ReactOS 0.4.15-dev-8102-g108db8f
ntapi.c File Reference
#include "ntoskrnl.h"
#include "debug.h"
Include dependency graph for ntapi.c:

Go to the source code of this file.

Macros

#define NDEBUG
 
#define PRODUCT_ACTIVATION_VERSION   7749
 

Functions

VOID ReleaseCapturedObjectAttributes (_In_ POBJECT_ATTRIBUTES CapturedObjectAttributes, _In_ KPROCESSOR_MODE AccessMode)
 
NTSTATUS ProbeAndCaptureObjectAttributes (_Out_ POBJECT_ATTRIBUTES CapturedObjectAttributes, _Out_ PUNICODE_STRING ObjectName, _In_ KPROCESSOR_MODE AccessMode, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ BOOLEAN CaptureSecurity)
 
static NTSTATUS CmpConvertHandleToKernelHandle (_In_ HANDLE SourceHandle, _In_opt_ POBJECT_TYPE ObjectType, _In_ ACCESS_MASK DesiredAccess, _In_ KPROCESSOR_MODE AccessMode, _Out_ PHANDLE KernelHandle)
 
NTSTATUS NTAPI NtCreateKey (OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG TitleIndex, IN PUNICODE_STRING Class OPTIONAL, IN ULONG CreateOptions, OUT PULONG Disposition OPTIONAL)
 
NTSTATUS NTAPI NtOpenKey (OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes)
 
NTSTATUS NTAPI NtDeleteKey (IN HANDLE KeyHandle)
 
NTSTATUS NTAPI NtEnumerateKey (IN HANDLE KeyHandle, IN ULONG Index, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT PVOID KeyInformation, IN ULONG Length, OUT PULONG ResultLength)
 
NTSTATUS NTAPI NtEnumerateValueKey (IN HANDLE KeyHandle, IN ULONG Index, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, OUT PVOID KeyValueInformation, IN ULONG Length, OUT PULONG ResultLength)
 
NTSTATUS NTAPI NtQueryKey (IN HANDLE KeyHandle, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT PVOID KeyInformation, IN ULONG Length, OUT PULONG ResultLength)
 
NTSTATUS NTAPI NtQueryValueKey (IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, OUT PVOID KeyValueInformation, IN ULONG Length, OUT PULONG ResultLength)
 
NTSTATUS NTAPI NtSetValueKey (IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN ULONG TitleIndex, IN ULONG Type, IN PVOID Data, IN ULONG DataSize)
 
NTSTATUS NTAPI NtDeleteValueKey (IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName)
 
NTSTATUS NTAPI NtFlushKey (IN HANDLE KeyHandle)
 
NTSTATUS NTAPI NtLoadKey (IN POBJECT_ATTRIBUTES KeyObjectAttributes, IN POBJECT_ATTRIBUTES FileObjectAttributes)
 
NTSTATUS NTAPI NtLoadKey2 (IN POBJECT_ATTRIBUTES KeyObjectAttributes, IN POBJECT_ATTRIBUTES FileObjectAttributes, IN ULONG Flags)
 
NTSTATUS NTAPI NtLoadKeyEx (IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile, IN ULONG Flags, IN HANDLE TrustClassKey)
 
NTSTATUS NTAPI NtNotifyChangeKey (IN HANDLE KeyHandle, IN HANDLE Event, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CompletionFilter, IN BOOLEAN WatchTree, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN Asynchronous)
 
NTSTATUS NTAPI NtInitializeRegistry (IN USHORT Flag)
 
NTSTATUS NTAPI NtCompactKeys (IN ULONG Count, IN PHANDLE KeyArray)
 
NTSTATUS NTAPI NtCompressKey (IN HANDLE Key)
 
NTSTATUS NTAPI NtLockProductActivationKeys (IN PULONG pPrivateVer, IN PULONG pSafeMode)
 
NTSTATUS NTAPI NtLockRegistryKey (IN HANDLE KeyHandle)
 
NTSTATUS NTAPI NtNotifyChangeMultipleKeys (IN HANDLE MasterKeyHandle, IN ULONG Count, IN POBJECT_ATTRIBUTES SlaveObjects, IN HANDLE Event, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CompletionFilter, IN BOOLEAN WatchTree, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN Asynchronous)
 
NTSTATUS NTAPI NtQueryMultipleValueKey (IN HANDLE KeyHandle, IN OUT PKEY_VALUE_ENTRY ValueList, IN ULONG NumberOfValues, OUT PVOID Buffer, IN OUT PULONG Length, OUT PULONG ReturnLength)
 
NTSTATUS NTAPI NtQueryOpenSubKeys (IN POBJECT_ATTRIBUTES TargetKey, OUT PULONG HandleCount)
 
NTSTATUS NTAPI NtQueryOpenSubKeysEx (IN POBJECT_ATTRIBUTES TargetKey, IN ULONG BufferLength, IN PVOID Buffer, IN PULONG RequiredSize)
 
NTSTATUS NTAPI NtRenameKey (IN HANDLE KeyHandle, IN PUNICODE_STRING ReplacementName)
 
NTSTATUS NTAPI NtReplaceKey (IN POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE Key, IN POBJECT_ATTRIBUTES ReplacedObjectAttributes)
 
NTSTATUS NTAPI NtRestoreKey (IN HANDLE KeyHandle, IN HANDLE FileHandle, IN ULONG RestoreFlags)
 
NTSTATUS NTAPI NtSaveKey (IN HANDLE KeyHandle, IN HANDLE FileHandle)
 
NTSTATUS NTAPI NtSaveKeyEx (IN HANDLE KeyHandle, IN HANDLE FileHandle, IN ULONG Flags)
 
NTSTATUS NTAPI NtSaveMergedKeys (IN HANDLE HighPrecedenceKeyHandle, IN HANDLE LowPrecedenceKeyHandle, IN HANDLE FileHandle)
 
NTSTATUS NTAPI NtSetInformationKey (IN HANDLE KeyHandle, IN KEY_SET_INFORMATION_CLASS KeyInformationClass, IN PVOID KeyInformation, IN ULONG KeyInformationLength)
 
NTSTATUS NTAPI NtUnloadKey (IN POBJECT_ATTRIBUTES KeyObjectAttributes)
 
NTSTATUS NTAPI NtUnloadKey2 (IN POBJECT_ATTRIBUTES TargetKey, IN ULONG Flags)
 
NTSTATUS NTAPI NtUnloadKeyEx (IN POBJECT_ATTRIBUTES TargetKey, IN HANDLE Event)
 

Variables

BOOLEAN CmBootAcceptFirstTime = TRUE
 
BOOLEAN CmFirstTime = TRUE
 
ULONG InitSafeBootMode
 

Macro Definition Documentation

◆ NDEBUG

#define NDEBUG

Definition at line 13 of file ntapi.c.

◆ PRODUCT_ACTIVATION_VERSION

#define PRODUCT_ACTIVATION_VERSION   7749

Definition at line 1400 of file ntapi.c.

Function Documentation

◆ CmpConvertHandleToKernelHandle()

static NTSTATUS CmpConvertHandleToKernelHandle ( _In_ HANDLE  SourceHandle,
_In_opt_ POBJECT_TYPE  ObjectType,
_In_ ACCESS_MASK  DesiredAccess,
_In_ KPROCESSOR_MODE  AccessMode,
_Out_ PHANDLE  KernelHandle 
)
static

Definition at line 195 of file ntapi.c.

201{
204
206
207 /* NULL handle is valid */
208 if (SourceHandle == NULL)
209 return STATUS_SUCCESS;
210
211 /* Get the object pointer */
216 &Object,
217 NULL);
218 if (!NT_SUCCESS(Status))
219 return Status;
220
221 /* Create a kernel handle from the pointer */
224 NULL,
229
230 /* Dereference the object */
232 return Status;
233}
LONG NTSTATUS
Definition: precomp.h:26
#define NULL
Definition: types.h:112
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
HANDLE KernelHandle
Definition: legacy.c:24
Status
Definition: gdiplustypes.h:25
#define OBJ_KERNEL_HANDLE
Definition: winternl.h:231
ObjectType
Definition: metafile.c:81
#define KernelMode
Definition: asm.h:34
_In_ HANDLE SourceHandle
Definition: obfuncs.h:429
NTSTATUS NTAPI ObOpenObjectByPointer(IN PVOID Object, IN ULONG HandleAttributes, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PHANDLE Handle)
Definition: obhandle.c:2742
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:494
#define STATUS_SUCCESS
Definition: shellext.h:65
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
Definition: wdfdevice.h:2658
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
Definition: mmfuncs.h:396
#define ObDereferenceObject
Definition: obfuncs.h:203

Referenced by NtLoadKeyEx(), NtSaveKeyEx(), NtSaveMergedKeys(), and NtUnloadKey2().

◆ NtCompactKeys()

NTSTATUS NTAPI NtCompactKeys ( IN ULONG  Count,
IN PHANDLE  KeyArray 
)

Definition at line 1384 of file ntapi.c.

1386{
1389}
#define UNIMPLEMENTED
Definition: debug.h:118
#define STATUS_NOT_IMPLEMENTED
Definition: ntstatus.h:239

◆ NtCompressKey()

NTSTATUS NTAPI NtCompressKey ( IN HANDLE  Key)

Definition at line 1393 of file ntapi.c.

1394{
1397}

◆ NtCreateKey()

NTSTATUS NTAPI NtCreateKey ( OUT PHANDLE  KeyHandle,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_ATTRIBUTES  ObjectAttributes,
IN ULONG  TitleIndex,
IN PUNICODE_STRING Class  OPTIONAL,
IN ULONG  CreateOptions,
OUT PULONG Disposition  OPTIONAL 
)

Definition at line 240 of file ntapi.c.

