1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
|
/*++
Copyright (c) Microsoft Corporation. All rights reserved.
THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
PURPOSE.
Module Name:
Capture.c
Abstract:
A sample that shows how to capture input parameters
Environment:
User mode only
--*/
#include "regctrl.h"
VOID
CaptureSample(
)
/*++
Routine Description:
This sample shows how to capture input parameters when the registery
operation comes from user mode.
The main part of this sample and a detailed explanation of why and how to
capture user mode parameters can be found in ..\sys\capture.c. The user
mode part of this sample simply calls RegSetValueEx and DeleteValue
since the REG_XXX_INFORMATION structure for these two operations are
only partially captured.
See ..\sys\Capture.c for the callback routine used in this sample.
Return Value:
None
--*/
{
LONG Res;
HRESULT hr;
DWORD ValueData = 0xDEADBEEF;
BOOL Result;
BOOL Success = FALSE;
DWORD BytesReturned;
REGISTER_CALLBACK_INPUT RegisterCallbackInput = {0};
REGISTER_CALLBACK_OUTPUT RegisterCallbackOutput = {0};
UNREGISTER_CALLBACK_INPUT UnRegisterCallbackInput = {0};
InfoPrint("");
InfoPrint("=== Capture Sample ====");
//
// Register callback
//
RtlZeroMemory(RegisterCallbackInput.Altitude,
MAX_ALTITUDE_BUFFER_LENGTH * sizeof(WCHAR));
hr = StringCbPrintf(RegisterCallbackInput.Altitude,
MAX_ALTITUDE_BUFFER_LENGTH * sizeof(WCHAR),
CALLBACK_ALTITUDE);
if (!SUCCEEDED(hr)) {
ErrorPrint("Copying altitude string failed. Error %d", hr);
goto Exit;
}
RegisterCallbackInput.CallbackMode = CALLBACK_MODE_CAPTURE;
Result = DeviceIoControl(g_Driver,
IOCTL_REGISTER_CALLBACK,
&RegisterCallbackInput,
sizeof(REGISTER_CALLBACK_INPUT),
&RegisterCallbackOutput,
sizeof(REGISTER_CALLBACK_OUTPUT),
&BytesReturned,
NULL);
if (Result != TRUE) {
ErrorPrint("RegisterCallback failed. Error %d", GetLastError());
goto Exit;
}
Success = TRUE;
//
// Create a value and delete it. Both should be successful.
//
Res = RegSetValueEx(g_RootKey,
VALUE_NAME,
0,
REG_DWORD,
(BYTE *) &ValueData,
sizeof(ValueData));
if(Res != ERROR_SUCCESS) {
ErrorPrint("RegSetValueEx return unexpected status %d", Res);
Success = FALSE;
}
Res = RegDeleteValue(g_RootKey, VALUE_NAME);
if (Res != ERROR_SUCCESS) {
ErrorPrint("RegDeleteValue on original value returned unexpected status: %d",
Res);
Success = FALSE;
}
//
// Unregister the callback
//
UnRegisterCallbackInput.Cookie = RegisterCallbackOutput.Cookie;
Result = DeviceIoControl(g_Driver,
IOCTL_UNREGISTER_CALLBACK,
&UnRegisterCallbackInput,
sizeof(UNREGISTER_CALLBACK_INPUT),
NULL,
0,
&BytesReturned,
NULL);
if (Result != TRUE) {
ErrorPrint("UnRegisterCallback failed. Error %d", GetLastError());
Success = FALSE;
}
Exit:
if (Success) {
InfoPrint("Capture Sample succeeded.");
} else {
ErrorPrint("Capture Sample failed.");
}
}
|
