Kernel Mode Driver and Registry Access

HANDLE
DrvOpenKey () {
 
        NTSTATUS ntStatus;
 
        WCHAR awcBaseKey [] = L"\\Registry\\Machine\\SOFTWARE\\Company\\Product";
        WCHAR awcKey [] = L"LoadCounter";
        UNICODE_STRING KeyName;
        HANDLE hBaseKey = NULL;
        HANDLE hKey = NULL;
 
        OBJECT_ATTRIBUTES oa;
        ULONG ulDisposition;
 
        KeyName.Buffer = awcBaseKey;
        KeyName.Length = (USHORT) wcslen (awcBaseKey) * sizeof (WCHAR);
 
        InitializeObjectAttributes(&oa, &KeyName, OBJ_CASE_INSENSITIVE, NULL, NULL );
 
        ntStatus = ZwCreateKey(&hBaseKey, KEY_ALL_ACCESS, &oa, 0,  NULL, REG_OPTION_NON_VOLATILE, &ulDisposition);
 
        if(!NT_SUCCESS (ntStatus )) {
 
                return NULL;
        }
 
        return hKey;
}
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:

#include <ntddk.h>
//#include <wtypes.h>
 
typedef unsigned long DWORD;
typedef int BOOL;
typedef void *HANDLE;
 
HANDLE
DrvOpenKey () {
 
        NTSTATUS ntStatus;
 
        WCHAR awcBaseKey [] = L"\\Registry\\Machine\\SOFTWARE\\Company\\Product";
        WCHAR awcKey [] = L"LoadCounter";
        UNICODE_STRING KeyName;
        HANDLE hBaseKey = NULL;
        HANDLE hKey = NULL;
 
        OBJECT_ATTRIBUTES oa;
        ULONG ulDisposition;
 
        KeyName.Buffer = awcBaseKey;
        KeyName.Length = (USHORT) wcslen (awcBaseKey) * sizeof (WCHAR);
 
        InitializeObjectAttributes(&oa, &KeyName, OBJ_CASE_INSENSITIVE, NULL, NULL );
 
        ntStatus = ZwCreateKey(&hBaseKey, KEY_ALL_ACCESS, &oa, 0,  NULL, REG_OPTION_NON_VOLATILE, &ulDisposition);
 
        if(!NT_SUCCESS (ntStatus )) {
 
                return NULL;
        }
 
        return hKey;
}
 
BOOL
DrvLoad (DWORD* pdwVal) {
 
        BOOL bRet = FALSE;
 
        WCHAR awcValue[]        = L"LoadCount";
        UNICODE_STRING ValueName;
        HANDLE hKey = NULL;
        NTSTATUS ntStatus;
 
        KEY_VALUE_PARTIAL_INFORMATION* pkvi = NULL;
 
        if (!(hKey = DrvOpenKey ())) return FALSE;
 
        __try {
 
                //
                // Create the storage value
                //
                ValueName.Buffer = awcValue;
                ValueName.Length = (USHORT) (wcslen (awcValue) + 1) * sizeof (WCHAR);
                ULONG ulNeeded;
 
                size_t szkvi = sizeof (KEY_VALUE_PARTIAL_INFORMATION);
                pkvi = (KEY_VALUE_PARTIAL_INFORMATION*) new BYTE [ szkvi];
 
                RtlZeroMemory (pkvi, sizeof (KEY_VALUE_PARTIAL_INFORMATION));
                pkvi->Type = REG_DWORD;
 
                // Query necessary size first
                ntStatus = ZwQueryValueKey (hKey, &ValueName, KeyValuePartialInformation, pkvi, (ULONG) szkvi, &ulNeeded);
 
                //
                //      Has not been saved yet
                //
                if (STATUS_OBJECT_NAME_NOT_FOUND == ntStatus) {
 
                        __leave;
                }
 
                if (ntStatus != STATUS_BUFFER_TOO_SMALL && ntStatus != STATUS_BUFFER_OVERFLOW) {
 
                        __leave;
                }
 
                delete [] pkvi;
                szkvi = sizeof (KEY_VALUE_PARTIAL_INFORMATION) + ulNeeded;
                pkvi = (KEY_VALUE_PARTIAL_INFORMATION*) new BYTE [ szkvi];
                RtlZeroMemory (pkvi, szkvi);
                pkvi->Type = REG_DWORD;
 
                // Finally, read value
                ntStatus = ZwQueryValueKey (hKey, &ValueName, KeyValuePartialInformation, pkvi, (ULONG) szkvi, &ulNeeded);
 
                if(!NT_SUCCESS (ntStatus )) {
 
 
                        __leave;
                }
 
                *pdwVal = (DWORD) pkvi->Data;
 
        } __finally {
 
                delete [] pkvi;
 
                ZwClose (hKey);
        }
 
        return bRet;
}
 
BOOL
DrvSave (DWORD dwVal) {
 
        BOOL bRet = FALSE;
 
        WCHAR awcValue []       = L"LoadCount";
        UNICODE_STRING ValueName;
        HANDLE hKey = NULL;
        NTSTATUS ntStatus;
 
        if (!(hKey = DrvOpenKey ())) return FALSE;
 
