Browsing the registry in kernel-mode

One of Windows kernel subsystem I recently dug into is the Configuration Manager (CM), mostly because I found very scarce public resources about it despite its criticality: this subsystem is responsible for managing the configuration of all Windows resources, and in user-land is exposed via a very familiar mechanism, the Windows Registry. It is a pretty well documented user-land mechanism, and so is its kernel driver API. My curiosity was around its inner working, and all the few (but brilliant) resources can be found in the link section below.

What I wondered was: How is the registry handled in the kernel (i.e. by the CM)? So in the same way that I explored other Windows subsystems, I tried to keep a practical approach, and the result was this WinDbg Js script, RegistryExplorer.js that’ll be referring to throughout this post. This script allows to browse and query via LINQ the registry in a kernel debugging session.

Notes: this is a collection of notes, do not blindly trust, assume mistakes. Also, you’ll find the KD commands are given to reproduce easily, but your offset/index may vary. Last, everything was done/tested against Windows 10 x64 1909: I assume those findings to be applicable to other versions, but it may not be the case.

https://blahcat.github.io/2021/01/11/browsing_registry_kernel_mode/

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)