阅读:2378回复:0
驱动操作注册表 ZwDeleteKey 问题。怎么删除 值键
现在代码是这样写的:
NTSTATUS DeleteRegKey(PCWSTR RegPath,PCWSTR ValueName) { int ReturnValue = 0; NTSTATUS Status; OBJECT_ATTRIBUTES ObjectAttributes; HANDLE KeyHandle,NewKeyHandle; UNICODE_STRING UnicodeRegPath; UNICODE_STRING UnicodeValueName; RtlInitUnicodeString(&UnicodeRegPath, RegPath); RtlInitUnicodeString(&UnicodeValueName, ValueName); InitializeObjectAttributes(&ObjectAttributes, &UnicodeRegPath, OBJ_CASE_INSENSITIVE, // Flags NULL, // Root directory NULL); // Security descriptor Status = ZwOpenKey(&KeyHandle, KEY_ALL_ACCESS, &ObjectAttributes); if (Status != STATUS_SUCCESS) { DbgPrint("ZwOpenKey Wrong\n"); return 0; } InitializeObjectAttributes(&ObjectAttributes, &UnicodeValueName, OBJ_CASE_INSENSITIVE | OBJ_OPENIF, KeyHandle, NULL); Status = ZwOpenKey(&NewKeyHandle, KEY_ALL_ACCESS, &ObjectAttributes); if (!NT_SUCCESS(Status)) { ZwClose(KeyHandle); DbgPrint("ZwOpenKey Wrong:%08x\n",Status); return Status; } Status = ZwDeleteKey(NewKeyHandle); if (!NT_SUCCESS(Status)) { ZwClose(NewKeyHandle); ZwClose(KeyHandle); DbgPrint("ZwDeleteKey Wrong:%08x\n",Status); return Status; } else { ReturnValue = 1; } ZwClose(NewKeyHandle); ZwClose(KeyHandle); return ReturnValue; } 当我调用: if(1!=DeleteRegKey(L"\\Registry\\Machine\\SYSTEM",L"123")) { DbgPrint("DeleteRegKey Wrong\n"); } else { DbgPrint("DeleteRegKey Ok\n"); } 删除的是: HKEY_LOCAL_MACHINE\SYSTEM下面的123键。 我要删除的是HKEY_LOCAL_MACHINE\SYSTEM右边的123键。 怎么做? |
|
最新喜欢:Leopar... |