00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022
#include "cmp.h"
00023
00024 #define HIVE_LIST L"\\registry\\machine\\system\\currentcontrolset\\control\\hivelist"
00025
00026 extern PCMHIVE CmpMasterHive;
00027
00028 BOOLEAN
00029
CmpGetHiveName(
00030
PCMHIVE CmHive,
00031 PUNICODE_STRING HiveName
00032 );
00033
00034
#ifdef ALLOC_PRAGMA
00035
#pragma alloc_text(PAGE,CmpAddToHiveFileList)
00036
#pragma alloc_text(PAGE,CmpRemoveFromHiveFileList)
00037
#pragma alloc_text(PAGE,CmpGetHiveName)
00038
#endif
00039
00040
00041
NTSTATUS
00042 CmpAddToHiveFileList(
00043
PCMHIVE CmHive
00044 )
00045
00046
00047
00048
00049
00050
00051
00052
00053
00054
00055
00056
00057
00058
00059
00060
00061
00062
00063 {
00064
00065
00066
00067
00068
#define NAME_BUFFER_SIZE 512
00069
OBJECT_ATTRIBUTES
ObjectAttributes;
00070 HANDLE KeyHandle;
00071
NTSTATUS Status;
00072 PUCHAR
Buffer;
00073 ULONG Length;
00074 PWSTR FilePath;
00075 WCHAR
UnicodeNull=UNICODE_NULL;
00076 UNICODE_STRING TempName;
00077 UNICODE_STRING HivePath;
00078
00079
00080
00081
00082
RtlInitUnicodeString(
00083 &TempName,
00084
HIVE_LIST
00085 );
00086
00087 InitializeObjectAttributes(
00088 &
ObjectAttributes,
00089 &TempName,
00090 OBJ_CASE_INSENSITIVE,
00091 (HANDLE)
NULL,
00092
NULL
00093 );
00094
00095
Status = ZwCreateKey(
00096 &KeyHandle,
00097 KEY_READ | KEY_WRITE,
00098 &
ObjectAttributes,
00099 0,
00100
NULL,
00101 REG_OPTION_VOLATILE,
00102
NULL
00103 );
00104
00105
if (!
NT_SUCCESS(
Status)) {
00106
CMLOG(
CML_MAJOR,
CMS_INIT_ERROR) {
00107 KdPrint((
"CmpAddToHiveFileList: "));
00108 KdPrint((
"Create/Open of Hive list failed status = %08lx\n",
Status));
00109 }
00110
return Status;
00111 }
00112
00113
00114
00115
00116
Buffer =
ExAllocatePool(
PagedPool,
NAME_BUFFER_SIZE);
00117
if (
Buffer ==
NULL) {
00118
NtClose(KeyHandle);
00119
return STATUS_NO_MEMORY;
00120 }
00121
00122
00123
00124
00125
if (!
CmpGetHiveName(CmHive, &HivePath)) {
00126
NtClose(KeyHandle);
00127
ExFreePool(
Buffer);
00128
return STATUS_NO_MEMORY;
00129 }
00130
00131
00132
00133
00134
00135
if (!(CmHive->
Hive.
HiveFlags &
HIVE_VOLATILE)) {
00136
Status = ZwQueryObject(
00137 CmHive->
FileHandles[
HFILE_TYPE_PRIMARY],
00138 ObjectNameInformation,
00139 (PVOID)
Buffer,
00140
NAME_BUFFER_SIZE,
00141 &Length
00142 );
00143 Length -=
sizeof(UNICODE_STRING);
00144
if (!
NT_SUCCESS(
Status)) {
00145
CMLOG(
CML_MAJOR,
CMS_INIT_ERROR) {
00146 KdPrint((
"CmpAddToHiveFileList: "));
00147 KdPrint((
"Query of name2 failed status = %08lx\n",
Status));
00148 }
00149
NtClose(KeyHandle);
00150
ExFreePool(HivePath.Buffer);
00151
ExFreePool(
Buffer);
00152
return Status;
00153 }
00154 FilePath = ((POBJECT_NAME_INFORMATION)
Buffer)->Name.Buffer;
00155 FilePath[Length/
sizeof(WCHAR)] = UNICODE_NULL;
00156 Length+=
sizeof(WCHAR);
00157 }
else {
00158 FilePath = &
UnicodeNull;
00159 Length =
sizeof(
UnicodeNull);
00160 }
00161
00162
00163
00164
00165
Status = ZwSetValueKey(
00166 KeyHandle,
00167 &HivePath,
00168 0,
00169 REG_SZ,
00170 FilePath,
00171 Length
00172 );
00173
if (!
