32 if (CapturedObjectAttributes->SecurityDescriptor)
38 CapturedObjectAttributes->SecurityDescriptor =
NULL;
42 if (CapturedObjectAttributes->ObjectName)
66 RtlZeroMemory(CapturedObjectAttributes,
sizeof(*CapturedObjectAttributes));
111 &CapturedObjectAttributes->
116 CapturedObjectAttributes->SecurityDescriptor =
NULL;
122 CapturedObjectAttributes->SecurityDescriptor =
NULL;
141 CapturedObjectAttributes->SecurityQualityOfService = *SecurityQos;
142 CapturedObjectAttributes->SecurityQos =
143 &CapturedObjectAttributes->SecurityQualityOfService;
146 CapturedObjectAttributes->SecurityQualityOfService =
NULL;
152 LocalObjectName =
NULL;
174 if (CapturedObjectAttributes->RootDirectory)
181 CapturedObjectAttributes->ObjectName =
ObjectName;
254 DPRINT(
"NtCreateKey(Path: %wZ, Root %x, Access: %x, CreateOptions %x)\n",
345 DPRINT(
"NtOpenKey(Path: %wZ, Root %x, Access: %x)\n",
470 DPRINT(
"NtEnumerateKey() KH 0x%p, Index 0x%x, KIC %d, Length %lu\n",
557 DPRINT(
"NtEnumerateValueKey() KH 0x%p, Index 0x%x, KVIC %d, Length %lu\n",
609 &EnumerateValueKeyInfo);
645 DPRINT(
"NtQueryKey() KH 0x%p, KIC %d, Length %lu\n",
760 DPRINT(
"NtQueryValueKey() KH 0x%p, VN '%wZ', KVIC %d, Length %lu\n",
816 while (ValueNameCopy.
Length &&
826 QueryValueKeyInfo.
ValueName = &ValueNameCopy;
946 DPRINT(
"NtSetValueKey() KH 0x%p, VN '%wZ', TI %x, T %lu, DS %lu\n",
950 if ((ValueNameCopy.
Length > 32767) ||
960 while (ValueNameCopy.
Length &&
978 SetValueKeyInfo.
ValueName = &ValueNameCopy;
1001 if (ValueNameCopy.
Buffer)
1061 &DeleteValueKeyInfo);
1071 &PostOperationInfo);
1075 if (ValueNameCopy.
Buffer)
1170 DPRINT1(
"Restore Privilege missing!\n");
1231 &KmTargetKeyRootDir);
1242 &KmSourceFileRootDir);
1262 &CapturedSourceFile,
1271 if (KmSourceFileRootDir)
1273 if (KmTargetKeyRootDir)
1400#define PRODUCT_ACTIVATION_VERSION 7749
1413 if (pPrivateVer !=
NULL)
1426 if (pSafeMode !=
NULL)
1498 DPRINT(
"NtQueryOpenSubKeys()\n");
1560 DPRINT(
"Error: Key is not a hive root key!\n");
1579 *HandleCount = SubKeys;
1718 DPRINT(
"NtSaveMergedKeys(0x%p, 0x%p, 0x%p)\n",
1719 HighPrecedenceKeyHandle, LowPrecedenceKeyHandle,
FileHandle);
1743 (
PVOID*)&HighPrecedenceKeyObject,
1752 (
PVOID*)&LowPrecedenceKeyObject,
1764 if (LowPrecedenceKeyObject)
1766 if (HighPrecedenceKeyObject)
1781 IN ULONG KeyInformationLength)
1813 DPRINT1(
"Restore Privilege missing!\n");
1828 CapturedTargetKey = *TargetKey;
1848 CapturedTargetKey = *TargetKey;
1856 &KmTargetKeyRootDir);
1890 if (KmTargetKeyRootDir)
#define STATUS_PRIVILEGE_NOT_HELD
#define CM_KCB_READ_ONLY_KEY
#define CmpAcquireKcbLockShared(k)
FORCEINLINE VOID CmpReleaseKcbLock(PCM_KEY_CONTROL_BLOCK Kcb)
NTSTATUS NTAPI CmSetValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN PUNICODE_STRING ValueName, IN ULONG Type, IN PVOID Data, IN ULONG DataLength)
NTSTATUS NTAPI CmSaveMergedKeys(IN PCM_KEY_CONTROL_BLOCK HighKcb, IN PCM_KEY_CONTROL_BLOCK LowKcb, IN HANDLE FileHandle)
