Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Source.c:
- UNREFERENCED_PARAMETER(RegistryPath);
- INT err = KLoggerInit(RegistryPath);
- Klogger.h/KLogger.c:
- INT KLoggerInit(PUNICODE_STRING RegistryPath)
- KLogger.c:
- size_t ring_buf_size = get_ring_buf_size(RegistryPath);
- size_t get_ring_buf_size(PUNICODE_STRING RegistryPath)
- {
- HANDLE reg_key_handle;
- NTSTATUS status;
- OBJECT_ATTRIBUTES obj_attr;
- UNICODE_STRING reg_key_path;
- ULONG key_value = DEFAULT_RING_BUF_SIZE;
- PKEY_VALUE_PARTIAL_INFORMATION part_info;
- ULONG part_info_size;
- InitializeObjectAttributes(&obj_attr, RegistryPath, 0, NULL, NULL);
- // status = ZwOpenKey(®_key_handle, KEY_QUERY_VALUE, &obj_attr);
- status = ZwCreateKey(®_key_handle, KEY_QUERY_VALUE | KEY_SET_VALUE, &obj_attr, 0, NULL, REG_OPTION_NON_VOLATILE, NULL);
- if (!NT_SUCCESS(status))
- {
- DbgPrint("[library_driver]: 'ZwCreateKey()' failed");
- return DEFAULT_RING_BUF_SIZE;
- }
- RtlInitUnicodeString(®_key_path, REGISTRY_BUF_SIZE_KEY);
- part_info_size = sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(part_info_size);
- part_info = ExAllocatePool(PagedPool, part_info_size);
- if (part_info == NULL)
- {
- DbgPrint("[library_driver]: 'ExAllocatePool()' failed");
- ZwClose(reg_key_handle);
- return DEFAULT_RING_BUF_SIZE;
- }
- status = ZwQueryValueKey(reg_key_handle, ®_key_path, KeyValuePartialInformation,
- part_info, part_info_size, &part_info_size);
- switch (status) {
- case STATUS_SUCCESS:
- DbgPrint("[library_driver]: switch: STATUS_SUCCESS");
- if (part_info->Type == REG_DWORD && part_info->DataLength == sizeof(ULONG))
- {
- RtlCopyMemory(&key_value, part_info->Data, sizeof(key_value));
- ZwClose(reg_key_handle);
- ExFreePool(part_info);
- return key_value;
- }
- // break; - not break
- case STATUS_OBJECT_NAME_NOT_FOUND:
- DbgPrint("[library_driver]: switch: STATUS_OBJECT_NAME_NOT_FOUND");
- status = ZwSetValueKey(reg_key_handle, ®_key_path, 0, REG_DWORD, &key_value, sizeof(key_value));
- if (!NT_SUCCESS(status))
- {
- ZwClose(reg_key_handle);
- ExFreePool(part_info);
- return DEFAULT_RING_BUF_SIZE;
- }
- break;
- default:
- DbgPrint("[library_driver]: switch: default");
- ZwClose(reg_key_handle);
- ExFreePool(part_info);
- return DEFAULT_RING_BUF_SIZE;
- break;
- }
- ZwClose(reg_key_handle);
- ExFreePool(part_info);
- return DEFAULT_RING_BUF_SIZE;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement