On windows xp ,
I used the RegistryCallback machanism to intercept some access to the
registry.
NTSTATUS RegistryCallback( IN PVOID CallbackContext, IN PVOID Argument1, IN
PVOID Argument2 )
{
case RegNtPreEnumerateValueKey:
{
PREG_ENUMERATE_VALUE_KEY_INFORMATION pEnum =
(PREG_ENUMERATE_VALUE_KEY_INFORMATION)Argument2;
GetProcess( name );//get the current process name which accessing the
registry
ConvertToUpper( name, name, sizeof(name)); //convert the name to
upper letters
…//get the keyname
if ( !strcmp(name,“EXPLORER.EXE”)||(!strcmp(name,“IEXPLORE.EXE”)) )
{
RtlInitUnicodeString(&TargetRegistryName,L"aaaa");
if ( 0 ==
RtlCompareUnicodeString(&TargetRegistryName,&keyname,TRUE) )
{
return STATUS_ACCESS_DENIED;
}
RtlInitUnicodeString(&TargetRegistryName,L"bbbb");
if ( 0 ==
RtlCompareUnicodeString(&TargetRegistryName,&keyname,TRUE) )
{
return STATUS_ACCESS_DENIED;
}
}
}
}
break;
…
“aaaa” and “bbbb” are the value keyname in
HKLM\MICROSOFT\WINDOWS\CURRENTVERSION\RUN, both values are “notepad.exe”,
when I reboot the system, two notepad lunched. So it can be judged that the
interception failed. But I wrote a simple
program named “EXPLORER.EXE” to enumerate
HKLM\MICROSOFT\WINDOWS\CURRENTVERSION\RUN, I can not get both “aaaa” and
“bbbb”,
if I named the program into other names, it can get the right names and
values, it is obviously my registry callback worked well.
But why two notepad.exe lunched after system reboot?