[myid]

Hi, everyone.
I have a very hard problem.
I preset there are 5 sub keys in "\REGISTRY\MACHINE\SYSTEM\xxx": sk1 sk2 sk3 sk4 sk5.
I can get "\REGISTRY\MACHINE\SYSTEM\xxx" in RegNtPostEnumerateKey/RegNtPreEnumerateKey callback.
But how to get sub keys' name(sk1~sk5) in RegNtPostEnumerateKey or RegNtPreEnumerateKey?

[Vrtule]

Hello,

if you want to get key name from its object pointer, there are two possibilities:
* ObQueryNameString
* CmCallbackGetKeyObjectID or CmCallbackGetKeyObjectIDEx

If you want to get information about a subkey enumerated by a call to Nt/ZwEnumerateKey that was caught by your registry filter, you can obtain this information from the output buffer. Howerver, you have to be careful (at least prior to Windows 8) because the output buffer may point to usermode part of the address space.

[myid]

Hello,

if you want to get key name from its object pointer, there are two possibilities:
* ObQueryNameString
* CmCallbackGetKeyObjectID or CmCallbackGetKeyObjectIDEx

If you want to get information about a subkey enumerated by a call to Nt/ZwEnumerateKey that was caught by your registry filter, you can obtain this information from the output buffer. Howerver, you have to be careful (at least prior to Windows 8) because the output buffer may point to usermode part of the address space.

Thanks. I have solved this problem now.