Restore filters from the registry. @return Whether or not the restoration was successful. */
| 460 | @return Whether or not the restoration was successful. |
| 461 | */ |
| 462 | BOOLEAN |
| 463 | StringFilters::RestoreFilters ( |
| 464 | VOID |
| 465 | ) |
| 466 | { |
| 467 | OBJECT_ATTRIBUTES driverRegistryAttributes; |
| 468 | NTSTATUS status; |
| 469 | HANDLE driverRegistryKey; |
| 470 | ULONG filterStorePartialSize; |
| 471 | PFILTER_STORE filterStore; |
| 472 | PKEY_VALUE_PARTIAL_INFORMATION filterStorePartial; |
| 473 | ULONG i; |
| 474 | BOOLEAN result; |
| 475 | |
| 476 | result = FALSE; |
| 477 | i = 0; |
| 478 | filterStorePartial = NULL; |
| 479 | filterStore = NULL; |
| 480 | |
| 481 | // |
| 482 | // Open the driver's registry key. |
| 483 | // |
| 484 | InitializeObjectAttributes(&driverRegistryAttributes, &this->driverRegistryPath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL); |
| 485 | status = ZwOpenKey(&driverRegistryKey, KEY_ALL_ACCESS, &driverRegistryAttributes); |
| 486 | if (NT_SUCCESS(status) == FALSE) |
| 487 | { |
| 488 | DBGPRINT("StringFilters!RestoreFilters: Failed to open driver registry key with status 0x%X.", status); |
| 489 | goto Exit; |
| 490 | } |
| 491 | |
| 492 | // |
| 493 | // Read the size of the FilterStore. |
| 494 | // |
| 495 | status = ZwQueryValueKey(driverRegistryKey, &this->filterStoreValueName, KeyValuePartialInformation, NULL, 0, &filterStorePartialSize); |
| 496 | if (status != STATUS_BUFFER_TOO_SMALL) |
| 497 | { |
| 498 | DBGPRINT("StringFilters!RestoreFilters: Failed to query filter store size with status 0x%X.", status); |
| 499 | goto Exit; |
| 500 | } |
| 501 | |
| 502 | // |
| 503 | // Allocate space for the FilterStore partial struct and query the actual value. |
| 504 | // |
| 505 | filterStorePartial = RCAST<PKEY_VALUE_PARTIAL_INFORMATION>(ExAllocatePoolWithTag(NonPagedPool, filterStorePartialSize, FILTER_INFO_TAG)); |
| 506 | status = ZwQueryValueKey(driverRegistryKey, &this->filterStoreValueName, KeyValuePartialInformation, filterStorePartial, filterStorePartialSize, &filterStorePartialSize); |
| 507 | if (NT_SUCCESS(status) == FALSE) |
| 508 | { |
| 509 | DBGPRINT("StringFilters!RestoreFilters: Failed to query filter store with status 0x%X.", status); |
| 510 | goto Exit; |
| 511 | } |
| 512 | |
| 513 | // |
| 514 | // Grab the filter store from the data member of the partial struct. |
| 515 | // |
| 516 | filterStore = RCAST<PFILTER_STORE>(filterStorePartial->Data); |
| 517 | |
| 518 | // |
| 519 | // Add the filters. |
no test coverage detected