Kernel File and registry API

//Create File

	OBJECT_ATTRIBUTES objectAttributes;
	IO_STATUS_BLOCK iostatus;
	HANDLE hFile;
	UNICODE_STRING logFileUnicodeString;

	RtlInitUnicodeString(&logFileUnicodeString, L"\\??\\C:\\1.log");
	InitializeObjectAttributes(&objectAttributes,
							&logFileUnicodeString,
							OBJ_CASE_INSENSITIVE,
							NULL,
							NULL);
	NTSTATUS ntStatus = ZwCreateFile(&hFile,
								GENERIC_WRITE,
								&objectAttributes,
								&iostatus,
								NULL,
								FILE_ATTRIBUTE_NORMAL,
								FILE_SHARE_READ,
								FILE_OPEN_IF,
								FILE_SYNCHRONOUS_IO_NONALERT,
								NULL,
								0);
	if (NT_SUCCESS(ntStatus))
	{
		KdPrint(("Create file successfully ! \n"));
	}
	else
	{
		KdPrint(("Create File unsuccessfully ! \n"));
	}
	
	const int BUFFER_SIZE = 1024;
	PUCHAR pBuffer = (PUCHAR)ExAllocatePool(PagedPool, BUFFER_SIZE);
	RtlFillMemory(pBuffer, BUFFER_SIZE, 0xcc);

	ZwWriteFile(hFile, NULL, NULL, NULL, &iostatus, pBuffer, BUFFER_SIZE, NULL, NULL);
	KdPrint(("Writed %d bytes", iostatus.Information));
	RtlFillMemory(pBuffer, BUFFER_SIZE, 0xBB);

	LARGE_INTEGER number;
	number.QuadPart = 1024i64;

	ZwWriteFile(hFile, NULL, NULL, NULL, &iostatus, pBuffer, BUFFER_SIZE, &number, NULL);
	KdPrint(("The program Really appended %d bytes \n", iostatus.Information));

	FILE_STANDARD_INFORMATION fsi;
	ntStatus = ZwQueryInformationFile(hFile,
										&iostatus,
										&fsi,
										sizeof(FILE_STANDARD_INFORMATION),
										FileStandardInformation);
	KdPrint(("Allocate Size is %d \n", fsi.AllocationSize));
	KdPrint(("Number of Links is %d \n", fsi.NumberOfLinks));
	KdPrint(("The File want to read %d Bytes\n", fsi.EndOfFile.QuadPart));

	PUCHAR pBufferRead = (PUCHAR)ExAllocatePool(PagedPool,
										(LONG)fsi.EndOfFile.QuadPart);
	ZwReadFile(hFile, NULL,
				NULL, NULL,
				&iostatus,
				pBufferRead,
				(LONG)fsi.EndOfFile.QuadPart,
				NULL, NULL);
	KdPrint(("The program really read %d bytes \n", iostatus.Information));
	ZwClose(hFile);
	ExFreePool(pBuffer);
	ExFreePool(pBufferRead);

文件操作常用API：

ZwCreateFile

ZwWriteFile

ZwOpenFile

ZwQueryInformationFile

ZwSetinformationFile

注册表操作常用API：

	UNICODE_STRING RegUnicodeString;
	HANDLE hRegistry;
#define MY_REG_SOFTWARE_KEY_NAME		L"\\Registry\\Machine\\Software\\M"
	RtlInitUnicodeString(&RegUnicodeString, MY_REG_SOFTWARE_KEY_NAME);
	OBJECT_ATTRIBUTES objectAttributes;
	InitializeObjectAttributes(&objectAttributes,
							&RegUnicodeString,
							OBJ_CASE_INSENSITIVE,
							NULL,
							NULL);
	ULONG ulResult;
	NTSTATUS ntStatus = ZwCreateKey( &hRegistry,
								KEY_ALL_ACCESS,
								&objectAttributes,
								0,
								NULL,
								REG_OPTION_NON_VOLATILE,
								&ulResult);
	if (NT_SUCCESS(ntStatus))
	{
		if (ulResult == REG_CREATED_NEW_KEY)
		{
			KdPrint(("The Register item is created \n"));
		}
		else
		{
			KdPrint(("The register item has been Created ,and now is opened\n"));
		}
	}

	UNICODE_STRING subRegistryUString;
	HANDLE hSubRegister;

	RtlInitUnicodeString(&subRegistryUString, L"SubItem");
	OBJECT_ATTRIBUTES subObjectAttributes;

	InitializeObjectAttributes(&subObjectAttributes,
							&subRegistryUString,
							OBJ_CASE_INSENSITIVE,
							hRegistry,
							NULL);
	ntStatus = ZwCreateKey(&hSubRegister,
							KEY_ALL_ACCESS,
							&subObjectAttributes,
							0,
							NULL,
							REG_OPTION_NON_VOLATILE,
							&ulResult);
	if (NT_SUCCESS(ntStatus))
	{
		if (ulResult == REG_CREATED_NEW_KEY)
		{
			KdPrint(("The sub register item is created \n"));
		}
		else
		{
			KdPrint(("The sub register item has been created, now is opened\n"));
		}
	}

	ZwClose(hRegistry);
	ZwClose(hSubRegister);

ZwSetValuekey：

	UNICODE_STRING ValueName;
	RtlInitUnicodeString(&ValueName, L"REG_DWORD Value Test");   //Key Name

