8 #define __return_type NTSTATUS
9 #define _SUCCESS STATUS_SUCCESS
10 #define IS_SUCCESS(x) (NT_SUCCESS(x))
12 #define REG_CREATE_FLAGS 0
13 #define GUID_STRING_LENGTH 38
28 UNICODE_STRING unicode_string = {0};
30 NTSTATUS status = RtlStringFromGUID(guid, &unicode_string);
31 if (status != STATUS_SUCCESS) {
36 status = STATUS_BUFFER_TOO_SMALL;
40 __analysis_assume(unicode_string.MaximumLength >=
GUID_STRING_LENGTH *
sizeof(
wchar_t));
41 __analysis_assume(unicode_string.Buffer != NULL);
48 if (unicode_string.Buffer != NULL) {
49 RtlFreeUnicodeString(&unicode_string);
56 ebpf_registry_key_t key, _In_z_
const wchar_t* value_name, _In_reads_(value_size) uint8_t* value,
size_t value_size)
58 UNICODE_STRING unicode_value_name;
60 RtlInitUnicodeString(&unicode_value_name, value_name);
61 return ZwSetValueKey(key, &unicode_value_name, 0, REG_BINARY, value, (ULONG)value_size);
68 UNICODE_STRING unicode_value;
69 UNICODE_STRING unicode_value_name;
71 ANSI_STRING ansi_string;
72 RtlInitAnsiString(&ansi_string, value);
74 status = RtlAnsiStringToUnicodeString(&unicode_value, &ansi_string, TRUE);
75 if (!NT_SUCCESS(status)) {
78 RtlInitUnicodeString(&unicode_value_name, value_name);
80 status = ZwSetValueKey(key, &unicode_value_name, 0, REG_SZ, unicode_value.Buffer, unicode_value.Length);
81 RtlFreeUnicodeString(&unicode_value);
90 UNICODE_STRING unicode_name;
91 RtlInitUnicodeString(&unicode_name, value_name);
92 return ZwSetValueKey(key, &unicode_name, 0, REG_DWORD, &value,
sizeof(uint32_t));
99 NTSTATUS status = STATUS_SUCCESS;
100 UNICODE_STRING registry_path;
101 OBJECT_ATTRIBUTES object_attributes = {0};
103 UNREFERENCED_PARAMETER(flags);
105 RtlInitUnicodeString(®istry_path, sub_key);
106 InitializeObjectAttributes(
107 &object_attributes, ®istry_path, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, root_key, NULL);
109 status = ZwCreateKey(key, KEY_WRITE, &object_attributes, 0, NULL, REG_OPTION_NON_VOLATILE, NULL);
118 NTSTATUS status = STATUS_SUCCESS;
119 UNICODE_STRING registry_path;
120 OBJECT_ATTRIBUTES object_attributes = {0};
121 ANSI_STRING ansi_string;
122 RtlInitAnsiString(&ansi_string, sub_key);
124 UNREFERENCED_PARAMETER(flags);
127 status = RtlAnsiStringToUnicodeString(®istry_path, &ansi_string, TRUE);
128 if (!NT_SUCCESS(status)) {
132 InitializeObjectAttributes(
133 &object_attributes, ®istry_path, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, root_key, NULL);
135 status = ZwCreateKey(key, KEY_WRITE, &object_attributes, 0, NULL, REG_OPTION_NON_VOLATILE, NULL);
136 RtlFreeUnicodeString(®istry_path);
uint8_t GUID[16]
Definition: ebpf_windows.h:13
HANDLE ebpf_registry_key_t
Definition: ebpf_registry_helper.h:17
uint32_t ebpf_registry_result_t
Definition: ebpf_registry_helper.h:15
#define GUID_STRING_LENGTH
Definition: ebpf_registry_helper.h:13
_Must_inspect_result_ ebpf_registry_result_t create_registry_key_ansi(ebpf_registry_key_t root_key, const char *sub_key, uint32_t flags, ebpf_registry_key_t *key)
void close_registry_key(ebpf_registry_key_t key)
_Must_inspect_result_ ebpf_registry_result_t convert_guid_to_string(const GUID *guid, _Out_writes_all_(string_size) wchar_t *string, size_t string_size)
_Must_inspect_result_ ebpf_registry_result_t write_registry_value_dword(ebpf_registry_key_t key, const wchar_t *value_name, uint32_t value)
_Must_inspect_result_ ebpf_registry_result_t write_registry_value_ansi_string(ebpf_registry_key_t key, const wchar_t *value_name, const char *value)
_Must_inspect_result_ ebpf_registry_result_t write_registry_value_binary(ebpf_registry_key_t key, const wchar_t *value_name, _In_reads_(value_size) uint8_t *value, size_t value_size)
_Must_inspect_result_ ebpf_registry_result_t create_registry_key(ebpf_registry_key_t root_key, const wchar_t *sub_key, uint32_t flags, ebpf_registry_key_t *key)