登录
当前位置： 首页 > 工具软件 > open-registry > 使用案例 >

解读 OpenRegistryKey

容柏
2023-12-01

解读 OpenRegistryKey

 

 

//----- (100EAC60)--------------------------------------------------------
int __fastcallCSystemIsolationLayer_IRtlSystemIsolationLayerTearoff::OpenRegistryKey(

int a1,

struct_RTL_TRACING_FACILITY *a2,

int a3,  // Flags 0 - 4

int a4,  // Access_Mask，来自直接注册表提供者的 SysOpenKey

int a5,  // 字符串

CKey **a6,   //Key 输出

_DWORD *a7) // 输出
{

  v14 =a1;
  v9 =a5;
  v7 =a6;
  v8 =a7;
  v19 =-1073741595;
  v21 =1;
  v22 =0;
  v23 =0;

  // 输出 a7

  if ( v8 )
    *v8=0;

  if ( a3 &0xFFFFFFFC)  // Flags
  {
  }

 

// a6 输出不能为空
  if (!v7)
  {
  }

 

// a5
  if (*(_DWORD*)v9<= 0u ||**(_WORD**)(v9+8) !=92 )
  {

//这里可以看出，字符串为内部表示格式，起先就当成NtFilePath，走了弯路，实际上是NtRegistryPath
    v10 =1789;
    v11 ="(KeyName.Length > 0) &&(KeyName.Buffer[0] == L'\\\\')";
    goto LABEL_15;
  }

  v12 = CSystemIsolationLayer::OpenRegistryKey(
          *(_DWORD**)(v14- 4),
          a3,
          a4,
          v9,
          v7,
          v8);
  if (v12 >=0)
  {
    v23 =1;
    v19 =0;
    CEnterExitTracer<CSimpleNtStatusCarryingFrame,5>::

~CEnterExitTracer<CSimpleNtStatusCarryingFrame,5>(
      (int)&v20,
      v9);
    return 0;
  }
  v19 =v12;
  CEnterExitTracer<CSimpleNtStatusCarryingFrame,5>::

~CEnterExitTracer<CSimpleNtStatusCarryingFrame,5>(
    (int)&v20,
    v9);
  return v19;
}

 

//----- (100FBD8C)--------------------------------------------------------
int __thiscall CSystemIsolationLayer::OpenRegistryKey(

_DWORD *this,

char a2,     //flag

int a3,      //Access_Mask

int a4,      // 字符串

CKey **a5,   // 输出

_DWORD *a6) // 输出
{

  v6 =this;
  v7 =0;
  v15 =this;
  if (a6 )
    *a6=0;
  v26 =-1;
  v33 =0;
  v34 =0;
  v22 =0;
  v23 =0;
  v24 =0;
  v25 =0;
  v8 =RtlInitUnicodeStringFromLUnicodeStringSafely(a4,(int)&v31);
  v9 =v6[7];

// 下面的是对Object_Attribues 对象的赋值

  v16 =24;    // 对象的大小，6个字段
  v17 =0;    // RootDirectory
  v18 =&v31; // ObjectName
  v19 =64;   // Attribues
  v20 =0;    // SecurityDescriptor
  v21 =0;    // SecurityQualityOfService

// 可能是 SetCurrentTransaction

  v10 = *(int (__thiscall**)(int,int*))(*(_DWORD*)v9+ 12);
  v8 =v10(v9,&v30);
  if (a2 &1)
    v7 =1;
  v11 =v30;
  v12 =v15[5];
  v13 =*(_DWORD*)v12;

 

// SysOpenKey
  v8 =(*(int(__thiscall**)(int,signed int,int *,int,int *, int,int,int *))(v13+ 36))(
         v12,
         v7,       // flag
         &v33,     // CSilHandle
         a3,       // Access_Mask
         &v16,     // Object_Attribues
         2*(a2&2),  // flag 相关
         v11,      // Transaction
         &v32);    // 返回值，控制是否创建实例
  if (v8 <0)
    goto LABEL_12;
  v26 =v34;

 

// CSystemIsolationLayer 中四个提供程序

// 因此，从这开始，向下的七个字段，就定义了 CreateKeySource
  v22 =v15[4];
  v23 =v15[5];
  v24 =v15[6];
  v25 =v15[7];
  v27 =*(_DWORD*)a4;
  v28 =*(_DWORD*)(a4+4);
  v29 =*(_DWORD*)(a4+8);
  if (v32 !=2)
  {
    v8 =CRtlRefCountedObjectBase<CKey,IRtlKey,IRtlSystemObject,IRtlSystemContainer,Detail::CRtlRefCountedObjectBaseNoInterface>::CreateInstance<CreateKeySource,IRtlKey>(
           (structCreateKeySource*)&v22,
           a5);
    if (v8 >=0)
    {
      if (a6 )
        *a6=1;
      goto LABEL_15;
    }
LABEL_12:
    CSilHandle::Close((CSilHandle *)&v33);
    AutoPointerBase<Cdf::IRtlCdfStringTableEnumerator*,Auto<Cdf::IRtlCdfStringTableEnumerator*>>::Close(&v33);
    return v8;
  }
  if (a6 )
    *a6=2;
LABEL_15:
  CSilHandle::Close((CSilHandle *)&v33);
  AutoPointerBase<Cdf::IRtlCdfStringTableEnumerator*,Auto<Cdf::IRtlCdfStringTableEnumerator*>>::Close(&v33);
  return 0;
}

