ansaurus

Question

How to link to NTQueryKey in Kernel Mode

Answer 1

A:

In kernel mode you link to the Zw.... equivalent functions. See Here. NT.... functions are called from user mode (for example the Win32 subsystem would call the NT... functions).

Preet Sangha 2010-10-13 02:27:26

I'm trying to use ZwQueryKey but I'm getting an STATUS_INVALID_HANDLE. All I'm trying to do is get the key name on a Windows 2003 machine in a PostCreateOpenKeyEx routine.

Iunknown 2010-10-14 02:17:59

For completeness, a full discussion of the differences between the Nt and Zw variants is here: http://www.osronline.com/article.cfm?id=257.

snoone 2010-10-22 14:40:00

Answer 2

+1 A:

NtXXXX functions should not be called from kernel mode. Use the ZwXXXX functions instead. In your case, you want ZwQueryKey. It has the same signature as NtQueryKey, but it performs actions on the x86 required for talking with kernel mode, and it's provided by ntoskrnl.exe rather than by ntdll.dll.

Billy ONeal 2010-10-13 02:27:35

The problem I have is I'm trying to open a user mode key. First I try ZwQueryKey and I get the error Invalid Handle, which I figured meant I need to use NTQueryKey.

Iunknown 2010-10-14 02:14:34

@kunknown: What do you mean by user mode key? ZwQueryKey is the exact same function as NtQueryKey with respect to how it works. The only difference is that NtQueryKey does a bunch of syscall crap.

Billy ONeal 2010-10-14 02:15:49

With a little help from OSR, I think I found the problem. I misunderstood the a "A pointer to the registry key object" is not a pointer to a handle. Trying ObOpenObjectByPointer now.

Iunknown 2010-10-14 16:15:32

ansaurus

tags:

views:

answers:

How to link to NTQueryKey in Kernel Mode

related questions