-
-
未解决 [求助]通过系统的hive文件对注册表进行操作，添加的键值在win7以上失效
-
发表于: 2019-5-9 08:10
-
引用 https://bbs.pediy.com/thread-115768.htm
首先我是参照大神"注册表文件解析完整解决方案”
这篇文章 ,想通过系统hive文件来读写注册表，在xp下读写都没有问题，但在win7 32或64位系统中，发现写入后，利用hive方式也能够读出键值，但是用注册表工具“RegWorkshop.exe”这个查看，键值并不存在。然后用pchunter.exe查看键值，也并不存在，如图1·，但使用pchunter的hive分析模式解析注册表，就能查看到键值，如图2
(图1)
(图2)
写入后，重启电脑，键值就消失了，百思不得解。
这里我贴下我写的代码。希望通过各路大神的帮助能解决问题
驱动部分都是参照上面引用的文章源码里修改文件句柄的访问权限
//
// TODO: Add your module definitions here.
//
//枚举句柄回调函数
bool EnumHandleCallBack(PHANDLE_TABLE_ENTRY Entry, HANDLE handle, ENUMHANDLE_PARAMETER* Param)
{
dprintf("函数被调用 %08x\n", handle);
if(Param->AccessMask == 0)
{
if((ULONG32)handle == Param->SorHadnle)
{
dprintf("找到源权限");
Param->AccessMask = Entry->GrantedAccess;
return true;
}
}
else
{
if((ULONG32)handle == Param->DesHandle)
{
dprintf("修改成功!GrantedAccess:\n");
Entry->GrantedAccess = Param->AccessMask;
return true;
}
}
return false;
}
typedef struct FILE_RIGHT_
{
ULONG32 DesHandle; //目标句柄
ULONG32 SourceHandle; //源句柄
} FILE_RIGHT_MODIFY, *PFILE_RIGHT_MODIFY;
NTSTATUS ModifyRight(FILE_RIGHT_MODIFY* Data)
{
NTSTATUS Status = STATUS_UNSUCCESSFUL;
dprintf("句柄 %08x---Sour %08x", Data->DesHandle, Data->SourceHandle);
ENUMHANDLE_PARAMETER * Param = (ENUMHANDLE_PARAMETER *)ExAllocatePool(NonPagedPool, sizeof(ENUMHANDLE_PARAMETER));
if(Param > 0)
{
Param->AccessMask = 0;
Param->DesHandle = Data->DesHandle;
Param->SorHadnle = Data->SourceHandle;
dprintf("ExEnumHandleTable:%x",ExEnumHandleTable);
PVOID TableAddr = (PVOID)GetHandleTableFromProcessWin7(PsGetCurrentProcess());
dprintf("TableAddr:%p",TableAddr);
if(ExEnumHandleTable(TableAddr,
(EX_ENUMERATE_HANDLE_ROUTINE)EnumHandleCallBack, Param, NULL))
{
KdPrint(("Enum Success!\n"));
if(ExEnumHandleTable((PVOID)GetHandleTableFromProcessWin7(PsGetCurrentProcess()),
(EX_ENUMERATE_HANDLE_ROUTINE)EnumHandleCallBack, Param, NULL))
{
Status = STATUS_SUCCESS;
}
}
ExFreePool(Param);
}
KdPrint(("ModifyRight---Status:%x", Status));
return Status;
}
NTSTATUS DisModifyRight(PDEVICE_OBJECT pDevice, PIRP pIrp)
{
PIO_STACK_LOCATION Stack = IoGetCurrentIrpStackLocation(pIrp);
pIrp->IoStatus.Information = 0;
NTSTATUS Status;
if(Stack->Parameters.DeviceIoControl.InputBufferLength < 4)
{
Status = STATUS_INFO_LENGTH_MISMATCH;
}
else
{
Status = ModifyRight((FILE_RIGHT_MODIFY*)pIrp->AssociatedIrp.SystemBuffer);
}
pIrp->IoStatus.Status = Status;
IofCompleteRequest(pIrp, IO_NO_INCREMENT);
return Status;
}
NTSTATUS DispatchDeviceControl(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp)
{
NTSTATUS status = STATUS_INVALID_DEVICE_REQUEST; // STATUS_UNSUCCESSFUL
PIO_STACK_LOCATION pIrpStack = IoGetCurrentIrpStackLocation(pIrp);
ULONG uIoControlCode = 0;
PVOID pIoBuffer = NULL;
ULONG uInSize = 0;
ULONG uOutSize = 0;
// Get the IoCtrl Code
uIoControlCode = pIrpStack->Parameters.DeviceIoControl.IoControlCode;
pIoBuffer = pIrp->AssociatedIrp.SystemBuffer;
uInSize = pIrpStack->Parameters.DeviceIoControl.InputBufferLength;
uOutSize = pIrpStack->Parameters.DeviceIoControl.OutputBufferLength;
switch(uIoControlCode)
{
case IOCTL_MODIFY_FILE_RIGHT:
return DisModifyRight(pDevObj, pIrp);
// TODO: Add execute code here.
