HowTo - Delete 0-Byte Registry Keys

HKEY_LOCAL_MACHINE\SOFTWARE\LicCtrl (noch lesbar)

HKEY_LOCAL_MACHINE\SOFTWARE\LicCtrl\LicCtrl (mit 0-Byte geschrieben und gesperrt)

LicCtrl Service

C:\WINDOWS\runservice.exe

void *LoadEntryPoint (HMODULE hModule, char *szFunction)
     {
     void *pResult_;

     if ((pResult_ = GetProcAddress (hModule, szFunction)) == NULL)
        {
        printf ("Could not find %s entry point.\n", szFunction);  
        exit (1);
        }
     return (pResult_);
     }

//
// Loads and finds the entry points we need in NTDLL.DLL
//
VOID LocateNTDLLEntryPoints ()
     {
     HMODULE hLib_;

     if ((hLib_ = GetModuleHandle ("ntdll.dll")) != NULL)  
        {
        NtOpenKey           = LoadEntryPoint (hLib_, "NtOpenKey");  
        NtCreateKey         = LoadEntryPoint (hLib_, "NtCreateKey");  
        NtEnumerateValueKey = LoadEntryPoint (hLib_, "NtEnumerateValueKey");  
        NtEnumerateKey      = LoadEntryPoint (hLib_, "NtEnumerateKey");  
        NtSetValueKey       = LoadEntryPoint (hLib_, "NtSetValueKey");  
        NtQueryValueKey     = LoadEntryPoint (hLib_, "NtQueryValueKey");  
        NtDeleteKey         = LoadEntryPoint (hLib_, "NtDeleteKey");  
        }
     else
        {
        printf("Could not get handle for NTDLL.DLL\n");  
        exit (1);
        }
     return;
     }

BOOL RecurseKey (PUNICODE_STRING pKeyName, HANDLE hPrior)
     {
     OBJECT_ATTRIBUTES ObjectAttributes_;
     UNICODE_STRING TmpKeyName_;
     NTSTATUS ntStatus_;
     KEY_NODE_INFORMATION *pknInfo_;
     char *szKey_;
     HANDLE hKey_;
     WCHAR wTmpKey_ [MaxKeySize * 2], wBuffer_ [MaxKeySize * 2];
     int ch_;
     DWORD dwSize_, dwKeyLen_, dwIndex_, dwChrIdx_;
     BOOL Result_;

     InitializeObjectAttributes (&ObjectAttributes_, pKeyName,  OBJ_CASE_INSENSITIVE, hPrior, NULL);

     ntStatus_ = NtOpenKey (&hKey_, KEY_ALL_ACCESS,  &ObjectAttributes_);

     dwIndex_ = 0;
     dwSize_ = (MaxKeySize + 1) * sizeof (WCHAR);
     ntStatus_ = NtEnumerateKey (hKey_, dwIndex_, KeyNodeInformation, (char *)wBuffer_, dwSize_, &dwSize_);

     while (ntStatus_ == 0)
        {
        pknInfo_ = (KEY_NODE_INFORMATION *) wBuffer_;
        dwKeyLen_ = WideCharToMultiByte (CP_ACP, 0, pknInfo_->Name, pknInfo_->NameLength/sizeof(WCHAR), NULL, 0, NULL, NULL);

        szKey_ = (char *) wTmpKey_;
        memcpy (szKey_, pKeyName->Buffer, pKeyName->Length);
        szKey_ += pKeyName->Length;
        *szKey_++ = '\\';  
        *szKey_++ = 0;
        memcpy (szKey_, pknInfo_->Name,   pknInfo_->NameLength);

        TmpKeyName_.Buffer = wTmpKey_;
        TmpKeyName_.Length = pKeyName->Length + 2 + pknInfo_->NameLength;

        if (RecurseKey (&TmpKeyName_, NULL) == FALSE)
           dwIndex_++;

        dwSize_ = (MaxKeySize + 1) * sizeof (WCHAR);
        ntStatus_ = NtEnumerateKey (hKey_, dwIndex_, KeyNodeInformation, (char *)wBuffer_, dwSize_, &dwSize_);
        }
     Result_ = FALSE;

     for (dwChrIdx_ = 0; dwChrIdx_ < (pKeyName->Length >> 1); dwChrIdx_++)
        {
        if (pKeyName->Buffer [dwChrIdx_] == 0)
           Result_ = TRUE;
        }
     if (Result_)
        {
        // We have a KEY with a NUL imbedded. Print it out.
        for (dwChrIdx_ = 0; dwChrIdx_ < (pKeyName->Length >> 1); dwChrIdx_++)
           {
           if (pKeyName->Buffer [dwChrIdx_] == 0)
              printf ("Û");  
           else
              printf ("%c", pKeyName->Buffer [dwChrIdx_]);  
           }
        printf ("\n");  
        PrintValues (hKey_);

        printf ("Kill this key? (y/n) ");  

        ch_ = getchar ();

        while (ch_ != 'y' && ch_ != 'n')  
           ch_ = getchar ();

        if (ch_ == 'y')  
           NtDeleteKey (hKey_);
        else
           Result_ = FALSE;
        }
     return (Result_);
     }

int main (int arg_cn, char *arg_pa )
     {
     UNICODE_STRING KeyName_;
     PWCHAR pwKeyName_;