NTSTATUS NTAPI CmFlushKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN BOOLEAN ExclusiveLock)
NTSTATUS NTAPI CmEnumerateKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN ULONG Index, IN KEY_INFORMATION_CLASS KeyInformationClass, IN PVOID KeyInformation, IN ULONG Length, IN PULONG ResultLength)
ULONG NTAPI CmpEnumerateOpenSubKeys(_In_ PCM_KEY_CONTROL_BLOCK RootKcb, _In_ BOOLEAN RemoveEmptyCacheEntries, _In_ BOOLEAN DereferenceOpenedEntries)
NTSTATUS NTAPI CmQueryValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN UNICODE_STRING ValueName, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, IN PVOID KeyValueInformation, IN ULONG Length, IN PULONG ResultLength)
NTSTATUS NTAPI CmDeleteValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN UNICODE_STRING ValueName)
NTSTATUS NTAPI CmEnumerateValueKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN ULONG Index, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, IN PVOID KeyValueInformation, IN ULONG Length, IN PULONG ResultLength)
NTSTATUS NTAPI CmSaveKey(IN PCM_KEY_CONTROL_BLOCK Kcb, IN HANDLE FileHandle, IN ULONG Flags)
NTSTATUS NTAPI CmQueryKey(_In_ PCM_KEY_CONTROL_BLOCK Kcb, _In_ KEY_INFORMATION_CLASS KeyInformationClass, _Out_opt_ PVOID KeyInformation, _In_ ULONG Length, _Out_ PULONG ResultLength)
NTSTATUS NTAPI CmDeleteKey(IN PCM_KEY_BODY KeyBody)
NTSTATUS NTAPI CmLoadKey(IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile, IN ULONG Flags, IN PCM_KEY_BODY KeyBody)
NTSTATUS NTAPI CmUnloadKey(_In_ PCM_KEY_CONTROL_BLOCK Kcb, _In_ ULONG Flags)
NTSTATUS NTAPI CmpSaveBootControlSet(IN USHORT ControlSet)
EX_PUSH_LOCK CmpLoadHiveLock
NTSTATUS CmiCallRegisteredCallbacks(IN REG_NOTIFY_CLASS Argument1, IN PVOID Argument2)
VOID NTAPI CmpLazyFlush(VOID)
VOID NTAPI CmpCmdInit(IN BOOLEAN SetupBoot)
VOID NTAPI CmpSetVersionData(VOID)
VOID NTAPI CmpLockRegistryExclusive(VOID)
VOID NTAPI CmpUnlockRegistry(VOID)
VOID NTAPI CmpLockRegistry(VOID)
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define STATUS_NOT_IMPLEMENTED
#define NT_SUCCESS(StatCode)
static const WCHAR Cleanup[]
IN CINT OUT PVOID IN ULONG OUT PULONG ReturnLength
#define ExAllocatePoolWithTag(hernya, size, tag)
#define ExGetPreviousMode
FORCEINLINE VOID ExAcquirePushLockExclusive(PEX_PUSH_LOCK PushLock)
FORCEINLINE VOID ExReleasePushLockExclusive(PEX_PUSH_LOCK PushLock)
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE FileHandle
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG CompletionFilter
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN WatchTree
LONG NTAPI ExSystemExceptionFilter(VOID)
#define OBJ_KERNEL_HANDLE
#define EXCEPTION_EXECUTE_HANDLER
POBJECT_TYPE IoFileObjectType
#define KeLeaveCriticalRegion()
#define KeEnterCriticalRegion()
#define ExFreePoolWithTag(_P, _T)
static OUT PIO_STATUS_BLOCK IoStatusBlock
@ KeyValuePartialInformationAlign64
@ KeyValueFullInformationAlign64
static ACCESS_MASK const OBJECT_ATTRIBUTES ULONG TitleIndex
_In_ NDIS_STATUS _In_ ULONG _In_ USHORT _In_opt_ PVOID _In_ ULONG DataSize
