C++ (Cpp) TsmiListPatchChains Examples

Example #1

File: main.c Project: CM44/VBoxHardenedLoader

/*
* TsmiReadPatchChains
*
* Purpose:
*
* Read specified chains value from registry.
*
*/
NTSTATUS TsmiReadPatchChains(
    _In_ HANDLE sKey,
    _In_ PUNICODE_STRING ParamName,
    _In_ VBOX_PATCH *PatchInfo
)
{
    KEY_VALUE_PARTIAL_INFORMATION       keyinfo;
    ULONG                               ChainsLength = 0, bytesIO;
    NTSTATUS                            status;

    PAGED_CODE();

    if (sKey == NULL)
        return STATUS_INVALID_PARAMETER_1;

    if (ParamName == NULL)
        return STATUS_INVALID_PARAMETER_2;

    if (PatchInfo == NULL)
        return STATUS_INVALID_PARAMETER_3;

    status = ZwQueryValueKey(sKey, ParamName, KeyValuePartialInformation, &keyinfo, sizeof(KEY_VALUE_PARTIAL_INFORMATION), &ChainsLength);
    if (NT_SUCCESS(status)) {
        return STATUS_BUFFER_TOO_SMALL; // The key value is empty. It should not success with zero-length buffer if there are some data;
    }

    if ((status != STATUS_BUFFER_TOO_SMALL) && (status != STATUS_BUFFER_OVERFLOW)) {
        return status;
    }

    //
    // Allocate buffer for data with given size
    //
    PatchInfo->Chains = (PKEY_VALUE_PARTIAL_INFORMATION)ExAllocatePoolWithTagPriority(PagedPool,
        (SIZE_T)ChainsLength, TSUGUMI_TAG, NormalPoolPriority);
    if (PatchInfo->Chains == NULL)
        return STATUS_INSUFFICIENT_RESOURCES;


#ifdef _DEBUGMSG
    DbgPrint("[TSMI] ChainsLength=%lx\n", ChainsLength);
#endif //_DEBUGMSG

    RtlSecureZeroMemory(PatchInfo->Chains, ChainsLength);
    status = ZwQueryValueKey(sKey, ParamName, KeyValuePartialInformation, PatchInfo->Chains, ChainsLength, &bytesIO);
    if (NT_SUCCESS(status)) {
        PatchInfo->ChainsLength = ChainsLength;
#ifdef _DEBUGMSG
        TsmiListPatchChains(PatchInfo->Chains);
#endif //_DEBUGMSG
    }

    return status;
}

Example #2

File: main.c Project: jamella/VBoxHardenedLoader

/*
* TsmiReadPatchChains
*
* Purpose:
*
* Read specified chains value from registry.
*
*/
NTSTATUS TsmiReadPatchChains(
    _In_ HANDLE sKey,
    _In_ PUNICODE_STRING ParamName,
    _In_ PVOID *ParamBuffer,
    _In_ ULONG *ChainsLength
)
{
    KEY_VALUE_PARTIAL_INFORMATION   keyinfo;
    NTSTATUS                        status;
    ULONG                           bytesIO = 0;

    if (ChainsLength == NULL)
        return STATUS_INVALID_PARAMETER_4;

    status = ZwQueryValueKey(sKey, ParamName, KeyValuePartialInformation, &keyinfo, sizeof(KEY_VALUE_PARTIAL_INFORMATION), &bytesIO);
    if (NT_SUCCESS(status))
        return STATUS_BUFFER_TOO_SMALL; // The key value is empty. It should not success with zero-length buffer if there are some data;

    if ((status != STATUS_BUFFER_TOO_SMALL) && (status != STATUS_BUFFER_OVERFLOW))
        return STATUS_INVALID_PARAMETER; // we got unexpected return

    // bytesIO contains key value data length
    *ChainsLength = bytesIO;
    *ParamBuffer = (PKEY_VALUE_PARTIAL_INFORMATION)ExAllocatePoolWithTagPriority(PagedPool, (SIZE_T)bytesIO, TSUGUMI_TAG, NormalPoolPriority);
    if (*ParamBuffer == NULL)
        return STATUS_INSUFFICIENT_RESOURCES;

#ifdef _DEBUGMSG
    DbgPrint("[TSMI] ChainsLength=%lx\n", *ChainsLength);
#endif

    RtlSecureZeroMemory(*ParamBuffer, bytesIO);
    status = ZwQueryValueKey(sKey, ParamName, KeyValuePartialInformation, *ParamBuffer, bytesIO, &bytesIO);
#ifdef _DEBUGMSG
    if (NT_SUCCESS(status)) {
        TsmiListPatchChains(*ParamBuffer);
    }
#endif
    return status;
}