     LocateNTDLLEntryPoints ();

     pwKeyName_ = L"\\Registry\\Machine\\SOFTWARE\\LicCtrl";  

     KeyName_.Buffer = pwKeyName_;
     KeyName_.Length = wcslen (pwKeyName_) * sizeof(WCHAR);

     RecurseKey (&KeyName_, NULL);

     return (0);
     }

// Reghide.c
//
// by Mark Russinovich
// http://www.sysinternals.com
//
// This program demonstrates how the Native API can be used to 
// create object names that are inaccessible from the Win32 API. While
// there are many different ways to do this, the method used here it to
// include a terminating NULL that is explicitly made part of the key name.
// There is no way to describe this with the Win32 API, which treats a NULL
// as the end of the name string and will therefore chop it. Thus, Regedit
// and Regedt32 won't be able to access this key, though it will be visible.                  
//
#include "windows.h" 
#include "stdio.h" 
#include "reghide.h" 

//
// The name of the key and value that we're going to create  
//
WCHAR KeyNameBuffer		= L"\\Registry\\Machine\\SOFTWARE";  
WCHAR NewKeyNameBuffer	= L"Systems Internals";  
WCHAR HiddenKeyNameBuffer = L"Can't touch me!\0";  
WCHAR HiddenValueNameBuffer= L"Hidden Value";  

//
// Convenience output routine
//
VOID Output( char *msg, DWORD Buttons )
{
	MessageBox( NULL, msg, "RegHide", Buttons );  
}


//
// Loads and finds the entry points we need in NTDLL.DLL
//
VOID LocateNTDLLEntryPoints()
{
	if( !(NtCreateKey = (void *) GetProcAddress( GetModuleHandle("ntdll.dll"),  
			"NtCreateKey" )) ) {  

		printf("Could not find NtCreateKey entry point in NTDLL.DLL\n");  
		exit(1);
	}
	if( !(NtDeleteKey = (void *) GetProcAddress( GetModuleHandle("ntdll.dll"),  
			"NtDeleteKey" )) ) {  

		printf("Could not find NtDeleteKey entry point in NTDLL.DLL\n");  
		exit(1);
	}
	if( !(NtSetValueKey = (void *) GetProcAddress( GetModuleHandle("ntdll.dll"),  
			"NtSetValueKey" )) ) {  

		printf("Could not find NtSetValueKey entry point in NTDLL.DLL\n");  
		exit(1);
	}
}


//
// Create the key and value, tell the user to try to access it, and then delete it
// after they've tried  
//
int APIENTRY WinMain( HINSTANCE hInstance, HINSTANCE hPrevInstance,
						LPSTR lpCmdLine, int nCmdShow )
{
	UNICODE_STRING KeyName, ValueName;
	HANDLE SoftwareKeyHandle, SysKeyHandle, HiddenKeyHandle;
	ULONG Status;
	OBJECT_ATTRIBUTES ObjectAttributes;
	ULONG Disposition;
	char input;

	//
	// Load the entry points we need
	//
	LocateNTDLLEntryPoints();

	//
	// Print banner
	//
	Output( "\n                                              Reghide\n"  
			"Creates a Registry key that cannot be opened with Regedit/Regedt32\n\n"  
			"                                 by Mark Russinovich\n"  
			"                             http://www.sysinternals.com\n", MB_OK );  

	//
	// Open the Software key
	//
	KeyName.Buffer = KeyNameBuffer;
	KeyName.Length = wcslen( KeyNameBuffer ) *sizeof(WCHAR);
	InitializeObjectAttributes( &ObjectAttributes, &KeyName, 
			OBJ_CASE_INSENSITIVE, NULL, NULL );
	Status = NtCreateKey( &SoftwareKeyHandle, KEY_ALL_ACCESS, 
					&ObjectAttributes, 0,  NULL, REG_OPTION_NON_VOLATILE,
					&Disposition );
	if( !NT_SUCCESS( Status )) {