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
#define KeGetPreviousMode()
_In_ ULONG _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass
_In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Reserved_ ULONG _In_opt_ PUNICODE_STRING _In_ ULONG _Out_opt_ PULONG Disposition
NTSYSAPI NTSTATUS NTAPI ZwInitializeRegistry(_In_ USHORT Flag)
#define CM_BOOT_FLAG_ACCEPTED
#define CM_BOOT_FLAG_SETUP
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE _In_opt_ PVOID ApcContext
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE ApcRoutine
#define OBJ_VALID_KERNEL_ATTRIBUTES
@ KeyValueBasicInformation
@ KeyValuePartialInformation
@ KeyValueFullInformation
enum _KEY_SET_INFORMATION_CLASS KEY_SET_INFORMATION_CLASS
#define REG_NO_LAZY_FLUSH
#define REG_OPTION_BACKUP_RESTORE
enum _KEY_VALUE_INFORMATION_CLASS KEY_VALUE_INFORMATION_CLASS
#define KEY_ENUMERATE_SUB_KEYS
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
enum _KEY_INFORMATION_CLASS KEY_INFORMATION_CLASS
VOID(* PIO_APC_ROUTINE)(IN PVOID ApcContext, IN PIO_STATUS_BLOCK IoStatusBlock, IN ULONG Reserved)
NTSTATUS NTAPI NtQueryValueKey(IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, OUT PVOID KeyValueInformation, IN ULONG Length, OUT PULONG ResultLength)
static NTSTATUS CmpConvertHandleToKernelHandle(_In_ HANDLE SourceHandle, _In_opt_ POBJECT_TYPE ObjectType, _In_ ACCESS_MASK DesiredAccess, _In_ KPROCESSOR_MODE AccessMode, _Out_ PHANDLE KernelHandle)
NTSTATUS NTAPI NtUnloadKey2(IN POBJECT_ATTRIBUTES TargetKey, IN ULONG Flags)
NTSTATUS NTAPI NtLoadKeyEx(IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile, IN ULONG Flags, IN HANDLE TrustClassKey)
NTSTATUS NTAPI NtQueryOpenSubKeysEx(IN POBJECT_ATTRIBUTES TargetKey, IN ULONG BufferLength, IN PVOID Buffer, IN PULONG RequiredSize)
NTSTATUS NTAPI NtSaveMergedKeys(IN HANDLE HighPrecedenceKeyHandle, IN HANDLE LowPrecedenceKeyHandle, IN HANDLE FileHandle)
NTSTATUS NTAPI NtUnloadKey(IN POBJECT_ATTRIBUTES KeyObjectAttributes)
NTSTATUS NTAPI NtEnumerateKey(IN HANDLE KeyHandle, IN ULONG Index, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT PVOID KeyInformation, IN ULONG Length, OUT PULONG ResultLength)
NTSTATUS NTAPI NtLoadKey2(IN POBJECT_ATTRIBUTES KeyObjectAttributes, IN POBJECT_ATTRIBUTES FileObjectAttributes, IN ULONG Flags)
NTSTATUS NTAPI NtCompressKey(IN HANDLE Key)
#define PRODUCT_ACTIVATION_VERSION
NTSTATUS NTAPI NtSaveKeyEx(IN HANDLE KeyHandle, IN HANDLE FileHandle, IN ULONG Flags)
NTSTATUS NTAPI NtDeleteKey(IN HANDLE KeyHandle)
NTSTATUS NTAPI NtInitializeRegistry(IN USHORT Flag)
NTSTATUS NTAPI NtNotifyChangeKey(IN HANDLE KeyHandle, IN HANDLE Event, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CompletionFilter, IN BOOLEAN WatchTree, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN Asynchronous)
NTSTATUS ProbeAndCaptureObjectAttributes(_Out_ POBJECT_ATTRIBUTES CapturedObjectAttributes, _Out_ PUNICODE_STRING ObjectName, _In_ KPROCESSOR_MODE AccessMode, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ BOOLEAN CaptureSecurity)
