阅读:1551回复:0
大家帮忙看一下,为何这段访问注册表的挖码,一运行就重启?
//从注册表读一个字符串
BOOLEAN ReadRegValueKey( IN HANDLE hHandle, //注册表句柄 IN PWCHAR pwValueNameString, //UNICOD型的键名 OUT PVOID pData, //数据指针 IN ULONG iDataLength //数据长度 ) { UINT i; NTSTATUS ntStatus; UNICODE_STRING wValueName;//测试,所以没返回,保存在这个值中 WCHAR wValue[1024]; ULONG iLength; BOOLEAN bSuccess = FALSE; PKEY_VALUE_FULL_INFORMATION FullInfo; PAGED_CODE(); RtlInitUnicodeString (&wValueName, pwValueNameString); iLength = sizeof (KEY_VALUE_FULL_INFORMATION) + wValueName.MaximumLength + iDataLength; FullInfo = ExAllocatePool (PagedPool, iLength); if (FullInfo) { ntStatus = ZwQueryValueKey (hHandle, &wValueName, KeyValueFullInformation, FullInfo, iLength, &iLength); if (NT_SUCCESS (ntStatus)) { DBGPRINT("ZwQueryValueKey is OK\n"); DbgPrint("ZwQueryValueKey return UNICODE length = %d\n",FullInfo->DataLength); ASSERT (iDataLength == FullInfo->DataLength); //RtlCopyMemory(&wValue, ((PUCHAR)FullInfo) + FullInfo->DataOffset, FullInfo->DataLength); //RtlInitUnicodeString (&wValueName, (PCWSTR)((PUCHAR) FullInfo) + FullInfo->DataOffset); //RtlUnicodeStringToAnsiString(&sValue,&wValue,TRUE); //NdisMoveMemory(pData,sValue.Buffer,sValue.Length); DbgPrint("ZwQueryValueKey return length = %d\n",FullInfo->DataLength); for(i=0;i<(FullInfo->DataLength)/2;i++) DbgPrint("%d",((PUCHAR)FullInfo) + FullInfo->DataOffset+i); DBGPRINT("\n"); bSuccess = TRUE; } else DBGPRINT("ZwQueryValueKey is FAILRUE\n"); ExFreePool (FullInfo); } return bSuccess; } |
|
|