How to probe Registry from krnl

NTDEV
1

I’m trying to protect some registry path from being victim of descrutive
operation ( so, no del, no add, no rename etc)…

I can essentially block all of the above on a global basis, but the hard
point is that when the requests comes to the krnl, there is no easy way to
makesure that the registry path it is trying to access is indeed \a\b\c\d.

Since registry is a hive, it seems like there is no fileobject associated
with it !!!

So if there is a way to find the fullpath (in the usr lvl registry sense) or
construct, that would help.

Any help!

-prokash

2

Never mind. an example was hanging out right on my face, to follow…

thanx
-prokash

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Prokash Sinha
Sent: Friday, May 30, 2003 1:43 PM
To: NT Developers Interest List
Subject: [ntdev] How to probe Registry from krnl

I’m trying to protect some registry path from being victim of descrutive
operation ( so, no del, no add, no rename etc)…

I can essentially block all of the above on a global basis, but the hard
point is that when the requests comes to the krnl, there is no easy way to
makesure that the registry path it is trying to access is indeed \a\b\c\d.

Since registry is a hive, it seems like there is no fileobject associated
with it !!!

So if there is a way to find the fullpath (in the usr lvl registry sense) or
construct, that would help.

Any help!

-prokash

You are currently subscribed to ntdev as: xxxxx@vormetric.com
To unsubscribe send a blank email to xxxxx@lists.osr.com