ZwCreateKey returns unexpected value

NTFSD
1

I’m using CmRegisterCallback to monitor registry events, in particular RegNtPostCreateKeyEx. The ‘status’ value from REG_POST_OPERATION_INFORMATION has unexpected values. So far I’ve seen the following:

0x00000000
0x00000001
0x00000002
0x00000004
0x00000005
0x00000006

I know the first one is STATUS_SUCCESS, but what are the other values? ntstatus.h doesn’t have defines for these values.

Oh, and I’m using CmRegisterCallback for pre-Vista machines. For post-Vista I use CmRegisterCallbackEx. Thanks.

2

The Registry filtering stuff is sometimes a bit eccentric in its operation.
At first I thought that these might be FILE_SUPERCEDED (0) through
FILE_DOES_NOT_EXIST (5). But I have no reason to state that other than a
guess. That doesn’t explain the 0x00000006 though.

I think you’ll need to step through CM to find out, unless someelse out
there knows better…

I’m using CmRegisterCallback to monitor registry events, in particular
RegNtPostCreateKeyEx. The ‘status’ value from
>REG_POST_OPERATION_INFORMATION has unexpected values. So far I’ve seen
the following:

0x00000000
0x00000001
0x00000002
0x00000004
0x00000005
0x00000006

I know the first one is STATUS_SUCCESS, but what are the other values?
ntstatus.h doesn’t have defines for these values.

Oh, and I’m using CmRegisterCallback for pre-Vista machines. For
post-Vista I use CmRegisterCallbackEx. Thanks.