I would have reckoned the key object in PreCloseHandle registry callback
would be usable… only it isn’t?
Even ObRefObject (inc ref api) causes a bugcheck.
So I’d need to keep an extra reference since Open but would that not cause
PreClise to not get called?
D.
According to https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/invalid-key-object-pointers-in-registry-notifications key object is invalid already for RegNtPreKeyHandleClose.
Maybe it’s possible to query the information you need earlier and retain it for later use ?
Funny, I was Googling for something like that, but it brought no results.
Thanks, when I have a clear “No” it feels much easier.
Referencing the object will not work then probably, so I will obtain a new
handle and keep it as a tag to the Object.
Kind regards, Dejan Maksimovic.
FS Lead: http://www.alfasp.com