自己调用NTDLL函数
一、概述
在DLL初始化的时候有时不能调用其它系统DLL的函数，以免导致问题，但有时候又必须要调用怎么办？一种办法就是自己直接调用NTDLL接口，这样肯定没有问题。
下面我写个自己调用Registry的封装类，用来代替原本系统注册表API。
二、申明NTDLL导出函数
在自己工程中需要调用NTDLL导出函数，可以通GetProcessAddr来获取函数地址再调用，也可以通过导入库的方式（这种需要ntdll.lib文件，在DDK中有），我这里采用第二种方式。
函数和类型声明：
NTDllDecl.h
#pragma once #include <windows.h> #include <winternl.h> namespace NT { extern "C" { // macro definition #ifndef NTSTATUS #define NTSTATUS LONG #endif #ifndef NTAPI #define NTAPI __stdcall #endif #ifndef NTSYSAPI #define NTSYSAPI __declspec(dllimport) #endif #ifndef STATUS_BUFFER_OVERFLOW #define STATUS_BUFFER_OVERFLOW ((NTSTATUS)0x80000005L) #endif typedef enum _KEY_INFORMATION_CLASS { KeyBasicInformation, KeyNodeInformation, KeyFullInformation, KeyNameInformation, KeyCachedInformation, KeyFlagsInformation, KeyVirtualizationInformation, KeyHandleTagsInformation, MaxKeyInfoClass // MaxKeyInfoClass should always be the last enum } KEY_INFORMATION_CLASS; typedef enum _KEY_VALUE_INFORMATION_CLASS { KeyValueBasicInformation, KeyValueFullInformation, KeyValuePartialInformation, KeyValueFullInformationAlign64, KeyValuePartialInformationAlign64, MaxKeyValueInfoClass // MaxKeyValueInfoClass should always be the last enum } KEY_VALUE_INFORMATION_CLASS; typedef struct _KEY_BASIC_INFORMATION { LARGE_INTEGER LastWriteTime; ULONG TitleIndex; ULONG NameLength; WCHAR Name[1]; // Variable length string } KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION; typedef struct _KEY_NODE_INFORMATION { LARGE_INTEGER LastWriteTime; ULONG TitleIndex; ULONG ClassOffset; ULONG ClassLength; ULONG NameLength; WCHAR Name[1]; // Variable length string // Class[1]; // Variable length string not declared } KEY_NODE_INFORMATION, *PKEY_NODE_INFORMATION; typedef struct _KEY_FULL_INFORMATION { LARGE_INTEGER LastWriteTime; ULONG TitleIndex; ULONG ClassOffset; ULONG ClassLength; ULONG SubKeys; ULONG MaxNameLen; ULONG MaxClassLen; ULONG Values; ULONG MaxValueNameLen; ULONG MaxValueDataLen; WCHAR Class[1]; // Variable length } KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION; typedef struct _KEY_VALUE_BASIC_INFORMATION { ULONG TitleIndex; ULONG Type; ULONG NameLength; WCHAR Name[1]; // Variable size } KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION; typedef struct _KEY_VALUE_PARTIAL_INFORMATION { ULONG TitleIndex; ULONG Type; ULONG DataLength; UCHAR Data[1]; // Variable size } KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION; // Registry NTSYSAPI NTSTATUS NTAPI ZwCreateKey( OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG TitleIndex, IN PUNICODE_STRING Class, IN ULONG CreateOptions, OUT PULONG Disposition ); NTSYSAPI NTSTATUS NTAPI ZwOpenKey( OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSYSAPI NTSTATUS NTAPI ZwQueryKey( IN HANDLE KeyHandle, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT PVOID KeyInformation, IN ULONG KeyInformationLength, OUT PULONG ResultLength ); NTSYSAPI NTSTATUS NTAPI ZwSetValueKey( IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN ULONG TitleIndex, IN ULONG Type, IN PVOID Data, IN ULONG DataSize ); NTSYSAPI NTSTATUS NTAPI ZwQueryValueKey( IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, OUT PVOID KeyValueInformation, IN ULONG KeyValueInformationLength, OUT PULONG ResultLength ); NTSYSAPI NTSTATUS NTAPI ZwEnumerateKey( IN HANDLE KeyHandle, IN ULONG Index, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT PVOID KeyInformation, IN ULONG KeyInformationLength, OUT PULONG ResultLength ); NTSYSAPI NTSTATUS NTAPI ZwClose( IN HANDLE Handle ); NTSYSAPI NTSTATUS NTAPI RtlFormatCurrentUserKeyPath( OUT PUNICODE_STRING RegistryPath ); } };
