Home » Category » Software & Application Miscellaneous

Software & Application Miscellaneous: ZwQueryKey with not opened handle?

205| Tue, 20 May 2008 08:01:00 GMT| anonymous| Comments (0)
Using Regmon I have watched registry operations during a process' initialization time.
The weired thing is "ZwQueryKey's input handle and the result" Sometimes, ZwQueryKey uses not-yet-opened handle values and get SUCCESSFUL return value. how is this possible?
(I am sure that my tests are correct, if the Regmon operates correctly.
I have seen these result so many times, with so many applications.)

following is an example.
OpenKey SUCCESS [RootKey: 0x0] [OutPut Handle: 0x58]
\REGISTRY\USER\S-1-5-21-1060284298-630328440-1801674531-500_Classes
QueryKey SUCCESS [InPut Handle: 0x5A]
Name:
\REGISTRY\User\S-1-5-21-1060284298-630328440-1801674531-500_Classes

pleas let me know the secret of the "ZwQueryKey"

Thank you in advance

Keywords & Tags: zwquerykey, opened, handle, software, application

URL: http://software.itags.org/software-application/240748/
 
«« Prev - Next »» 0 helpful answers below.

Software & Application Miscellaneous Hot Answers

Software & Application Miscellaneous New questions

Software & Application Miscellaneous Related Categories