247{
250 CM_PARSE_CONTEXT ParseContext = {0};
252 PAGED_CODE();
253
254 DPRINT("NtCreateKey(Path: %wZ, Root %x, Access: %x, CreateOptions %x)\n",
255 ObjectAttributes->ObjectName, ObjectAttributes->RootDirectory,
257
258 /* Ignore the WOW64 flag, it's not valid in the kernel */
259 DesiredAccess &= ~KEY_WOW64_RES;
260
261 /* Check for user-mode caller */
263 {
264 /* Prepare to probe parameters */
266 {
267 /* Check if we have a class */
268 if (Class)
269 {
270 /* Probe it */
271 ParseContext.Class = ProbeForReadUnicodeString(Class);
272 ProbeForRead(ParseContext.Class.Buffer,
273 ParseContext.Class.Length,
274 sizeof(WCHAR));
275 }
276
277 /* Probe the key handle */
279 *KeyHandle = NULL;
280
281 /* Probe object attributes */
283 sizeof(OBJECT_ATTRIBUTES),
284 sizeof(ULONG));
285
286 if (Disposition)
288 }
290 {
291 /* Return the exception code */
293 }
294 _SEH2_END;
295 }
296 else
297 {
298 /* Save the class directly */
299 if (Class) ParseContext.Class = *Class;
300 }
301
302 /* Setup the parse context */
303 ParseContext.CreateOperation = TRUE;
304 ParseContext.CreateOptions = CreateOptions;
305
306 /* Do the create */
310 NULL,
312 &ParseContext,
313 &Handle);
314
316 {
317 /* Return data to user */
319 if (Disposition) *Disposition = ParseContext.Disposition;
320 }
322 {
323 /* Get the status */
325 }
326 _SEH2_END;
327
328 DPRINT("Returning handle %x, Status %x.\n", Handle, Status);
329
330 /* Return status */
331 return Status;
332}
#define PAGED_CODE()
#define CmpKeyObjectType
Definition: ObTypes.c:127
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
Definition: conport.c:36
#define TRUE
Definition: types.h:120
#define ExGetPreviousMode
Definition: ex.h:140
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:102
#define _SEH2_END
Definition: filesup.c:22
#define _SEH2_TRY
Definition: filesup.c:19
ULONG Handle
Definition: gdb_input.c:15
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4715
_In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Reserved_ ULONG _In_opt_ PUNICODE_STRING _In_ ULONG _Out_opt_ PULONG Disposition
Definition: cmfuncs.h:56
NTSTATUS NTAPI ObOpenObjectByName(IN POBJECT_ATTRIBUTES ObjectAttributes, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN OUT PVOID ParseContext, OUT PHANDLE Handle)
Definition: obhandle.c:2532
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:165
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:66
#define _SEH2_YIELD(__stmt)
Definition: pseh2_64.h:168
#define ProbeForWriteHandle(Ptr)
Definition: probe.h:43
#define ProbeForWriteUlong(Ptr)
Definition: probe.h:36
#define ProbeForReadUnicodeString(Ptr)
Definition: probe.h:77
#define DPRINT
Definition: sndvol32.h:73
ULONG Disposition
Definition: cm.h:437
UNICODE_STRING Class
Definition: cm.h:435
BOOLEAN CreateOperation
Definition: cm.h:441
ULONG CreateOptions
Definition: cm.h:436
uint32_t ULONG
Definition: typedefs.h:59
_Must_inspect_result_ _In_opt_ WDFKEY _In_ PCUNICODE_STRING _In_ ACCESS_MASK _In_ ULONG CreateOptions
Definition: wdfregistry.h:118
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
__wchar_t WCHAR
Definition: xmlstorage.h:180

Referenced by AddHotkeySettings(), AddKbLayoutsToRegistry(), BasepMoveFileDelayed(), CmInitSystem1(), CmpCreateControlSet(), CmpCreateHardwareProfile(), CmpInitializeHardwareConfiguration(), CmpInitializeMachineDependentConfiguration(), CmpInitializeRegistryNode(), CmpSetVersionData(), create_key(), create_registry_key(), CreateKeyTest(), CreateNestedKey(), CreateRegistryKeyHandle(), CreateRegKey(), CreateSymLinkKey(), DeleteSymLinkKey(), InitFunctionPtrs(), InitializeUserModePnpManager(), InstallDriver(), LOCALE_InitRegistry(), LsapCreateDatabaseKeys(), LsapCreateDbObject(), LsapSetObjectAttribute(), RegInitializeRegistry(), RegpCopyTree(), SdbRegisterDatabaseEx(), SdbUnregisterDatabase(), SetActiveComputerNameToRegistry(), SetMountedDeviceValue(), SetUserGeoID(), SetValueTest1(), SetValueTest2(), START_TEST(), test2(), test3(), test6(), test7(), Test_KeyFullInformation(), and TestCreateOpen_().

◆ NtDeleteKey()

NTSTATUS NTAPI NtDeleteKey ( IN HANDLE  KeyHandle)

Definition at line 408 of file ntapi.c.

409{
410 PCM_KEY_BODY KeyObject;
412 REG_DELETE_KEY_INFORMATION DeleteKeyInfo;
413 REG_POST_OPERATION_INFORMATION PostOperationInfo;
414 PAGED_CODE();
415 DPRINT("NtDeleteKey(KH 0x%p)\n", KeyHandle);
416
417 /* Verify that the handle is valid and is a registry key */
419 DELETE,
422 (PVOID*)&KeyObject,
423 NULL);
424 if (!NT_SUCCESS(Status)) return Status;
425
426 /* Setup the callback */
427 PostOperationInfo.Object = (PVOID)KeyObject;
428 DeleteKeyInfo.Object = (PVOID)KeyObject;
430 if (NT_SUCCESS(Status))
431 {
432 /* Check if we are read-only */
433 if ((KeyObject->KeyControlBlock->ExtFlags & CM_KCB_READ_ONLY_KEY) ||
434 (KeyObject->KeyControlBlock->ParentKcb->ExtFlags & CM_KCB_READ_ONLY_KEY))
435 {
436 /* Fail */
438 }
439 else
440 {
441 /* Call the internal API */
442 Status = CmDeleteKey(KeyObject);
443 }
444
445 /* Do post callback */
446 PostOperationInfo.Status = Status;
448 }
449
450 /* Dereference and return status */
451 ObDereferenceObject(KeyObject);
452 return Status;
453}
#define CM_KCB_READ_ONLY_KEY
Definition: cm.h:59
NTSTATUS NTAPI CmDeleteKey(IN PCM_KEY_BODY KeyBody)
Definition: cmapi.c:1823
NTSTATUS CmiCallRegisteredCallbacks(IN REG_NOTIFY_CLASS Argument1, IN PVOID Argument2)
Definition: cmhook.c:59
#define DELETE
Definition: nt_native.h:57
struct _CM_KEY_CONTROL_BLOCK * KeyControlBlock
Definition: cm.h:234
Definition: cmtypes.h:858
PVOID Object
Definition: cmtypes.h:859
NTSTATUS Status
Definition: cmtypes.h:860
void * PVOID
Definition: typedefs.h:50
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145
@ RegNtPostDeleteKey
Definition: cmtypes.h:656
@ RegNtPreDeleteKey
Definition: cmtypes.h:631

Referenced by DeleteKeyTest(), DeleteSymLinkKey(), DestroyProtoHive(), do_reg_operation(), InitFunctionPtrs(), LsapRegDeleteKey(), LsapRegDeleteSubKey(), RegCleanupRegistry(), RegDeleteKeyExW(), RegInitializeRegistry(), SampRegDeleteKey(), SdbUnregisterDatabase(), START_TEST(), test2(), test3(), test7(), and Test_KeyFullInformation().

◆ NtDeleteValueKey()

NTSTATUS NTAPI NtDeleteValueKey ( IN HANDLE  KeyHandle,
IN PUNICODE_STRING  ValueName 
)

Definition at line 1014 of file ntapi.c.

1016{
1018 PCM_KEY_BODY KeyObject;
1019 REG_DELETE_VALUE_KEY_INFORMATION DeleteValueKeyInfo;
1020 REG_POST_OPERATION_INFORMATION PostOperationInfo;
1022 UNICODE_STRING ValueNameCopy;
1023
1024 PAGED_CODE();
1025
1026 /* Verify that the handle is valid and is a registry key */
1031 (PVOID*)&KeyObject,
1032 NULL);
1033 if (!NT_SUCCESS(Status))
1034 return Status;
1035
1036 /* Capture the string */
1038 if (!NT_SUCCESS(Status))
1039 goto Quit;
1040
1041 /* Make sure the name is aligned properly */
1042 if (ValueNameCopy.Length & (sizeof(WCHAR) - 1))
1043 {
1044 /* It isn't, so we'll fail */
1046 goto Quit;
1047 }
1048
1049 /* Don't touch read-only keys */
1050 if (KeyObject->KeyControlBlock->ExtFlags & CM_KCB_READ_ONLY_KEY)
1051 {
1052 /* Fail */
1054 goto Quit;
1055 }
1056
1057 /* Do the callback */
1058 DeleteValueKeyInfo.Object = (PVOID)KeyObject;
1059 DeleteValueKeyInfo.ValueName = ValueName;
1061 &DeleteValueKeyInfo);
1062 if (NT_SUCCESS(Status))
1063 {
1064 /* Call the internal API */
1065 Status = CmDeleteValueKey(KeyObject->KeyControlBlock, ValueNameCopy);
1066
1067 /* Do the post callback */
1068 PostOperationInfo.Object = (PVOID)KeyObject;
1069 PostOperationInfo.Status = Status;
1071 &PostOperationInfo);
1072 }
1073
1074Quit:
1075 if (ValueNameCopy.Buffer)
1077
1078 /* Dereference and return status */
1079 ObDereferenceObject(KeyObject);
1080 return Status;
1081}
NTSTATUS NTAPI CmDeleteValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN UNICODE_STRING ValueName)
Definition: cmapi.c:915
#define KEY_SET_VALUE
Definition: nt_native.h:1017
static __inline NTSTATUS ProbeAndCaptureUnicodeString(OUT PUNICODE_STRING Dest, IN KPROCESSOR_MODE CurrentMode, IN const UNICODE_STRING *UnsafeSrc)
Definition: probe.h:142
static __inline VOID ReleaseCapturedUnicodeString(IN PUNICODE_STRING CapturedString, IN KPROCESSOR_MODE CurrentMode)
Definition: probe.h:239
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING ValueName
Definition: wdfregistry.h:243
@ RegNtPreDeleteValueKey
Definition: cmtypes.h:635
@ RegNtPostDeleteValueKey
Definition: cmtypes.h:658

Referenced by AddFontsSettingsToRegistry(), CmpSetVersionData(), DeleteHKCRValue(), DeleteSymLinkKey(), DeleteValueTest(), InitFunctionPtrs(), LsapRegDeleteValue(), RegDeleteValueA(), RegDeleteValueW(), RtlApplyRXact(), RtlInitializeRXact(), SampRegDeleteValue(), SdbDeletePermLayerKeys(), SmpLoadDataFromRegistry(), START_TEST(), and test7().

◆ NtEnumerateKey()

NTSTATUS NTAPI NtEnumerateKey ( IN HANDLE  KeyHandle,
IN ULONG  Index,
IN KEY_INFORMATION_CLASS  KeyInformationClass,
OUT PVOID  KeyInformation,
IN ULONG  Length,
OUT PULONG  ResultLength 
)

Definition at line 457 of file ntapi.c.

