IopOpenRegistryKey
NTSTATUS __stdcall IopOpenRegistryKey(
PVOID *Handle,
PVOID BaseHandle,
UNICODE_STRING *KeyName,
UINT64 DesiredAccess,
UINT8 Create){
UINT64 CreateOptions;
struct _OBJECT_ATTRIBUTES v7;
UINT64 Disposition;
v7.ObjectName = KeyName;
*(_QWORD *)&v7.Length = 48i64;
*(_QWORD *)&v7.Attributes = 576i64;
v7.RootDirectory = BaseHandle;
LODWORD(Disposition) = 0;
*(_OWORD *)&v7.SecurityDescriptor = 0i64;
if( !Create )
return ZwOpenKey(Handle, DesiredAccess, &v7);
LODWORD(CreateOptions) = 1;
return ZwCreateKey(Handle, (unsigned int)DesiredAccess, &v7, 0i64, 0i64, CreateOptions, &Disposition);
}Referenced by:
IoQueryDeviceDescription
IopAllowRemoteDASD
IopBootLog
IopCopyBootLogRegistryToFile
IopInitializeOfflineCrashDump
IopIsBitlockerOn
IopLiveDumpInitRegistrySettings
IopLoadUnloadDriver
IopReadDumpRegistry
IopRegistryOpenDeepestPath
IopSafebootDriverLoad
IopSymlinkQueryEnabledClasses
IopUnloadDriver
SecureDump_ReadRegistry
pIoQueryBusDescription
pIoQueryDeviceDescription