	ULONG ulValue = 1000;  //Key Value
	ZwSetValueKey(hRegForWrite, &ValueName,
		0,
		REG_DWORD,
		&ulValue,
		sizeof(ulValue));

枚举注册表子项：

VOID KeEnumerateKeyTest()
{
	UNICODE_STRING RegUTestString;
	RtlInitUnicodeString(&RegUTestString, L"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion");
	
	OBJECT_ATTRIBUTES objectRegAttributes;
	InitializeObjectAttributes(&objectRegAttributes,
		&RegUTestString,
		OBJ_CASE_INSENSITIVE,
		NULL,
		NULL);
	
	HANDLE hRegForWrite;
	NTSTATUS ntStatus = ZwOpenKey(&hRegForWrite, KEY_ALL_ACCESS, &objectRegAttributes);
	if (!NT_SUCCESS(ntStatus))
	{
		KdPrint(("Open key Faild!\n"));
		return;
	}

	ULONG ulSize = 0;

	ZwQueryKey(hRegForWrite,
		KeyFullInformation,
		NULL,
		0,
		&ulSize);

	PKEY_FULL_INFORMATION pfi = 
		(PKEY_FULL_INFORMATION)ExAllocatePool(PagedPool, ulSize);

	ZwQueryKey(hRegForWrite,
			KeyFullInformation,
			pfi,
			ulSize,
			&ulSize);
	ULONG i = 0;
	KdPrint(("The subkeys is %d \n", pfi->SubKeys));
	for (; i < pfi->SubKeys; i++)
	{
		NTSTATUS ntStatus;
		ntStatus = ZwEnumerateKey(hRegForWrite,
			i,
			KeyBasicInformation,
			NULL,
			0,
			&ulSize);

		PKEY_BASIC_INFORMATION pbi =
			(PKEY_BASIC_INFORMATION)ExAllocatePool(PagedPool, ulSize);

		ntStatus = ZwEnumerateKey(hRegForWrite,
					i,
					KeyBasicInformation,
					pbi,
					ulSize,
					&ulSize);

		UNICODE_STRING uKeyName;
		uKeyName.Length = 
		uKeyName.MaximumLength = (USHORT)pbi->NameLength;
		uKeyName.Buffer = pbi->Name;
		KdPrint(("The %d sub Item name : %wZ\n", i, &uKeyName));

		ExFreePool(pbi);
	}
	ExFreePool(pfi);
	ZwClose(hRegForWrite);
}

枚举子键：

VOID KeEnumerateSubValueTest()
{
	UNICODE_STRING RegUTestString;
	RtlInitUnicodeString(&RegUTestString, L"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion");
	
	OBJECT_ATTRIBUTES objectRegAttributes;
	InitializeObjectAttributes(&objectRegAttributes,
		&RegUTestString,
		OBJ_CASE_INSENSITIVE,
		NULL,
		NULL);
	
	HANDLE hRegForWrite;
	NTSTATUS ntStatus = ZwOpenKey(&hRegForWrite, KEY_ALL_ACCESS, &objectRegAttributes);
	if (!NT_SUCCESS(ntStatus))
	{
		KdPrint(("Open key Faild!\n"));
		return;
	}
	
	ULONG ulSize = 0;
	
	ZwQueryKey(hRegForWrite,
		KeyFullInformation,
		NULL,
		0,
		&ulSize);
	
	PKEY_FULL_INFORMATION pfi = 
		(PKEY_FULL_INFORMATION)ExAllocatePool(PagedPool, ulSize);
	
	ZwQueryKey(hRegForWrite,
		KeyFullInformation,
		pfi,
		ulSize,
		&ulSize);
	ULONG i = 0;
	KdPrint(("The subkeys is %d \n", pfi->Values));

	for (; i < pfi->Values; i++)
	{
		ZwEnumerateValueKey(hRegForWrite,
					i,
					KeyValueBasicInformation,
					NULL,
					0,
					&ulSize);

		PKEY_VALUE_BASIC_INFORMATION pbi =
			(PKEY_VALUE_BASIC_INFORMATION)ExAllocatePool(PagedPool, ulSize);

		ZwEnumerateValueKey(hRegForWrite,
						i,
						KeyValueBasicInformation,
						pbi,
						ulSize,
						&ulSize);

		UNICODE_STRING uKeyName;
		uKeyName.Length =
		uKeyName.MaximumLength = (USHORT)pbi->NameLength;
		uKeyName.Buffer = pbi->Name;

		KdPrint(("The %d Sub Value Name: %wZ\n", i, &uKeyName));
		
		if (pbi->Type == REG_SZ)
		{
			KdPrint(("The sub value type:REG_SZ\n"));
		}
		else if(pbi->Type == REG_MULTI_SZ)
		{
			KdPrint(("The sub value type:REG_MULTI_SZ\n"));
		}
		else if(pbi->Type == REG_DWORD)
		{
			KdPrint(("The sub value type:REG_DWORD\n"));
		}
		else if(pbi->Type == REG_BINARY)
		{
			KdPrint(("The sub value type:REG_BINARY\n"));
		}
		ExFreePool(pbi);
	}
	ExFreePool(pfi);
	ZwClose(hRegForWrite);
｝

封装的注册表操作API：

RtlCreateRegistryKey

RtlCheckRegistryKey

RtlWriteRegistryValue

RtlDeleteRegistryValue

RtlQueryRegistryValues