        __try {
 
                // Create the storage value
                ValueName.Buffer = awcValue;
                ValueName.Length = (USHORT) (wcslen (awcValue)) * sizeof(WCHAR);
 
                ntStatus = ZwSetValueKey (hKey, &ValueName, 0, REG_DWORD, (LPBYTE) &dwVal, sizeof (DWORD));
 
                if(!NT_SUCCESS (ntStatus )) {
 
                        __leave;
                }
 
                bRet = TRUE;
 
        } __finally {
 
                ZwClose (hKey);
        }
 
        return bRet;
}
 
NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, 
					  IN PUNICODE_STRING theRegistryPath )
{
 
 
 
 
	return STATUS_SUCCESS;
 
}
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:

#include <ntddk.h>
//#include <wtypes.h>
 
typedef unsigned long DWORD;
typedef int BOOL;
typedef void *HANDLE;
 
HANDLE
DrvOpenKey () {
 
        NTSTATUS ntStatus;
 
        WCHAR awcBaseKey [] = L"\\Registry\\Machine\\SOFTWARE\\Company\\Product";
        WCHAR awcKey [] = L"LoadCounter";
        UNICODE_STRING KeyName;
        HANDLE hBaseKey = NULL;
        HANDLE hKey = NULL;
 
        OBJECT_ATTRIBUTES oa;
        ULONG ulDisposition;
 
        KeyName.Buffer = awcBaseKey;
        KeyName.Length = (USHORT) wcslen (awcBaseKey) * sizeof (WCHAR);
 
        InitializeObjectAttributes(&oa, &KeyName, OBJ_CASE_INSENSITIVE, NULL, NULL );
 
        ntStatus = ZwCreateKey(&hBaseKey, KEY_ALL_ACCESS, &oa, 0,  NULL, REG_OPTION_NON_VOLATILE, &ulDisposition);
 
        if(!NT_SUCCESS (ntStatus )) {
 
                return NULL;
        }
 
        return hKey;
}
 
BOOL
DrvLoad (DWORD* pdwVal) {
 
        BOOL bRet = FALSE;
 
        WCHAR awcValue[]        = L"LoadCount";
        UNICODE_STRING ValueName;
        HANDLE hKey = NULL;
        NTSTATUS ntStatus;
        char buf[2048];
 
        KEY_VALUE_PARTIAL_INFORMATION* pkvi = NULL;
 
        if (!(hKey = DrvOpenKey ())) return FALSE;
 
        __try {
 
                //
                // Create the storage value
                //
                ValueName.Buffer = awcValue;
                ValueName.Length = (USHORT) (wcslen (awcValue) + 1) * sizeof (WCHAR);
                ULONG ulNeeded;
 
                size_t szkvi = sizeof (buf);
                pkvi = (KEY_VALUE_PARTIAL_INFORMATION*) buf;
 
                RtlZeroMemory (pkvi, sizeof (buf));
                pkvi->Type = REG_DWORD;
 
 
                // Finally, read value
                ntStatus = ZwQueryValueKey (hKey, &ValueName, KeyValuePartialInformation, pkvi, (ULONG) szkvi, &ulNeeded);
 
                if(!NT_SUCCESS (ntStatus )) {
 
 
                        __leave;
                }
 
                *pdwVal = (DWORD) pkvi->Data;
 
        } __finally {
 
 
                ZwClose (hKey);
        }
 
        return bRet;
}
 
BOOL
DrvSave (DWORD dwVal) {
 
        BOOL bRet = FALSE;
 
        WCHAR awcValue []       = L"LoadCount";
        UNICODE_STRING ValueName;
        HANDLE hKey = NULL;
        NTSTATUS ntStatus;
 
        if (!(hKey = DrvOpenKey ())) return FALSE;
 
        __try {
 
                // Create the storage value
                ValueName.Buffer = awcValue;
                ValueName.Length = (USHORT) (wcslen (awcValue)) * sizeof(WCHAR);
 
                ntStatus = ZwSetValueKey (hKey, &ValueName, 0, REG_DWORD, (LPBYTE) &dwVal, sizeof (DWORD));
 
                if(!NT_SUCCESS (ntStatus )) {
 
                        __leave;
                }
 
                bRet = TRUE;
 
        } __finally {
 
                ZwClose (hKey);
        }
 
        return bRet;
}
 
NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, 
					  IN PUNICODE_STRING theRegistryPath )
{
 
 
 
 
	return STATUS_SUCCESS;
 
}

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:

exteren "C" 
NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, 
					  IN PUNICODE_STRING theRegistryPath )
{
 
 
 
 
	return STATUS_SUCCESS;
 
}
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:

HANDLE
DrvOpenKey () {
 
        NTSTATUS ntStatus;
 
        WCHAR awcKey [] = L"\\Registry\\Machine\\SOFTWARE\\Company\\Product";
        UNICODE_STRING KeyName;
        HANDLE hKey = NULL;
 
        OBJECT_ATTRIBUTES oa;
        ULONG ulDisposition;
 
        KeyName.Buffer = awcKey;
        KeyName.Length = (USHORT) wcslen (awcKey) * sizeof (WCHAR);
 
        InitializeObjectAttributes(&oa, &KeyName, OBJ_CASE_INSENSITIVE, NULL, NULL );
 
        ntStatus = ZwCreateKey(&hKey, KEY_ALL_ACCESS, &oa, 0,  NULL, REG_OPTION_NON_VOLATILE, &ulDisposition); // <---------
 
        if(!NT_SUCCESS (ntStatus )) {
 
                return NULL;
        }
 
        return hKey;
}
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26: