RegNotifyClass-(Pls Don't Ignore..) on windowsXp.

NTFSD
1

Hi all,
We are developing a mini filter driver to monitor the registry keys. I am
really fed up with this CmRegisterCallBack and REG_NOTIFY_CLASS structure
types.
For RegNtPreOpenKey value, I am not getting the full path of the opened key.
Coz the structure REG_PRE_OPEN_KEY_INFORMATION directly gives the notified
key’s name but with out root object.

If I get a object for the opened or created key , I can easily get the name
of the key using ObQueryNameString as advised in this forum. But no
provision to get the object name with the value which I can get from
REG_PRE_OPEN_KEY_INFORMATION structure’s ->CompleteName.(only name says
complete name, but in real it’s blaming me)
I have searched at my best in this forum and some other articles. But no
answer for this.
Is there any one to say it’s possible or not possible ??!!

Thanks in advance.

http://www.patni.com
World-Wide Partnerships. World-Class Solutions.

This e-mail message may contain proprietary, confidential or legally
privileged information for the sole use of the person or entity to
whom this message was originally addressed. Any review, e-transmission
dissemination or other use of or taking of any action in reliance upon
this information by persons or entities other than the intended
recipient is prohibited. If you have received this e-mail in error
kindly delete this e-mail from your records. If it appears that this
mail has been forwarded to you without proper authority, please notify
us immediately at xxxxx@patni.com and delete this mail.

2

RegNotifyClass-(Pls Don’t Ignore…) on windowsXp.Hi.

CmRegisterCallBack is a good thing…but only on 2K3 and higher (RegNtPreOpenKeyEx). From my point of view, the implementation that comes with XP is unusable.

“Kathiresan M” wrote news:xxxxx@ntfsd…
Hi all,

We are developing a mini filter driver to monitor the registry keys. I am really fed up with this CmRegisterCallBack and REG_NOTIFY_CLASS structure types.

For RegNtPreOpenKey value, I am not getting the full path of the opened key. Coz the structure REG_PRE_OPEN_KEY_INFORMATION directly gives the notified key’s name but with out root object.

If I get a object for the opened or created key , I can easily get the name of the key using ObQueryNameString as advised in this forum. But no provision to get the object name with the value which I can get from REG_PRE_OPEN_KEY_INFORMATION structure’s ->CompleteName.(only name says complete name, but in real it’s blaming me)

I have searched at my best in this forum and some other articles. But no answer for this.

Is there any one to say it’s possible or not possible ??!!

Thanks in advance.

http://www.patni.com
World-Wide Partnerships. World-Class Solutions.


This e-mail message may contain proprietary, confidential or legally privileged information for the sole use of the person or entity to whom this message was originally addressed. Any review, e-transmission dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you have received this e-mail in error kindly delete this e-mail from your records. If it appears that this mail has been forwarded to you without proper authority, please notify us immediately at xxxxx@patni.com and delete this mail.

3

>>CmRegisterCallBack is a good thing…but only on 2K3 and higher
(RegNtPreOpenKeyEx). From my point of view, the implementation that comes

>with XP is unusable.

Ya… that’s true. The callback mechanism in Windows XP has very limited
features.

If you have read the documentation carefully, you will notice that the post
callback that you get in Windows XP is limited to only Create, Open and
Close key.

I don’t know what your exact requirement is, but what will you do when you
require the status of the operation ( QueryKey, SetKeyValue, etc).

For these reasons, I personally feel that Mark R.'s implementation of
Registry monitoring driver is very useful and the best solution. Do a google
on “Windows NT System Call Hooking”. I know we are not supposed to advice a
person to use “HOOKING”, but what if there is no proper solution?

Advice: Use “Windows NT System Call Hooking” for Windows XP and use the
normal, Documented Registry Callback mechanism, way of doing this in Windows
2003 and Vista.

Regards!

Ayush Gupta.

K7 Computing Pvt. Ltd.

www.k7computing.com

4

Thnx a lot for the valuable information from ayush and frank .

One more thing ayush…

My requirement for registry is like , my driver will be having conserved
registry key object names data structure. When my driver finds a match with
accessed key and the key which is there in it’s own data structure ,it has
to stop that particular action. (All things should be done during
preoperation notifications)

So will the hooking system calls be useful if I would follow hooking
procedures according to my requirements. ?

Also I ve just completed my college studies and I m not much aware about
windows kernel architecture. So pls don mind, if I ask some stupid
questions.

If u wish u can guide me how to tackle the system call hooking by referring
some more article or sites from which a fresher can improve his knowledge.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ayush Gupta
Sent: Saturday, July 28, 2007 9:08 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] RegNotifyClass-(Pls Don’t Ignore…) on windowsXp.

>CmRegisterCallBack is a good thing…but only on 2K3 and higher
(RegNtPreOpenKeyEx). From my point of view, the implementation that comes
>with XP is unusable.

Ya… that’s true. The callback mechanism in Windows XP has very limited
features.

If you have read the documentation carefully, you will notice that the post
callback that you get in Windows XP is limited to only Create, Open and
Close key.

I don’t know what your exact requirement is, but what will you do when you
require the status of the operation ( QueryKey, SetKeyValue, etc).

For these reasons, I personally feel that Mark R.'s implementation of
Registry monitoring driver is very useful and the best solution. Do a google
on “Windows NT System Call Hooking”. I know we are not supposed to advice a
person to use “HOOKING”, but what if there is no proper solution?

Advice: Use “Windows NT System Call Hooking” for Windows XP and use the
normal, Documented Registry Callback mechanism, way of doing this in Windows
2003 and Vista.

Regards!

Ayush Gupta.

K7 Computing Pvt. Ltd.

www.k7computing.com

NTDEV is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
http://www.patni.com
World-Wide Partnerships. World-Class Solutions.

This e-mail message may contain proprietary, confidential or legally
privileged information for the sole use of the person or entity to whom this
message was originally addressed. Any review, e-transmission dissemination
or other use of or taking of any action in reliance upon this information by
persons or entities other than the intended recipient is prohibited. If you
have received this e-mail in error kindly delete this e-mail from your
records. If it appears that this mail has been forwarded to you without
proper authority, please notify us immediately at xxxxx@patni.com and
delete this mail.

http://www.patni.com
World-Wide Partnerships. World-Class Solutions.

This e-mail message may contain proprietary, confidential or legally
privileged information for the sole use of the person or entity to
whom this message was originally addressed. Any review, e-transmission
dissemination or other use of or taking of any action in reliance upon
this information by persons or entities other than the intended
recipient is prohibited. If you have received this e-mail in error
kindly delete this e-mail from your records. If it appears that this
mail has been forwarded to you without proper authority, please notify
us immediately at xxxxx@patni.com and delete this mail.

5

“Ayush Gupta” wrote in message news:xxxxx@ntfsd…
>>>CmRegisterCallBack is a good thing…but only on 2K3 and higher
> (RegNtPreOpenKeyEx). From my point of view, the implementation that comes
>>>with XP is unusable.
>
> Ya… that’s true. The callback mechanism in Windows XP has very limited
> features.
>
> If you have read the documentation carefully, you will notice that the
> post
> callback that you get in Windows XP is limited to only Create, Open and
> Close key.
>
> I don’t know what your exact requirement is, but what will you do when
> you
> require the status of the operation ( QueryKey, SetKeyValue, etc).
>
> For these reasons, I personally feel that Mark R.'s implementation of
> Registry monitoring driver is very useful and the best solution. Do a
> google
> on “Windows NT System Call Hooking”. I know we are not supposed to advice
> a
> person to use “HOOKING”, but what if there is no proper solution?
>
> Advice: Use “Windows NT System Call Hooking” for Windows XP and use the
> normal, Documented Registry Callback mechanism, way of doing this in
> Windows
> 2003 and Vista.
>
This is funny since Mark used the registry calls for XP since his hooking
was shown to be unstable and dangerous! For the OP is this is a commercial
product, or if you need to support 64-bit using hooking is buying you a ton
of problems.

I agree with the other posters that the XP version of the calls stinks, in
fact in general Microsoft should be hung out to dry for the poor
functionality of the various monitoring calls (Cm, and the
PsSetXxxRegisterCallback, etc). The problem is that hooking introduces
its own set of nasties, as well as the fact that a hooking driver will be
detected as MALWARE by most security products. Then there is the fact that
on 64-bit hooking will not work, without doing system surgery which really
is nasty.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

6

>>For the OP is this is a commercial
product, or if you need to support 64-bit using hooking is buying you a ton
of problems.<<

Exactly, using Hooking for a 64 bit XP ( assuming that you will use Callback
mechanism for all other OS ) can be painful. Plus, UNSTABILITY is a key
factor that brings down the entire concept of Hooking.

>The problem is that hooking introduces
its own set of nasties, as well as the fact that a hooking driver will be
detected as MALWARE by most security products. Then there is the fact that
on 64-bit hooking will not work, without doing system surgery which really
is nasty.<<

I would like to point out that you DO NOT require HOOKING for Windows XP
x64. You can use the driver built for Windows 2003 x64 on Windows XP x64.
In fact you won’t find a build environment for Windows XP x64.
The reason being that “Windows XP x64 and Windows 2003 x64 are essentially
the same build. The build no. is same”.

So, I would advise you implement HOOKING ( if and only if you have to ) for
just Windows XP 32 bit OS. For all others, use the documented way of doing
things: Use Registry Callback mechanism.

Cheers!
Ayush Gupta
K7 Computing Pvt. Ltd.
www.k7computing.com

7

RegNotifyClass-(Pls Don’t Ignore…) on windowsXp.There are tons of hooking samples on the net. Keyword is ‘KeServiceDescriptorTable’ or SSDT. However what most of those samples do not cover is proper parameter checking. Because user mode applications which call the registry APIs will enter upon your hooked routines instead of reaching ntoskrnl, you are going to be responsible for making sure that the parameters passed from user mode are actually valid, if not they may cause a bug check as soon as you touch those invalid addresses. The majority of antispyware tools which does system call hooking does not do proper parameter checking and are thus responsible for an incredible amount of misery by causing random blue screens.

One simple way to overcome this is in your hooked function to first call the original functions in NTOSKRNL and only upon success do what you have to do. But you mention you need a pre operation call back, then you need to make sure that within your hooked function you call ProbeForRead / ProbeForWrite on your parameters within in a try/except block before touching them and return STATUS_INVALID_PARAMETER if they throw an exception.

When you are done with your hooking driver you can use my RootKit Hook Analyzer with the /hooktest parameter to un a quality test to see if you have done your parameter checking well.
http://www.resplendence.com/hookanalzyer

Note that on x64 you can not nornally use this technique because PatchGuard does not allow this but remeber the Windows XP x64 kernel is equal to Win2003 XP x64 kernel so on XP x64 you CAN use the more advanced and useful Ex functions which are not at your disposal on Windows XP x86.

/Daniel

“Kathiresan M” wrote in message news:xxxxx@ntfsd…
Thnx a lot for the valuable information from ayush and frank .

One more thing ayush…

My requirement for registry is like , my driver will be having conserved registry key object names data structure. When my driver finds a match with accessed key and the key which is there in it’s own data structure ,it has to stop that particular action. (All things should be done during preoperation notifications)

So will the hooking system calls be useful if I would follow hooking procedures according to my requirements. ?

Also I ve just completed my college studies and I m not much aware about windows kernel architecture. So pls don mind, if I ask some stupid questions.

If u wish u can guide me how to tackle the system call hooking by referring some more article or sites from which a fresher can improve his knowledge.

------------------------------------------------------------------------------

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ayush Gupta
Sent: Saturday, July 28, 2007 9:08 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] RegNotifyClass-(Pls Don’t Ignore…) on windowsXp.

>>CmRegisterCallBack is a good thing…but only on 2K3 and higher (RegNtPreOpenKeyEx). From my point of view, the implementation that comes >>with XP is unusable.

Ya… that’s true. The callback mechanism in Windows XP has very limited features.

If you have read the documentation carefully, you will notice that the post callback that you get in Windows XP is limited to only Create, Open and Close key.

I don’t know what your exact requirement is, but what will you do when you require the status of the operation ( QueryKey, SetKeyValue, etc).

For these reasons, I personally feel that Mark R.'s implementation of Registry monitoring driver is very useful and the best solution. Do a google on “Windows NT System Call Hooking”. I know we are not supposed to advice a person to use “HOOKING”, but what if there is no proper solution?

Advice: Use “Windows NT System Call Hooking” for Windows XP and use the normal, Documented Registry Callback mechanism, way of doing this in Windows 2003 and Vista.

Regards!

Ayush Gupta.

K7 Computing Pvt. Ltd.

www.k7computing.com

—
NTDEV is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
http://www.patni.com
World-Wide Partnerships. World-Class Solutions.


This e-mail message may contain proprietary, confidential or legally privileged information for the sole use of the person or entity to whom this message was originally addressed. Any review, e-transmission dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you have received this e-mail in error kindly delete this e-mail from your records. If it appears that this mail has been forwarded to you without proper authority, please notify us immediately at xxxxx@patni.com and delete this mail.


http://www.patni.com
World-Wide Partnerships. World-Class Solutions.


This e-mail message may contain proprietary, confidential or legally privileged information for the sole use of the person or entity to whom this message was originally addressed. Any review, e-transmission dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you have received this e-mail in error kindly delete this e-mail from your records. If it appears that this mail has been forwarded to you without proper authority, please notify us immediately at xxxxx@patni.com and delete this mail.

8

“Don Burn” wrote in message news:xxxxx@ntfsd…
> I agree with the other posters that the XP version of the calls stinks, in
> fact in general Microsoft should be hung out to dry for the poor
> functionality of the various monitoring calls (Cm, and the
> PsSetXxxRegisterCallback, etc). The problem is that hooking introduces
> its own set of nasties, as well as the fact that a hooking driver will be
> detected as MALWARE by most security products. Then there is the fact
> that on 64-bit hooking will not work, without doing system surgery which
> really is nasty.
>
>

Not exactly on topic but I just came across a document about new kernel
filtering APIs which describes a lot of more stuff that just does not do
what we want and is tailored to specific operating systems.

http://download.microsoft.com/download/4/4/b/44bb7147-f058-4002-9ab2-ed22870e3fe9/Kernal%20Data%20and%20Filtering%20Support%20for%20Windows%20Server%202008.doc

/Daniel

9

“Daniel Terhell” wrote in message
news:xxxxx@ntfsd…
>
> Not exactly on topic but I just came across a document about new kernel
> filtering APIs which describes a lot of more stuff that just does not do
> what we want and is tailored to specific operating systems.
>
> http://download.microsoft.com/download/4/4/b/44bb7147-f058-4002-9ab2-ed22870e3fe9/Kernal%20Data%20and%20Filtering%20Support%20for%20Windows%20Server%202008.doc
>
Daniel,

Thanks for the link, I had tried to find this a while back with no
success.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply