */
66  RtlZeroMemory(CapturedObjectAttributes, sizeof(*CapturedObjectAttributes));
67 
68  /* SEH everything here for protection */
69  _SEH2_TRY
70  {
71  /* Check if we got attributes */
72  if (ObjectAttributes)
73  {
74  /* Check if we're in user mode */
75  if (AccessMode != KernelMode)
76  {
77  /* Probe the attributes */
79  sizeof(OBJECT_ATTRIBUTES),
80  sizeof(ULONG));
81  }
82 
83  /* Validate the Size and Attributes */
84  if ((ObjectAttributes->Length != sizeof(OBJECT_ATTRIBUTES)) ||
85  (ObjectAttributes->Attributes & ~OBJ_VALID_KERNEL_ATTRIBUTES)) // Understood as all the possible valid attributes
86  {
87  /* Invalid combination, fail */
89  }
90 
91  /* Set some Create Info and do not allow user-mode kernel handles */
92  CapturedObjectAttributes->Length = sizeof(OBJECT_ATTRIBUTES);
93  CapturedObjectAttributes->RootDirectory = ObjectAttributes->RootDirectory;
94  CapturedObjectAttributes->Attributes = ObpValidateAttributes(ObjectAttributes->Attributes, AccessMode);
95  LocalObjectName = ObjectAttributes->ObjectName;
96  SecurityDescriptor = ObjectAttributes->SecurityDescriptor;
97  // SecurityQos = ObjectAttributes->SecurityQualityOfService;
98 
99  /* Check if we have a security descriptor */
100  if (CaptureSecurity && SecurityDescriptor)
101  {
102  /*
103  * Capture it.
104  * Note: This has an implicit memory barrier due
105  * to the function call, so cleanup is safe here.
106  */
108  AccessMode,
109  NonPagedPool,
110  TRUE,
111  &CapturedObjectAttributes->
113  if (!NT_SUCCESS(Status))
114  {
115  /* Capture failed, quit */
116  CapturedObjectAttributes->SecurityDescriptor = NULL;
117  _SEH2_YIELD(return Status);
118  }
119  }
120  else
121  {
122  CapturedObjectAttributes->SecurityDescriptor = NULL;
123  }
124 
125 #if 0
126 // We don't use the QoS!
127 
128  /* Check if we have QoS */
129  if (SecurityQos)
130  {
131  /* Check if we came from user mode */
132  if (AccessMode != KernelMode)
133  {
134  /* Validate the QoS */
135  ProbeForRead(SecurityQos,
137  sizeof(ULONG));
138  }
139 
140  /* Save Info */
141  CapturedObjectAttributes->SecurityQualityOfService = *SecurityQos;
142  CapturedObjectAttributes->SecurityQos =
143  &CapturedObjectAttributes->SecurityQualityOfService;
144  }
145 #else
146  CapturedObjectAttributes->SecurityQualityOfService = NULL;
147 #endif
148  }
149  else
150  {
151  /* We don't have a name */
152  LocalObjectName = NULL;
153  }
154  }
156  {
157  /* Cleanup and return the exception code */
158  ReleaseCapturedObjectAttributes(CapturedObjectAttributes, AccessMode);
160  }
161  _SEH2_END;
162 
163  /* Now check if the Object Attributes had an Object Name */
164  if (LocalObjectName)
165  {
167  }
168  else
169  {
170  /* Clear the string */
171  RtlInitEmptyUnicodeString(ObjectName, NULL, 0);
172 
173  /* It cannot have specified a Root Directory */
174  if (CapturedObjectAttributes->RootDirectory)
175  {
177  }
178  }
179 
180  /* Set the caputured object attributes name pointer to the one the user gave to us */
181  CapturedObjectAttributes->ObjectName = ObjectName;
182 
183  /* Cleanup if we failed */
184  if (!NT_SUCCESS(Status))
185  {
186  ReleaseCapturedObjectAttributes(CapturedObjectAttributes, AccessMode);
187  }
188 
189  /* Return status to caller */
190  return Status;
191 }
static __inline NTSTATUS ProbeAndCaptureUnicodeString(OUT PUNICODE_STRING Dest, IN KPROCESSOR_MODE CurrentMode, IN const UNICODE_STRING *UnsafeSrc)
Definition: probe.h:142
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
Definition: conport.c:35
#define TRUE
Definition: types.h:120
_In_ USHORT _In_ ULONG _In_ PSOCKADDR _In_ PSOCKADDR _Reserved_ ULONG _In_opt_ PVOID _In_opt_ const WSK_CLIENT_CONNECTION_DISPATCH _In_opt_ PEPROCESS _In_opt_ PETHREAD _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor
Definition: wsk.h:182
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
LONG NTSTATUS
Definition: precomp.h:26
_In_ PVOID _Out_opt_ PULONG_PTR _Outptr_opt_ PCUNICODE_STRING * ObjectName
Definition: cmfuncs.h:62
VOID ReleaseCapturedObjectAttributes(_In_ POBJECT_ATTRIBUTES CapturedObjectAttributes, _In_ KPROCESSOR_MODE AccessMode)
Definition: ntapi.c:27
_SEH2_TRY
Definition: create.c:4250
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
Definition: mmfuncs.h:396
smooth NULL
Definition: ftsmooth.c:416
#define OBJ_VALID_KERNEL_ATTRIBUTES
Definition: obtypes.h:92
struct _OBJECT_ATTRIBUTES OBJECT_ATTRIBUTES
#define _SEH2_YIELD(STMT_)
Definition: pseh2_64.h:8
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:102
Status
Definition: gdiplustypes.h:24
FORCEINLINE ULONG ObpValidateAttributes(IN ULONG Attributes, IN KPROCESSOR_MODE PreviousMode)
Definition: ob_x.h:22
_SEH2_END
Definition: create.c:4424
LONG NTAPI ExSystemExceptionFilter(VOID)
Definition: harderr.c:351
#define STATUS_OBJECT_NAME_INVALID
Definition: udferr_usr.h:148
unsigned int ULONG
Definition: retypes.h:1
#define RtlZeroMemory(Destination, Length)
Definition: typedefs.h:261
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
NTSTATUS NTAPI SeCaptureSecurityDescriptor(IN PSECURITY_DESCRIPTOR _OriginalSecurityDescriptor, IN KPROCESSOR_MODE CurrentMode, IN POOL_TYPE PoolType, IN BOOLEAN CaptureIfKernel, OUT PSECURITY_DESCRIPTOR *CapturedSecurityDescriptor)
Definition: sd.c:434
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12
return STATUS_SUCCESS
Definition: btrfs.c:2938

