registry.c File Reference

#include "wdfloader.h"

Include dependency graph for registry.c:

Go to the source code of this file.

Functions
NTSTATUS NTAPI	GetVersionRegistryHandle (_In_ PWDF_BIND_INFO BindInfo, _Out_ PHANDLE HandleRegKey)
	Open framework version registry key.
NTSTATUS NTAPI	GetDefaultServiceName (_In_ PWDF_BIND_INFO BindInfo, _Out_ PUNICODE_STRING RegistryPath)
	Create default service path from bind info.
NTSTATUS	GetVersionServicePath (_In_ PWDF_BIND_INFO BindInfo, _Out_ PUNICODE_STRING ServicePath)
	Get service path from bind info and registry.
BOOLEAN	ServiceCheckBootStart (_In_ PUNICODE_STRING Service)
NTSTATUS	FxLdrQueryUlong (_In_ HANDLE KeyHandle, _In_ PUNICODE_STRING ValueName, _Out_ PULONG Value)
NTSTATUS	FxLdrQueryData (_In_ HANDLE KeyHandle, _In_ PUNICODE_STRING ValueName, _In_ ULONG Tag, _Out_ PKEY_VALUE_PARTIAL_INFORMATION *KeyValPartialInfo)
NTSTATUS	BuildServicePath (_In_ PKEY_VALUE_PARTIAL_INFORMATION KeyValueInformation, _In_ PUNICODE_STRING ServicePath)

Function Documentation

BuildServicePath()

NTSTATUS BuildServicePath	(	_In_ PKEY_VALUE_PARTIAL_INFORMATION	KeyValueInformation,
		_In_ PUNICODE_STRING	ServicePath
	)

Definition at line 338 of file registry.c.

{
    NTSTATUS status;
    PWCHAR buffer;
    PWCHAR lastChar;
    UNICODE_STRING name;
    CONST WCHAR regPath[] = L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\%wZ";
 
    if (KeyValueInformation->Type != REG_SZ &&
        KeyValueInformation->Type != REG_EXPAND_SZ)
    {
        status = STATUS_OBJECT_TYPE_MISMATCH;
        __DBGPRINT(("ERROR: BuildServicePath failed with status 0x%x\n", status));
        return status;
    }
 
    if (KeyValueInformation->DataLength == 0 ||
        KeyValueInformation->DataLength > 0xFFFF)
    {
        status = STATUS_INVALID_PARAMETER;
        __DBGPRINT(("ERROR: BuildServicePath failed with status 0x%x\n", status));
        return status;
    }
 
    name.Buffer = (PWCH)KeyValueInformation->Data;
    name.Length = (USHORT)KeyValueInformation->DataLength;
    name.MaximumLength = (USHORT)KeyValueInformation->DataLength;
 
    lastChar = (PWCHAR)KeyValueInformation->Data + KeyValueInformation->DataLength / sizeof(WCHAR);
    if (KeyValueInformation->DataLength >= sizeof(WCHAR) && *lastChar == UNICODE_NULL)
    {
        name.Length = (USHORT)KeyValueInformation->DataLength - sizeof(WCHAR);
    }
 
    buffer = ExAllocatePoolZero(PagedPool, name.Length + sizeof(regPath), WDFLDR_TAG);
    if (buffer != NULL)
    {
        ServicePath->Length = 0;
        ServicePath->MaximumLength = name.Length + sizeof(L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\");//106;
        ServicePath->Buffer = buffer;
        status = RtlUnicodeStringPrintf(ServicePath, regPath, &name);
 
        if (!NT_SUCCESS(status))
        {
            ExFreePoolWithTag(buffer, WDFLDR_TAG);
            ServicePath->Length = 0;
            ServicePath->Buffer = NULL;
        }
    }
    else
    {
        status = STATUS_INSUFFICIENT_RESOURCES;
        __DBGPRINT(("ERROR: ExAllocatePoolWithTag failed with Status 0x%x\n", status));
    }
 
    return status;
}

Referenced by GetClassServicePath(), and GetVersionServicePath().

FxLdrQueryData()

NTSTATUS FxLdrQueryData	(	_In_ HANDLE	KeyHandle,
		_In_ PUNICODE_STRING	ValueName,
		_In_ ULONG	Tag,
		_Out_ PKEY_VALUE_PARTIAL_INFORMATION *	KeyValPartialInfo
	)

Definition at line 267 of file registry.c.