三、封装自己注册表函数
自己定义一个类用来封装注册表函数，我这里只封装了几个需要用的注册表函数（参考ReatOS和Windows代码），其余的可以后续再添加。
注册封装类声明：
NTRegistry.h
//******************************************************************** // 文件名: NTRegistry.h // 文件描述: Ntdll导出注册表函数定义头文件 // 作者: // 版本: 1.0 // // 修改历史: // 备注: //********************************************************************* #pragma once #ifndef STATIC #define STATIC static #endif #ifndef NTSTATUS #define NTSTATUS LONG #endif class NTRegistry { public: STATIC LONG RegCreateKey( HKEY hKey, LPCWSTR lpSubKey, DWORD Reserved, LPWSTR lpClass, DWORD dwOptions, REGSAM samDesired, LPSECURITY_ATTRIBUTES lpSecurityAttributes, PHKEY phkResult, LPDWORD lpdwDisposition); STATIC LONG RegOpenKey( HKEY hKey, LPCWSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY phkResult); STATIC LONG RegQueryInfoKey( HKEY hKey, LPWSTR lpClass, LPDWORD lpcbClass, LPDWORD lpReserved, LPDWORD lpcSubKeys, LPDWORD lpcbMaxSubKeyLen, LPDWORD lpcbMaxClassLen, LPDWORD lpcValues, LPDWORD lpcbMaxValueNameLen, LPDWORD lpcbMaxValueLen, LPDWORD lpcbSecurityDescriptor, PFILETIME lpftLastWriteTime ); STATIC LONG RegSetValue( HKEY hKey, LPCWSTR lpValueName, DWORD Reserved, DWORD dwType, CONST BYTE* lpData, DWORD cbData); STATIC LONG RegQueryValue( HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData ); STATIC LONG RegEnumKey( HKEY hKey, DWORD dwIndex, LPWSTR lpName, LPDWORD lpcbName, LPDWORD lpReserved, LPWSTR lpClass, LPDWORD lpcbClass, PFILETIME lpftLastWriteTime); STATIC LONG RegCloseKey(HKEY hKey); private: STATIC NTSTATUS OpenCurrentUser( IN ACCESS_MASK DesiredAccess, OUT PHANDLE KeyHandle); STATIC NTSTATUS OpenLocalMachineKey( OUT PHANDLE KeyHandle); STATIC NTSTATUS OpenCurrentConfigKey (PHANDLE KeyHandle); STATIC NTSTATUS OpenUsersKey(PHANDLE KeyHandle); STATIC NTSTATUS OpenClassesRootKey(PHANDLE KeyHandle); STATIC NTSTATUS MapDefaultKey( OUT PHANDLE RealKey, IN HKEY Key); };
注册封装类定义：
NTRegistry.cpp
#include "StdAfx.h" #include "NTRegistry.h" #include "NTDllDecl.h" #define ARGUMENT_PRESENT( arg ) \ ((( PVOID ) arg ) != (( PVOID ) NULL )) #define DEFAULT_KEY_NAME_SIZE 128 #define DEFAULT_CLASS_SIZE 128 #define DEFAULT_VALUE_SIZE 128 #define REG_MAX_NAME_SIZE 256 #define REG_MAX_DATA_SIZE 2048 #ifndef STATUS_SUCCESS #define STATUS_SUCCESS ((NTSTATUS)0x00000000L) #endif #define RTL_CONSTANT_STRING(__SOURCE_STRING__) \ { \ sizeof(__SOURCE_STRING__) - sizeof((__SOURCE_STRING__)[0]), \ sizeof(__SOURCE_STRING__), \ (__SOURCE_STRING__) \ } #define IsPredefKey(HKey) \ (((ULONG_PTR)(HKey) & 0xF0000000) == 0x80000000) #define ClosePredefKey(Handle) \ if ((ULONG_PTR)Handle & 0x1) { \ NT::ZwClose(Handle); \ } NTSTATUS NTRegistry::OpenCurrentUser( IN ACCESS_MASK DesiredAccess, OUT PHANDLE KeyHandle) { OBJECT_ATTRIBUTES ObjectAttributes; UNICODE_STRING KeyPath; NTSTATUS Status; /* Get the user key */ Status = NT::RtlFormatCurrentUserKeyPath(&KeyPath); if (NT_SUCCESS(Status)) { /* Initialize the attributes