English 中文(简体)
隐蔽的书记官处钥匙/价值
原标题:Hidden Registry Keys/Values
  • 时间:2011-11-21 11:28:49
  •  标签:
  • c#
  • registry

After reading this post on SO I tried to write a small app I need to read and write hidden registry keys/values.
I checked Registry Manipulation using NT Native APIs and Creating "Hidden" Registry Values links.
First one gave me something to work on, but it s written in C++ while second is a Delphi project working well.
I am not able to convert first and I could try to convert second, but I d need to find some code to read keys/values too. For this reason I d like to know if there s something "ready" and tested in C#.
I ve also downloaded Proces Hacker v1.11 source code and used it to partially convert Delphi example as shown below, but hidden registry key is accessible (while in Delphi it wasn t) and there are not APIs to write values.

static void Main(string[] args)
{
    string KeyNameBuffer = @"RegistryUserS-1-5-21-3979903645-2167650815-2353538381-1001SOFTWARE";
    string NewKeyNameBuffer = "Systems Internals";
    string HiddenKeyNameBuffer = "Can t touch me";
    string HiddenValueNameBuffer = "Hidden Value";

    // Apro la chiave di registro
    IntPtr SoftwareKeyHandle = CreateKey(KeyNameBuffer, IntPtr.Zero);
    if (SoftwareKeyHandle != IntPtr.Zero)
    {
        IntPtr SysKeyHandle = CreateKey(NewKeyNameBuffer, SoftwareKeyHandle);
        if (SysKeyHandle != IntPtr.Zero)
        {        
            // This key shouldn t be accessible, but it is            
            IntPtr HiddenKeyHandle = CreateKey(HiddenKeyNameBuffer, SysKeyHandle);
            if (HiddenKeyHandle != IntPtr.Zero)
            {
                // I don t have APIs to write values
            }
        }
    }
}

static IntPtr CreateKey(string keyName, IntPtr rootKey)
{
    IntPtr res;
    KeyCreationDisposition disp;
    ObjectAttributes attributes = new ObjectAttributes(keyName,
        ObjectFlags.CaseInsensitive, 
        new NativeHandle(rootKey));
    NtStatus st = Win32.NtCreateKey(out res, KeyAccess.All, 
        ref attributes, 0, 
        IntPtr.Zero, RegOptions.NonVolatile, out disp);
    return st == NtStatus.Success ? res : IntPtr.Zero;
}

最后,从Vista on来说,如果你不再担任署长,你就无法撰写部分,例如,我使用了我的用户登记册钥匙。 如果我需要储存每件机器价值,我们是否有办法将这一部分登记在册?

问题回答

如果你在《香港人权法案》和特权中不提你的话,那么,它就没有把你重新使用过的安森朗德(Nt*)的职能交给你处理,那么,它就没有错误。





相关问题
Anyone feel like passing it forward?

I m the only developer in my company, and am getting along well as an autodidact, but I know I m missing out on the education one gets from working with and having code reviewed by more senior devs. ...

NSArray s, Primitive types and Boxing Oh My!

I m pretty new to the Objective-C world and I have a long history with .net/C# so naturally I m inclined to use my C# wits. Now here s the question: I feel really inclined to create some type of ...

C# Marshal / Pinvoke CBitmap?

I cannot figure out how to marshal a C++ CBitmap to a C# Bitmap or Image class. My import looks like this: [DllImport(@"test.dll", CharSet = CharSet.Unicode)] public static extern IntPtr ...

How to Use Ghostscript DLL to convert PDF to PDF/A

How to user GhostScript DLL to convert PDF to PDF/A. I know I kind of have to call the exported function of gsdll32.dll whose name is gsapi_init_with_args, but how do i pass the right arguments? BTW, ...

Linqy no matchy

Maybe it s something I m doing wrong. I m just learning Linq because I m bored. And so far so good. I made a little program and it basically just outputs all matches (foreach) into a label control. ...

热门标签