[NT API] Open Any Registry Key for Full Access

#define WIN32_NO_STATUS

#include <Windows.h>

#include <..\ndk\ntndk.h>

#include "global.h"

NTSTATUS openKeyAllAccess(PHANDLE pKeyHandle, PUNICODE_STRING pFullKeyPath) {

OBJECT_ATTRIBUTES keyAttr;

ULONG privsToEnable[] = { SE_BACKUP_PRIVILEGE, SE_RESTORE_PRIVILEGE };

BOOLEAN oldPrivState[sizeof(privsToEnable) / sizeof(ULONG)] = { 0 };

NTSTATUS status = STATUS_NOT_ALLOWED_ON_SYSTEM_FILE;

if (!pKeyHandle || !pFullKeyPath)

return STATUS_INVALID_PARAMETER;

for (ULONG i = 0; i < sizeof(privsToEnable) / sizeof(ULONG); i++) {

status = RtlAdjustPrivilege(privsToEnable[i], TRUE, FALSE, &oldPrivState[i]);

if (status) {

for (i = 0; i < sizeof(privsToEnable) / sizeof(ULONG); i++)

RtlAdjustPrivilege(privsToEnable[i], oldPrivState[i], FALSE, &oldPrivState[i]);

*pKeyHandle = NULL;

return status;

}

}

InitializeObjectAttributes(&keyAttr, pFullKeyPath, OBJ_CASE_INSENSITIVE, NULL, NULL);

status = NtOpenKeyEx(pKeyHandle, KEY_ALL_ACCESS, &keyAttr, REG_OPTION_BACKUP_RESTORE);

if (status)

*pKeyHandle = NULL;

for (ULONG i = 0; i < sizeof(privsToEnable) / sizeof(ULONG); i++)

RtlAdjustPrivilege(privsToEnable[i], oldPrivState[i], FALSE, &oldPrivState[i]);

return status;

}

void mymain(void){

UNICODE_STRING uKeyFullName;

NTSTATUS status = STATUS_NOT_ALLOWED_ON_SYSTEM_FILE;

HANDLE hTestKey = INVALID_HANDLE_VALUE;

RtlInitUnicodeString(&uKeyFullName, L"\\Registry\\Machine\\SECURITY\\Policy");

status = openKeyAllAccess(&hTestKey, &uKeyFullName);

NtRaiseHardError(status, 0, 0, NULL, 0, (PULONG)&status);

}