Software & Application Miscellaneous: ZwQueryKey with not opened handle?

  • anonymous / 205 / Sun, 31 Jan 2010 01:46:00 GMT / Comments (0)
  • Using Regmon I have watched registry operations during a process' initialization time.
    The weired thing is "ZwQueryKey's input handle and the result" Sometimes, ZwQueryKey uses not-yet-opened handle values and get SUCCESSFUL return value. how is this possible?
    (I am sure that my tests are correct, if the Regmon operates correctly.
    I have seen these result so many times, with so many applications.)

    following is an example.
    OpenKey SUCCESS [RootKey: 0x0] [OutPut Handle: 0x58]
    \REGISTRY\USER\S-1-5-21-1060284298-630328440-1801674531-500_Classes
    QueryKey SUCCESS [InPut Handle: 0x5A]
    Name:
    \REGISTRY\User\S-1-5-21-1060284298-630328440-1801674531-500_Classes

    pleas let me know the secret of the "ZwQueryKey"

    Thank you in advance
  • Keywords:

    zwquerykey, opened, handle, software, application

  • http://software.itags.org/software-application/240748/«« Last Thread - Next Thread »»