{"action":"created","issue":{"url":"https://api.github.com/repos/tklengyel/drakvuf/issues/310","repository_url":"https://api.github.com/repos/tklengyel/drakvuf","labels_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/310/labels{/name}","comments_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/310/comments","events_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/310/events","html_url":"https://github.com/tklengyel/drakvuf/pull/310","id":262732323,"number":310,"title":"Add new functions to the drakvuf API for resolving full path of windows registry keys","user":{"login":"aoshiken","id":5227552,"avatar_url":"https://avatars3.githubusercontent.com/u/5227552?v=4","gravatar_id":"","url":"https://api.github.com/users/aoshiken","html_url":"https://github.com/aoshiken","followers_url":"https://api.github.com/users/aoshiken/followers","following_url":"https://api.github.com/users/aoshiken/following{/other_user}","gists_url":"https://api.github.com/users/aoshiken/gists{/gist_id}","starred_url":"https://api.github.com/users/aoshiken/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aoshiken/subscriptions","organizations_url":"https://api.github.com/users/aoshiken/orgs","repos_url":"https://api.github.com/users/aoshiken/repos","events_url":"https://api.github.com/users/aoshiken/events{/privacy}","received_events_url":"https://api.github.com/users/aoshiken/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2017-10-04T10:06:02Z","updated_at":"2017-10-05T16:39:10Z","closed_at":"2017-10-05T16:04:57Z","author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/tklengyel/drakvuf/pulls/310","html_url":"https://github.com/tklengyel/drakvuf/pull/310","diff_url":"https://github.com/tklengyel/drakvuf/pull/310.diff","patch_url":"https://github.com/tklengyel/drakvuf/pull/310.patch"},"body":"The new functions are:\r\n- _drakvuf_reg_keybody_path()_: Returns path from CM_KEY_CONTROL_BLOCK pointer\r\n- _drakvuf_reg_keycontrolblock_path()_: Returns allocated registry key full path from key object\r\n- _drakvuf_reg_keyhandle_path()_: Returns an allocated registry key full path from key handle\r\n\r\nThose functions are included in the new file `src/libdrakvuf/win-registry.c`\r\n\r\n### WARNING\r\nI tested this code **only** on a Windows 7 SP1 x64 platform although the code **probably** works on x86 too.\r\n\r\n### USAGE\r\nI'm assuming that the mainly used function will be _drakvuf_reg_keyhandle_path()_ (although I myself currently use the other two from some hooks deep down in the kernel).\r\n\r\nThe following example shows its use from a trap callback for the syscall _NtDeleteValueKey_, you can also use the same callback body for the syscalls _NtSetValueKey_ and _NtDeleteKey_ because all of them have a KEY HANDLE as the 1st parameter (we don't care about the value name):\r\n```\r\nstatic event_response_t hook_deletevaluekey_cb( drakvuf_t drakvuf, drakvuf_trap_info_t *info )\r\n{\r\n    if ( info->regs->rcx )\r\n    {\r\n        vmi_instance_t vmi = drakvuf_lock_and_get_vmi( drakvuf );\r\n\r\n        char *key_path = drakvuf_reg_keyhandle_path( drakvuf, info, info->regs->rcx, 0 );\r\n\r\n        if ( key_path )\r\n        {\r\n            printf(\"DELETEVALUEKEY: %s\\n\", key_path );\r\n            free( key_path );\r\n        }\r\n\r\n        drakvuf_release_vmi( drakvuf );\r\n    }\r\n    return 0 ;\r\n}\r\n```\r\n\r\nAnd below you can see the DRAKVUF output (sorted and snipped) with that plugin enabled and starting an Internet Explorer and trigger some manual actions from `regedit.exe`:\r\n```\r\nDELETEKEY: \\REGISTRY\\USER\\S-1-5-21-2200285794-3943342076-1391323334-1000\\SOFTWARE\\ALFREDO1\r\nDELETEKEY: \\REGISTRY\\USER\\S-1-5-21-2200285794-3943342076-1391323334-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\5.0\\LOWCACHE\\EXTENSIBLE CACHE\\MSHIST012017100420171005\r\nDELETEVALUEKEY: \\REGISTRY\\USER\\S-1-5-21-2200285794-3943342076-1391323334-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\r\nDELETEVALUEKEY: \\REGISTRY\\USER\\S-1-5-21-2200285794-3943342076-1391323334-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\r\nDELETEVALUEKEY: \\REGISTRY\\USER\\S-1-5-21-2200285794-3943342076-1391323334-1000\\SOFTWARE\\NEW KEY #4\r\nSETVALUEKEY: \\REGISTRY\\USER\\S-1-5-21-2200285794-3943342076-1391323334-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\r\nSETVALUEKEY: \\REGISTRY\\USER\\S-1-5-21-2200285794-3943342076-1391323334-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONES\r\nSETVALUEKEY: \\REGISTRY\\USER\\S-1-5-21-2200285794-3943342076-1391323334-1000\\SOFTWARE\\NEW KEY #4\r\n```\r\nHope this helps,\r\n\r\nRegards"},"comment":{"url":"https://api.github.com/repos/tklengyel/drakvuf/issues/comments/334522229","html_url":"https://github.com/tklengyel/drakvuf/pull/310#issuecomment-334522229","issue_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/310","id":334522229,"user":{"login":"aoshiken","id":5227552,"avatar_url":"https://avatars3.githubusercontent.com/u/5227552?v=4","gravatar_id":"","url":"https://api.github.com/users/aoshiken","html_url":"https://github.com/aoshiken","followers_url":"https://api.github.com/users/aoshiken/followers","following_url":"https://api.github.com/users/aoshiken/following{/other_user}","gists_url":"https://api.github.com/users/aoshiken/gists{/gist_id}","starred_url":"https://api.github.com/users/aoshiken/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aoshiken/subscriptions","organizations_url":"https://api.github.com/users/aoshiken/orgs","repos_url":"https://api.github.com/users/aoshiken/repos","events_url":"https://api.github.com/users/aoshiken/events{/privacy}","received_events_url":"https://api.github.com/users/aoshiken/received_events","type":"User","site_admin":false},"created_at":"2017-10-05T16:39:10Z","updated_at":"2017-10-05T16:39:10Z","author_association":"CONTRIBUTOR","body":"Humm, I'm afraid I'm lost with that `\"Closed with unmerged commits\"`.\r\n\r\nAll of my commits have been against the same branch and merged perfectly while this PR was open so I don't understand that message. :?\r\n\r\nDo you want me to open a new PR?\r\n"}}
{"actor":{"display_login":"aoshiken"}}