Code:
uses
Windows;
type
_UNICODE_STRING = record
Length : Byte;
MaximumLength : Byte;
Buffer : WideString;
end;
_OBJECT_ATTRIBUTES = record
Length : LongWord;
RootDirectory : THandle;
ObjectName : _UNICODE_STRING;
Attributes : LongWord;
SecurityDescriptor : pointer;
SecurityQualityOfService : pointer;
end;
TNTCK = function(KeyHandle : THandle;
DesiredAccess : LongWord;
ObjectAttributes : _OBJECT_ATTRIBUTES;
TitleIndex : LongWord;
rClass : pointer;
CreateOptions : LongWord;
Disposition : PLongWord) : Cardinal;
TNTSVK = function(KeyHandle : THandle;
ValueName : _UNICODE_STRING;
TitleIndex : LongWord;
rType : Cardinal;
Data : pointer;
DataSize : LongWord) : Cardinal;
TNTDK = function(KeyHandle : THandle) : Cardinal;
const
OBJ_CASE_INSENSITIVE = 0x40;
var
KeyNameBuffer : WideString = '\Registry\Machine\SOFTWARE';
NewKeyNameBuffer : WideString = 'ProbaKey';
HiddenKeyNameBuffer : WideString = 'ProbaPodKey' + #0;
HiddenValueNameBuffer : WideString = 'HiddenVal';
SoftwareKeyHandle : Cardinal;
SysKeyHandle : Cardinal;
Disposition : LongWord;
KeyName, ValueName : _UNICODE_STRING;
NTCreateKey : TNTCK;
NTSetValueKey : TNTSVK;
NTDeleteKey : TNTDK;
ObjectAttributes : _OBJECT_ATTRIBUTES;
procedure InitializeObjectAttributes(n : _UNICODE_STRING; a : LongWord; r : THandle; s : pointer);
begin
With ObjectAttributes Do
Begin
Length := SizeOf(_OBJECT_ATTRIBUTES);
RootDirectory := r;
Attributes := a;
ObjectName := n;
SecurityDescriptor := s;
SecurityQualityOfService := nil;
End;
end;
procedure LocateNTDLLEntryPoints;
begin
NTCreateKey := GetProcAddress(GetModuleHandle('ntdll.dll'), 'NtCreateKey');
NTDeleteKey := GetProcAddress(GetModuleHandle('ntdll.dll'), 'NtDeleteKey');
NTSetValueKey := GetProcAddress(GetModuleHandle('ntdll.dll'), 'NtSetValueKey');
end;
begin
LocateNTDLLEntryPoints;
KeyName.Buffer := KeyNameBuffer;
KeyName.Length := Length(KeyNameBuffer) * SizeOf(WCHAR);
InitializeObjectAttributes(KeyName, OBJ_CASE_INSENSITIVE, 0, nil);
SoftwareKeyHandle := 0;
NTCreateKey(SoftwareKeyHandle, KEY_ALL_ACCESS, ObjectAttributes,
0, nil, REG_OPTION_NON_VOLATILE, @Disposition); // Ovo ne vraca ERROR_SUCCESS
SysKeyHandle := 0;
KeyName.Buffer := NewKeyNameBuffer;
KeyName.Length := Length(NewKeyNameBuffer) * SizeOf(WCHAR);
InitializeObjectAttributes(KeyName, OBJ_CASE_INSENSITIVE, SoftwareKeyHandle, nil);
NtCreateKey(SysKeyHandle, KEY_ALL_ACCESS, ObjectAttributes, 0,
nil, REG_OPTION_NON_VOLATILE, @Disposition); // Ni ovo ne vraca ERROR_SUCCESS
end.
uses
Windows;
type
_UNICODE_STRING = record
Length : Byte;
MaximumLength : Byte;
Buffer : WideString;
end;
_OBJECT_ATTRIBUTES = record
Length : LongWord;
RootDirectory : THandle;
ObjectName : _UNICODE_STRING;
Attributes : LongWord;
SecurityDescriptor : pointer;
SecurityQualityOfService : pointer;
end;
TNTCK = function(KeyHandle : THandle;
DesiredAccess : LongWord;
ObjectAttributes : _OBJECT_ATTRIBUTES;
TitleIndex : LongWord;
rClass : pointer;
CreateOptions : LongWord;
Disposition : PLongWord) : Cardinal;
TNTSVK = function(KeyHandle : THandle;
ValueName : _UNICODE_STRING;
TitleIndex : LongWord;
rType : Cardinal;
Data : pointer;
DataSize : LongWord) : Cardinal;
TNTDK = function(KeyHandle : THandle) : Cardinal;
const
OBJ_CASE_INSENSITIVE = 0x40;
var
KeyNameBuffer : WideString = '\Registry\Machine\SOFTWARE';
NewKeyNameBuffer : WideString = 'ProbaKey';
HiddenKeyNameBuffer : WideString = 'ProbaPodKey' + #0;
HiddenValueNameBuffer : WideString = 'HiddenVal';
SoftwareKeyHandle : Cardinal;
SysKeyHandle : Cardinal;
Disposition : LongWord;
KeyName, ValueName : _UNICODE_STRING;
NTCreateKey : TNTCK;
NTSetValueKey : TNTSVK;
NTDeleteKey : TNTDK;
ObjectAttributes : _OBJECT_ATTRIBUTES;
procedure InitializeObjectAttributes(n : _UNICODE_STRING; a : LongWord; r : THandle; s : pointer);
begin
With ObjectAttributes Do
Begin
Length := SizeOf(_OBJECT_ATTRIBUTES);
RootDirectory := r;
Attributes := a;
ObjectName := n;
SecurityDescriptor := s;
SecurityQualityOfService := nil;
End;
end;
procedure LocateNTDLLEntryPoints;
begin
NTCreateKey := GetProcAddress(GetModuleHandle('ntdll.dll'), 'NtCreateKey');
NTDeleteKey := GetProcAddress(GetModuleHandle('ntdll.dll'), 'NtDeleteKey');
NTSetValueKey := GetProcAddress(GetModuleHandle('ntdll.dll'), 'NtSetValueKey');
end;
begin
LocateNTDLLEntryPoints;
KeyName.Buffer := KeyNameBuffer;
KeyName.Length := Length(KeyNameBuffer) * SizeOf(WCHAR);
InitializeObjectAttributes(KeyName, OBJ_CASE_INSENSITIVE, 0, nil);
SoftwareKeyHandle := 0;
NTCreateKey(SoftwareKeyHandle, KEY_ALL_ACCESS, ObjectAttributes,
0, nil, REG_OPTION_NON_VOLATILE, @Disposition); // Ovo ne vraca ERROR_SUCCESS
SysKeyHandle := 0;
KeyName.Buffer := NewKeyNameBuffer;
KeyName.Length := Length(NewKeyNameBuffer) * SizeOf(WCHAR);
InitializeObjectAttributes(KeyName, OBJ_CASE_INSENSITIVE, SoftwareKeyHandle, nil);
NtCreateKey(SysKeyHandle, KEY_ALL_ACCESS, ObjectAttributes, 0,
nil, REG_OPTION_NON_VOLATILE, @Disposition); // Ni ovo ne vraca ERROR_SUCCESS
end.
OBJ_CASE_INSENSITIVE je 0x40 u C-u, ali koliko je u Delphi-u ??!
poz