NTSTATUS NTAPI NtCreateKey(OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG TitleIndex, IN PUNICODE_STRING Class OPTIONAL, IN ULONG CreateOptions, OUT PULONG Disposition OPTIONAL)
NTSTATUS NTAPI NtCompactKeys(IN ULONG Count, IN PHANDLE KeyArray)
NTSTATUS NTAPI NtFlushKey(IN HANDLE KeyHandle)
NTSTATUS NTAPI NtQueryOpenSubKeys(IN POBJECT_ATTRIBUTES TargetKey, OUT PULONG HandleCount)
NTSTATUS NTAPI NtSaveKey(IN HANDLE KeyHandle, IN HANDLE FileHandle)
NTSTATUS NTAPI NtEnumerateValueKey(IN HANDLE KeyHandle, IN ULONG Index, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, OUT PVOID KeyValueInformation, IN ULONG Length, OUT PULONG ResultLength)
VOID ReleaseCapturedObjectAttributes(_In_ POBJECT_ATTRIBUTES CapturedObjectAttributes, _In_ KPROCESSOR_MODE AccessMode)
NTSTATUS NTAPI NtRenameKey(IN HANDLE KeyHandle, IN PUNICODE_STRING ReplacementName)
NTSTATUS NTAPI NtLoadKey(IN POBJECT_ATTRIBUTES KeyObjectAttributes, IN POBJECT_ATTRIBUTES FileObjectAttributes)
NTSTATUS NTAPI NtOpenKey(OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes)
NTSTATUS NTAPI NtLockRegistryKey(IN HANDLE KeyHandle)
NTSTATUS NTAPI NtQueryKey(IN HANDLE KeyHandle, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT PVOID KeyInformation, IN ULONG Length, OUT PULONG ResultLength)
BOOLEAN CmBootAcceptFirstTime
NTSTATUS NTAPI NtSetValueKey(IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN ULONG TitleIndex, IN ULONG Type, IN PVOID Data, IN ULONG DataSize)
NTSTATUS NTAPI NtSetInformationKey(IN HANDLE KeyHandle, IN KEY_SET_INFORMATION_CLASS KeyInformationClass, IN PVOID KeyInformation, IN ULONG KeyInformationLength)
NTSTATUS NTAPI NtUnloadKeyEx(IN POBJECT_ATTRIBUTES TargetKey, IN HANDLE Event)
NTSTATUS NTAPI NtQueryMultipleValueKey(IN HANDLE KeyHandle, IN OUT PKEY_VALUE_ENTRY ValueList, IN ULONG NumberOfValues, OUT PVOID Buffer, IN OUT PULONG Length, OUT PULONG ReturnLength)
NTSTATUS NTAPI NtLockProductActivationKeys(IN PULONG pPrivateVer, IN PULONG pSafeMode)
NTSTATUS NTAPI NtDeleteValueKey(IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName)
NTSTATUS NTAPI NtRestoreKey(IN HANDLE KeyHandle, IN HANDLE FileHandle, IN ULONG RestoreFlags)
NTSTATUS NTAPI NtNotifyChangeMultipleKeys(IN HANDLE MasterKeyHandle, IN ULONG Count, IN POBJECT_ATTRIBUTES SlaveObjects, IN HANDLE Event, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CompletionFilter, IN BOOLEAN WatchTree, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN Asynchronous)
NTSTATUS NTAPI NtReplaceKey(IN POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE Key, IN POBJECT_ATTRIBUTES ReplacedObjectAttributes)
_In_ ULONG _In_ ULONG _In_ ULONG Length
const LUID SeBackupPrivilege
const LUID SeRestorePrivilege
BOOLEAN NTAPI SeSinglePrivilegeCheck(_In_ LUID PrivilegeValue, _In_ KPROCESSOR_MODE PreviousMode)
Checks if a single privilege is present in the context of the calling thread.
