获得手柄NtCreateKey以键/ NtOpenKey

我试图让这将创造在HKCU注册表配置单元给定的子键，或打开子键，如果它已经存在的功能，然后返回TRUE。

NOTES

让RegSidPath表示与附加到user SID一个完全合格的HKCU注册表路径它如\\Registry\\User\\S-1-5-20-xxxxxx-xxxxxx-xxxxxxxx-1050

让KeyToCreate表示特定注册表路径如\\Software\\MyCompany\\MySoftware\\MySubKey

CODE

我有以下功能：

BOOL CreateHKCUKey(PWCHAR RegSidPath, PWCHAR KeyToCreate) { 

UNICODE_STRING uString; 
RtlInitUnicodeString(&uString, RegSidPath); 

OBJECT_ATTRIBUTES ObjAttributes; 
InitializeObjectAttributes(&ObjAttributes, &uString, OBJ_CASE_INSENSITIVE, 0, 0); 

HANDLE BaseKeyHandle = NULL; 
NTSTATUS Status = NtOpenKey(&BaseKeyHandle, KEY_CREATE_SUB_KEY, &ObjAttributes); 
if (NT_SUCCESS(Status) && Status != STATUS_OBJECT_NAME_NOT_FOUND) { 

    UNICODE_STRING KeyString = { 0 }; 
    do { 
     PWCHAR NextSubKey = StrStrW((KeyString.Length == 0 ? KeyToCreate : KeyString.Buffer) + 1, L"\\"); 
     DWORD CurrentKeyLength = lstrlenW(KeyToCreate) - lstrlenW(NextSubKey); 
     PWCHAR CurrentSubKey = PWCHAR(GlobalAlloc(GPTR, CurrentKeyLength + sizeof(WCHAR))); 
     if (CurrentSubKey != ERROR) { 
      memcpy(CurrentSubKey, KeyToCreate, CurrentKeyLength * sizeof(WCHAR)); 
      CurrentSubKey[CurrentKeyLength] = UNICODE_NULL; 

      RtlInitUnicodeString(&KeyString, CurrentSubKey); 

      OBJECT_ATTRIBUTES KeyAttributes; 
      InitializeObjectAttributes(&KeyAttributes, &KeyString, OBJ_CASE_INSENSITIVE, &BaseKeyHandle, 0); 

      HANDLE CurrentHiveEntry = NULL; 
      Status = NtOpenKey(&CurrentHiveEntry, KEY_CREATE_SUB_KEY, &KeyAttributes); 
      if (RtlNtStatusToDosError(Status) == ERROR_BAD_PATHNAME) { 
       InitializeObjectAttributes(&KeyAttributes, &KeyString, OBJ_CASE_INSENSITIVE, &CurrentHiveEntry, 0); 

       DWORD DefaultDisposition; 
       Status = NtCreateKey(&CurrentHiveEntry, KEY_CREATE_SUB_KEY, &KeyAttributes, 0, NULL, REG_OPTION_NON_VOLATILE, &DefaultDisposition); 
       if (NT_SUCCESS(Status)) { 
        if (StrCmpNW(KeyString.Buffer + uString.Length, KeyString.Buffer, lstrlenW(KeyToCreate) == 0)) 
         return TRUE; 
        else continue; 
       } else break; 
      } else break; 
      BaseKeyHandle = CurrentHiveEntry; 
     } 
    } while (TRUE); 
} 
NtClose(BaseKeyHandle); 
return FALSE; 
}

问题

每当代码获取的这部分功能

Status = NtOpenKey(&CurrentHiveEntry, KEY_CREATE_SUB_KEY, &KeyAttributes); 
     if (RtlNtStatusToDosError(Status) == ERROR_BAD_PATHNAME) {

的返回值始终是ERROR_BAD_PATHNAME (161)即使当前子键已经存在。

问题

的原因是什么，以及我究竟做错了什么？有没有我做过的不正确的，我该如何解决？

来源

2017-09-14 mike chang

在点失败，'CurrentSubKey'的价值是什么？此外，您检查的唯一错误是“ERROR_BAD_PATHNAME”，如果前一个循环失败并出现任何其他错误代码，则“BaseKeyHandle”将不会指向您所期望的位置。（哦，你正在泄漏句柄。） –

