Can't catch KEY_VALUE_BASIC_INFORMATION.Name in CmRegisterCallback

Posted by alex on Stack Overflow See other posts from Stack Overflow or by alex
Published on 2012-12-01T17:02:57Z Indexed on 2012/12/01 17:03 UTC
Read the original article Hit count: 408

Filed under:

I want to hide in registry name of key value. I write driver, that using CmRegisterCallback. But I can't catch name of key value that I need. When I DbgPrint PKEY_VALUE_BASIC_INFORMATION->Name I get only symbols [ , u . Where is my mistake? Can anybody help me?My RegistryCallback source:

NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID Argument2)
{
    PDEVICE_CONTEXT pContext = (PDEVICE_CONTEXT) CallbackContext;
    REG_NOTIFY_CLASS Action  = (REG_NOTIFY_CLASS) Argument1;
    UNICODE_STRING regKeyNameValueToHide = {0}; 

    try
    {
    switch (Action) 
    { 

    case RegNtEnumerateValueKey:
        {
            PREG_ENUMERATE_VALUE_KEY_INFORMATION pInfo = (PREG_ENUMERATE_VALUE_KEY_INFORMATION) Argument2;
            //DbgPrint(pInfo->ValueName->Buffer);
            RtlInitUnicodeString(&regKeyNameValueToHide,L"alex-56328943333");

            if(pInfo->KeyValueInformationClass == KeyValueBasicInformation)
            {
               PKEY_VALUE_BASIC_INFORMATION  pKeyValueBasicInfirmation = (PKEY_VALUE_BASIC_INFORMATION) pInfo->KeyValueInformation;
               UNICODE_STRING regKeyNameValue = {0};
               RtlInitUnicodeString(&regKeyNameValue,pKeyValueBasicInfirmation->Name);

               if (RtlEqualUnicodeString(&regKeyNameValue, &regKeyNameValueToHide, 1))
               {  
                   return STATUS_CALLBACK_BYPASS;
               } 
            }
            else if(pInfo->KeyValueInformationClass == KeyValueFullInformation)
            {
               PKEY_VALUE_FULL_INFORMATION  pKeyValueFullInfirmation = (PKEY_VALUE_FULL_INFORMATION) pInfo->KeyValueInformation;
               UNICODE_STRING regKeyNameValue = {0};
               RtlInitUnicodeString(&regKeyNameValue,pKeyValueFullInfirmation->Name); 
                if (RtlEqualUnicodeString(&regKeyNameValue, &regKeyNameValueToHide, 1))
               {    
                   return STATUS_CALLBACK_BYPASS;
               }
            }

           break;
        }  
    default:
        {

            return STATUS_SUCCESS  
            break;
        }

    }

    }
    except (EXCEPTION_EXECUTE_HANDLER)
   {
     DbgPrint("Exception in RegistryCallback!!!");
   }
    return STATUS_SUCCESS;
}

© Stack Overflow or respective owner

Related posts about c++