NT_SUCCESS(
Status)) {
00174
CMLOG(
CML_MAJOR,
CMS_INIT_ERROR) {
00175 KdPrint((
"CmpAddToHiveFileList: "));
00176 KdPrint((
"Set of entry in Hive list failed status = %08lx\n",
Status));
00177 }
00178 }
00179
00180
NtClose(KeyHandle);
00181
ExFreePool(HivePath.Buffer);
00182
ExFreePool(
Buffer);
00183
return Status;
00184 }
00185
00186
00187
VOID
00188 CmpRemoveFromHiveFileList(
00189
PCMHIVE CmHive
00190 )
00191
00192
00193
00194
00195
00196
00197
00198
00199
00200
00201
00202
00203
00204
00205
00206 {
00207
NTSTATUS Status;
00208 UNICODE_STRING EntryName;
00209 UNICODE_STRING TempName;
00210 OBJECT_ATTRIBUTES
ObjectAttributes;
00211 HANDLE KeyHandle;
00212
00213
00214
00215
00216
RtlInitUnicodeString(
00217 &TempName,
00218
HIVE_LIST
00219 );
00220
00221 InitializeObjectAttributes(
00222 &
ObjectAttributes,
00223 &TempName,
00224 OBJ_CASE_INSENSITIVE,
00225 (HANDLE)
NULL,
00226
NULL
00227 );
00228
00229
Status = ZwOpenKey(
00230 &KeyHandle,
00231 KEY_READ | KEY_WRITE,
00232 &
ObjectAttributes
00233 );
00234
00235
if (!
NT_SUCCESS(
Status)) {
00236
return;
00237 }
00238
00239
CmpGetHiveName(CmHive, &EntryName);
00240
00241 ZwDeleteValueKey(KeyHandle, &EntryName);
00242
00243
NtClose(KeyHandle);
00244
ExFreePool(EntryName.Buffer);
00245
00246
return;
00247 }
00248
00249
00250 BOOLEAN
00251 CmpGetHiveName(
00252
PCMHIVE CmHive,
00253 PUNICODE_STRING HiveName
00254 )
00255
00256
00257
00258
00259
00260
00261
00262
00263
00264
00265
00266
00267
00268
00269
00270
00271
00272
00273
00274
00275 {
00276
HCELL_INDEX RootCell;
00277
HCELL_INDEX LinkCell;
00278
PCM_KEY_NODE LinkKey;
00279
PCM_KEY_NODE LinkParent;
00280 ULONG size;
00281 ULONG rsize;
00282 ULONG KeySize;
00283 ULONG ParentSize;
00284 PWCHAR p;
00285
PCM_KEY_NODE EntryKey;
00286
00287
00288
00289
00290 RootCell = CmHive->
Hive.
BaseBlock->
RootCell;
00291 EntryKey = (
PCM_KEY_NODE)
HvGetCell((
PHHIVE)CmHive, RootCell);
00292 LinkCell = EntryKey->
Parent;
00293
00294
00295
00296
00297
00298 LinkKey = (
PCM_KEY_NODE)
HvGetCell((
PHHIVE)
CmpMasterHive, LinkCell);
00299 LinkParent = (
PCM_KEY_NODE)
HvGetCell(
00300 (
PHHIVE)
CmpMasterHive,
00301 LinkKey->
Parent
00302 );
00303 rsize = wcslen(
L"\\REGISTRY\\");
00304
00305 KeySize =
CmpHKeyNameLen(LinkKey);
00306 ParentSize =
CmpHKeyNameLen(LinkParent);
00307 size = KeySize + ParentSize +
00308 (rsize *
sizeof(WCHAR)) +
sizeof(WCHAR);
00309
00310 HiveName->Buffer =
ExAllocatePool(
PagedPool, size);
00311
if (HiveName->Buffer ==
NULL) {
00312
return FALSE;
00313 }
00314
00315 HiveName->Length = (
USHORT)size;
00316 HiveName->MaximumLength = (
USHORT)size;
00317 p = HiveName->Buffer;
00318
00319 RtlCopyMemory(
00320 (PVOID)p,
00321 (PVOID)
L"\\REGISTRY\\",
00322 rsize *
sizeof(WCHAR)
00323 );
00324 p += rsize;
00325
00326
if (LinkParent->
Flags &
KEY_COMP_NAME) {
00327
CmpCopyCompressedName(p,
00328 ParentSize,
00329 LinkParent->
Name,
00330 LinkParent->
NameLength);
00331 }
else {
00332 RtlMoveMemory(
00333 (PVOID)p,
00334 (PVOID)&(LinkParent->
Name[0]),
00335 ParentSize
00336 );
00337 }
00338
00339 p += ParentSize /
sizeof(WCHAR);
00340
00341 *p = OBJ_NAME_PATH_SEPARATOR;
00342 p++;
00343
00344
if (LinkKey->
Flags &
KEY_COMP_NAME) {
00345
CmpCopyCompressedName(p,
00346 KeySize,
00347 LinkKey->
Name,
00348 LinkKey->
NameLength);
00349
00350 }
else {
00351 RtlMoveMemory(
00352 (PVOID)p,
00353 (PVOID)&(LinkKey->
Name[0]),
00354 KeySize
00355 );
00356 }
00357
00358
return TRUE;
00359 }
00360
00361