Referenced by NtLoadKeyEx().

◆ ReleaseCapturedObjectAttributes()

VOID ReleaseCapturedObjectAttributes ( _In_ POBJECT_ATTRIBUTES  CapturedObjectAttributes,
_In_ KPROCESSOR_MODE  AccessMode 
)

Definition at line 27 of file ntapi.c.

30 {
31  /* Check if we have a security descriptor */
32  if (CapturedObjectAttributes->SecurityDescriptor)
33  {
34  /* Release it */
35  SeReleaseSecurityDescriptor(CapturedObjectAttributes->SecurityDescriptor,
36  AccessMode,
37  TRUE);
38  CapturedObjectAttributes->SecurityDescriptor = NULL;
39  }
40 
41  /* Check if we have an object name */
42  if (CapturedObjectAttributes->ObjectName)
43  {
44  /* Release it */
45  ReleaseCapturedUnicodeString(CapturedObjectAttributes->ObjectName, AccessMode);
46  }
47 }
#define TRUE
Definition: types.h:120
NTSTATUS NTAPI SeReleaseSecurityDescriptor(IN PSECURITY_DESCRIPTOR CapturedSecurityDescriptor, IN KPROCESSOR_MODE CurrentMode, IN BOOLEAN CaptureIfKernelMode)
Definition: sd.c:766
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
Definition: mmfuncs.h:396
smooth NULL
Definition: ftsmooth.c:416
static __inline VOID ReleaseCapturedUnicodeString(IN PUNICODE_STRING CapturedString, IN KPROCESSOR_MODE CurrentMode)
Definition: probe.h:239

Referenced by NtLoadKeyEx(), and ProbeAndCaptureObjectAttributes().

Variable Documentation

◆ CmBootAcceptFirstTime

BOOLEAN CmBootAcceptFirstTime = TRUE

Definition at line 16 of file ntapi.c.

Referenced by NtInitializeRegistry().

◆ CmFirstTime

BOOLEAN CmFirstTime = TRUE

Definition at line 17 of file ntapi.c.

Referenced by CmShutdownSystem(), and NtInitializeRegistry().

◆ InitSafeBootMode

ULONG InitSafeBootMode

Definition at line 68 of file init.c.

Referenced by NtLockProductActivationKeys().