Driver Isolation & Registry Access

NTDEV
1

What are the best practices recommendations for a file system mini-filter driver accessing the registry other than during the time that the DriverEntry() function is being called?

My best understanding, at least in the context of driver isolation, is that registry accesses performed by DriverEntry() should be restricted to the driver's service registry key, possibly even to just the "Parameters" subkey, for purposes of reading driver configuration data from the registry.

Are there HLK related ramifications associated with a driver which reads from some location under "HKEY_LOCAL_MACHINE\SOFTWARE" at various times, such as when a process create event is being handled? The driver in question is part of a larger product with various optional components, and when one of those optional components is installed, then the driver's behavior needs to be altered and it needs to consult the registry at various times provided execution is occurring at the appropriate IRQL.

My thought was to modify the '.inf' file so that installation of the driver creates a placeholder REG_SZ value under the driver's "Parameters" subkey that is flagged to not be overwritten if it exists and to not be deleted during driver uninstallation. Then, the optional user-mode component's installer could populate this REG_SZ value with the appropriate registry key path to read from. The driver, during execution of DriverEntry(), would then test for this REG_SZ value to be non-empty and would alter the driver's initialization if the value referred to a valid registry key path.

2

What value is ultimately being read from the registry? The Parameters subkey should ideally be treated as immutable.

Without knowing more, I think you want the APIs mentioned in "Shared service registry state" on this page:

Shared service state is state that is written at runtime and can be shared with other user mode components if they are sufficiently privileged. To access the location for this shared service state, use one of these functions:

IoOpenDriverRegistryKey (WDM) with a DRIVER_REGKEY_TYPE of DriverRegKeySharedPersistentState

GetSharedServiceRegistryStateKey (Win32 Services) with a SERVICE_SHARED_REGISTRY_STATE_TYPE of ServiceSharedRegistryPersistentState