在远景中情况怎样REG.EXE的FLAGS开关工作吗?分开2

笔记:这原来从http://mygreenpaste.blogspot.com内容.如果时间你正从一些另一地点,请花费访问我的格林浆糊公司看出它,感谢你.

从前,我计划性地在远景中写作为REG.EXE FLAGS开关和包括一将设定一登记处关键的和virtualization-有关的旗帜的技术.这杆打算包括另一面提出问题为一登记处关键的和virtualization-有关的旗帜.再次,我们正处理一个在NTDLL.DLL--NtQueryKey中"无证明文件的"功能:

NTSTATUS NtQueryKey(
  IN HANDLE KeyHandle,
  IN KEY_INFORMATION_CLASS KeyInformationClass,
  OUT PVOID KeyInformation,
  IN ULONG Length
  OUT PULONG ResultLength );

为一关键找回旗帜,有KeyInformationClass的呼叫NtQueryKey开始工作WDM.h向我们显示是KeyFlagsInformation的5.

typedef enum _KEY_INFORMATION_CLASS {
  KeyBasicInformation,
  KeyNodeInformation,
  KeyFullInformation,
  KeyNameInformation,
  KeyCachedInformation,
  KeyFlagsInformation,
  KeyVirtualizationInformation,
  MaxKeyInfoClass // MaxKeyInfoClass should always be the last enum
} KEY_INFORMATION_CLASS

当NtQueryKey返回的时候,为长度param的价值和缓冲存储器((KeyInformation)的最后4字节REG.EXE供应12被修改.这个将建议收到含有virtualization旗帜信息struct看起来像某样东西看来好像:

typedef struct _KEY_FLAGS_INFO {
  ULONG unknown1;
  ULONG unknown2;
  ULONG ControlFlags;
} KEY_FLAGS_INFO, *PKEY_FLAGS_INFO;

然后,同时表达它,我们喜欢让某样东西:

typedef NTSYSAPI NTSTATUS (NTAPI* FuncNtQueryKey)( HANDLE KeyHandle, KEY_INFORMATION_CLASS KeyInformationClass, PVOID KeyInformation, ULONG Length, PULONG ResultLength );
// ...
FuncNtQueryKey ntqk = (FuncNtQueryKey)GetProcAddress( GetModuleHandle( _T("ntdll.dll") ), "NtQueryKey" );
KEY_FLAGS_INFO kfi = {0};
HKEY hTheKey = NULL;
RegOpenKeyEx( HKEY_LOCAL_MACHINE, _T("SOFTWARE\\Whatever"), 0, KEY_ALL_ACCESS, &hTheKey );
DWORD dwResultLen = 0;
DWORD dwNtqkResult = ntqk( hTheKey , KeyFlagsInformation, &kfi, sizeof( KEY_FLAGS_INFO ), &dwResultLen );
RegCloseKey( hTheKey );
hTheKey = NULL;

旗帜((从第1)部分_CONTROL_FLAGS被在kfi.ControlFlags中储存为一bitmask.

typedef enum _CONTROL_FLAGS {
  RegKeyClearFlags = 0,
  RegKeyDontVirtualize = 2,
  RegKeyDontSilentFail = 4,
  RegKeyRecurseFlag = 8
} CONTROL_FLAGS;

是祈求保佑REG.EXE FLAGSHKLM\Software\Whatever QUERY,在上方的代码提供同样的信息.

再次-指出这探查被有关视窗远景SP1.我将预期这里内容也施加禁止以及视窗服务器2008但是...深孚众望SP于视窗远景:2%

被Â«/\/\Ã˜|Ã¶Â±Ã²\/Â»Â®Â��作a9.阅读更多伟大喂在来源是WEBSITE
禁止意见.
阅读更的多的有关Sysinternals论坛和登记处virtualization和reg.exe旗帜和NtQueryKey和REG_KEY_DONT_VIRTUALIZE和旗帜和远景和otherSoftware和REG_KEY_DONT_SILENT_FAIL和规章和Virtualization的文章.