@HarryJohnston'\\ Software' - 那么我能做些什么来调试错误 –

为什么你需要这个NT API？ – Anders

NTSTATUS CreateKey(PHANDLE KeyHandle, ACCESS_MASK DesiredAccess, PWCHAR RegSidPath, PWCHAR KeyToCreate, PULONG Disposition) 
{ 
    UNICODE_STRING ObjectName; 
    RtlInitUnicodeString(&ObjectName, RegSidPath); 

    OBJECT_ATTRIBUTES oa = { sizeof(oa), 0, &ObjectName ,OBJ_CASE_INSENSITIVE }; 

    NTSTATUS status = ZwOpenKey(&oa.RootDirectory, KEY_CREATE_SUB_KEY, &oa); 

    if (0 <= status) 
    { 
     ObjectName.Buffer = KeyToCreate; 

     do 
     { 
      ACCESS_MASK Access; 

      if (KeyToCreate = wcschr(++ObjectName.Buffer, '\\')) 
      { 
       ObjectName.Length = (USHORT)RtlPointerToOffset(ObjectName.Buffer, KeyToCreate); 
       Access = KEY_CREATE_SUB_KEY; 
      } 
      else 
      { 
       ObjectName.Length = (USHORT)wcslen(ObjectName.Buffer) * sizeof(WCHAR); 
       Access = DesiredAccess; 
      } 

      ObjectName.MaximumLength = ObjectName.Length; 

      status = ZwCreateKey(KeyHandle, Access, &oa, 0, 0, 0, Disposition); 

      NtClose(oa.RootDirectory); 

      oa.RootDirectory = *KeyHandle; 

     } while (0 <= status && (ObjectName.Buffer = KeyToCreate)); 
    } 

    return status; 
}

和使用作为

HANDLE hKey; 
    NTSTATUS status = CreateKey(&hKey, KEY_ALL_ACCESS, 
    L"\\REGISTRY\\USER\\S-***", 
    L"\\Software\\MyCompany\\MySoftware\\MySubKey", 0);

来源

2017-09-15 00:53:24 RbMm

除非你正在编写一个驱动程序，使用RegCreateKeyEx()代替。如果它们不存在，它将处理为您创建中间密钥的所有逻辑。 1个函数调用，不需要循环。

HKEY hKey; 
DWORD dwDisposition; 
LONG lRet = RegCreateKeyExW(HKEY_USERS, L"S-1-5-20-xxxxxx-xxxxxx-xxxxxxxx-1050\\Software\\MyCompany\\MySoftware\\MySubKey", 0, NULL, REG_OPTION_NON_VOLATILE, samDesired, NULL, &hKey, &dwDisposition); 
if (lRet == 0) 
{ 
    ... 
    RegCloseKey(hKey); 
}

但是，要访问一个特定用户的HKEY_CURRENT_USER蜂巢，优选的解决方案是使用的RegOpenCurrentUser()或LoadUserProfile()而不是直接访问HKEY_USERS：

// impersonate the desired user first, then... 

HKEY hRootKey; 
LONG lRet = RegOpenCurrentUser(samDesired, &hRootKey); 
if (lRet == 0) 
{ 
    HKEY hKey; 
    DWORD dwDisposition; 
    lRet = RegCreateKeyExW(hRootKey, L"Software\\MyCompany\\MySoftware\\MySubKey", 0, NULL, REG_OPTION_NON_VOLATILE, samDesired, NULL, &hKey, &dwDisposition); 
    if (lRet == 0) 
    { 
     ... 
     RegCloseKey(hKey); 
    } 
    RegCloseKey(hRootKey); 
} 

// stop impersonating...

// obtain token to desired user first, then... 

PROFILEINFO profile = {0}; 
profile.dwSize = sizeof(profile); 
profile.dwFlags = PI_NOUI; 

if (LoadUserProfile(hToken, &profile)) 
{ 
    HKEY hKey; 
    DWORD dwDisposition; 
    LONG lRet = RegCreateKeyExW((HKEY)profile.hProfile, L"Software\\MyCompany\\MySoftware\\MySubKey", 0, NULL, REG_OPTION_NON_VOLATILE, samDesired, NULL, &hKey, &dwDisposition); 
    if (lRet == 0) 
    { 
     ... 
     RegCloseKey(hKey); 
    } 
    UnloadUserProfile(hToken, profile.hProfile); 
} 

// release token ...

来源

2017-09-15 15:19:01

我知道如何使用Advapi32，谢谢，但我正在寻找NTAPI电话。后者在其他地方都有很好的记录。 –

获得手柄NtCreateKey以键/ NtOpenKey

回答

相关问题