		Output("Error: Couldn't open HKLM\\Software\n", MB_ICONERROR );  
		exit(1);
	}

	//
	// Create the Systems Internals key
	//
	KeyName.Buffer = NewKeyNameBuffer;
	KeyName.Length = wcslen( NewKeyNameBuffer ) *sizeof(WCHAR);
	InitializeObjectAttributes( &ObjectAttributes, &KeyName, 
			OBJ_CASE_INSENSITIVE, SoftwareKeyHandle, NULL );
	Status = NtCreateKey( &SysKeyHandle, KEY_ALL_ACCESS, 
					&ObjectAttributes, 0, NULL, REG_OPTION_NON_VOLATILE,
					&Disposition );
	if( !NT_SUCCESS( Status )) {

		Output("Error: Couldn't create HKLM\\Software\\Systems Internals\n",  
				MB_ICONERROR);
		exit(1);
	}

	//
	// Create the Hidden key
	//
	KeyName.Buffer = HiddenKeyNameBuffer;
	// length here must include terminating null
	KeyName.Length = wcslen( HiddenKeyNameBuffer ) *sizeof(WCHAR) + sizeof(WCHAR);
	InitializeObjectAttributes( &ObjectAttributes, &KeyName, 
			OBJ_CASE_INSENSITIVE, SysKeyHandle, NULL );
	Status = NtCreateKey( &HiddenKeyHandle, KEY_ALL_ACCESS, 
					&ObjectAttributes, 0, NULL, REG_OPTION_NON_VOLATILE,
					&Disposition );
	if( !NT_SUCCESS( Status )) {

		Output("Error: Couldn't create HKLM\\Software\\Systems Internals\\RegHide\n",  
				MB_ICONERROR);
		exit(1);
	}

	//
	// Create the hidden value
	//
	ValueName.Buffer = HiddenValueNameBuffer;
	ValueName.Length = wcslen( HiddenValueNameBuffer ) *sizeof(WCHAR);
	Status = NtSetValueKey( HiddenKeyHandle, &ValueName, 0, REG_SZ, 
						HiddenValueNameBuffer, 
						wcslen( HiddenValueNameBuffer ) * sizeof(WCHAR) );
	if( !NT_SUCCESS( Status )) {

		Output("Error: Couldn't create our hidden value\n", MB_ICONERROR);  
		NtDeleteKey( HiddenKeyHandle );
		exit(1);
	}

	//
	// Let the user try and open our key!
	//
	Output("Try and open the key \"HKLM\\SOFTWARE\\Systems Internals\\Can't touch me!\"\n"  
		"with Regedit or Regedt32 (or any other Registry editor). There is a value\n"  
		"in the key called \"Hidden Value\".\n\n"  
		"When done trying, press any key to have the key deleted and exit.\n",  
		MB_ICONINFORMATION|MB_OK );

	input = getchar();

	//
	// Cleanup the key
	//
	NtDeleteKey( HiddenKeyHandle );
	return 0;

}

//
// Reghide.h
//
// Various native API stuff that we need
//

#define OBJ_CASE_INSENSITIVE 0x40

typedef DWORD ULONG;
typedef WORD  USHORT;
typedef ULONG NTSTATUS;

#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)

typedef struct _UNICODE_STRING {
    USHORT Length;
    USHORT MaximumLength;
    PWSTR  Buffer;
} UNICODE_STRING;
typedef UNICODE_STRING *PUNICODE_STRING;


typedef struct _OBJECT_ATTRIBUTES {
    ULONG Length;
    HANDLE RootDirectory;
    PUNICODE_STRING ObjectName;
    ULONG Attributes;
    PVOID SecurityDescriptor;        // Points to type SECURITY_DESCRIPTOR
    PVOID SecurityQualityOfService;  // Points to type SECURITY_QUALITY_OF_SERVICE
} OBJECT_ATTRIBUTES;
typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES;

#define InitializeObjectAttributes( p, n, a, r, s ) { \
    (p)->Length = sizeof( OBJECT_ATTRIBUTES );          \
    (p)->RootDirectory = r;                             \
    (p)->Attributes = a;                                \
    (p)->ObjectName = n;                                \
    (p)->SecurityDescriptor = s;                        \
    (p)->SecurityQualityOfService = NULL;               \
    }

NTSTATUS (__stdcall *NtCreateKey)(
		HANDLE KeyHandle, 
		ULONG DesiredAccess, 
		POBJECT_ATTRIBUTES ObjectAttributes,
		ULONG TitleIndex, 
		PUNICODE_STRING Class, 
		ULONG CreateOptions, 
		PULONG Disposition 
		);

NTSTATUS (__stdcall *NtSetValueKey)(
		IN HANDLE  KeyHandle,
		IN PUNICODE_STRING  ValueName,
		IN ULONG  TitleIndex,			/* optional */
		IN ULONG  Type,
		IN PVOID  Data,
		IN ULONG  DataSize
		);


NTSTATUS (__stdcall *NtDeleteKey)(
		HANDLE KeyHandle
		);