NTSTATUS NTAPI SeCaptureSecurityDescriptor(_In_ PSECURITY_DESCRIPTOR _OriginalSecurityDescriptor, _In_ KPROCESSOR_MODE CurrentMode, _In_ POOL_TYPE PoolType, _In_ BOOLEAN CaptureIfKernel, _Out_ PSECURITY_DESCRIPTOR *CapturedSecurityDescriptor)
Captures a security descriptor.
NTSTATUS NTAPI SeReleaseSecurityDescriptor(_In_ PSECURITY_DESCRIPTOR CapturedSecurityDescriptor, _In_ KPROCESSOR_MODE CurrentMode, _In_ BOOLEAN CaptureIfKernelMode)
Releases a captured security descriptor buffer.
_In_ SYSTEM_POWER_STATE _In_ ULONG _In_ BOOLEAN Asynchronous
#define STATUS_KEY_DELETED
FORCEINLINE ULONG ObpValidateAttributes(IN ULONG Attributes, IN KPROCESSOR_MODE PreviousMode)
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
NTSTATUS NTAPI ObOpenObjectByPointer(IN PVOID Object, IN ULONG HandleAttributes, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PHANDLE Handle)
NTSTATUS NTAPI ObOpenObjectByName(IN POBJECT_ATTRIBUTES ObjectAttributes, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN OUT PVOID ParseContext, OUT PHANDLE Handle)
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
#define _SEH2_YIELD(__stmt)
static __inline NTSTATUS ProbeAndCaptureUnicodeString(OUT PUNICODE_STRING Dest, IN KPROCESSOR_MODE CurrentMode, IN const UNICODE_STRING *UnsafeSrc)
static __inline VOID ReleaseCapturedUnicodeString(IN PUNICODE_STRING CapturedString, IN KPROCESSOR_MODE CurrentMode)
#define ProbeForWriteHandle(Ptr)
#define ProbeForWriteUlong(Ptr)
#define ProbeForReadUnicodeString(Ptr)
PULONG MinorVersion OPTIONAL
struct _CM_KEY_CONTROL_BLOCK * KeyControlBlock
PUNICODE_STRING ObjectName
#define UNIMPLEMENTED_ONCE
#define RtlCopyMemory(Destination, Source, Length)
#define RtlZeroMemory(Destination, Length)
#define STATUS_ACCESS_DENIED
#define STATUS_INVALID_PARAMETER
#define STATUS_OBJECT_NAME_INVALID
#define STATUS_INSUFFICIENT_RESOURCES
struct _OBJECT_ATTRIBUTES OBJECT_ATTRIBUTES
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
_In_ WDFCOLLECTION _In_ ULONG Index
_In_ PWDFDEVICE_INIT _In_ PWDF_FILEOBJECT_CONFIG _In_opt_ PWDF_OBJECT_ATTRIBUTES FileObjectAttributes
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG _Out_ PULONG ResultLength
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ ULONG _Out_ PVOID _Out_ PULONG RequiredSize
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG BufferLength
_Must_inspect_result_ _In_opt_ WDFKEY _In_ PCUNICODE_STRING _In_ ACCESS_MASK _In_ ULONG CreateOptions
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING ValueName
_In_ USHORT _In_ ULONG _In_ PSOCKADDR _In_ PSOCKADDR _Reserved_ ULONG _In_opt_ PVOID _In_opt_ const WSK_CLIENT_CONNECTION_DISPATCH _In_opt_ PEPROCESS _In_opt_ PETHREAD _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor
_Must_inspect_result_ _In_ ULONG Flags
_In_ PVOID _Out_opt_ PULONG_PTR _Outptr_opt_ PCUNICODE_STRING * ObjectName
#define REG_LATEST_FORMAT
@ RegNtPostEnumerateValueKey
@ RegNtPreEnumerateValueKey
@ RegNtPostDeleteValueKey
#define REG_NO_COMPRESSION
#define REG_STANDARD_FORMAT
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
#define ObDereferenceObject
_In_ KPROCESSOR_MODE PreviousMode
_In_ ULONG _In_ KEY_INFORMATION_CLASS KeyInformationClass