调用 IRtlKey

调用 IRtlKey

 

 

voidGetInterfaceAndObject(LPWSTRpszKey,IRtlKey **pIKey,CKey **pKey)

{

   IRtlSystemIsolationLayer *pSystem = NULL;

   RtlGetSystem(0,NULL, &pSystem);

   unsignedlongr = 2;

   LUNICODE_STRINGkey,ntKey = { 0 };

   RtlInitLUnicodeString(&key,pszKey);

   RtlConvertWin32RegistryPathToNtRegistryPath(&key, &ntKey);

   pSystem->OpenRegistryKey(1, 0xF003F, ntKey,pIKey, &r);

   //unsigned long,   flag0 - 4

   //ACCESS_MASK, DesiredAccessF003F

   //_LUNICODE_STRING const &,

   // attribues,      4

   //IRtlFile **, 创建的接口对象

   //unsigned long *  返回值

   if (pIKey)

       *pKey = *(CKey **)(pIKey);

}

 

IRtlKey *pIKey =NULL;

CKey *pKey =NULL;

//HKEY_LOCAL_MACHINE\\SYSTEM

//ACCESS DENIED Desired Access: All Access

GetInterfaceAndObject(L"HKCU\\CSITEST", &pIKey, &pKey);

 

LUNICODE_STRING *KeyName =newLUNICODE_STRING();

pIKey->GetName(2,KeyName);

标志值只能为2或 3，但结果一样。