463{
466 PCM_KEY_BODY KeyObject;
467 REG_ENUMERATE_KEY_INFORMATION EnumerateKeyInfo;
468 REG_POST_OPERATION_INFORMATION PostOperationInfo;
469 PAGED_CODE();
470 DPRINT("NtEnumerateKey() KH 0x%p, Index 0x%x, KIC %d, Length %lu\n",
472
473 /* Reject classes we don't know about */
477 {
478 /* Fail */
480 }
481
482 /* Verify that the handle is valid and is a registry key */
487 (PVOID*)&KeyObject,
488 NULL);
489 if (!NT_SUCCESS(Status)) return Status;
490
492 {
494 {
496 ProbeForWrite(KeyInformation,
497 Length,
498 sizeof(ULONG));
499 }
501 {
502 /* Dereference and return status */
503 ObDereferenceObject(KeyObject);
505 }
506 _SEH2_END;
507 }
508
509 /* Setup the callback */
510 PostOperationInfo.Object = (PVOID)KeyObject;
511 EnumerateKeyInfo.Object = (PVOID)KeyObject;
512 EnumerateKeyInfo.Index = Index;
513 EnumerateKeyInfo.KeyInformationClass = KeyInformationClass;
514 EnumerateKeyInfo.Length = Length;
515 EnumerateKeyInfo.ResultLength = ResultLength;
516
517 /* Do the callback */
519 if (NT_SUCCESS(Status))
520 {
521 /* Call the internal API */
523 Index,
525 KeyInformation,
526 Length,
528
529 /* Do the post callback */
530 PostOperationInfo.Status = Status;
532 }
533
534 /* Dereference and return status */
535 ObDereferenceObject(KeyObject);
536 DPRINT("Returning status %x.\n", Status);
537 return Status;
538}
NTSTATUS NTAPI CmEnumerateKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN ULONG Index, IN KEY_INFORMATION_CLASS KeyInformationClass, IN PVOID KeyInformation, IN ULONG Length, IN PULONG ResultLength)
Definition: cmapi.c:1734
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:143
@ KeyBasicInformation
Definition: nt_native.h:1131
@ KeyNodeInformation
Definition: nt_native.h:1132
@ KeyFullInformation
Definition: nt_native.h:1133
#define KEY_ENUMERATE_SUB_KEYS
Definition: nt_native.h:1019
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:102
KEY_INFORMATION_CLASS KeyInformationClass
Definition: cmtypes.h:744
_In_ WDFCOLLECTION _In_ ULONG Index
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG _Out_ PULONG ResultLength
Definition: wdfdevice.h:3776
@ RegNtPreEnumerateKey
Definition: cmtypes.h:641
@ RegNtPostEnumerateKey
Definition: cmtypes.h:661
_In_ ULONG _In_ KEY_INFORMATION_CLASS KeyInformationClass
Definition: zwfuncs.h:167

◆ NtEnumerateValueKey()

NTSTATUS NTAPI NtEnumerateValueKey ( IN HANDLE  KeyHandle,
IN ULONG  Index,
IN KEY_VALUE_INFORMATION_CLASS  KeyValueInformationClass,
OUT PVOID  KeyValueInformation,
IN ULONG  Length,
OUT PULONG  ResultLength 
)

Definition at line 542 of file ntapi.c.

548{
551 PCM_KEY_BODY KeyObject;
552 REG_ENUMERATE_VALUE_KEY_INFORMATION EnumerateValueKeyInfo;
553 REG_POST_OPERATION_INFORMATION PostOperationInfo;
554
555 PAGED_CODE();
556
557 DPRINT("NtEnumerateValueKey() KH 0x%p, Index 0x%x, KVIC %d, Length %lu\n",
559
560 /* Reject classes we don't know about */
566 {
567 /* Fail */
569 }
570
571 /* Verify that the handle is valid and is a registry key */
576 (PVOID*)&KeyObject,
577 NULL);
578 if (!NT_SUCCESS(Status)) return Status;
579
581 {
583 {
585 ProbeForWrite(KeyValueInformation,
586 Length,
587 sizeof(ULONG));
588 }
590 {
591 /* Dereference and return status */
592 ObDereferenceObject(KeyObject);
594 }
595 _SEH2_END;
596 }
597
598 /* Setup the callback */
599 PostOperationInfo.Object = (PVOID)KeyObject;
600 EnumerateValueKeyInfo.Object = (PVOID)KeyObject;
601 EnumerateValueKeyInfo.Index = Index;
603 EnumerateValueKeyInfo.KeyValueInformation = KeyValueInformation;
604 EnumerateValueKeyInfo.Length = Length;
605 EnumerateValueKeyInfo.ResultLength = ResultLength;
606
607 /* Do the callback */
609 &EnumerateValueKeyInfo);
610 if (NT_SUCCESS(Status))
611 {
612 /* Call the internal API */
614 Index,
616 KeyValueInformation,
617 Length,
619
620 /* Do the post callback */
621 PostOperationInfo.Status = Status;
623 }
624
625 /* Dereference and return status */
626 ObDereferenceObject(KeyObject);
627 return Status;
628}
NTSTATUS NTAPI CmEnumerateValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN ULONG Index, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, IN PVOID KeyValueInformation, IN ULONG Length, IN PULONG ResultLength)
Definition: cmapi.c:1191
@ KeyValuePartialInformationAlign64
Definition: reg.c:103
@ KeyValueFullInformationAlign64
Definition: reg.c:102
_In_ ULONG _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass
Definition: cmfuncs.h:94
@ KeyValueBasicInformation
Definition: nt_native.h:1180
@ KeyValuePartialInformation
Definition: nt_native.h:1182
@ KeyValueFullInformation
Definition: nt_native.h:1181
#define KEY_QUERY_VALUE
Definition: nt_native.h:1016
KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass
Definition: cmtypes.h:756
@ RegNtPostEnumerateValueKey
Definition: cmtypes.h:662
@ RegNtPreEnumerateValueKey
Definition: cmtypes.h:643

Referenced by EnumerateValueTest(), InitializeFmIfsOnce(), NLS_RegEnumValue(), RegEnumValueW(), RegpCopyTree(), test1(), test2(), test3(), and test9().

◆ NtFlushKey()

NTSTATUS NTAPI NtFlushKey ( IN HANDLE  KeyHandle)

Definition at line 1085 of file ntapi.c.

1086{
1088 PCM_KEY_BODY KeyObject;
1089 PAGED_CODE();
1090
1091 /* Get the key object */
1093 0,
1096 (PVOID*)&KeyObject,
1097 NULL);
1098 if (!NT_SUCCESS(Status)) return Status;
1099
1100 /* Lock the registry */
1102
1103 /* Lock the KCB */
1105
1106 /* Make sure KCB isn't deleted */
1107 if (KeyObject->KeyControlBlock->Delete)
1108 {
1109 /* Fail */
1111 }
1112 else
1113 {
1114 /* Call the internal API */
1115 Status = CmFlushKey(KeyObject->KeyControlBlock, FALSE);
1116 }
1117
1118 /* Release the locks */
1121
1122 /* Dereference the object and return status */
1123 ObDereferenceObject(KeyObject);
1124 return Status;
1125}
#define CmpAcquireKcbLockShared(k)
Definition: cm_x.h:145
FORCEINLINE VOID CmpReleaseKcbLock(PCM_KEY_CONTROL_BLOCK Kcb)
Definition: cm_x.h:185
NTSTATUS NTAPI CmFlushKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN BOOLEAN ExclusiveLock)
Definition: cmapi.c:1937
VOID NTAPI CmpUnlockRegistry(VOID)
Definition: cmsysini.c:2056
VOID NTAPI CmpLockRegistry(VOID)
Definition: cmsysini.c:1970
#define FALSE
Definition: types.h:117
#define STATUS_KEY_DELETED
Definition: ntstatus.h:613

Referenced by CreateProtoHive(), InitFunctionPtrs(), RegCleanupRegistry(), RegFlushKey(), RegInitializeRegistry(), RtlApplyRXact(), SetActiveComputerNameToRegistry(), SetComputerNameToRegistry(), START_TEST(), and test5().

◆ NtInitializeRegistry()

NTSTATUS NTAPI NtInitializeRegistry ( IN USHORT  Flag)

Definition at line 1318 of file ntapi.c.

1319{
1320 BOOLEAN SetupBoot;
1322 PAGED_CODE();
1323
1324 /* Always do this as kernel mode */
1325 if (KeGetPreviousMode() == UserMode)
1326 return ZwInitializeRegistry(Flag);
1327
1328 /* Enough of the system has booted by now */
1329 Ki386PerfEnd();
1330
1331 /* Validate flag */
1333
1334 /* Check if boot was accepted */
1336 {
1337 /* Only allow once */
1340
1341 /* Get the control set accepted */
1343 if (Flag)
1344 {
1345 /* Save the last known good boot */
1347
1348 /* Notify HAL */
1349 HalEndOfBoot();
1350
1351 /* Enable lazy flush */
1353 CmpLazyFlush();
1354 return Status;
1355 }
1356
1357 /* Otherwise, invalid boot */
1359 }
1360
1361 /* Check if this was a setup boot */
1362 SetupBoot = (Flag == CM_BOOT_FLAG_SETUP ? TRUE : FALSE);
1363
1364 /* Make sure we're only called once */
1365 if (!CmFirstTime) return STATUS_ACCESS_DENIED;
1367
1368 /* Lock the registry exclusively */
1370
1371 /* Initialize the hives and lazy flusher */
1372 CmpCmdInit(SetupBoot);
1373
1374 /* Save version data */
1376
1377 /* Release the registry lock */
1379 return STATUS_SUCCESS;
1380}
unsigned char BOOLEAN
NTSTATUS NTAPI CmpSaveBootControlSet(IN USHORT ControlSet)
Definition: cmcontrl.c:267
VOID NTAPI CmpLazyFlush(VOID)
Definition: cmlazy.c:157
VOID NTAPI CmpCmdInit(IN BOOLEAN SetupBoot)
Definition: cmlazy.c:233
BOOLEAN CmpHoldLazyFlush
Definition: cmlazy.c:23
VOID NTAPI CmpSetVersionData(VOID)
Definition: cmsysini.c:2182
VOID NTAPI CmpLockRegistryExclusive(VOID)
Definition: cmsysini.c:1957
#define UserMode
Definition: asm.h:35
#define KeGetPreviousMode()
Definition: ketypes.h:1115
NTSYSAPI NTSTATUS NTAPI ZwInitializeRegistry(_In_ USHORT Flag)
#define CM_BOOT_FLAG_ACCEPTED
Definition: cmtypes.h:160
#define CM_BOOT_FLAG_MAX
Definition: cmtypes.h:161
#define CM_BOOT_FLAG_SETUP
Definition: cmtypes.h:159
BOOLEAN CmBootAcceptFirstTime
Definition: ntapi.c:16
BOOLEAN CmFirstTime
Definition: ntapi.c:17
#define Ki386PerfEnd()
Definition: ke.h:174
Definition: xml2sdb.h:80
#define HalEndOfBoot
Definition: haltypes.h:307

Referenced by RunUSetup(), SmpLoadDataFromRegistry(), and WinMain().

◆ NtLoadKey()

NTSTATUS NTAPI NtLoadKey ( IN POBJECT_ATTRIBUTES  KeyObjectAttributes,
IN POBJECT_ATTRIBUTES  FileObjectAttributes 
)

Definition at line 1129 of file ntapi.c.

1131{
1132 /* Call the newer API */
1133 return NtLoadKeyEx(KeyObjectAttributes, FileObjectAttributes, 0, NULL);
1134}
NTSTATUS NTAPI NtLoadKeyEx(IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile, IN ULONG Flags, IN HANDLE TrustClassKey)
Definition: ntapi.c:1148
_In_ PWDFDEVICE_INIT _In_ PWDF_FILEOBJECT_CONFIG _In_opt_ PWDF_OBJECT_ATTRIBUTES FileObjectAttributes
Definition: wdfdevice.h:3400

Referenced by ConnectRegistry(), RegLoadKeyW(), and test8().

