| 6 | #define DRIVER_TAG 'trpD' |
| 7 | |
| 8 | NTSTATUS InitMiniFilter(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) { |
| 9 | // |
| 10 | // initialize initial extensions string |
| 11 | // |
| 12 | WCHAR ext[] = L"PDF;"; |
| 13 | g_State.Extensions.Buffer = (PWSTR)ExAllocatePoolWithTag(NonPagedPool, sizeof(ext), DRIVER_TAG); |
| 14 | if (g_State.Extensions.Buffer == nullptr) |
| 15 | return STATUS_NO_MEMORY; |
| 16 | |
| 17 | memcpy(g_State.Extensions.Buffer, ext, sizeof(ext)); |
| 18 | g_State.Extensions.Length = g_State.Extensions.MaximumLength = sizeof(ext); |
| 19 | |
| 20 | NTSTATUS status; |
| 21 | RegistryKey key; |
| 22 | HANDLE hKey = nullptr; |
| 23 | do |
| 24 | { |
| 25 | |
| 26 | OBJECT_ATTRIBUTES keyAttr = RTL_CONSTANT_OBJECT_ATTRIBUTES(RegistryPath, OBJ_KERNEL_HANDLE); |
| 27 | status = ZwOpenKey(&hKey, KEY_WRITE, &keyAttr); |
| 28 | if (!NT_SUCCESS(status)) |
| 29 | break; |
| 30 | |
| 31 | UNICODE_STRING subKeyName = RTL_CONSTANT_STRING(L"Instances"); |
| 32 | key.Create(hKey, &subKeyName, RegistryAccessMask::Write); |
| 33 | if (!NT_SUCCESS(status)) |
| 34 | break; |
| 35 | |
| 36 | // |
| 37 | // set "DefaultInstance" value. Any name is fine. |
| 38 | // |
| 39 | UNICODE_STRING valueName = RTL_CONSTANT_STRING(L"DefaultInstance"); |
| 40 | WCHAR name[] = L"DelProtectDefaultInstance"; |
| 41 | status = key.SetStringValue(&valueName, name); |
| 42 | if (!NT_SUCCESS(status)) |
| 43 | break; |
| 44 | |
| 45 | // |
| 46 | // create "instance" key under "Instances" |
| 47 | // |
| 48 | UNICODE_STRING instKeyName; |
| 49 | RtlInitUnicodeString(&instKeyName, name); |
| 50 | key.Create(key.Get(), &instKeyName, RegistryAccessMask::Write); |
| 51 | if (!NT_SUCCESS(status)) |
| 52 | break; |
| 53 | |
| 54 | // |
| 55 | // write out altitude |
| 56 | // |
| 57 | WCHAR altitude[] = L"425342"; |
| 58 | UNICODE_STRING altitudeName = RTL_CONSTANT_STRING(L"Altitude"); |
| 59 | key.SetStringValue(&altitudeName, altitude); |
| 60 | if (!NT_SUCCESS(status)) |
| 61 | break; |
| 62 | |
| 63 | // |
| 64 | // write out flags |
| 65 | // |
no test coverage detected