Windows内核--交互注册表Reg
2021/8/29 7:08:17
本文主要是介绍Windows内核--交互注册表Reg,对大家解决编程问题具有一定的参考价值,需要的程序猿们随着小编来一起学习吧!
void RegTest()//内核的操作Reg函数和User下的函数不一样 { RawCreateOpenRegTest(); EasyOpenRegTest(); EditReg(); QueryReg(); } void RawCreateOpenRegTest() //内核的操作Reg函数和User下的函数不一样 { //获取注册表句柄ZwCreateKey //创建或打开某注册表 UNICODE_STRING RegUnicodeString; HANDLE hRegister; //初始化UNICODE_STRING字符串 RtlInitUnicodeString(&RegUnicodeString, L"MY_REG_SOFTWARE_KEY_NAME"); OBJECT_ATTRIBUTES objectAttributes; //初始化objectAttributes InitializeObjectAttributes(&objectAttributes, &RegUnicodeString, OBJ_CASE_INSENSITIVE, NULL, NULL); ULONG ulResult; //创建或打开注册表项目,有就打开没有就创建再打开 NTSTATUS ntStatus = ZwCreateKey(&hRegister, KEY_ALL_ACCESS, &objectAttributes, 0, NULL, REG_OPTION_NON_VOLATILE, &ulResult); if (NT_SUCCESS(ntStatus)) { //判断是新创建打开,还是直接打开 if (ulResult == REG_CREATED_NEW_KEY) { KdPrint(("The Register item is created\n")); } else if (ulResult == REG_OPENED_EXISTING_KEY) { KdPrint(("The Register item has been created,and now is opened\n")); } } //创建或打开注册表项目的子项 UNICODE_STRING subRegUnicodeString; HANDLE hSubRegister; //初始化UNICODE_STRING字符串 RtlInitUnicodeString(&subRegUnicodeString, L"SubItem"); OBJECT_ATTRIBUTES subObjectAttributes; //初始化subObjectAttributes InitializeObjectAttributes(&subObjectAttributes, &subRegUnicodeString, OBJ_CASE_INSENSITIVE,//对大小写敏感 hRegister, NULL); //创建或打开注册表 ntStatus = ZwCreateKey(&hSubRegister, KEY_ALL_ACCESS, &subObjectAttributes, 0, NULL, REG_OPTION_NON_VOLATILE, &ulResult); if (NT_SUCCESS(ntStatus)) { //判断是被新创建,还是被打开 if (ulResult == REG_CREATED_NEW_KEY) { KdPrint(("The Sub Register item is Created\n")); } else if (ulResult == REG_OPENED_EXISTING_KEY) { KdPrint(("The Sub Register item has benn create,and now is opened\n")); } } //关闭注册表句柄 ZwClose(hRegister); ZwClose(hSubRegister); } void EasyOpenRegTest() { //使用ZwOpenKey函数来简化打开注册表 UNICODE_STRING RegUnicodeString; HANDLE hRegister; //初始化UNICODE_STRING字符串 RtlInitUnicodeString(&RegUnicodeString, L"MY_REG_SOFTWARE_KEY_NAME"); OBJECT_ATTRIBUTES objectAttributes; //初始化objectAttributes InitializeObjectAttributes(&objectAttributes, &RegUnicodeString, OBJ_CASE_INSENSITIVE, NULL, NULL); //打开注册表 NTSTATUS ntStatus = ZwOpenKey(&hRegister, KEY_ALL_ACCESS, &objectAttributes); //判断是否打开成功 if((NT_SUCCESS(ntStatus))) { KdPrint(("Open Register Successfully\n")); } ZwClose(hRegister); } void EditReg() { //ZwSetValueKey,注册表以二元形式存储,也就是map UNICODE_STRING RegUnicodeString; HANDLE hRegsiter; //初始化UNICODE_STRING字符串 RtlInitUnicodeString(&RegUnicodeString, L"MY_REG_SOFTWARE_KEY_NAME"); OBJECT_ATTRIBUTES objectAttributes; //初始化objectAttributes InitializeObjectAttributes(&objectAttributes, &RegUnicodeString, OBJ_CASE_INSENSITIVE, NULL, NULL); //打开注册表 NTSTATUS ntStatus = ZwOpenKey(&hRegsiter, KEY_ALL_ACCESS, &objectAttributes); if (NT_SUCCESS(ntStatus)) { KdPrint(("Open Register Successfully\n")); } UNICODE_STRING ValueName; //初始化ValueName RtlInitUnicodeString(&ValueName, L"REG_DWORD value"); //设置REG_DWORD子健 ULONG ulValue = 1000; ZwSetValueKey(hRegsiter, &ValueName, 0, REG_DWORD, &ulValue, sizeof(ulValue)); //初始化ValueName RtlInitUnicodeString(&ValueName, L"REG_SZ value"); WCHAR* strValue = L"hello world"; //设置REG_SZ子健 ZwSetValueKey(hRegsiter, &ValueName, 0, REG_SZ, strValue, wcslen(strValue) * 2 + 2); //初始化ValueName RtlInitUnicodeString(&ValueName, L"REG_BINARY value"); UCHAR buffer[10]; RtlFillMemory(buffer, sizeof(buffer), 0XFF); //设置REG_MULTI_SZ子健 ZwSetValueKey(hRegsiter, &ValueName, 0, REG_BINARY, buffer, sizeof(buffer)); //关闭注册表句柄 ZwClose(hRegsiter); }
这篇关于Windows内核--交互注册表Reg的文章就介绍到这儿,希望我们推荐的文章对大家有所帮助,也希望大家多多支持为之网!
- 2024-09-28AI给的和自己写的Python代码,都无法改变输入框的内容,替换也不行
- 2024-09-27Sentinel配置限流资料:新手入门教程
- 2024-09-27Sentinel配置限流资料详解
- 2024-09-27Sentinel限流资料:新手入门教程
- 2024-09-26Sentinel限流资料入门详解
- 2024-09-26Springboot框架资料:初学者入门教程
- 2024-09-26Springboot框架资料详解:新手入门教程
- 2024-09-26Springboot企业级开发资料:新手入门指南
- 2024-09-26SpringBoot企业级开发资料新手指南
- 2024-09-26Springboot微服务资料入门教程