Using Regmon I have watched registry operations during a process' initialization time.
The weired thing is "ZwQueryKey's input handle and the result" Sometimes, ZwQueryKey uses not-yet-opened handle values and get SUCCESSFUL return value. how is this possible?
(I am sure that my tests are correct, if the Regmon operates correctly.
I have seen these result so many times, with so many applications.)
following is an example.
OpenKey SUCCESS [RootKey: 0x0] [OutPut Handle: 0x58]
\REGISTRY\USER\S-1-5-21-1060284298-630328440-1801674531-500_Classes
QueryKey SUCCESS [InPut Handle: 0x5A]
Name:
\REGISTRY\User\S-1-5-21-1060284298-630328440-1801674531-500_Classes
pleas let me know the secret of the "ZwQueryKey"
Thank you in advance