◆ NtLoadKey2()

NTSTATUS NTAPI NtLoadKey2 ( IN POBJECT_ATTRIBUTES  KeyObjectAttributes,
IN POBJECT_ATTRIBUTES  FileObjectAttributes,
IN ULONG  Flags 
)

Definition at line 1138 of file ntapi.c.

1141{
1142 /* Call the newer API */
1143 return NtLoadKeyEx(KeyObjectAttributes, FileObjectAttributes, Flags, NULL);
1144}
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170

◆ NtLoadKeyEx()

NTSTATUS NTAPI NtLoadKeyEx ( IN POBJECT_ATTRIBUTES  TargetKey,
IN POBJECT_ATTRIBUTES  SourceFile,
IN ULONG  Flags,
IN HANDLE  TrustClassKey 
)

Definition at line 1148 of file ntapi.c.

1152{
1155 OBJECT_ATTRIBUTES CapturedTargetKey;
1156 OBJECT_ATTRIBUTES CapturedSourceFile;
1157 UNICODE_STRING TargetKeyName, SourceFileName;
1158 HANDLE KmTargetKeyRootDir = NULL, KmSourceFileRootDir = NULL;
1159 PCM_KEY_BODY KeyBody = NULL;
1160
1161 PAGED_CODE();
1162
1163 /* Validate flags */
1164 if (Flags & ~REG_NO_LAZY_FLUSH)
1166
1167 /* Validate privilege */
1169 {
1170 DPRINT1("Restore Privilege missing!\n");
1172 }
1173
1174 /* Block APCs */
1176
1177 /* Check for user-mode caller */
1178 if (PreviousMode != KernelMode)
1179 {
1180 /* Prepare to probe parameters */
1181 _SEH2_TRY
1182 {
1183 /* Probe target key */
1184 ProbeForRead(TargetKey,
1185 sizeof(OBJECT_ATTRIBUTES),
1186 sizeof(ULONG));
1187
1188 /* Probe source file */
1189 ProbeForRead(SourceFile,
1190 sizeof(OBJECT_ATTRIBUTES),
1191 sizeof(ULONG));
1192 }
1194 {
1195 /* Return the exception code */
1197 _SEH2_YIELD(goto Quit);
1198 }
1199 _SEH2_END;
1200 }
1201
1202 /* Probe and capture the target key attributes, including the security */
1203 Status = ProbeAndCaptureObjectAttributes(&CapturedTargetKey,
1204 &TargetKeyName,
1206 TargetKey,
1207 TRUE);
1208 if (!NT_SUCCESS(Status))
1209 goto Quit;
1210
1211 /*
1212 * Probe and capture the source file attributes, but not the security.
1213 * A proper security context is built by CmLoadKey().
1214 */
1215 Status = ProbeAndCaptureObjectAttributes(&CapturedSourceFile,
1216 &SourceFileName,
1218 SourceFile,
1219 FALSE);
1220 if (!NT_SUCCESS(Status))
1221 {
1222 ReleaseCapturedObjectAttributes(&CapturedTargetKey, PreviousMode);
1223 goto Quit;
1224 }
1225
1226 /* Make sure the target key root directory handle is a kernel handle */
1229 KEY_READ,
1231 &KmTargetKeyRootDir);
1232 if (!NT_SUCCESS(Status))
1233 goto Cleanup;
1234 CapturedTargetKey.RootDirectory = KmTargetKeyRootDir;
1235 CapturedTargetKey.Attributes |= OBJ_KERNEL_HANDLE;
1236
1237 /* Make sure the source file root directory handle is a kernel handle */
1242 &KmSourceFileRootDir);
1243 if (!NT_SUCCESS(Status))
1244 goto Cleanup;
1245 CapturedSourceFile.RootDirectory = KmSourceFileRootDir;
1246 CapturedSourceFile.Attributes |= OBJ_KERNEL_HANDLE;
1247
1248 /* Check if we have a trust class */
1249 if (TrustClassKey)
1250 {
1251 /* Reference it */
1252 Status = ObReferenceObjectByHandle(TrustClassKey,
1253 0,
1256 (PVOID*)&KeyBody,
1257 NULL);
1258 }
1259
1260 /* Call the internal API */
1261 Status = CmLoadKey(&CapturedTargetKey,
1262 &CapturedSourceFile,
1263 Flags,
1264 KeyBody);
1265
1266 /* Dereference the trust key, if any */
1267 if (KeyBody) ObDereferenceObject(KeyBody);
1268
1269Cleanup:
1270 /* Close the local kernel handles */
1271 if (KmSourceFileRootDir)
1272 ObCloseHandle(KmSourceFileRootDir, KernelMode);
1273 if (KmTargetKeyRootDir)
1274 ObCloseHandle(KmTargetKeyRootDir, KernelMode);
1275
1276 /* Release the captured object attributes */
1277 ReleaseCapturedObjectAttributes(&CapturedSourceFile, PreviousMode);
1278 ReleaseCapturedObjectAttributes(&CapturedTargetKey, PreviousMode);
1279
1280Quit:
1281 /* Bring back APCs */
1283
1284 /* Return status */
1285 return Status;
1286}
#define STATUS_PRIVILEGE_NOT_HELD
Definition: DriverTester.h:9
#define DPRINT1
Definition: precomp.h:8
NTSTATUS NTAPI CmLoadKey(IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile, IN ULONG Flags, IN PCM_KEY_BODY KeyBody)
Definition: cmapi.c:2012
static const WCHAR Cleanup[]
Definition: register.c:80
POBJECT_TYPE IoFileObjectType
Definition: iomgr.c:36
#define KeLeaveCriticalRegion()
Definition: ke_x.h:119
#define KeEnterCriticalRegion()
Definition: ke_x.h:88
#define REG_NO_LAZY_FLUSH
Definition: nt_native.h:1093
#define KEY_READ
Definition: nt_native.h:1023
#define FILE_TRAVERSE
Definition: nt_native.h:643
static NTSTATUS CmpConvertHandleToKernelHandle(_In_ HANDLE SourceHandle, _In_opt_ POBJECT_TYPE ObjectType, _In_ ACCESS_MASK DesiredAccess, _In_ KPROCESSOR_MODE AccessMode, _Out_ PHANDLE KernelHandle)
Definition: ntapi.c:195
NTSTATUS ProbeAndCaptureObjectAttributes(_Out_ POBJECT_ATTRIBUTES CapturedObjectAttributes, _Out_ PUNICODE_STRING ObjectName, _In_ KPROCESSOR_MODE AccessMode, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ BOOLEAN CaptureSecurity)
Definition: ntapi.c:53
VOID ReleaseCapturedObjectAttributes(_In_ POBJECT_ATTRIBUTES CapturedObjectAttributes, _In_ KPROCESSOR_MODE AccessMode)
Definition: ntapi.c:27
const LUID SeRestorePrivilege
Definition: priv.c:37
BOOLEAN NTAPI SeSinglePrivilegeCheck(_In_ LUID PrivilegeValue, _In_ KPROCESSOR_MODE PreviousMode)
Checks if a single privilege is present in the context of the calling thread.
Definition: priv.c:744
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
Definition: obhandle.c:3379
HANDLE RootDirectory
Definition: umtypes.h:184

Referenced by NtLoadKey(), and NtLoadKey2().

◆ NtLockProductActivationKeys()

NTSTATUS NTAPI NtLockProductActivationKeys ( IN PULONG  pPrivateVer,
IN PULONG  pSafeMode 
)

Definition at line 1404 of file ntapi.c.

1406{
1408
1410 _SEH2_TRY
1411 {
1412 /* Check if the caller asked for the version */
1413 if (pPrivateVer != NULL)
1414 {
1415 /* For user mode, probe it */
1416 if (PreviousMode != KernelMode)
1417 {
1418 ProbeForWriteUlong(pPrivateVer);
1419 }
1420
1421 /* Return the expected version */
1422 *pPrivateVer = PRODUCT_ACTIVATION_VERSION;
1423 }
1424
1425 /* Check if the caller asked for safe mode mode state */
1426 if (pSafeMode != NULL)
1427 {
1428 /* For user mode, probe it */
1429 if (PreviousMode != KernelMode)
1430 {
1431 ProbeForWriteUlong(pSafeMode);
1432 }
1433
1434 /* Return the safe boot mode state */
1435 *pSafeMode = InitSafeBootMode;
1436 }
1437 }
1439 {
1441 }
1442 _SEH2_END;
1443
1444 return STATUS_SUCCESS;
1445}
#define PRODUCT_ACTIVATION_VERSION
Definition: ntapi.c:1400
ULONG InitSafeBootMode
Definition: init.c:71

◆ NtLockRegistryKey()

NTSTATUS NTAPI NtLockRegistryKey ( IN HANDLE  KeyHandle)

Definition at line 1449 of file ntapi.c.

1450{
1453}

◆ NtNotifyChangeKey()

NTSTATUS NTAPI NtNotifyChangeKey ( IN HANDLE  KeyHandle,
IN HANDLE  Event,
IN PIO_APC_ROUTINE ApcRoutine  OPTIONAL,
IN PVOID ApcContext  OPTIONAL,
OUT PIO_STATUS_BLOCK  IoStatusBlock,
IN ULONG  CompletionFilter,
IN BOOLEAN  WatchTree,
OUT PVOID  Buffer,
IN ULONG  Length,
IN BOOLEAN  Asynchronous 
)

Definition at line 1290 of file ntapi.c.

1300{
1301 /* Call the newer API */
1303 0,
1304 NULL,
1305 Event,
1306 ApcRoutine,
1307 ApcContext,
1310 WatchTree,
1311 Buffer,
1312 Length,
1313 Asynchronous);
1314}
Definition: bufpool.h:45
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG CompletionFilter
Definition: fltkernel.h:2243
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN WatchTree
Definition: fltkernel.h:2241
static OUT PIO_STATUS_BLOCK IoStatusBlock
Definition: pipe.c:75
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE _In_opt_ PVOID ApcContext
Definition: iofuncs.h:727
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE ApcRoutine
Definition: iofuncs.h:726
NTSTATUS NTAPI NtNotifyChangeMultipleKeys(IN HANDLE MasterKeyHandle, IN ULONG Count, IN POBJECT_ATTRIBUTES SlaveObjects, IN HANDLE Event, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CompletionFilter, IN BOOLEAN WatchTree, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN Asynchronous)
Definition: ntapi.c:1457
_In_ SYSTEM_POWER_STATE _In_ ULONG _In_ BOOLEAN Asynchronous
Definition: ntpoapi.h:305

Referenced by InitFunctionPtrs(), and RegNotifyChangeKeyValue().

