驱动枚举注册表项

枚举注册表项

NTSTATUS EnumerateKey( HANDLE hKey )
{
	NTSTATUS status = STATUS_SUCCESS;
	PKEY_BASIC_INFORMATION pkbi = NULL;
	PKEY_FULL_INFORMATION pkfi = NULL;
	ULONG ulLength = 0;

	// 获取子健个数
	status = ZwQueryKey(hKey, KeyFullInformation, pkfi, 0, &ulLength);
	// allocate key information buffer
	pkfi = (PKEY_FULL_INFORMATION)ExAllocatePoolWithTag(PagedPool, ulLength, 'abcd');
	if (pkfi == NULL)
	{
		DbgPrint("ZwQueryKey ExAllocatePoolWithTag failed %x\n", status);
		goto exit1;
	}
	status = ZwQueryKey(hKey, KeyFullInformation, pkfi, ulLength, &ulLength);
	if (!NT_SUCCESS(status))
	{
		DbgPrint("ZwQueryKey 2 failed %x\n", status);
		goto exit1;
	}

	// enumerate key 
	for (ULONG i = 0; i < pkfi->SubKeys; i++)
	{
		status = ZwEnumerateKey(hKey, i, KeyBasicInformation, pkbi, 0, &ulLength);
		// allcate enumerate buffer
		pkbi = (PKEY_BASIC_INFORMATION)ExAllocatePoolWithTag(PagedPool, ulLength, 'abcd');
		if (pkbi == NULL)
		{
			DbgPrint("ZwEnumerateKey ExAllocatePoolWithTag failed %x\n", status);
			goto exit1;
		}
		status = ZwEnumerateKey(hKey, i, KeyBasicInformation, pkbi, ulLength, &ulLength);
		if (!NT_SUCCESS(status))
		{
			DbgPrint("ZwEnumerateKey failed %x\n", status);
			goto exit1;
		}

		// show key name
		UNICODE_STRING uShowKey = { 0 };
		uShowKey.Length = uShowKey.MaximumLength = (USHORT)pkbi->NameLength;
		uShowKey.Buffer = pkbi->Name;
		DbgPrint("%wZ\n", &uShowKey);

		HANDLE hValue = NULL;
		OBJECT_ATTRIBUTES ObjValuePath;

		InitializeObjectAttributes(&ObjValuePath, &uShowKey, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, hKey, NULL);


		status = ZwOpenKey(&hValue, STANDARD_RIGHTS_ALL, &ObjValuePath);
		if ( NT_SUCCESS(status) )
		{
			// enumerate value key.
			status = EnumerateValueKey(hValue);
			if (!NT_SUCCESS(status))
			{
				DbgPrint("EnumerateValueKey failed %x\n", status);
			}
			ZwClose(hValue);
		}
		else
		{
			DbgPrint("ZwOpenKey failed %x\n", status);
		}

		ExFreePool(pkbi);
		pkbi = NULL;
	}
exit1:

	if (pkfi != NULL)
		ExFreePool(pkfi);
	if (pkbi != NULL)
		ExFreePool(pkbi);
	return status;
}

枚举注册表键值

NTSTATUS EnumerateValueKey(HANDLE hKey)
{
	NTSTATUS status = STATUS_SUCCESS;
	PKEY_FULL_INFORMATION pkfi = NULL;
	PKEY_VALUE_FULL_INFORMATION pkvfi = NULL;
	ULONG ulLength = 0;

	// 获取ValueKey个数
	status = ZwQueryKey(hKey, KeyFullInformation, pkfi, 0, &ulLength);
	// allocate key information buffer
	pkfi = (PKEY_FULL_INFORMATION)ExAllocatePoolWithTag(PagedPool, ulLength, 'abcd');
	if (pkfi == NULL)
	{
		DbgPrint("ZwQueryKey ExAllocatePoolWithTag failed %x\n", status);
		goto exit2;
	}
	status = ZwQueryKey(hKey, KeyFullInformation, pkfi, ulLength, &ulLength);
	if (!NT_SUCCESS(status))
	{
		DbgPrint("ZwQueryKey 2 failed %x\n", status);
		goto exit2;
	}
	// enumerater value key
	for (ULONG i = 0; i < pkfi->Values; i++)
	{
		status = ZwEnumerateValueKey(hKey, i, KeyValueFullInformation, pkvfi, 0, &ulLength);
		// allcate enumerate buffer
		pkvfi = (PKEY_VALUE_FULL_INFORMATION)ExAllocatePoolWithTag(PagedPool, ulLength, 'abcd');
		if (pkvfi == NULL)
		{
			DbgPrint("ZwEnumerateKey ExAllocatePoolWithTag failed %x\n", status);
			goto exit2;
		}
		status = ZwEnumerateValueKey(hKey, i, KeyValueFullInformation, pkvfi, ulLength, &ulLength);
		if (!NT_SUCCESS(status))
		{
			DbgPrint("ZwEnumerateKey failed %x\n", status);
			goto exit2;
		}
		// show value name
		UNICODE_STRING uValueKey = { 0 };
		UNICODE_STRING uValueData = {0};
		// value key
		uValueKey.Length = uValueKey.MaximumLength = (USHORT)pkvfi->NameLength;
		uValueKey.Buffer = pkvfi->Name;
		// value data
		uValueData.Length = uValueData.MaximumLength = (USHORT)pkvfi->DataLength;
		uValueData.Buffer = (PWCH)((PCH)pkvfi + pkvfi->DataOffset);

		// 没有分不同类型来显示..
		DbgPrint("  ValueKey : %wZ\n  ValueData : %wZ\n", &uValueKey,&uValueData);

		ExFreePool(pkvfi);
		pkvfi = NULL;
	}

exit2:
	if (pkfi != NULL)
		ExFreePool(pkfi);
	if (pkvfi != NULL)
		ExFreePool(pkvfi);
	return status;
}