//
default:
{
status = STATUS_INVALID_PARAMETER;
}
break;
}
if(status == STATUS_SUCCESS)
{
pIrp->IoStatus.Information = uOutSize;
}
else
{
pIrp->IoStatus.Information = 0;
}
// Complete the I/O Request
pIrp->IoStatus.Status = status;
IoCompleteRequest(pIrp, IO_NO_INCREMENT);
return status;
}应用层部分代码：
#define IOCTL_MODIFY_FILE_RIGHT CTL_CODE(FILE_DEVICE_UNKNOWN,800,METHOD_BUFFERED,FILE_ANY_ACCESS)
BOOL GetRightToAccessFile(HANDLE hSor, HANDLE hDes)
{
/*
hSor 源句柄
hDes 目标句柄，
目标句柄会获得和源句柄相同的权限
*/
ASSERT(hSor != 0);
ASSERT(hDes != 0);
FILE_RIGHT_MODIFY Data = {0};
Data.SourceHandle = hSor;
Data.DesHandle = hDes;
HANDLE h1 = gProcess::getSysHandle("5YRlp");
glog::trace("h1:%x CurProHandle:%x", h1, Data.CurProHandle);
if(h1 != INVALID_HANDLE_VALUE)
{
DWORD dwret;
BYTE hhh[216] = {0};
BOOL b2 = DeviceIoControl(h1, IOCTL_MODIFY_FILE_RIGHT, &Data, sizeof(FILE_RIGHT_MODIFY), 0, 0, &dwret, NULL);
if(b2 == 0)
{
glog::traceErrorInfo("DeviceIoControl", GetLastError());
}
FILE_RIGHT_MODIFY* p2 = (FILE_RIGHT_MODIFY*)hhh;
CloseHandle(h1);
return b2;
}
CloseHandle(h1);
}
BOOL GetHiveFileList(PHIVE_FILE_LIST pList, ULONG BufferSize)
{
ULONG Count = 0;
Count = BufferSize / sizeof(HIVE_FILE_LSIT) - 1;
unsigned char Buffer[2048] = {0};
ULONG RetLen = 0;
BOOL isWOW64;
REGSAM p = KEY_READ;
IsWow64Process(GetCurrentProcess(), &isWOW64);//判断环境是否为WOW64
if(isWOW64)
p |= KEY_WOW64_64KEY;
HKEY hKey;
if(RegCreateKeyEx(HKEY_LOCAL_MACHINE, TEXT("SYSTEM\\CurrentControlSet\\Control\\hivelist"), 0, NULL, 0, p, NULL, &hKey, NULL) != ERROR_SUCCESS)
{
//失败
return 0;
}//打开键
LONG re;
int i = 0;
// glog::trace("枚举值项");
char name[16383] = { 0 };
DWORD type;
do
{
char Name[MAX_PATH] = {0};
ULONG BufferLen = MAX_PATH;
ULONG NameLen = MAX_PATH;
DWORD lang = 16383;
re = RegEnumValue(hKey, i, Name, &NameLen, 0, &type, Buffer, &BufferLen);
// glog::trace("Name:%s Buffer:%s i:%d \n", Name, Buffer, i);
if(i == 12)
{
int aa = 5;
}
if(type == REG_SZ)
{
// name:\REGISTRY\MACHINE\SECURITY path:\Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY
glog::trace("Buffer:%s", Buffer);
// [3944] Buffer:\Device\HarddiskVolume2\Windows\System32\config\SOFTWARE
char* a1 = "\\Device\\HarddiskVolume1";
string str1 = gstring::toAlphabe((char*)Buffer, 2);
char* p2 = (char*)strstr((const char*)str1.c_str(), "e1");
char* p3 = (char*)strstr(str1.c_str(), "software");
//char* p3 = (char*)strstr((const char*)Buffer, "software");
if(BufferLen > strlen(a1) && Count > RetLen)
{
if(p2 && p3)
{
*p2 = 'c';
*(p2 + 1) = ':';
}
if(p2 != NULL && p3)
{
//RegBack
//[368] Name:\REGISTRY\MACHINE\SOFTWARE path:c:\windows\system32\config\software pHive:004F1BD0
char data[216] = {0};
RtlCopyMemory(data, p2, BufferLen - strlen(a1) + 2);
string s22 = data;
//gstring::replace(s22, "software", "regback\\software");
//glog::trace("s22:%s", s22.c_str());
RtlCopyMemory(pList->Entry[RetLen].Path, s22.c_str(), s22.size());
RtlCopyMemory(pList->Entry[RetLen].Name, Name, NameLen);