{
    PKEY_VALUE_PARTIAL_INFORMATION pKeyInfo;
    NTSTATUS status;
    ULONG resultLength;
 
    *KeyValPartialInfo = NULL;
    for (;;)
    {
        status = ZwQueryValueKey(KeyHandle, ValueName, KeyValuePartialInformation, NULL, 0, &resultLength);
        if (status != STATUS_BUFFER_TOO_SMALL)
        {
            if (!NT_SUCCESS(status))
            {
                __DBGPRINT(("ERROR: ZwQueryValueKey failed with status 0x%x\n", status));
            }
 
            return status;
        }
 
        status = RtlULongAdd(resultLength, 0xCu, &resultLength);
        if (!NT_SUCCESS(status))
        {
            __DBGPRINT(("ERROR: Computing length of data under %wZ failed with status 0x%x\n", ValueName, status));
 
            return status;
        }
 
        pKeyInfo = ExAllocatePoolWithTag(PagedPool, resultLength, Tag);
 
        if (pKeyInfo == NULL)
        {
            break;
        }
 
        RtlZeroMemory(pKeyInfo, resultLength);
        status = ZwQueryValueKey(
            KeyHandle,
            ValueName,
            KeyValuePartialInformation,
            pKeyInfo,
            resultLength,
            &resultLength);
 
        if (NT_SUCCESS(status))
        {
            *KeyValPartialInfo = pKeyInfo;
            return status;
        }
 
        ExFreePoolWithTag(pKeyInfo, WDFLDR_TAG);
 
        if (status != STATUS_BUFFER_TOO_SMALL)
        {
            __DBGPRINT(("ERROR: ZwQueryValueKey (%wZ) failed with Status 0x%x\n", ValueName, status));
 
            return status;
        }
    }
 
    __DBGPRINT(("ERROR: ExAllocatePoolWithTag failed with Status 0x%x\n", STATUS_INSUFFICIENT_RESOURCES));
 
    return STATUS_INSUFFICIENT_RESOURCES;
}

Referenced by GetClassServicePath(), GetImageName(), and GetVersionServicePath().

FxLdrQueryUlong()

NTSTATUS FxLdrQueryUlong	(	_In_ HANDLE	KeyHandle,
		_In_ PUNICODE_STRING	ValueName,
		_Out_ PULONG	Value
	)

Definition at line 231 of file registry.c.

{
    NTSTATUS status;
    ULONG resultLength;
    KEY_VALUE_PARTIAL_INFORMATION keyValue;
 
    keyValue.DataLength = 0;
    keyValue.TitleIndex = 0;
    keyValue.Type = 0;
    keyValue.Data[0] = 0;
    status = ZwQueryValueKey(KeyHandle, ValueName, KeyValuePartialInformation, &keyValue, sizeof(keyValue), &resultLength);
    if (NT_SUCCESS(status))
    {
        if (keyValue.Type != REG_DWORD || keyValue.DataLength != sizeof(*Value))
        {
            status = STATUS_INVALID_BUFFER_SIZE;
        }
        else
        {
            *Value = keyValue.Data[0];
            status = STATUS_SUCCESS;
        }
    }
    else
    {
        __DBGPRINT(("ERROR: ZwQueryValueKey failed with Status 0x%x\n", status));
    }
 
    return status;
}

Referenced by ServiceCheckBootStart(), and WdfLdrDiagnosticsValueByNameAsULONG().

GetDefaultServiceName()

NTSTATUS NTAPI GetDefaultServiceName	(	_In_ PWDF_BIND_INFO	BindInfo,
		_Out_ PUNICODE_STRING	RegistryPath
	)

Create default service path from bind info.

Parameters

BindInfo	Bind information
RegistryPath	Created service path

Returns

STATUS_SUCCESS on success, error code otherwise

Definition at line 88 of file registry.c.

{
    NTSTATUS status;
    static const SIZE_T regPathLength = sizeof(L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Wdf01000") - sizeof(WCHAR);
 
    if (RegistryPath == NULL)
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    RegistryPath->Buffer = (PWCHAR)ExAllocatePoolWithTag(PagedPool, regPathLength, WDFLDR_TAG);
 
    if (RegistryPath->Buffer == NULL)
    {
        status = STATUS_INSUFFICIENT_RESOURCES;
        __DBGPRINT(("ERROR: ExAllocatePoolWithTag failed with status 0x%x\n", status));
        return STATUS_INSUFFICIENT_RESOURCES;
    }
 
    RegistryPath->Length = 0;
    RegistryPath->MaximumLength = regPathLength;
 
    status = RtlUnicodeStringPrintf(RegistryPath,
        L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Wdf%02d000",
        BindInfo->Version.Major);
 
    if (NT_SUCCESS(status))
    {
        __DBGPRINT(("Couldn't find control Key -- using default service name %wZ\n", RegistryPath));
        status = STATUS_SUCCESS;
    }
    else
    {
        __DBGPRINT(("ERROR: RtlUnicodeStringCopyString failed with Status 0x%x\n", status));
 
        ExFreePoolWithTag(RegistryPath->Buffer, WDFLDR_TAG);
        RegistryPath->Length = 0;
        RegistryPath->Buffer = NULL;
    }
 
    return status;
}

Referenced by GetVersionServicePath().

GetVersionRegistryHandle()

NTSTATUS NTAPI GetVersionRegistryHandle	(	_In_ PWDF_BIND_INFO	BindInfo,
		_Out_ PHANDLE	HandleRegKey
	)

Open framework version registry key.

Parameters

BindInfo	Bind information
HandleRegKey	Opened key handle

Returns

STATUS_SUCCESS on success, error code otherwise

Definition at line 21 of file registry.c.

