A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #31141  by myid
 Tue Dec 19, 2017 2:04 pm
Hi, everyone.
How to redirect registry key in registry callback?
I use RegEdit to test, OS environment is WIN7.
For example: redirect \\REGISTRY\\MACHINE\\SOFTWARE\\1111 to \\REGISTRY\\MACHINE\\SOFTWARE\\2222. These two keys are already exists.
I try to filter RegNtPreCreateKeyEx and RegNtPreOpenKeyEx, I can catch the call, but I cannot change the result.
1.Modify CompleteName and RootObject in PreInfo: no effect.
2.Use ZwCreateKey/ZwOpenKey to operate redirection key with original parameters, modify *ResultObject(convert handle to object by ObReferenceObjectByHandle), GrantedAccess and *Disposition(for RegNtPreOpenKeyEx only) after call: RegEdit cannot open the target key. No redirect effect.
 #31144  by Brock
 Wed Dec 20, 2017 5:58 pm
Microsoft's sample code doesn't work on Microsoft's Regedit? What do you mean it "cannot" work? Have you verified this with other registry editors/viewers?