and open it */ InitializeObjectAttributes(&ObjectAttributes, &KeyPath, OBJ_CASE_INSENSITIVE, NULL, NULL); Status = NT::ZwOpenKey(KeyHandle, DesiredAccess, &ObjectAttributes); /* Free the path and return success if it worked */ RtlFreeUnicodeString(&KeyPath); } return Status; } NTSTATUS NTRegistry::OpenLocalMachineKey( OUT PHANDLE KeyHandle) { OBJECT_ATTRIBUTES Attributes; UNICODE_STRING KeyName = RTL_CONSTANT_STRING(L"\\Registry\\Machine"); NTSTATUS Status; InitializeObjectAttributes( &Attributes, &KeyName, OBJ_CASE_INSENSITIVE, NULL, NULL); Status = NT::ZwOpenKey(KeyHandle, MAXIMUM_ALLOWED, &Attributes); return Status; } NTSTATUS NTRegistry::OpenClassesRootKey(PHANDLE KeyHandle) { OBJECT_ATTRIBUTES Attributes; UNICODE_STRING KeyName = RTL_CONSTANT_STRING(L"\\Registry\\Machine\\Software\\CLASSES"); InitializeObjectAttributes( &Attributes, &KeyName, OBJ_CASE_INSENSITIVE, NULL, NULL); return NT::ZwOpenKey(KeyHandle, MAXIMUM_ALLOWED, &Attributes); } NTSTATUS NTRegistry::OpenUsersKey(PHANDLE KeyHandle) { OBJECT_ATTRIBUTES Attributes; UNICODE_STRING KeyName = RTL_CONSTANT_STRING(L"\\Registry\\User"); InitializeObjectAttributes(&Attributes, &KeyName, OBJ_CASE_INSENSITIVE, NULL, NULL); return NT::ZwOpenKey(KeyHandle, MAXIMUM_ALLOWED, &Attributes); } NTSTATUS NTRegistry::OpenCurrentConfigKey (PHANDLE KeyHandle) { OBJECT_ATTRIBUTES Attributes; UNICODE_STRING KeyName = RTL_CONSTANT_STRING(L"\\Registry\\Machine\\System\\CurrentControlSet\\Hardware Profiles\\Current"); InitializeObjectAttributes(&Attributes, &KeyName, OBJ_CASE_INSENSITIVE, NULL, NULL); return NT::ZwOpenKey(KeyHandle, MAXIMUM_ALLOWED, &Attributes); } NTSTATUS NTRegistry::MapDefaultKey( OUT PHANDLE RealKey, IN HKEY Key) { NTSTATUS Status; if (!IsPredefKey(Key)) { *RealKey = (HANDLE)((ULONG_PTR)Key & ~0x1); return STATUS_SUCCESS; } switch ((LONG)Key) { case HKEY_CURRENT_USER: { Status = OpenCurrentUser(MAXIMUM_ALLOWED, RealKey); } break; case HKEY_LOCAL_MACHINE: { Status = OpenLocalMachineKey(RealKey); } break; case HKEY_CLASSES_ROOT: { Status = OpenClassesRootKey(RealKey); } break; case HKEY_USERS: { Status = OpenUsersKey(RealKey); } break; case HKEY_CURRENT_CONFIG: { Status = OpenCurrentConfigKey(RealKey); } break; default: Status = STATUS_INVALID_PARAMETER; break; } return Status; } LONG NTRegistry::RegCreateKey( HKEY hKey, LPCWSTR lpSubKey, DWORD Reserved, LPWSTR lpClass, DWORD dwOptions, REGSAM samDesired, LPSECURITY_ATTRIBUTES lpSecurityAttributes, PHKEY phkResult, LPDWORD lpdwDisposition) { UNICODE_STRING SubKeyString; UNICODE_STRING ClassString; OBJECT_ATTRIBUTES ObjectAttributes; HANDLE ParentKey = NULL; NTSTATUS Status; if (lpSecurityAttributes && lpSecurityAttributes->nLength != sizeof(SECURITY_ATTRIBUTES)) { return ERROR_INVALID_USER_BUFFER; } /* get the real parent key */ Status = MapDefaultKey(&ParentKey, hKey); if (!NT_SUCCESS(Status)) { return RtlNtStatusToDosError(Status); } if (!phkResult) { return ERROR_INVALID_PARAMETER; } RtlInitUnicodeString(&ClassString, lpClass); RtlInitUnicodeString(&SubKeyString, lpSubKey); InitializeObjectAttributes( &ObjectAttributes, &SubKeyString, OBJ_CASE_INSENSITIVE, (HANDLE)ParentKey, lpSecurityAttributes ? (PSECURITY_DESCRIPTOR)lpSecurityAttributes->lpSecurityDescriptor : NULL); Status = NT::ZwCreateKey( (PHANDLE)phkResult, samDesired, &ObjectAttributes, 0, (lpClass == NULL) ? NULL : &ClassString, /* optional*/ dwOptions, lpdwDisposition ); ClosePredefKey(ParentKey); return RtlNtStatusToDosError( Status ); } LONG NTRegistry::RegOpenKey( HKEY hKey, LPCWSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY phkResult) { OBJECT_ATTRIBUTES ObjectAttributes; UNICODE_STRING SubKeyString; HANDLE KeyHandle; NTSTATUS Status; if (!phkResult) { return ERROR_INVALID_PARAMETER; } Status = MapDefaultKey(&KeyHandle, hKey); if (!NT_SUCCESS(Status)) { return RtlNtStatusToDosError(Status); } if (lpSubKey != NULL) RtlInitUnicodeString(&SubKeyString, (LPWSTR)lpSubKey); else RtlInitUnicodeString(&SubKeyString, (LPWSTR)L""); InitializeObjectAttributes( &ObjectAttributes, &SubKeyString, OBJ_CASE_INSENSITIVE, KeyHandle, NULL ); Status = NT::ZwOpenKey( (PHANDLE)phkResult, samDesired, &ObjectAttributes ); ClosePredefKey(KeyHandle); return RtlNtStatusToDosError( Status ); } LONG NTRegistry::RegQueryInfoKey( HKEY hKey, LPWSTR lpClass, LPDWORD lpcbClass, LPDWORD lpReserved, LPDWORD lpcSubKeys, LPDWORD lpcbMaxSubKeyLen, LPDWORD lpcbMaxClassLen, LPDWORD lpcValues, LPDWORD lpcbMaxValueNameLen, LPDWORD lpcbMaxValueLen, LPDWORD lpcbSecurityDescriptor, PFILETIME lpftLastWriteTime ) { NT::KEY_FULL_INFORMATION FullInfoBuffer; NT::PKEY_FULL_INFORMATION FullInfo; ULONG FullInfoSize; ULONG ClassLength = 0; HANDLE KeyHandle; NTSTATUS Status; ULONG Length; LONG ErrorCode = ERROR_SUCCESS; if ((lpClass) && (!lpcbClass)) { return ERROR_INVALID_PARAMETER; } Status = MapDefaultKey(&KeyHandle, hKey); if (!NT_SUCCESS(Status)) { return RtlNtStatusToDosError(Status); } if (lpClass != NULL) { if (*lpcbClass > 0) { ClassLength = min(*lpcbClass - 1, REG_MAX_NAME_SIZE) * sizeof(WCHAR); } else { ClassLength = 0; } FullInfoSize = sizeof(NT::KEY_FULL_INFORMATION) + ((ClassLength + 3) & ~3); FullInfo = (NT::PKEY_FULL_INFORMATION)HeapAlloc(GetProcessHeap(), 0, FullInfoSize); if (FullInfo == NULL) { ErrorCode = ERROR_OUTOFMEMORY; goto Cleanup; } FullInfo->ClassLength = ClassLength; } else { FullInfoSize = sizeof(NT::KEY_FULL_INFORMATION); FullInfo = &FullInfoBuffer; FullInfo->ClassLength = 0; } FullInfo->ClassOffset = FIELD_OFFSET(NT::KEY_FULL_INFORMATION, Class); Status = NT::ZwQueryKey(KeyHandle, NT::KeyFullInformation, FullInfo, FullInfoSize, &Length); if (!NT_SUCCESS(Status)) { if (lpClass != NULL) { HeapFree(GetProcessHeap(), 0, FullInfo); } ErrorCode = RtlNtStatusToDosError(Status); goto Cleanup; } if (lpcSubKeys != NULL) { *lpcSubKeys = FullInfo->SubKeys; } if (lpcbMaxSubKeyLen != NULL) { *lpcbMaxSubKeyLen = FullInfo->MaxNameLen / sizeof(WCHAR) + 1; } if (lpcbMaxClassLen != NULL) { *lpcbMaxClassLen = FullInfo->MaxClassLen / sizeof(WCHAR) + 1; } if (lpcValues != NULL) { *lpcValues = FullInfo->Values; } if (lpcbMaxValueNameLen != NULL) { *lpcbMaxValueNameLen = FullInfo->MaxValueNameLen / sizeof(WCHAR) + 1; } if (lpcbMaxValueLen != NULL) { *lpcbMaxValueLen = FullInfo->MaxValueDataLen; } if (lpftLastWriteTime != NULL) { lpftLastWriteTime->dwLowDateTime = FullInfo->LastWriteTime.u.LowPart; lpftLastWriteTime->dwHighDateTime = FullInfo->LastWriteTime.u.HighPart; } if (lpClass != NULL) { if (FullInfo->ClassLength > ClassLength) { ErrorCode = ERROR_BUFFER_OVERFLOW; } else { RtlCopyMemory(lpClass, FullInfo->Class, FullInfo->ClassLength); *lpcbClass = FullInfo->ClassLength / sizeof(WCHAR); lpClass[*lpcbClass] = 0; } HeapFree(GetProcessHeap(), 0, FullInfo); } Cleanup: ClosePredefKey(KeyHandle); return ErrorCode; } LONG NTRegistry::RegSetValue( HKEY hKey, LPCWSTR lpValueName, DWORD Reserved, DWORD dwType, CONST BYTE* lpData, DWORD cbData) { UNICODE_STRING ValueName; PUNICODE_STRING pValueName; HANDLE KeyHandle; NTSTATUS Status; Status = MapDefaultKey(&KeyHandle, hKey); if (!NT_SUCCESS(Status)) { return RtlNtStatusToDosError(Status); } RtlInitUnicodeString(&ValueName, lpValueName); pValueName = &ValueName; if ((dwType == REG_SZ) || (dwType == REG_EXPAND_SZ) || (dwType == REG_MULTI_SZ) && (cbData != 0)) { PWSTR pwsData = (PWSTR)lpData; if((pwsData[cbData / sizeof(WCHAR) - 1] != L'\0') && (pwsData[cbData / sizeof(WCHAR)] == L'\0')) { /* Increment length if last character is not zero and next is zero */ cbData += sizeof(WCHAR); } } Status = NT::ZwSetValueKey( hKey, &ValueName, 0, dwType, (PVOID)lpData, cbData); ClosePredefKey(KeyHandle); return RtlNtStatusToDosError( Status ); } LONG NTRegistry::RegQueryValue( HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData ) { NTSTATUS Status; UNICODE_STRING ValueName; ULONG BufferLength; NT::KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass; PVOID KeyValueInformation; ULONG ResultLength; HANDLE KeyHandle; BYTE PrivateKeyValueInformation[ sizeof( NT::KEY_VALUE_PARTIAL_INFORMATION ) + DEFAULT_VALUE_SIZE ]; // // Validate dependency between lpData and lpcbData parameters. // if( ARGUMENT_PRESENT( lpReserved ) || (ARGUMENT_PRESENT( lpData ) && ( ! ARGUMENT_PRESENT( lpcbData )))) { return ERROR_INVALID_PARAMETER; } Status = MapDefaultKey(&KeyHandle, hKey); if (!NT_SUCCESS(Status)) { return RtlNtStatusToDosError(Status); } // // Convert the value name to a counted Unicode string. // RtlInitUnicodeString( &ValueName, lpValueName ); // // First we assume that the information we want will fit on // PrivateKeyValueInformattion // KeyValueInformationClass = ( ARGUMENT_PRESENT( lpcbData ))? NT::KeyValuePartialInformation : NT::KeyValueBasicInformation; KeyValueInformation = PrivateKeyValueInformation; BufferLength = sizeof( PrivateKeyValueInformation ); Status = NT::ZwQueryValueKey( KeyHandle, &ValueName, KeyValueInformationClass, KeyValueInformation, BufferLength, &ResultLength); if( ( Status == STATUS_BUFFER_OVERFLOW ) && ( !ARGUMENT_PRESENT( lpData ) ) ) { Status = STATUS_SUCCESS; } if( Status == STATUS_BUFFER_OVERFLOW ) { // // The buffer defined in the stack wasn't big enough to hold // the Value information. // If the caller's buffer is big enough to hold the value data // then allocate a new buffer, and call the NT API again. // if( ( ( KeyValueInformationClass == NT::KeyValuePartialInformation ) && ( ARGUMENT_PRESENT( lpData ) ) && ( *lpcbData >= (( NT::PKEY_VALUE_PARTIAL_INFORMATION )KeyValueInformation )->DataLength)) ) { BufferLength = ResultLength; KeyValueInformation = HeapAlloc( GetProcessHeap( ), 0, BufferLength); // // If the memory allocation fails, return a Registry error. // if( ! KeyValueInformation ) { return ERROR_OUTOFMEMORY; } // // Query for the necessary information about the supplied