{
    NTSTATUS status;
    OBJECT_ATTRIBUTES objectAttributes;
    HANDLE handle = NULL;
    HANDLE keyHandle = NULL;
    DECLARE_UNICODE_STRING_SIZE(string, 256);
 
    status = RtlUnicodeStringPrintf(&string,
        L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Wdf\\Kmdf\\%s\\Versions",
        BindInfo->Component); // Component name for kmdf driver - 'KmdfLibrary'
 
    if (!NT_SUCCESS(status))
    {
        __DBGPRINT(("ERROR: RtlUnicodeStringPrintf failed with Status 0x%x\n", status));
        goto end;
    }
 
    __DBGPRINT(("Component path %wZ\n", &string));
 
    InitializeObjectAttributes(&objectAttributes, &string, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);
    status = ZwOpenKey(&keyHandle, KEY_QUERY_VALUE, &objectAttributes);
 
    if (!NT_SUCCESS(status))
    {
        __DBGPRINT(("ERROR: ZwOpenKey (%wZ) failed with Status 0x%x\n", &string, status));
        goto end;
    }
 
    status = RtlIntegerToUnicodeString(BindInfo->Version.Major, 10, &string);
 
    if (!NT_SUCCESS(status))
    {
        __DBGPRINT(("ERROR: ConvertUlongToWString failed with Status 0x%x\n", status));
        goto end;
    }
 
    InitializeObjectAttributes(&objectAttributes, &string, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, keyHandle, NULL);
    status = ZwOpenKey(&handle, KEY_READ, &objectAttributes);
 
    if (!NT_SUCCESS(status))
    {
        __DBGPRINT(("ERROR: ZwOpenKey (%wZ) failed with Status 0x%x\n", string, status));
    }
 
end:
    *HandleRegKey = handle;
 
    if (keyHandle != NULL)
    {
        ZwClose(keyHandle);
    }
 
    return status;
}

Referenced by GetVersionServicePath().

GetVersionServicePath()

NTSTATUS GetVersionServicePath	(	_In_ PWDF_BIND_INFO	BindInfo,
		_Out_ PUNICODE_STRING	ServicePath
	)

Get service path from bind info and registry.

Parameters

BindInfo	Bind information
ServicePath	Service path in registry

Returns

STATUS_SUCCESS on success, error code otherwise

Definition at line 141 of file registry.c.

{
    NTSTATUS status;
    PKEY_VALUE_PARTIAL_INFORMATION pKeyVal = NULL;
    HANDLE handleRegKey = NULL;
    UNICODE_STRING ValueName = RTL_CONSTANT_STRING(L"Service");
 
    status = GetVersionRegistryHandle(BindInfo, &handleRegKey);
 
    if (!NT_SUCCESS(status))
    {
        __DBGPRINT(("ERROR: GetVersionRegistryHandle failed with Status 0x%x\n", status));
    }
    else
    {
        // get service name
        status = FxLdrQueryData(handleRegKey, &ValueName, WDFLDR_TAG, &pKeyVal);
 
        if (!NT_SUCCESS(status))
        {
            __DBGPRINT(("ERROR: QueryData failed with status 0x%x\n", status));
        }
        else
        {
            status = BuildServicePath(pKeyVal, ServicePath);
        }
    }
 
    if (!NT_SUCCESS(status))
    {
        status = GetDefaultServiceName(BindInfo, ServicePath);
 
        if (!NT_SUCCESS(status))
        {
            __DBGPRINT(("ERROR: GetVersionServicePath failed with Status 0x%x\n", status));
        }
    }
    else
    {
        __DBGPRINT(("(%wZ)\n", ServicePath));
    }
 
    if (handleRegKey != NULL)
        ZwClose(handleRegKey);
    if (pKeyVal != NULL)
        ExFreePoolWithTag(pKeyVal, WDFLDR_TAG);
 
    return status;
}

Referenced by ReferenceVersion().

ServiceCheckBootStart()

BOOLEAN ServiceCheckBootStart

(

_In_ PUNICODE_STRING

Service

)

Definition at line 194 of file registry.c.

{
    NTSTATUS status;
    OBJECT_ATTRIBUTES objectAttributes;
    HANDLE keyHandle = NULL;
    BOOLEAN result = FALSE;
    ULONG value;
    UNICODE_STRING valueName = RTL_CONSTANT_STRING(L"Start");
 
    InitializeObjectAttributes(&objectAttributes, Service, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);
    status = ZwOpenKey(&keyHandle, KEY_READ, &objectAttributes);
 
    if (status != STATUS_OBJECT_NAME_NOT_FOUND)
    {
        if (NT_SUCCESS(status))
        {
            status = FxLdrQueryUlong(keyHandle, &valueName, &value);
            if (NT_SUCCESS(status))
            {
                result = value == 0;
            }
        }
        else
        {
            __DBGPRINT(("ZwOpenKey(%wZ) failed: %08X\n", Service, status));
        }
    }
 
    if (keyHandle)
        ZwClose(keyHandle);
 
    return result;
}

Referenced by ClassCreate().