◆ NtNotifyChangeMultipleKeys()

NTSTATUS NTAPI NtNotifyChangeMultipleKeys ( IN HANDLE  MasterKeyHandle,
IN ULONG  Count,
IN POBJECT_ATTRIBUTES  SlaveObjects,
IN HANDLE  Event,
IN PIO_APC_ROUTINE ApcRoutine  OPTIONAL,
IN PVOID ApcContext  OPTIONAL,
OUT PIO_STATUS_BLOCK  IoStatusBlock,
IN ULONG  CompletionFilter,
IN BOOLEAN  WatchTree,
OUT PVOID  Buffer,
IN ULONG  Length,
IN BOOLEAN  Asynchronous 
)

Definition at line 1457 of file ntapi.c.

1469{
1472}
#define UNIMPLEMENTED_ONCE
Definition: typedefs.h:30

Referenced by NtNotifyChangeKey().

◆ NtOpenKey()

NTSTATUS NTAPI NtOpenKey ( OUT PHANDLE  KeyHandle,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_ATTRIBUTES  ObjectAttributes 
)

Definition at line 336 of file ntapi.c.

339{
340 CM_PARSE_CONTEXT ParseContext = {0};
344 PAGED_CODE();
345 DPRINT("NtOpenKey(Path: %wZ, Root %x, Access: %x)\n",
346 ObjectAttributes->ObjectName, ObjectAttributes->RootDirectory, DesiredAccess);
347
348 /* Ignore the WOW64 flag, it's not valid in the kernel */
349 DesiredAccess &= ~KEY_WOW64_RES;
350
351 /* Check for user-mode caller */
353 {
354 /* Prepare to probe parameters */
356 {
357 /* Probe the key handle */
359 *KeyHandle = NULL;
360
361 /* Probe object attributes */
363 sizeof(OBJECT_ATTRIBUTES),
364 sizeof(ULONG));
365 }
367 {
368 /* Return the exception code */
370 }
371 _SEH2_END;
372 }
373
374 /* Just let the object manager handle this */
378 NULL,
380 &ParseContext,
381 &Handle);
382
383 /* Only do this if we succeeded */
384 if (NT_SUCCESS(Status))
385 {
387 {
388 /* Return the handle to caller */
389 *KeyHandle = Handle;
390 }
392 {
393 /* Get the status */
395 }
396 _SEH2_END;
397 }
398
399 DPRINT("Returning handle %x, Status %x.\n", Handle, Status);
400
401 /* Return status */
402 return Status;
403}

Referenced by AddCodepageToRegistry(), AddFontsSettingsToRegistry(), BaseComputeProcessDllPath(), BasepIsProcessAllowed(), BaseSrvIsVdmAllowed(), CmGetSystemDriverList(), CmpCreateControlSet(), CmpInitializeMachineDependentConfiguration(), CmpSetSystemValues(), CreateBaseAcls(), DeleteKeyTest(), DeleteSymLinkKey(), DeleteValueTest(), do_enumeratekey(), DumpRegistryData(), EnumerateKeyTest(), EnumerateValueTest(), GetComputerIdentifier(), GetComputerNameFromRegistry(), GetCPFileNameFromRegistry(), GetDisplayIdentifier(), GetDllList(), GetDosDevicesProtection(), GetRegInt(), GetTimeouts(), InitFunctionPtrs(), InitializeFmIfsOnce(), InitializeUserModePnpManager(), InstallDevice(), IsAcpiComputer(), IsShimInfrastructureDisabled(), LdrpDisableProcessCompatGuidDetection(), LsapCreateDbObject(), LsapGetObjectAttribute(), LsapOpenDbObject(), LsapRegDeleteSubKey(), LsapRegOpenKey(), NLS_RegOpenKey(), NtOpenObject(), open_classes_key(), OpenClassesRootKey(), OpenCurrentConfigKey(), OpenLocalMachineKey(), OpenRegistryKeyHandle(), OpenUsersKey(), ProcessDisplayRegistry(), ProcessLocaleRegistry(), RegCleanupRegistry(), RegCopyTreeW(), RegDeleteKeyExW(), RegInitializeRegistry(), registry_callback(), RegOpenKeyExW(), RegOpenUserClassesRoot(), RegpCopyTree(), RegReplaceKeyW(), RegSetKeyValueA(), RegSetKeyValueW(), SampRegDeleteKey(), SampRegOpenKey(), SdbpOpenKey(), SetActiveComputerNameToRegistry(), SetComputerNameToRegistry(), SetDefaultPagefile(), SetGeoID(), SetMountedDeviceValue(), SetRosSpecificInfo(), SmLookupSubsystem(), SmpCreateDynamicEnvironmentVariables(), SmpLoadDataFromRegistry(), SmpQueryRegistrySosOption(), SmpTranslateSystemPartitionInformation(), START_TEST(), test1(), test2(), test3(), test5(), test8(), test9(), Test_KeyFullInformation(), Test_KeyNameInformation(), TestCreateOpen_(), and UnhandledExceptionFilter().

◆ NtQueryKey()

NTSTATUS NTAPI NtQueryKey ( IN HANDLE  KeyHandle,
IN KEY_INFORMATION_CLASS  KeyInformationClass,
OUT PVOID  KeyInformation,
IN ULONG  Length,
OUT PULONG  ResultLength 
)

Definition at line 632 of file ntapi.c.

637{
640 PCM_KEY_BODY KeyObject;
641 REG_QUERY_KEY_INFORMATION QueryKeyInfo;
642 REG_POST_OPERATION_INFORMATION PostOperationInfo;
643 OBJECT_HANDLE_INFORMATION HandleInfo;
644 PAGED_CODE();
645 DPRINT("NtQueryKey() KH 0x%p, KIC %d, Length %lu\n",
647
648 /* Reject invalid classes */
655 {
656 /* Fail */
658 }
659
660 /* Check if just the name is required */
662 {
663 /* Ignore access level */
665 0,
668 (PVOID*)&KeyObject,
669 &HandleInfo);
670 if (NT_SUCCESS(Status))
671 {
672 /* At least a single bit of access is required */
673 if (!HandleInfo.GrantedAccess)
674 {
675 /* No such luck */
676 ObDereferenceObject(KeyObject);
678 }
679 }
680 }
681 else
682 {
683 /* Get a reference */
688 (PVOID*)&KeyObject,
689 NULL);
690 }
691
692 /* Quit on failure */
693 if (!NT_SUCCESS(Status)) return Status;
694
696 {
698 {
700 ProbeForWrite(KeyInformation,
701 Length,
702 sizeof(ULONG));
703 }
705 {
706 /* Dereference and return status */
707 ObDereferenceObject(KeyObject);
709 }
710 _SEH2_END;
711 }
712
713 /* Setup the callback */
714 PostOperationInfo.Object = (PVOID)KeyObject;
715 QueryKeyInfo.Object = (PVOID)KeyObject;
717 QueryKeyInfo.KeyInformation = KeyInformation;
718 QueryKeyInfo.Length = Length;
719 QueryKeyInfo.ResultLength = ResultLength;
720
721 /* Do the callback */
723 if (NT_SUCCESS(Status))
724 {
725 /* Call the internal API */
726 Status = CmQueryKey(KeyObject->KeyControlBlock,
728 KeyInformation,
729 Length,
731
732 /* Do the post callback */
733 PostOperationInfo.Status = Status;
735 }
736
737 /* Dereference and return status */
738 ObDereferenceObject(KeyObject);
739 return Status;
740}
NTSTATUS NTAPI CmQueryKey(_In_ PCM_KEY_CONTROL_BLOCK Kcb, _In_ KEY_INFORMATION_CLASS KeyInformationClass, _Out_opt_ PVOID KeyInformation, _In_ ULONG Length, _Out_ PULONG ResultLength)
Definition: cmapi.c:1614
@ KeyFlagsInformation
Definition: winternl.h:833
@ KeyCachedInformation
Definition: winternl.h:832
@ KeyNameInformation
Definition: winternl.h:831
ACCESS_MASK GrantedAccess
Definition: iotypes.h:181
KEY_INFORMATION_CLASS KeyInformationClass
Definition: cmtypes.h:767
@ RegNtPostQueryKey
Definition: cmtypes.h:663
@ RegNtPreQueryKey
Definition: cmtypes.h:645

Referenced by EnumerateKeyTest(), GetComputerIdentifier(), GetKeyName(), InitFunctionPtrs(), LsapRegQueryKeyInfo(), RegQueryInfoKeyW(), SampRegQueryKeyInfo(), test1(), test9(), Test_KeyFullInformation(), and Test_KeyNameInformation().

◆ NtQueryMultipleValueKey()

NTSTATUS NTAPI NtQueryMultipleValueKey ( IN HANDLE  KeyHandle,
IN OUT PKEY_VALUE_ENTRY  ValueList,
IN ULONG  NumberOfValues,
OUT PVOID  Buffer,
IN OUT PULONG  Length,
OUT PULONG  ReturnLength 
)

Definition at line 1476 of file ntapi.c.

1482{
1485}

◆ NtQueryOpenSubKeys()

NTSTATUS NTAPI NtQueryOpenSubKeys ( IN POBJECT_ATTRIBUTES  TargetKey,
OUT PULONG  HandleCount 
)

Definition at line 1489 of file ntapi.c.

1491{
1493 PCM_KEY_BODY KeyBody = NULL;
1496 ULONG SubKeys;
1497
1498 DPRINT("NtQueryOpenSubKeys()\n");
1499
1500 PAGED_CODE();
1501
1502 /* Get the processor mode */
1504
1505 /* Check for user-mode caller */
1506 if (PreviousMode != KernelMode)
1507 {
1508 /* Prepare to probe parameters */
1509 _SEH2_TRY
1510 {
1511 /* Probe target key */
1512 ProbeForRead(TargetKey,
1513 sizeof(OBJECT_ATTRIBUTES),
1514 sizeof(ULONG));
1515
1516 /* Probe handle count */
1517 ProbeForWriteUlong(HandleCount);
1518 }
1520 {
1521 /* Return the exception code */
1523 }
1524 _SEH2_END;
1525 }
1526
1527 /* Open a handle to the key */
1528 Status = ObOpenObjectByName(TargetKey,
1531 NULL,
1532 KEY_READ,
1533 NULL,
1534 &KeyHandle);
1535 if (NT_SUCCESS(Status))
1536 {
1537 /* Reference the key object */
1539 KEY_READ,
1542 (PVOID*)&KeyBody,
1543 NULL);
1544
1545 /* Close the handle */
1547 }
1548
1549 /* Fail, if the key object could not be referenced */
1550 if (!NT_SUCCESS(Status))
1551 return Status;
1552
1553 /* Lock the registry exclusively */
1555
1556 /* Fail, if we did not open a hive root key */
1557 if (KeyBody->KeyControlBlock->KeyCell !=
1558 KeyBody->KeyControlBlock->KeyHive->BaseBlock->RootCell)
1559 {
1560 DPRINT("Error: Key is not a hive root key!\n");
1562 ObDereferenceObject(KeyBody);
1564 }
1565
1566 /* Call the internal API */
1567 SubKeys = CmpEnumerateOpenSubKeys(KeyBody->KeyControlBlock,
1568 TRUE, FALSE, FALSE);
1569
1570 /* Unlock the registry */
1572
1573 /* Dereference the key object */
1574 ObDereferenceObject(KeyBody);
1575
1576 /* Write back the result */
1577 _SEH2_TRY
1578 {
1579 *HandleCount = SubKeys;
1580 }
1582 {
1584 }
1585 _SEH2_END;
1586
1587 DPRINT("Done.\n");
1588
1589 return Status;
1590}
ULONG NTAPI CmpEnumerateOpenSubKeys(_In_ PCM_KEY_CONTROL_BLOCK RootKcb, _In_ BOOLEAN LockHeldExclusively, _In_ BOOLEAN RemoveEmptyCacheEntries, _In_ BOOLEAN DereferenceOpenedEntries)
Definition: cmapi.c:2341
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
Definition: obhandle.c:3402

Referenced by START_TEST().