value. // Status = NT::ZwQueryValueKey( KeyHandle, &ValueName, KeyValueInformationClass, KeyValueInformation, BufferLength, &ResultLength ); } } if( NT_SUCCESS( Status ) && ARGUMENT_PRESENT( lpData ) ) { // // If requested, copy the value data // if( *lpcbData >= (( NT::PKEY_VALUE_PARTIAL_INFORMATION ) KeyValueInformation )->DataLength ) { RtlMoveMemory( lpData, (( NT::PKEY_VALUE_PARTIAL_INFORMATION )KeyValueInformation )->Data, (( NT::PKEY_VALUE_PARTIAL_INFORMATION )KeyValueInformation )->DataLength); } else { Status = STATUS_BUFFER_OVERFLOW; } } // // Certain information is returned on success or in the case of // NtQueryValueKey returning STATUS_BUFFER_OVERFLOW. This information // is always available because we always pass the minimum size required for // the NtQueryValueKey API. // if( NT_SUCCESS( Status ) || ( Status == STATUS_BUFFER_OVERFLOW ) ) { if( KeyValueInformationClass == NT::KeyValueBasicInformation ) { // // If requested, return the value type. // if( ARGUMENT_PRESENT( lpType )) { *lpType = (( NT::PKEY_VALUE_BASIC_INFORMATION ) KeyValueInformation )->Type; } } else { // // If requested, return the value type. // if( ARGUMENT_PRESENT( lpType )) { *lpType = (( NT::PKEY_VALUE_PARTIAL_INFORMATION ) KeyValueInformation )->Type; } // // Return the value data size // *lpcbData = (( NT::PKEY_VALUE_PARTIAL_INFORMATION ) KeyValueInformation )->DataLength; } } // // Transmit all of the data back to the client. // if( ARGUMENT_PRESENT( lpcbData ) ) { if( NT_SUCCESS( Status ) && ARGUMENT_PRESENT( lpData ) ) { *lpcbData = (( NT::PKEY_VALUE_PARTIAL_INFORMATION ) KeyValueInformation )->DataLength; } else { // // The API failed, so make sure that no data is transmitted back // to the client. This ensures that the client stub will not // attempt to unmarshall data that doesn't exist. // *lpcbData = 0; } } // // If memory was allocated, then free it // if( KeyValueInformation != PrivateKeyValueInformation ) { HeapFree( GetProcessHeap( ), 0, KeyValueInformation ); } return RtlNtStatusToDosError( Status ); } LONG NTRegistry::RegEnumKey( HKEY hKey, DWORD dwIndex, LPWSTR lpName, LPDWORD lpcName, LPDWORD lpReserved, LPWSTR lpClass, LPDWORD lpcClass, PFILETIME lpftLastWriteTime) { NTSTATUS Status; NT::KEY_INFORMATION_CLASS KeyInformationClass; UNICODE_STRING NameString; UNICODE_STRING ClassString; PVOID KeyInformation; ULONG BufferLength; ULONG ResultLength; HANDLE KeyHandle; BYTE PrivateKeyInformation[ sizeof( NT::KEY_NODE_INFORMATION ) + DEFAULT_KEY_NAME_SIZE + DEFAULT_CLASS_SIZE ]; if( !ARGUMENT_PRESENT( lpName ) || (ARGUMENT_PRESENT( lpClass ) && ( ! ARGUMENT_PRESENT( lpcClass )))) { return ERROR_INVALID_PARAMETER; } // // Use the supplied name string buffer as the buffer in a counted // Unicode string. // NameString.Length = 0; if ((*lpcName << 1) > 0xFFFE) { NameString.MaximumLength = ( USHORT ) 0xFFFE; } else { NameString.MaximumLength = ( USHORT )( *lpcName << 1 ); } NameString.Buffer = lpName; // // If supplied use the supplied name string buffer as the buffer in a // counted Unicode string. // if (ARGUMENT_PRESENT( lpClass )) RtlInitUnicodeString(&ClassString, (LPWSTR)lpClass); else RtlInitUnicodeString(&ClassString, (LPWSTR)L""); // // First we assume that the information we want will fit on // PrivateKeyValueInformattion // KeyInformationClass = (ARGUMENT_PRESENT( lpClass )) ? NT::KeyNodeInformation : NT::KeyBasicInformation; KeyInformation = PrivateKeyInformation; BufferLength = sizeof( PrivateKeyInformation ); Status = MapDefaultKey(&KeyHandle, hKey); if (!NT_SUCCESS(Status)) { return RtlNtStatusToDosError(Status); } Status = NT::ZwEnumerateKey( KeyHandle, dwIndex, KeyInformationClass, KeyInformation, BufferLength, &ResultLength); if( Status == STATUS_BUFFER_OVERFLOW ) { // // The buffer defined in the stack wasn't big enough to hold // the Key information. // If the caller's buffer are big enough to hold the key name // and key class, then allocate a new buffer, and call the // NT API again. // if( ( ( KeyInformationClass == NT::KeyBasicInformation ) && ( (ULONG)(NameString.MaximumLength) >= (( NT::PKEY_BASIC_INFORMATION )KeyInformation )->NameLength + sizeof(UNICODE_NULL)) ) || ( ( KeyInformationClass == NT::KeyNodeInformation ) && ( (ULONG)(NameString.MaximumLength) >= (( NT::PKEY_NODE_INFORMATION )KeyInformation )->NameLength + sizeof(UNICODE_NULL)) && ( ARGUMENT_PRESENT( lpClass )) && ( (ULONG)(ClassString.MaximumLength) >= (( NT::PKEY_NODE_INFORMATION )KeyInformation )->ClassLength + sizeof(UNICODE_NULL)) ) ) { BufferLength = ResultLength; KeyInformation = HeapAlloc( GetProcessHeap( ), 0, BufferLength); // // If the memory allocation fails, return a Registry error. // if( ! KeyInformation ) { return ERROR_OUTOFMEMORY; } // // Query for the necessary information about the supplied key. // This may or may not include the class depending on lpClass->Buffer // as determined above. // { Status = NT::ZwEnumerateKey( KeyHandle, dwIndex, KeyInformationClass, KeyInformation, BufferLength, &ResultLength); } } } if( NT_SUCCESS( Status ) ) { if( KeyInformationClass == NT::KeyBasicInformation ) { // // Return the name length and the name of the key. // Note that the NUL byte is included so that RPC copies the // correct number of bytes. It is decremented on the client // side. // if( (ULONG)(NameString.MaximumLength) >= (( NT::PKEY_BASIC_INFORMATION )KeyInformation )->NameLength + sizeof( UNICODE_NULL ) ) { NameString.Length = ( USHORT )(( NT::PKEY_BASIC_INFORMATION )KeyInformation )->NameLength; RtlMoveMemory( NameString.Buffer, (( NT::PKEY_BASIC_INFORMATION )KeyInformation )->Name, NameString.Length); // // NUL terminate the value name. // NameString.Buffer[ NameString.Length >> 1 ] = UNICODE_NULL; if( ARGUMENT_PRESENT( lpcName )) { *lpcName = NameString.Length >> 1; } } else { Status = STATUS_BUFFER_OVERFLOW; } // // If requested, return the last write time. // if( ARGUMENT_PRESENT( lpftLastWriteTime )) { *lpftLastWriteTime = *( PFILETIME )&(( NT::PKEY_BASIC_INFORMATION ) KeyInformation )->LastWriteTime; } } else { // // Return the name length and the name of the key. // Note that the NUL byte is included so that RPC copies the // correct number of bytes. It is decremented on the client // side. // if( ( (ULONG)(NameString.MaximumLength) >= (( NT::PKEY_NODE_INFORMATION ) KeyInformation )->NameLength + sizeof( UNICODE_NULL ) ) && ( (ULONG)(ClassString.MaximumLength) >= (( NT::PKEY_NODE_INFORMATION ) KeyInformation )->ClassLength + sizeof( UNICODE_NULL) ) ) { // // Copy the key name // NameString.Length = ( USHORT ) (( NT::PKEY_NODE_INFORMATION ) KeyInformation )->NameLength; RtlMoveMemory( NameString.Buffer, (( NT::PKEY_NODE_INFORMATION )KeyInformation )->Name, NameString.Length ); // // NUL terminate the key name. // NameString.Buffer[ NameString.Length >> 1 ] = UNICODE_NULL; if( ARGUMENT_PRESENT( lpcName )) { *lpcName = NameString.Length >> 1; } // // Copy the key class // ClassString.Length = (USHORT) ((( NT::PKEY_NODE_INFORMATION ) KeyInformation )->ClassLength ); RtlMoveMemory( ClassString.Buffer, ( PBYTE ) KeyInformation + (( NT::PKEY_NODE_INFORMATION ) KeyInformation )->ClassOffset, ClassString.Length ); // // NUL terminate the class. // ClassString.Buffer[ ClassString.Length >> 1 ] = UNICODE_NULL; if( ARGUMENT_PRESENT( lpcClass )) { *lpcClass = ClassString.Length >> 1; } } else { Status = STATUS_BUFFER_OVERFLOW; } // // If requested, return the last write time. // if( ARGUMENT_PRESENT( lpftLastWriteTime )) { *lpftLastWriteTime = *( PFILETIME ) &(( NT::PKEY_NODE_INFORMATION ) KeyInformation ) ->LastWriteTime; } } } if( KeyInformation != PrivateKeyInformation ) { // // Free the buffer allocated. // HeapFree( GetProcessHeap( ), 0, KeyInformation ); } return RtlNtStatusToDosError( Status ); } LONG NTRegistry::RegCloseKey(HKEY hKey) { NTSTATUS Status; /* don't close null handle or a pseudo handle */ if ((!hKey) || (((ULONG_PTR)hKey & 0xF0000000) == 0x80000000)) { return ERROR_INVALID_HANDLE; } Status = NT::ZwClose( hKey ); return RtlNtStatusToDosError( Status ); }
四、项目设置
为了使用NTDLL导出函数，我们这里还需要用到ntdll.lib，需要在工程属性中添加导入ntdll.lib，只需要把ntdll.lib从DDK中拷贝出来放到你自己第三方库位置。
五、测试程序
测试了个获取Adobe安装目录的程序
NtFunctionTest.cpp
#include "stdafx.h" #include <gtest/gtest.h> #include <string> #include <NT/NtRegistry.h> TEST(GsKernelTest, tRegistryKey) { HKEY hKey = NULL; LONG RetVal = NTRegistry::RegOpenKey( HKEY_LOCAL_MACHINE, L"SOFTWARE\\Adobe\\Acrobat Reader", REG_OPTION_NON_VOLATILE, KEY_READ, &hKey); ASSERT_TRUE(RetVal==ERROR_SUCCESS); if ( ERROR_SUCCESS != RetVal ) { return; } DWORD cSubKeys = 0; RetVal = NTRegistry::RegQueryInfoKey(hKey, NULL, NULL, NULL, &cSubKeys, NULL, NULL, NULL, NULL, NULL, NULL, NULL ); ASSERT_TRUE(RetVal==ERROR_SUCCESS); if ( ERROR_SUCCESS != RetVal ) { NTRegistry::RegCloseKey(hKey); return; } TCHAR szKeyName[MAX_PATH]; for ( DWORD i=0; i < cSubKeys; ++i ) { DWORD dwKeyNameLength = sizeof(szKeyName)/sizeof(szKeyName[0]); RetVal = NTRegistry::RegEnumKey( hKey, i, szKeyName, &dwKeyNameLength, NULL, NULL, NULL,NULL); if ( ERROR_SUCCESS != RetVal ) { continue; } double fVersion = _tstof(szKeyName); DWORD dwVesion = (DWORD)(fVersion*10); if ( dwVesion > 120 || dwVesion < 60 ) { continue; } /// 拷贝文件 TCHAR szAdobePath[MAX_PATH]; _tcscat_s(szKeyName,_countof(szKeyName), TEXT("\\InstallPath")); HKEY hChildKey = NULL; RetVal = NTRegistry::RegOpenKey(hKey, szKeyName, 0, KEY_READ, &hChildKey); if ( ERROR_SUCCESS != RetVal ) { continue; } DWORD cKey = sizeof(szAdobePath); RetVal = NTRegistry::RegQueryValue(hChildKey, NULL, 0, NULL, (LPBYTE)szAdobePath, &cKey ); if ( ERROR_SUCCESS == RetVal ) { wcout << L"InstallPath: " << szAdobePath << endl; } NTRegistry::RegCloseKey(hChildKey); } NTRegistry::RegCloseKey(hKey); }
我的测试代码都是放到测试工程中的，采用的是gTest框架。
不采用导入ntdll.lib库方式的我后面再补充，只要通过GetProcessAddr获取函数地址就可以了。
看书、学习、写代码
