Windows驱动中读取注册表中的DWORD32值
2022-02-11
46
0
ULONG GetRegisterMicChannelDWORD32()
{
HANDLE hHandle = NULL;
OBJECT_ATTRIBUTES oa;
NTSTATUS statues;
UNICODE_STRING path;
UNICODE_STRING keyName;
ULONG rtn = 0;
UCHAR buff[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + 4] = { 0 };
ULONG MicChannelDisableMask = 0;
RtlInitUnicodeString(&path, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\pnpon");
RtlInitUnicodeString(&keyName, L"DWORD32_KEY");//设置键名字
InitializeObjectAttributes(&oa, &path, OBJ_CASE_INSENSITIVE, NULL, NULL);
do
{
statues = ZwOpenKey(&hHandle, KEY_ALL_ACCESS, &oa);
if (!NT_SUCCESS(statues))
{
break;
}
statues = ZwQueryValueKey(hHandle, &keyName, KeyValuePartialInformation, (PVOID)buff, sizeof(buff), &rtn);
if (NT_SUCCESS(statues))
{
PKEY_VALUE_PARTIAL_INFORMATION prv = (PKEY_VALUE_PARTIAL_INFORMATION)buff;
if (prv->DataLength == sizeof(ULONG))
{
RtlCopyMemory(&MicChannelDisableMask, prv->Data, sizeof(ULONG));
}
}
} while (0);
if (hHandle != NULL)
{
ZwClose(hHandle);
hHandle = NULL;
}
return MicChannelDisableMask;
}