MCPcopy Create free account
hub / github.com/BeneficialCode/WinArk / RegRenameKey

Function RegRenameKey

Anti-Rootkit/RegManager.cpp:31–53  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

29}
30
31void RegRenameKey(LPWSTR OldKeyName, LPWSTR NewKeyName) {
32 OBJECT_ATTRIBUTES objectAttributes;
33 HANDLE hRegister;
34 NTSTATUS status;
35 UNICODE_STRING usOldKeyName, usNewKeyName;
36 RtlInitUnicodeString(&usOldKeyName, OldKeyName);
37 RtlInitUnicodeString(&usNewKeyName, NewKeyName);
38 InitializeObjectAttributes(&objectAttributes,
39 &usOldKeyName,
40 OBJ_CASE_INSENSITIVE,
41 NULL,
42 NULL);
43 status = ZwOpenKey(&hRegister, KEY_ALL_ACCESS, &objectAttributes);
44 if (NT_SUCCESS(status)) {
45 status = ZwRenameKey(hRegister, &usNewKeyName);
46 ZwFlushKey(hRegister);
47 ZwClose(hRegister);
48 KdPrint(("ZwRenameKey successful!\n"));
49 }
50 else {
51 KdPrint(("ZwRenameKey failed!\n"));
52 }
53}
54void RegDeleteKey(LPWSTR KeyName) {
55 OBJECT_ATTRIBUTES objectAttributes;
56 UNICODE_STRING usKeyName;

Callers 1

RenameKeyMethod · 0.85

Calls 1

RtlInitUnicodeStringFunction · 0.85

Tested by

no test coverage detected