CmRegisterCallback question

NTDEV
1

Hello!

Got question regarding CmRegisterCallback and RegNtPreCreateKey/RegNtPreCreateKeyEx.

After calling CmRegisterCallback/CmRegisterCallbackEx CallbackRoutine is called each time registry is ‘touched’.
Now, assuming that we’re on vista+ os: is RegNtPreCreateKeyEx called even if user used CreateKey (not *Ex version) or it will work only on Ex version.
If it will work only on ex version then is it possible to modify arguments via RegNtPreCreate (without ex) - since doc says that REG_PRE_CREATE_KEY_INFORMATION struct has only one member so there is no field to be updated after modification.

Next question is regarding Xp system - I understand that RegNtPreCreateKeyEx won’t be called in this os - correct?
Is it possible to somehow modify parameters in pre create callback or should I do it in different way, if so then how?

sorry for bunch of questions and thank you for everyone!

2

Yes, RegNtPreCreateKeyEx is called for all types of Create’s including
both the Ex versions and the transacted versions.

If you really need to muck with the parameters on XP, you may have to
hook with all the problems that represents.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“xxxxx@gmail.com” wrote in message
news:xxxxx@ntdev:

> Hello!
>
> Got question regarding CmRegisterCallback and RegNtPreCreateKey/RegNtPreCreateKeyEx.
>
> After calling CmRegisterCallback/CmRegisterCallbackEx CallbackRoutine is called each time registry is ‘touched’.
> Now, assuming that we’re on vista+ os: is RegNtPreCreateKeyEx called even if user used CreateKey (not *Ex version) or it will work only on Ex version.
> If it will work only on ex version then is it possible to modify arguments via RegNtPreCreate (without ex) - since doc says that REG_PRE_CREATE_KEY_INFORMATION struct has only one member so there is no field to be updated after modification.
>
> Next question is regarding Xp system - I understand that RegNtPreCreateKeyEx won’t be called in this os - correct?
> Is it possible to somehow modify parameters in pre create callback or should I do it in different way, if so then how?
>
> sorry for bunch of questions and thank you for everyone!

3

The WDK documentation states that RegNtPreCreateKey is only called for XP
while RegNtPreCreateKeyEx is called starting with W2K3. Do you think that
the documentation is incorrect?

Bill Wandel

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Wednesday, December 28, 2011 4:43 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] CmRegisterCallback question

Hello!

Got question regarding CmRegisterCallback and
RegNtPreCreateKey/RegNtPreCreateKeyEx.

After calling CmRegisterCallback/CmRegisterCallbackEx CallbackRoutine is
called each time registry is ‘touched’.
Now, assuming that we’re on vista+ os: is RegNtPreCreateKeyEx called even if
user used CreateKey (not *Ex version) or it will work only on Ex version.
If it will work only on ex version then is it possible to modify arguments
via RegNtPreCreate (without ex) - since doc says that
REG_PRE_CREATE_KEY_INFORMATION struct has only one member so there is no
field to be updated after modification.

Next question is regarding Xp system - I understand that RegNtPreCreateKeyEx
won’t be called in this os - correct?
Is it possible to somehow modify parameters in pre create callback or should
I do it in different way, if so then how?

sorry for bunch of questions and thank you for everyone!

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

Don,

Thank you for your quick response!
Well I was wondering how to ommit hooks, but if guy so experienced like You says that this ‘is’ solution I assume that probably there is no way to ommit this.
The problem seems to be with Windows Xp x64 since because of KPP is introduced and even if problem is not in KPP indeed, it is disallowed solution by microsoft, so any hooks on x64 will be ended up with UNTRUSTED pop up.
Any ideas how to achieve it on x64 xp?

5

Unfortunately no. I have a client who ignores 64-bit before Win7 just
because of the problems of earlier versions.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“xxxxx@gmail.com” wrote in message
news:xxxxx@ntdev:

> Don,
>
> Thank you for your quick response!
> Well I was wondering how to ommit hooks, but if guy so experienced like You says that this ‘is’ solution I assume that probably there is no way to ommit this.
> The problem seems to be with Windows Xp x64 since because of KPP is introduced and even if problem is not in KPP indeed, it is disallowed solution by microsoft, so any hooks on x64 will be ended up with UNTRUSTED pop up.
> Any ideas how to achieve it on x64 xp?

6

One more question to this topic.

Assuming we’ve got Callback on registrys.
Is is possible to determine in context of which thread/process my callback is working?
Can I safely assume that callback works in context of thread that requested registry operation (and then call PsGetCurrentProcess())?
If not then is it possible (if so then how) to determine procId/threadId of process/thread that requested reguistry operation?

Thank you very much,

7

Ops.
Sorry seems that I haven’t noticed doc

"RegistryCallback executes at IRQL = PASSIVE_LEVEL and in the context of the thread that is performing the registry operation. "