 

//----- (100EE490)--------------------------------------------------------
int __fastcall DirectRegistryProvider::SysOpenKey(

DirectRegistryProvider *this,

struct_RTL_TRACING_FACILITY *a2,

unsigned __int32 a3,

structCSilHandle *a4,

ACCESS_MASK DesiredAccess, // 这是证明前面 ACCESS_MASK的源头

struct_OBJECT_ATTRIBUTES *a6,

unsigned __int32 a7,

void *a8,

unsigned __int32 *a9)
{

  v44 =-1073741595;
  v9 =this;
  v10 =a4;
  ObjectAttributes = a6;
  v35 =a8;
  v42 =a9;
  v38 =0;
  KeyHandle =0;
  v48 =0;
  v49 =0;
  v47 =1;

// 返回结果 a9

  if ( v42 )
    *v42=0;
 

  v43 =0;
  v45 =(unsigned __int32)v9; // this, DirectRegistryProvider
  v11 =((int(__thiscall*)(constchar**, unsigned __int32*))AutoInterface<IRtlRegistryProvider*,Auto<IRtlRegistryProvider*>>

::CreateInterfaceFrom<CQueuedRegistryProvider*>)(
          &v43,
          &v45);

  v37 = a7&4;
  if (a7 &4)
  {
    v45 =0;
    v12 =*(_DWORD*)v9;
    v13 =a7 &0xFFFFFFFB;
    v14 =DesiredAccess;
    v15 =a3 |2;

 

// DirectRegistryProvider::SysOpenKey
    if ( (*(int(__thiscall**)(DirectRegistryProvider*, unsigned __int32,struct CSilHandle*, ACCESS_MASK, POBJECT_ATTRIBUTES,unsigned__int32, void *, unsigned__int32 *))(v12+ 36))(
           v9,
           v15,
           v10,
           v14,
           ObjectAttributes,
           v13,
           v35,
           &v45)>= 0
      &&v45 !=3)
    {
      if (v42 )
        *v42= v45;
      v49 =1;
      v44 =0;
      goto LABEL_12;
    }
  }
  v11 =`anonymous namespace'::TransformKeyPermissions(&DesiredAccess);
  if (v11 <0)
  {  }
  v36 =0;
  HIWORD(v33)= 256;
  do
  {
    v16 =(int(__stdcall*)(HANDLE*, ACCESS_MASK, POBJECT_ATTRIBUTES,unsigned__int32))*((_DWORD*)v9+ 4);
    if (v16 &&!v35 )
    {
      v32 =a7;
LABEL_36:
      v25 =ObjectAttributes;
      v26 =DesiredAccess;
      //NTOpenKeyEx

