Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

What operations cause a RegistryCallback with RegNtPreRenameKey

Don_Burn_1Don_Burn_1 Member Posts: 4,311
I am looking at a driver for a client that uses CmRegisterCallbackEx and
I need to know what kernel or user calls generate a callback with
RegNtPreRenameKey. I don't know of any kernel or user space calls to
rename a registry key. Unfortunately to do things right I need a way to
recreate this call in both kernel and user space.


Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

Comments

  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Was wondering the same thing a few years back :) Came across no docs then, but found this later on:
    http://msdn.microsoft.com/en-us/library/cc512138(v=vs.85).aspx
    http://msdn.microsoft.com/en-us/library/cc512139(v=vs.85).aspx
    They aren't public APIs, but do exist nonetheless.

    Dejan.

    Don Burn wrote:

    > I am looking at a driver for a client that uses CmRegisterCallbackEx and
    > I need to know what kernel or user calls generate a callback with
    > RegNtPreRenameKey. I don't know of any kernel or user space calls to
    > rename a registry key. Unfortunately to do things right I need a way to
    > recreate this call in both kernel and user space.
    >
    > Don Burn
    > Windows Filesystem and Driver Consulting
    > Website: http://www.windrvr.com
    > Blog: http://msmvps.com/blogs/WinDrvr
    >
    > ---
    > NTDEV is sponsored by OSR
    >
    > For our schedule of WDF, WDM, debugging and other seminars visit:
    > http://www.osr.com/seminars
    >
    > To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

    --
    Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
    http://www.alfasp.com
    File system audit, security and encryption kits.
  • Pavel_APavel_A Member Posts: 2,681
    Have you tried to rename a key in Win7 regedit?
    IIRC I've seen this callback in Win7 RC (did not return to this sort of projects since then).

    Regards,
    -- pa
  • Bill_WandelBill_Wandel Member - All Emails Posts: 228
    Don,

    NtRenameKey is the call. There is no ZwRenameKey. Regedit definitely uses it
    since Vista. I have also written a simple user app that uses the call. I am
    pretty sure that the call was added in XP.

    Bill Wandel

    -----Original Message-----
    From: xxxxx@lists.osr.com
    [mailto:xxxxx@lists.osr.com] On Behalf Of Don Burn
    Sent: Saturday, September 03, 2011 5:38 PM
    To: Windows System Software Devs Interest List
    Subject: [ntdev] What operations cause a RegistryCallback with
    RegNtPreRenameKey

    I am looking at a driver for a client that uses CmRegisterCallbackEx and I
    need to know what kernel or user calls generate a callback with
    RegNtPreRenameKey. I don't know of any kernel or user space calls to
    rename a registry key. Unfortunately to do things right I need a way to
    recreate this call in both kernel and user space.


    Don Burn
    Windows Filesystem and Driver Consulting
    Website: http://www.windrvr.com
    Blog: http://msmvps.com/blogs/WinDrvr




    ---
    NTDEV is sponsored by OSR

    For our schedule of WDF, WDM, debugging and other seminars visit:
    http://www.osr.com/seminars

    To unsubscribe, visit the List Server section of OSR Online at
    http://www.osronline.com/page.cfm?name=ListServer
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Developing Minifilters 29 July 2019 OSR Seminar Space
Writing WDF Drivers 23 Sept 2019 OSR Seminar Space
Kernel Debugging 21 Oct 2019 OSR Seminar Space
Internals & Software Drivers 18 Nov 2019 Dulles, VA