◆ NtQueryOpenSubKeysEx()

NTSTATUS NTAPI NtQueryOpenSubKeysEx ( IN POBJECT_ATTRIBUTES  TargetKey,
IN ULONG  BufferLength,
IN PVOID  Buffer,
IN PULONG  RequiredSize 
)

Definition at line 1594 of file ntapi.c.

1598{
1601}

◆ NtQueryValueKey()

NTSTATUS NTAPI NtQueryValueKey ( IN HANDLE  KeyHandle,
IN PUNICODE_STRING  ValueName,
IN KEY_VALUE_INFORMATION_CLASS  KeyValueInformationClass,
OUT PVOID  KeyValueInformation,
IN ULONG  Length,
OUT PULONG  ResultLength 
)

Definition at line 744 of file ntapi.c.

750{
753 PCM_KEY_BODY KeyObject;
754 REG_QUERY_VALUE_KEY_INFORMATION QueryValueKeyInfo;
755 REG_POST_OPERATION_INFORMATION PostOperationInfo;
756 UNICODE_STRING ValueNameCopy;
757
758 PAGED_CODE();
759
760 DPRINT("NtQueryValueKey() KH 0x%p, VN '%wZ', KVIC %d, Length %lu\n",
762
763 /* Reject classes we don't know about */
769 {
770 /* Fail */
772 }
773
774 /* Verify that the handle is valid and is a registry key */
779 (PVOID*)&KeyObject,
780 NULL);
781 if (!NT_SUCCESS(Status))
782 return Status;
783
785 {
787 {
789 ProbeForWrite(KeyValueInformation,
790 Length,
791 sizeof(ULONG));
792 }
794 {
795 /* Dereference and return status */
796 ObDereferenceObject(KeyObject);
798 }
799 _SEH2_END;
800 }
801
802 /* Capture the string */
804 if (!NT_SUCCESS(Status))
805 goto Quit;
806
807 /* Make sure the name is aligned properly */
808 if (ValueNameCopy.Length & (sizeof(WCHAR) - 1))
809 {
810 /* It isn't, so we'll fail */
812 goto Quit;
813 }
814
815 /* Ignore any null characters at the end */
816 while (ValueNameCopy.Length &&
817 !(ValueNameCopy.Buffer[ValueNameCopy.Length / sizeof(WCHAR) - 1]))
818 {
819 /* Skip it */
820 ValueNameCopy.Length -= sizeof(WCHAR);
821 }
822
823 /* Setup the callback */
824 PostOperationInfo.Object = (PVOID)KeyObject;
825 QueryValueKeyInfo.Object = (PVOID)KeyObject;
826 QueryValueKeyInfo.ValueName = &ValueNameCopy;
828 QueryValueKeyInfo.Length = Length;
829 QueryValueKeyInfo.ResultLength = ResultLength;
830
831 /* Do the callback */
833 if (NT_SUCCESS(Status))
834 {
835 /* Call the internal API */
837 ValueNameCopy,
839 KeyValueInformation,
840 Length,
842
843 /* Do the post callback */
844 PostOperationInfo.Status = Status;
846 }
847
848Quit:
849 if (ValueNameCopy.Buffer)
851
852 /* Dereference and return status */
853 ObDereferenceObject(KeyObject);
854 return Status;
855}
NTSTATUS NTAPI CmQueryValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN UNICODE_STRING ValueName, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, IN PVOID KeyValueInformation, IN ULONG Length, IN PULONG ResultLength)
Definition: cmapi.c:1074
KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass
Definition: cmtypes.h:779
@ RegNtPostQueryValueKey
Definition: cmtypes.h:664
@ RegNtPreQueryValueKey
Definition: cmtypes.h:647

◆ NtRenameKey()

NTSTATUS NTAPI NtRenameKey ( IN HANDLE  KeyHandle,
IN PUNICODE_STRING  ReplacementName 
)

Definition at line 1605 of file ntapi.c.

1607{
1610}

◆ NtReplaceKey()

NTSTATUS NTAPI NtReplaceKey ( IN POBJECT_ATTRIBUTES  ObjectAttributes,
IN HANDLE  Key,
IN POBJECT_ATTRIBUTES  ReplacedObjectAttributes 
)

Definition at line 1614 of file ntapi.c.

1617{
1620}

Referenced by RegReplaceKeyW().

◆ NtRestoreKey()

NTSTATUS NTAPI NtRestoreKey ( IN HANDLE  KeyHandle,
IN HANDLE  FileHandle,
IN ULONG  RestoreFlags 
)

Definition at line 1624 of file ntapi.c.

1627{
1630}

Referenced by RegRestoreKeyW().

◆ NtSaveKey()

NTSTATUS NTAPI NtSaveKey ( IN HANDLE  KeyHandle,
IN HANDLE  FileHandle 
)

Definition at line 1634 of file ntapi.c.

1636{
1637 /* Call the extended API */
1639}
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE FileHandle
Definition: fltkernel.h:1231
NTSTATUS NTAPI NtSaveKeyEx(IN HANDLE KeyHandle, IN HANDLE FileHandle, IN ULONG Flags)
Definition: ntapi.c:1643
#define REG_STANDARD_FORMAT
Definition: cmtypes.h:97

Referenced by RegSaveKeyW(), and START_TEST().

◆ NtSaveKeyEx()

NTSTATUS NTAPI NtSaveKeyEx ( IN HANDLE  KeyHandle,
IN HANDLE  FileHandle,
IN ULONG  Flags 
)

Definition at line 1643 of file ntapi.c.

1646{
1648 HANDLE KmFileHandle = NULL;
1649 PCM_KEY_BODY KeyObject;
1651
1652 PAGED_CODE();
1653
1654 DPRINT("NtSaveKeyEx(0x%p, 0x%p, %lu)\n", KeyHandle, FileHandle, Flags);
1655
1656 /* Verify the flags */
1657 if ((Flags != REG_STANDARD_FORMAT)
1658 && (Flags != REG_LATEST_FORMAT)
1659 && (Flags != REG_NO_COMPRESSION))
1660 {
1661 /* Only one of these values can be specified */
1663 }
1664
1665 /* Validate privilege */
1667 {
1669 }
1670
1671 /* Make sure the target file handle is a kernel handle */
1676 &KmFileHandle);
1677 if (!NT_SUCCESS(Status))
1678 goto Quit;
1679
1680 /* Verify that the handle is valid and is a registry key */
1682 KEY_READ,
1685 (PVOID*)&KeyObject,
1686 NULL);
1687 if (!NT_SUCCESS(Status))
1688 goto Quit;
1689
1690 /* Call the internal API */
1691 Status = CmSaveKey(KeyObject->KeyControlBlock, KmFileHandle, Flags);
1692
1693 /* Dereference the registry key */
1694 ObDereferenceObject(KeyObject);
1695
1696Quit:
1697 /* Close the local kernel handle */
1698 if (KmFileHandle)
1699 ObCloseHandle(KmFileHandle, KernelMode);
1700
1701 return Status;
1702}
NTSTATUS NTAPI CmSaveKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN HANDLE FileHandle, IN ULONG Flags)
Definition: cmapi.c:2661
#define FILE_WRITE_DATA
Definition: nt_native.h:631
const LUID SeBackupPrivilege
Definition: priv.c:36
#define REG_LATEST_FORMAT
Definition: cmtypes.h:98
#define REG_NO_COMPRESSION
Definition: cmtypes.h:99

Referenced by CreateRegistryFile(), and NtSaveKey().

◆ NtSaveMergedKeys()

NTSTATUS NTAPI NtSaveMergedKeys ( IN HANDLE  HighPrecedenceKeyHandle,
IN HANDLE  LowPrecedenceKeyHandle,
IN HANDLE  FileHandle 
)

Definition at line 1706 of file ntapi.c.

1709{
1712 HANDLE KmFileHandle = NULL;
1713 PCM_KEY_BODY HighPrecedenceKeyObject = NULL;
1714 PCM_KEY_BODY LowPrecedenceKeyObject = NULL;
1715
1716 PAGED_CODE();
1717
1718 DPRINT("NtSaveMergedKeys(0x%p, 0x%p, 0x%p)\n",
1719 HighPrecedenceKeyHandle, LowPrecedenceKeyHandle, FileHandle);
1720
1722
1723 /* Validate privilege */
1725 {
1727 }
1728
1729 /* Make sure the target file handle is a kernel handle */
1734 &KmFileHandle);
1735 if (!NT_SUCCESS(Status))
1736 goto Quit;
1737
1738 /* Verify that the handles are valid and are registry keys */
1739 Status = ObReferenceObjectByHandle(HighPrecedenceKeyHandle,
1740 KEY_READ,
1743 (PVOID*)&HighPrecedenceKeyObject,
1744 NULL);
1745 if (!NT_SUCCESS(Status))
1746 goto Quit;
1747
1748 Status = ObReferenceObjectByHandle(LowPrecedenceKeyHandle,
1749 KEY_READ,
1752 (PVOID*)&LowPrecedenceKeyObject,
1753 NULL);
1754 if (!NT_SUCCESS(Status))
1755 goto Quit;
1756
1757 /* Call the internal API */
1758 Status = CmSaveMergedKeys(HighPrecedenceKeyObject->KeyControlBlock,
1759 LowPrecedenceKeyObject->KeyControlBlock,
1760 KmFileHandle);
1761
1762Quit:
1763 /* Dereference the opened key objects */
1764 if (LowPrecedenceKeyObject)
1765 ObDereferenceObject(LowPrecedenceKeyObject);
1766 if (HighPrecedenceKeyObject)
1767 ObDereferenceObject(HighPrecedenceKeyObject);
1768
1769 /* Close the local kernel handle */
1770 if (KmFileHandle)
1771 ObCloseHandle(KmFileHandle, KernelMode);
1772
1773 return Status;
1774}
NTSTATUS NTAPI CmSaveMergedKeys(IN PCM_KEY_CONTROL_BLOCK HighKcb, IN PCM_KEY_CONTROL_BLOCK LowKcb, IN HANDLE FileHandle)
Definition: cmapi.c:2755

◆ NtSetInformationKey()

NTSTATUS NTAPI NtSetInformationKey ( IN HANDLE  KeyHandle,
IN KEY_SET_INFORMATION_CLASS  KeyInformationClass,
IN PVOID  KeyInformation,
IN ULONG  KeyInformationLength 
)

Definition at line 1778 of file ntapi.c.