RetLen++;
}
}
}
i++;
}
while(re != ERROR_NO_MORE_ITEMS);
pList->Count = RetLen;
if(hKey)
RegCloseKey(hKey);
return TRUE;
}
void test()
{
glog::setOpenLog(TRUE);
gProcess::EnableDebugPrivilege();
PVOID OldValue = NULL;
ULONG BufferSize = 260 * 30, i = 0;
PHIVE_FILE_LIST pList = (PHIVE_FILE_LIST)AllocateBuffer(BufferSize);
glog::trace("pList:%p", pList);
if(pList == 0)
return ;
char Name[MAX_PATH] = {0};
if(GetHiveFileList(pList, BufferSize) == false)
return;
glog::trace("pList->Count:%d", pList->Count);
PHIVE_LIST p = NULL;
PHIVE pHive = NULL;
PHIVE_LIST Seek = 0;
for(i = 0; i < pList->Count; i++)
{
RtlZeroMemory(Name, MAX_PATH);
string FilePath3 = pList->Entry[i].Path;
glog::trace("\ni:%d hRootNode:%p name:%s path:%s ", i, hRootNode, pList->Entry[i].Name, pList->Entry[i].Path);
if(FilePath3.size() < 10)
continue;
pHive = NewOpenHive((char*)FilePath3.c_str(), HMODE_RW);
if(pHive == NULL)
{
glog::trace("打开文件失败:");
glog::trace("\n");
continue;
}
if(hRootNode)
{
p = (PHIVE_LIST)AllocateBuffer(sizeof(HIVE_LIST));
RtlZeroMemory(Name, MAX_PATH);
strcpy(Name, pList->Entry[i].Name);
RtlCopyMemory(p->Name, Name, strlen(Name));
glog::trace("Name:%s path:%s pHive:%p", Name, pList->Entry[i].Path, pHive);
p->hRoot = pHive;
Seek->Next = p;
Seek = p;
}
else
{
p = (PHIVE_LIST)AllocateBuffer(sizeof(HIVE_LIST));
RtlZeroMemory(Name, MAX_PATH);
strcpy(Name, pList->Entry[i].Name);
RtlCopyMemory(p->Name, Name, strlen(Name));
p->hRoot = pHive;
glog::trace("Name:%s path:%s pHive:%p", Name, pList->Entry[i].Path, pHive);
hRootNode = p;
Seek = p;
}
}
if(hRootNode == 0)
{
FreeBuffer(pList);
return;
}
string val = "hehe";
wstring wval = gstring::s2w(val);
//添加键hehe
ULONG u1 = AddValue("\\REGISTRY\\MACHINE\\SOFTWARE\\ODBC", "hehe", (BYTE*)wval.c_str(), wval.size() * 2, REG_SZ);
//设置值也是hehe
ULONG ret = SetKeyValueData("\\REGISTRY\\MACHINE\\SOFTWARE\\ODBC", "hehe", (BYTE*)wval.c_str(), wval.size() * 2);
SIZE_T dwBytesWritten = 0;
WriteFile((HANDLE)pHive->filehandle, pHive->buffer, pHive->size, &dwBytesWritten, NULL);
if(dwBytesWritten != (SIZE_T)(pHive->size))
{
glog::trace("WriteHive error\n");
}
int nn = GetSubKeyCount("\\REGISTRY\\MACHINE\\SOFTWARE\\ODBC");
glog::trace("键值数量:%d", nn);
PSUB_KEY_INFO pInfo = (PSUB_KEY_INFO)malloc(0x1000);
PKEY_VALUE_INFO pvalinfo = (PKEY_VALUE_INFO)malloc(0x1000);
if(EnumSubKey("\\REGISTRY\\MACHINE\\SOFTWARE\\ODBC", pInfo, 0x1000) == REG_SUCCESS)
{
glog::trace("Count:%d", pInfo->Count);
for(ULONG i = 0; i < pInfo->Count; i++)
{
glog::trace("%s", pInfo->Entrys[i].Name);
}
}
if(EnumKeyValue("\\REGISTRY\\MACHINE\\SOFTWARE\\ODBC", pvalinfo, 0x1000) == REG_SUCCESS)
{
for(ULONG i = 0; i < pvalinfo->Count; i++)
{
char name[216] = {0};
char val[216];
glog::trace("name:%s val:%ws", pvalinfo->Entrys[i].Name, pvalinfo->Entrys[i].DataBuffer);
}
}
FreeBuffer(pList);
}
测试 加载驱动5yrip.sys
打开win32project7.exe ,打开后工具栏-》帮助-》关于，会调用通过写注册表函数如图3
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
