Hi all,
I am writing an application which makes a protected system.
The need of the application is that, once the system is restarted all the
applications uninstalled in the protected session should not get
uninstalled, and pop up in the second session.
I want to know, how should I handle registry. I am protecting all files all
files from deletion in the current session, and hiding them using
IRP_MJ_DIRECTORY_CONTROL. But I am not knowing how to handle registries at
kernel level. I want to hook registry in such a way that the entries deleted
should come in next session.
Thanks.
Lalit.