1782{
1785}

◆ NtSetValueKey()

NTSTATUS NTAPI NtSetValueKey ( IN HANDLE  KeyHandle,
IN PUNICODE_STRING  ValueName,
IN ULONG TitleIndex  OPTIONAL,
IN ULONG  Type,
IN PVOID  Data,
IN ULONG  DataSize 
)

Definition at line 859 of file ntapi.c.

865{
868 PCM_KEY_BODY KeyObject;
869 REG_SET_VALUE_KEY_INFORMATION SetValueKeyInfo;
870 REG_POST_OPERATION_INFORMATION PostOperationInfo;
871 UNICODE_STRING ValueNameCopy;
872
873 PAGED_CODE();
874
876
877 /* Verify that the handle is valid and is a registry key */
882 (PVOID*)&KeyObject,
883 NULL);
884 if (!NT_SUCCESS(Status))
885 return Status;
886
887 if (!DataSize)
888 Data = NULL;
889
890 /* Probe and copy the data */
891 if ((PreviousMode != KernelMode) && (DataSize != 0))
892 {
893 PVOID DataCopy = NULL;
894
896 {
898 }
900 {
902 }
903 _SEH2_END;
904
905 if (!NT_SUCCESS(Status))
906 {
907 /* Dereference and return status */
908 ObDereferenceObject(KeyObject);
909 return Status;
910 }
911
913 if (!DataCopy)
914 {
915 /* Dereference and return status */
916 ObDereferenceObject(KeyObject);
918 }
919
921 {
922 RtlCopyMemory(DataCopy, Data, DataSize);
923 }
925 {
927 }
928 _SEH2_END;
929
930 if (!NT_SUCCESS(Status))
931 {
932 /* Dereference and return status */
933 ExFreePoolWithTag(DataCopy, TAG_CM);
934 ObDereferenceObject(KeyObject);
935 return Status;
936 }
937
938 Data = DataCopy;
939 }
940
941 /* Capture the string */
943 if (!NT_SUCCESS(Status))
944 goto Quit;
945
946 DPRINT("NtSetValueKey() KH 0x%p, VN '%wZ', TI %x, T %lu, DS %lu\n",
947 KeyHandle, &ValueNameCopy, TitleIndex, Type, DataSize);
948
949 /* Make sure the name is aligned, not too long, and the data under 4GB */
950 if ((ValueNameCopy.Length > 32767) ||
951 (ValueNameCopy.Length & (sizeof(WCHAR) - 1)) ||
952 (DataSize > 0x80000000))
953 {
954 /* Fail */
956 goto Quit;
957 }
958
959 /* Ignore any null characters at the end */
960 while (ValueNameCopy.Length &&
961 !(ValueNameCopy.Buffer[ValueNameCopy.Length / sizeof(WCHAR) - 1]))
962 {
963 /* Skip it */
964 ValueNameCopy.Length -= sizeof(WCHAR);
965 }
966
967 /* Don't touch read-only keys */
968 if (KeyObject->KeyControlBlock->ExtFlags & CM_KCB_READ_ONLY_KEY)
969 {
970 /* Fail */
972 goto Quit;
973 }
974
975 /* Setup callback */
976 PostOperationInfo.Object = (PVOID)KeyObject;
977 SetValueKeyInfo.Object = (PVOID)KeyObject;
978 SetValueKeyInfo.ValueName = &ValueNameCopy;
979 SetValueKeyInfo.TitleIndex = TitleIndex;
980 SetValueKeyInfo.Type = Type;
981 SetValueKeyInfo.Data = Data;
982 SetValueKeyInfo.DataSize = DataSize;
983
984 /* Do the callback */
986 if (NT_SUCCESS(Status))
987 {
988 /* Call the internal API */
990 &ValueNameCopy,
991 Type,
992 Data,
993 DataSize);
994
995 /* Do the post-callback */
996 PostOperationInfo.Status = Status;
998 }
999
1000Quit:
1001 if (ValueNameCopy.Buffer)
1003
1004 if ((PreviousMode != KernelMode) && Data)
1006
1007 /* Dereference and return status */
1008 ObDereferenceObject(KeyObject);
1009 return Status;
1010}
Type
Definition: Type.h:7
NTSTATUS NTAPI CmSetValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN PUNICODE_STRING ValueName, IN ULONG Type, IN PVOID Data, IN ULONG DataLength)
Definition: cmapi.c:643
#define TAG_CM
Definition: cmlib.h:212
#define ExAllocatePoolWithTag(hernya, size, tag)
Definition: env_spec_w32.h:350
#define PagedPool
Definition: env_spec_w32.h:308
#define ExFreePoolWithTag(_P, _T)
Definition: module.h:1109
static ACCESS_MASK const OBJECT_ATTRIBUTES ULONG TitleIndex
Definition: reg.c:131
_In_ NDIS_STATUS _In_ ULONG _In_ USHORT _In_opt_ PVOID _In_ ULONG DataSize
Definition: ndis.h:4755
PUNICODE_STRING ValueName
Definition: cmtypes.h:713
#define RtlCopyMemory(Destination, Source, Length)
Definition: typedefs.h:263
#define STATUS_INSUFFICIENT_RESOURCES
Definition: udferr_usr.h:158
@ RegNtPreSetValueKey
Definition: cmtypes.h:633
@ RegNtPostSetValueKey
Definition: cmtypes.h:657

Referenced by AddCodepageToRegistry(), AddFontsSettingsToRegistry(), AddHotkeySettings(), AddKbLayoutsToRegistry(), BasepMoveFileDelayed(), CmpCreateControlSet(), CmpInitializeMachineDependentConfiguration(), CmpInitializeRegistryNode(), CmpSetSystemValues(), CmpSetVersionData(), CreateSymLinkKey(), do_reg_operation(), InitFunctionPtrs(), InstallDriver(), LOCALE_InitRegistry(), locale_update_registry(), Phase1InitializationDiscard(), ProcessLocaleRegistry(), RegpCopyTree(), RegSetValueExW(), SdbRegisterDatabaseEx(), SdbSetPermLayerKeys(), SetActiveComputerNameToRegistry(), SetComputerNameToRegistry(), SetDefaultPagefile(), SetGeoID(), SetLocaleInfoW(), SetMountedDeviceValue(), SetUserGeoID(), SetValueTest1(), SetValueTest2(), SmpCreateDynamicEnvironmentVariables(), SmpTranslateSystemPartitionInformation(), START_TEST(), test2(), test3(), and test6().

◆ NtUnloadKey()

NTSTATUS NTAPI NtUnloadKey ( IN POBJECT_ATTRIBUTES  KeyObjectAttributes)

Definition at line 1789 of file ntapi.c.

1790{
1791 return NtUnloadKey2(KeyObjectAttributes, 0);
1792}
NTSTATUS NTAPI NtUnloadKey2(IN POBJECT_ATTRIBUTES TargetKey, IN ULONG Flags)
Definition: ntapi.c:1796

Referenced by DisconnectRegistry(), and RegUnLoadKeyW().

◆ NtUnloadKey2()

NTSTATUS NTAPI NtUnloadKey2 ( IN POBJECT_ATTRIBUTES  TargetKey,
IN ULONG  Flags 
)

Definition at line 1796 of file ntapi.c.

1798{
1800 OBJECT_ATTRIBUTES CapturedTargetKey;
1802 HANDLE KmTargetKeyRootDir = NULL;
1803 CM_PARSE_CONTEXT ParseContext = {0};
1805 PCM_KEY_BODY KeyBody = NULL;
1806 ULONG ParentConv = 0, ChildConv = 0;
1807 HANDLE Handle;
1808
1809 PAGED_CODE();
1810
1811 /* Validate privilege */
1813 {
1814 DPRINT1("Restore Privilege missing!\n");
1816 }
1817
1818 /* Check for user-mode caller */
1819 if (PreviousMode != KernelMode)
1820 {
1821 /* Prepare to probe parameters */
1822 _SEH2_TRY
1823 {
1824 /* Probe object attributes */
1825 ProbeForRead(TargetKey,
1826 sizeof(OBJECT_ATTRIBUTES),
1827 sizeof(ULONG));
1828
1829 CapturedTargetKey = *TargetKey;
1830
1831 /* Probe the string */
1832 ObjectName = ProbeForReadUnicodeString(CapturedTargetKey.ObjectName);
1833 ProbeForRead(ObjectName.Buffer,
1834 ObjectName.Length,
1835 sizeof(WCHAR));
1836
1837 CapturedTargetKey.ObjectName = &ObjectName;
1838 }
1840 {
1841 /* Return the exception code */
1843 }
1844 _SEH2_END;
1845 }
1846 else
1847 {
1848 /* Save the target attributes directly */
1849 CapturedTargetKey = *TargetKey;
1850 }
1851
1852 /* Make sure the target key root directory handle is a kernel handle */
1855 KEY_WRITE,
1857 &KmTargetKeyRootDir);
1858 if (!NT_SUCCESS(Status))
1859 return Status;
1860 CapturedTargetKey.RootDirectory = KmTargetKeyRootDir;
1861 CapturedTargetKey.Attributes |= OBJ_KERNEL_HANDLE;
1862
1863 /* Setup the parse context */
1864 ParseContext.CreateOperation = TRUE;
1866
1867 /* Do the create */
1868 /* Open a local handle to the key */
1869 Status = ObOpenObjectByName(&CapturedTargetKey,
1871 KernelMode,
1872 NULL,
1873 KEY_WRITE,
1874 &ParseContext,
1875 &Handle);
1876 if (NT_SUCCESS(Status))
1877 {
1878 /* Reference the key object */
1880 KEY_WRITE,
1882 KernelMode,
1883 (PVOID*)&KeyBody,
1884 NULL);
1885
1886 /* Close the handle */
1888 }
1889
1890 /* Close the local kernel handle */
1891 if (KmTargetKeyRootDir)
1892 ObCloseHandle(KmTargetKeyRootDir, KernelMode);
1893
1894 /* Return if a failure was encountered */
1895 if (!NT_SUCCESS(Status))
1896 return Status;
1897
1898 /* Acquire the lock depending on flags */
1899 if (Flags == REG_FORCE_UNLOAD)
1900 {
1901 /* Lock registry exclusively */
1903 }
1904 else
1905 {
1906 /* Lock registry */
1908
1909 /* Acquire the hive loading lock */
1911
1912 /* Lock parent and child */
1913 if (KeyBody->KeyControlBlock->ParentKcb)
1914 ParentConv = KeyBody->KeyControlBlock->ParentKcb->ConvKey;
1915 else
1916 ParentConv = KeyBody->KeyControlBlock->ConvKey;
1917
1918 ChildConv = KeyBody->KeyControlBlock->ConvKey;
1919
1920 CmpAcquireTwoKcbLocksExclusiveByKey(ChildConv, ParentConv);
1921 }
1922
1923 /* Check if it's being deleted already */
1924 if (KeyBody->KeyControlBlock->Delete)
1925 {
1926 /* Return appropriate status */
1928 goto Quit;
1929 }
1930
1931 /* Check if it's a read-only key */
1932 if (KeyBody->KeyControlBlock->ExtFlags & CM_KCB_READ_ONLY_KEY)
1933 {
1934 /* Return appropriate status */
1936 goto Quit;
1937 }
1938
1939 /* Call the internal API. Note that CmUnloadKey() unlocks the registry only on success. */
1941
1942 /* Check if we failed, but really need to succeed */
1944 {
1945 /* TODO: We should perform another attempt here */
1946 _SEH2_TRY
1947 {
1948 DPRINT1("NtUnloadKey2(%wZ): We want to force-unload the hive but couldn't unload it: Retrying is UNIMPLEMENTED!\n", TargetKey->ObjectName);
1949 }
1951 {
1952 }
1953 _SEH2_END;
1954 }
1955
1956 /* If CmUnloadKey() failed we need to unlock registry ourselves */
1957 if (!NT_SUCCESS(Status))
1958 {
1959 if (Flags != REG_FORCE_UNLOAD)
1960 {
1961 /* Release the KCB locks */
1962 CmpReleaseTwoKcbLockByKey(ChildConv, ParentConv);
1963
1964 /* Release the hive loading lock */
1966 }
1967
1968 /* Unlock the registry */
1970 }
1971
1972Quit:
1973 /* Dereference the key */
1974 ObDereferenceObject(KeyBody);
1975
1976 /* Return status */
1977 return Status;
1978}
#define REG_FORCE_UNLOAD
NTSTATUS NTAPI CmUnloadKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN ULONG Flags)
Definition: cmapi.c:2209
EX_PUSH_LOCK CmpLoadHiveLock
Definition: cmdata.c:39
VOID NTAPI CmpAcquireTwoKcbLocksExclusiveByKey(IN ULONG ConvKey1, IN ULONG ConvKey2)
Definition: cmsysini.c:2079
VOID NTAPI CmpReleaseTwoKcbLockByKey(IN ULONG ConvKey1, IN ULONG ConvKey2)
Definition: cmsysini.c:2108
FORCEINLINE VOID ExAcquirePushLockExclusive(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1036
FORCEINLINE VOID ExReleasePushLockExclusive(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1252
#define REG_OPTION_BACKUP_RESTORE
Definition: nt_native.h:1066
#define KEY_WRITE
Definition: nt_native.h:1031
#define STATUS_CANNOT_DELETE
Definition: shellext.h:71
PUNICODE_STRING ObjectName
Definition: umtypes.h:185
_In_ PVOID _Out_opt_ PULONG_PTR _Outptr_opt_ PCUNICODE_STRING * ObjectName
Definition: cmfuncs.h:64