      v22 = v16(&KeyHandle, v26, v25, v32);
      goto LABEL_37;
    }
    v17 =(int(__stdcall*)(HANDLE*, ACCESS_MASK, POBJECT_ATTRIBUTES,unsigned__int32, void *))*((_DWORD*)v9+ 5);
    if (v17 && v35)
    {
      v18 =v35;
      v19 =a7;
      v20 =ObjectAttributes;
      v21 =DesiredAccess;
      v22 =v17(&KeyHandle,v21, v20, v19, v18);
      goto LABEL_37;
    }
    if (!v37)
    {
      if (v35 )
      {
        v16 =(int(__stdcall*)(HANDLE*, ACCESS_MASK, POBJECT_ATTRIBUTES,unsigned__int32))*((_DWORD*)v9+ 2);
        if ( !v16)
        {
          v31 =5313;
          v44 =-1073740759;
          goto LABEL_60;
        }
        v32 =(unsigned __int32)v35;
        goto LABEL_36;
      }
      v22 =NtOpenKey(&KeyHandle,DesiredAccess, ObjectAttributes);
LABEL_37:
      v23 =(DirectRegistryProvider*)v22;
      goto LABEL_38;
    }
    v45 =0;
    v23 =DirectRegistryProvider::OpenExistingKeyWithBackupRestore(
            v9,
            DesiredAccess,
            ObjectAttributes,
            v35,
            (structCSilHandle *)&v38,
            &v45);
    if (v45 ==4)
    {
      v23 =(DirectRegistryProvider*)-1073741670;
      goto LABEL_39;
    }
    if (v45 ==8)
    {
      v23 =(DirectRegistryProvider*)-1073741772;
LABEL_26:
      v24 =BYTE2(v33);
      continue;
    }
    if (v45 ==16)
      v23 =(DirectRegistryProvider*)-1073741790;
LABEL_38:
    if (v23 !=(DirectRegistryProvider*)-1073741670)
      goto LABEL_26;
LABEL_39:
    v11 =DelayForInsufficientResources(&v36,(_BYTE*)&v33+3);
    if (v11 <0)
      goto LABEL_41;
    v24 =1;
    BYTE2(v33)= 1;
  }
  while (BYTE3(v33)&& v23 ==(DirectRegistryProvider*)-1073741670);
  if ((signed int)v23>=0)
  {
    if (v24 )
      RtlTrace(
        0,
        (unsigned__int32)&Facility_SIL,
        (struct_RTL_TRACING_FACILITY*)&"Transient insufficient resources at NtOpenKey for{oa}",
        (constchar *const )1,
        (unsigned__int32)"oa",
       RtlTraceFormat_PCOBJECT_ATTRIBUTES,
        ObjectAttributes);
    v27 =v43;
    v43 =0;
    AutoPointerBase<Cdf::IRtlCdfStringTableEnumerator*,Auto<Cdf::IRtlCdfStringTableEnumerator*>>::Close(&v38);
    v38 =v27;
    if (v42 )
    {
      *v42=1;
      v27 =v38;
    }
    v28 =(void*)*((_DWORD*)v10+ 1);
    *((_DWORD*)v10+ 1) = KeyHandle;
    KeyHandle =v28;
    v29 =*(constchar**)v10;
    *(_DWORD*)v10=v27;
    v38 =v29;
LABEL_57:
    v49 =1;
    v44 =0;
    AutoPointerBase<Cdf::IRtlCdfStringTableEnumerator*,Auto<Cdf::IRtlCdfStringTableEnumerator*>>::Close(&v43);
    CEnterExitTracer<CSimpleNtStatusCarryingFrame,5>::~CEnterExitTracer<CSimpleNtStatusCarryingFrame,5>(
      (int)&v46,
      (int)v10);
    CSilHandle::Close((CSilHandle *)&v38);
    AutoPointerBase<Cdf::IRtlCdfStringTableEnumerator*,Auto<Cdf::IRtlCdfStringTableEnumerator*>>::Close(&v38);
    return 0;
  }
  if ((v23==(DirectRegistryProvider*)-1073741772
     ||v23 ==(DirectRegistryProvider*)-1073741766)
    &&a3 &1)
  {
    if (v42 )
      *v42=2;
    goto LABEL_57;
  }
  if (v23 ==(DirectRegistryProvider*)-1073741790&& a3 &2)
  {
    if (v42 )
      *v42=3;
    goto LABEL_57;
  }
  v31 =5349;
  v44 =(int)v23;
LABEL_60:
  AutoPointerBase<Cdf::IRtlCdfStringTableEnumerator*,Auto<Cdf::IRtlCdfStringTableEnumerator*>>::Close(&v43);
  CEnterExitTracer<CSimpleNtStatusCarryingFrame,5>::~CEnterExitTracer<CSimpleNtStatusCarryingFrame,5>(
    (int)&v46,
    v31);
  CSilHandle::Close((CSilHandle *)&v38);
  AutoPointerBase<Cdf::IRtlCdfStringTableEnumerator*,Auto<Cdf::IRtlCdfStringTableEnumerator*>>::Close(&v38);
  v38 ="base\\wcp\\sil\\merged\\ntu\\ntsystem.cpp";
  KeyHandle ="DirectRegistryProvider::SysOpenKey";
  v40 =v31;
  v41 =0;
  CBaseFrame<CVoidRaiseFrame>::ReportErrorOrigination(
    &v44,
    (int)&v38);
  return v44;
}

 

 

 类似资料：

相关阅读

Oracle连接配置解读Java回调机制解读基于PostgreSQL 权限解读Bootstrap源码解读表单（2）Java hashCode() 方法详细解读

相关文章

mysql源码解读——数据到文件之数据ChatGPT怎么读？Mysql 之 幻读Firebase读取数据Cassandra读取数据

相关问答

阅读和理解ASHOJ切入点？JAXB 解组 - 读取器不能为空BLE心率传感器价值解读JAXB:解组时如何读取xsi:type值用mule读取文件并用dataweave解析

相关文档

Ruby 源码解读深入理解 ES6 读书笔记深入理解 Java 虚拟机 阅读笔记阅读 express 源码快学 Scala 读书笔记
快捷导航： 新手教程 算法原理 架构设计 Java进阶 数据库进阶 大厂专栏 面试经验 编程笔记 编程问答 所有专题 文档资料 工具软件 电子书籍 小牛导航
在线工具： 房贷计算器 个税计算器 Linux命令查询 Json格式化 正则表达式 颜色转换 AES加解密 SHA1加密 MD5加密 毒鸡汤 字数统计 随机密码生成 进制转换 Base64编解码 励志句子
Copyright © 2019-2024 小牛知识库@xnip.cn. All Rights Reserved.