Click here to Skip to main content
Sign Up to vote bad
good
See more: C++registry
Problem with KEY_VALUE_BASIC_INFORMATION in CmRegisterCallback.
Hi, I want to hide in registry name of key value. I write driver, that using CmRegisterCallback. But I can't catch name of key value that I need. When I DbgPrint PKEY_VALUE_BASIC_INFORMATION->Name I get only symbols [ , u . Where is my mistake? Can anybody help me?My RegistryCallback source:
 
NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID Argument2)
{
	PDEVICE_CONTEXT pContext = (PDEVICE_CONTEXT) CallbackContext;
	REG_NOTIFY_CLASS Action  = (REG_NOTIFY_CLASS) Argument1;
    UNICODE_STRING regKeyNameValueToHide = {0}; 
   
    try
    {
	switch (Action) 
	{ 
	 
    case RegNtEnumerateValueKey:
		{
		    PREG_ENUMERATE_VALUE_KEY_INFORMATION pInfo = (PREG_ENUMERATE_VALUE_KEY_INFORMATION) Argument2;
		    //DbgPrint(pInfo->ValueName->Buffer);
		    RtlInitUnicodeString(&regKeyNameValueToHide,L"alex-56328943333");
			
			if(pInfo->KeyValueInformationClass == KeyValueBasicInformation)
			{
			   PKEY_VALUE_BASIC_INFORMATION  pKeyValueBasicInfirmation = (PKEY_VALUE_BASIC_INFORMATION) pInfo->KeyValueInformation;
			   UNICODE_STRING regKeyNameValue = {0};
			   RtlInitUnicodeString(&regKeyNameValue,pKeyValueBasicInfirmation->Name);
			    
			   if (RtlEqualUnicodeString(&regKeyNameValue, &regKeyNameValueToHide, 1))
			   {  
				   return STATUS_CALLBACK_BYPASS;
			   } 
			}
			else if(pInfo->KeyValueInformationClass == KeyValueFullInformation)
			{
			   PKEY_VALUE_FULL_INFORMATION  pKeyValueFullInfirmation = (PKEY_VALUE_FULL_INFORMATION) pInfo->KeyValueInformation;
			   UNICODE_STRING regKeyNameValue = {0};
			   RtlInitUnicodeString(&regKeyNameValue,pKeyValueFullInfirmation->Name); 
			    if (RtlEqualUnicodeString(&regKeyNameValue, &regKeyNameValueToHide, 1))
			   {    
				   return STATUS_CALLBACK_BYPASS;
			   }
			}
		   
		   break;
	    }  
	default:
		{
			 
			return STATUS_SUCCESS  
			break;
		}
		
	}
 
	}
	except (EXCEPTION_EXECUTE_HANDLER)
   {
     DbgPrint("Exception in RegistryCallback!!!");
   }
	return STATUS_SUCCESS;
}
Posted 1 Dec '12 - 5:52
bitov27630


This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

  Print Answers RSS
Your Filters
Interested
Ignored
     
0 OriginalGriff 266
1 Mohammed Hameed 183
2 Sergey Alexandrovich Kryukov 143
3 Santhosh G_ 108
4 CPallini 96
0 Sergey Alexandrovich Kryukov 8,266
1 OriginalGriff 6,306
2 CPallini 3,528
3 Rohan Leuva 2,703
4 Maciej Los 2,234


Advertise | Privacy | Mobile
Web03 | 2.6.130516.1 | Last Updated 1 Dec 2012
Copyright © CodeProject, 1999-2013
All Rights Reserved. Terms of Use
Layout: fixed | fluid