Referenced by DisconnectRegistry(), and NtUnloadKey().

◆ NtUnloadKeyEx()

NTSTATUS NTAPI NtUnloadKeyEx ( IN POBJECT_ATTRIBUTES  TargetKey,
IN HANDLE  Event 
)

Definition at line 1982 of file ntapi.c.

1984{
1987}

◆ ProbeAndCaptureObjectAttributes()

NTSTATUS ProbeAndCaptureObjectAttributes ( _Out_ POBJECT_ATTRIBUTES  CapturedObjectAttributes,
_Out_ PUNICODE_STRING  ObjectName,
_In_ KPROCESSOR_MODE  AccessMode,
_In_ POBJECT_ATTRIBUTES  ObjectAttributes,
_In_ BOOLEAN  CaptureSecurity 
)

Definition at line 53 of file ntapi.c.

59{
62 // PSECURITY_QUALITY_OF_SERVICE SecurityQos;
63 PUNICODE_STRING LocalObjectName = NULL;
64
65 /* Zero out the Capture Data */
66 RtlZeroMemory(CapturedObjectAttributes, sizeof(*CapturedObjectAttributes));
67
68 /* SEH everything here for protection */
70 {
71 /* Check if we got attributes */
73 {
74 /* Check if we're in user mode */
76 {
77 /* Probe the attributes */
79 sizeof(OBJECT_ATTRIBUTES),
80 sizeof(ULONG));
81 }
82
83 /* Validate the Size and Attributes */
84 if ((ObjectAttributes->Length != sizeof(OBJECT_ATTRIBUTES)) ||
85 (ObjectAttributes->Attributes & ~OBJ_VALID_KERNEL_ATTRIBUTES)) // Understood as all the possible valid attributes
86 {
87 /* Invalid combination, fail */
89 }
90
91 /* Set some Create Info and do not allow user-mode kernel handles */
92 CapturedObjectAttributes->Length = sizeof(OBJECT_ATTRIBUTES);
93 CapturedObjectAttributes->RootDirectory = ObjectAttributes->RootDirectory;
94 CapturedObjectAttributes->Attributes = ObpValidateAttributes(ObjectAttributes->Attributes, AccessMode);
95 LocalObjectName = ObjectAttributes->ObjectName;
96 SecurityDescriptor = ObjectAttributes->SecurityDescriptor;
97 // SecurityQos = ObjectAttributes->SecurityQualityOfService;
98
99 /* Check if we have a security descriptor */
100 if (CaptureSecurity && SecurityDescriptor)
101 {
102 /*
103 * Capture it.
104 * Note: This has an implicit memory barrier due
105 * to the function call, so cleanup is safe here.
106 */
110 TRUE,
111 &CapturedObjectAttributes->
113 if (!NT_SUCCESS(Status))
114 {
115 /* Capture failed, quit */
116 CapturedObjectAttributes->SecurityDescriptor = NULL;
117 _SEH2_YIELD(return Status);
118 }
119 }
120 else
121 {
122 CapturedObjectAttributes->SecurityDescriptor = NULL;
123 }
124
125#if 0
126// We don't use the QoS!
127
128 /* Check if we have QoS */
129 if (SecurityQos)
130 {
131 /* Check if we came from user mode */
132 if (AccessMode != KernelMode)
133 {
134 /* Validate the QoS */
135 ProbeForRead(SecurityQos,
137 sizeof(ULONG));
138 }
139
140 /* Save Info */
141 CapturedObjectAttributes->SecurityQualityOfService = *SecurityQos;
142 CapturedObjectAttributes->SecurityQos =
143 &CapturedObjectAttributes->SecurityQualityOfService;
144 }
145#else
146 CapturedObjectAttributes->SecurityQualityOfService = NULL;
147#endif
148 }
149 else
150 {
151 /* We don't have a name */
152 LocalObjectName = NULL;
153 }
154 }
156 {
157 /* Cleanup and return the exception code */
158 ReleaseCapturedObjectAttributes(CapturedObjectAttributes, AccessMode);
160 }
161 _SEH2_END;
162
163 /* Now check if the Object Attributes had an Object Name */
164 if (LocalObjectName)
165 {
167 }
168 else
169 {
170 /* Clear the string */
171 RtlInitEmptyUnicodeString(ObjectName, NULL, 0);
172
173 /* It cannot have specified a Root Directory */
174 if (CapturedObjectAttributes->RootDirectory)
175 {
177 }
178 }
179
180 /* Set the caputured object attributes name pointer to the one the user gave to us */
181 CapturedObjectAttributes->ObjectName = ObjectName;
182
183 /* Cleanup if we failed */
184 if (!NT_SUCCESS(Status))
185 {
186 ReleaseCapturedObjectAttributes(CapturedObjectAttributes, AccessMode);
187 }
188
189 /* Return status to caller */
190 return Status;
191}
#define NonPagedPool
Definition: env_spec_w32.h:307
LONG NTAPI ExSystemExceptionFilter(VOID)
Definition: harderr.c:349
#define OBJ_VALID_KERNEL_ATTRIBUTES
Definition: obtypes.h:92
NTSTATUS NTAPI SeCaptureSecurityDescriptor(_In_ PSECURITY_DESCRIPTOR _OriginalSecurityDescriptor, _In_ KPROCESSOR_MODE CurrentMode, _In_ POOL_TYPE PoolType, _In_ BOOLEAN CaptureIfKernel, _Out_ PSECURITY_DESCRIPTOR *CapturedSecurityDescriptor)
Captures a security descriptor.
Definition: sd.c:386
FORCEINLINE ULONG ObpValidateAttributes(IN ULONG Attributes, IN KPROCESSOR_MODE PreviousMode)
Definition: ob_x.h:22
#define RtlZeroMemory(Destination, Length)
Definition: typedefs.h:262
#define STATUS_OBJECT_NAME_INVALID
Definition: udferr_usr.h:148
struct _OBJECT_ATTRIBUTES OBJECT_ATTRIBUTES
_In_ USHORT _In_ ULONG _In_ PSOCKADDR _In_ PSOCKADDR _Reserved_ ULONG _In_opt_ PVOID _In_opt_ const WSK_CLIENT_CONNECTION_DISPATCH _In_opt_ PEPROCESS _In_opt_ PETHREAD _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor
Definition: wsk.h:191

Referenced by NtLoadKeyEx().

◆ ReleaseCapturedObjectAttributes()

VOID ReleaseCapturedObjectAttributes ( _In_ POBJECT_ATTRIBUTES  CapturedObjectAttributes,
_In_ KPROCESSOR_MODE  AccessMode 
)

Definition at line 27 of file ntapi.c.

30{
31 /* Check if we have a security descriptor */
32 if (CapturedObjectAttributes->SecurityDescriptor)
33 {
34 /* Release it */
35 SeReleaseSecurityDescriptor(CapturedObjectAttributes->SecurityDescriptor,
37 TRUE);
38 CapturedObjectAttributes->SecurityDescriptor = NULL;
39 }
40
41 /* Check if we have an object name */
42 if (CapturedObjectAttributes->ObjectName)
43 {
44 /* Release it */
45 ReleaseCapturedUnicodeString(CapturedObjectAttributes->ObjectName, AccessMode);
46 }
47}
NTSTATUS NTAPI SeReleaseSecurityDescriptor(_In_ PSECURITY_DESCRIPTOR CapturedSecurityDescriptor, _In_ KPROCESSOR_MODE CurrentMode, _In_ BOOLEAN CaptureIfKernelMode)
Releases a captured security descriptor buffer.
Definition: sd.c:760

Referenced by NtLoadKeyEx(), and ProbeAndCaptureObjectAttributes().

Variable Documentation

◆ CmBootAcceptFirstTime

BOOLEAN CmBootAcceptFirstTime = TRUE

Definition at line 16 of file ntapi.c.

Referenced by NtInitializeRegistry().

◆ CmFirstTime

BOOLEAN CmFirstTime = TRUE

Definition at line 17 of file ntapi.c.

Referenced by CmShutdownSystem(), and NtInitializeRegistry().

◆ InitSafeBootMode

ULONG InitSafeBootMode
extern

Definition at line 71 of file init.c.

Referenced by NtLockProductActivationKeys().