API Win32 et noyau en profondeur¶

// Watch a registry key for changes in real time
HKEY hKey;
RegOpenKeyExW(HKEY_CURRENT_USER, L"Software\\MonApp", 0, KEY_NOTIFY, &hKey);
RegNotifyChangeKeyValue(hKey, TRUE, REG_NOTIFY_CHANGE_LAST_SET, NULL, FALSE);
printf("Something changed!\n");
RegCloseKey(hKey);

LSTATUS RegNotifyChangeKeyValue(
    HKEY   hKey,            // Handle to an open key
    BOOL   bWatchSubtree,   // TRUE = watch all subkeys recursively
    DWORD  dwNotifyFilter,  // What changes to watch for
    HANDLE hEvent,          // Event object (async) or NULL (sync)
    BOOL   fAsynchronous    // TRUE = async, FALSE = blocking
);

#include <windows.h>
#include <stdio.h>

int main(void) {
    HKEY hKey;
    RegOpenKeyExW(HKEY_CURRENT_USER, L"Software\\MonApp",
                  0, KEY_NOTIFY, &hKey);
    printf("Watching HKCU\\Software\\MonApp...\n");

    // Block until something changes
    LSTATUS s = RegNotifyChangeKeyValue(hKey, TRUE,
        REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET,
        NULL, FALSE);

    if (s == ERROR_SUCCESS) printf("Change detected!\n");
    else printf("Failed: %ld\n", s);

    RegCloseKey(hKey);
    return 0;
}

#include <windows.h>
#include <stdio.h>

int main(void) {
    HKEY hKey;
    RegOpenKeyExW(HKEY_CURRENT_USER, L"Software\\MonApp",
                  0, KEY_NOTIFY, &hKey);
    HANDLE hEvent = CreateEventW(NULL, TRUE, FALSE, NULL);

    printf("Watching (async). Ctrl+C to stop.\n");
    while (1) {
        ResetEvent(hEvent);
        LSTATUS s = RegNotifyChangeKeyValue(hKey, TRUE,
            REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET |
            REG_NOTIFY_THREAD_AGNOSTIC,
            hEvent, TRUE);
        if (s != ERROR_SUCCESS) break;

        DWORD w = WaitForSingleObject(hEvent, 5000);
        if (w == WAIT_OBJECT_0)
            printf("[CHANGE] detected at tick %lu\n", GetTickCount());
        else if (w == WAIT_TIMEOUT)
            printf("[TICK] no change (5s)\n");
        else break;
    }
    CloseHandle(hEvent);
    RegCloseKey(hKey);
    return 0;
}

#include <windows.h>
#include <stdio.h>

typedef struct { HKEY hKey; HANDLE hEvent; WCHAR path[MAX_PATH]; } WATCH;

static LSTATUS RegisterWatch(WATCH *w) {
    ResetEvent(w->hEvent);
    return RegNotifyChangeKeyValue(w->hKey, TRUE,
        REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET |
        REG_NOTIFY_THREAD_AGNOSTIC, w->hEvent, TRUE);
}

int main(void) {
    WATCH w[2]; HANDLE ev[2];
    LPCWSTR paths[] = { L"Software\\MonApp", L"Software\\AutreApp" };
    for (int i = 0; i < 2; i++) {
        w[i].hEvent = CreateEventW(NULL, TRUE, FALSE, NULL);
        wcscpy_s(w[i].path, MAX_PATH, paths[i]);
        RegOpenKeyExW(HKEY_CURRENT_USER, paths[i], 0, KEY_NOTIFY, &w[i].hKey);
        ev[i] = w[i].hEvent;
        RegisterWatch(&w[i]);
    }
    while (1) {
        DWORD idx = WaitForMultipleObjects(2, ev, FALSE, INFINITE);
        if (idx >= WAIT_OBJECT_0 && idx < WAIT_OBJECT_0 + 2) {
            int i = idx - WAIT_OBJECT_0;
            wprintf(L"[CHANGE] %s\n", w[i].path);
            RegisterWatch(&w[i]);
        }
    }
    return 0;
}

#include <windows.h>
#include <ktmw32.h>
#include <stdio.h>
#pragma comment(lib, "ktmw32.lib")
#pragma comment(lib, "advapi32.lib")

int main(void) {
    HANDLE hTx = CreateTransaction(NULL, NULL, 0, 0, 0, 0, NULL);
    if (hTx == INVALID_HANDLE_VALUE) return 1;

    HKEY hKey1 = NULL, hKey2 = NULL;
    DWORD disp;
    LSTATUS s;

    // Operation 1: create Config key
    s = RegCreateKeyTransacted(HKEY_CURRENT_USER,
        L"Software\\MonApp\\Config", 0, NULL,
        REG_OPTION_NON_VOLATILE, KEY_WRITE, NULL,
        &hKey1, &disp, hTx, NULL);
    if (s != ERROR_SUCCESS) goto rollback;

    DWORD ver = 2;
    s = RegSetValueExW(hKey1, L"Version", 0, REG_DWORD, (LPBYTE)&ver, sizeof(ver));
    if (s != ERROR_SUCCESS) goto rollback;

    // Operation 2: create State key
    s = RegCreateKeyTransacted(HKEY_CURRENT_USER,
        L"Software\\MonApp\\State", 0, NULL,
        REG_OPTION_NON_VOLATILE, KEY_WRITE, NULL,
        &hKey2, &disp, hTx, NULL);
    if (s != ERROR_SUCCESS) goto rollback;

    DWORD migrated = 1;
    s = RegSetValueExW(hKey2, L"Migrated", 0, REG_DWORD, (LPBYTE)&migrated, sizeof(migrated));
    if (s != ERROR_SUCCESS) goto rollback;

    // All OK: commit
    CommitTransaction(hTx);
    printf("Transaction committed.\n");
    goto cleanup;

rollback:
    RollbackTransaction(hTx);
    printf("Transaction rolled back.\n");

cleanup:
    if (hKey1) RegCloseKey(hKey1);
    if (hKey2) RegCloseKey(hKey2);
    CloseHandle(hTx);
    return 0;
}

#include <windows.h>
#include <stdio.h>

static void EnablePrivilege(LPCWSTR priv) {
    HANDLE hToken; TOKEN_PRIVILEGES tp;
    OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
    LookupPrivilegeValueW(NULL, priv, &tp.Privileges[0].Luid);
    tp.PrivilegeCount = 1; tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    AdjustTokenPrivileges(hToken, FALSE, &tp, 0, NULL, NULL);
    CloseHandle(hToken);
}

int main(void) {
    EnablePrivilege(SE_BACKUP_NAME);
    EnablePrivilege(SE_RESTORE_NAME);

    // Load an offline NTUSER.DAT into HKLM\TempHive
    RegLoadKeyW(HKEY_LOCAL_MACHINE, L"TempHive", L"C:\\Backup\\NTUSER.DAT");

    HKEY hKey;
    RegOpenKeyExW(HKEY_LOCAL_MACHINE,
        L"TempHive\\Software\\Microsoft\\Windows\\CurrentVersion",
        0, KEY_READ, &hKey);
    WCHAR buf[256]; DWORD sz = sizeof(buf);
    RegQueryValueExW(hKey, L"ProgramFilesDir", NULL, NULL, (LPBYTE)buf, &sz);
    wprintf(L"ProgramFilesDir = %s\n", buf);
    RegCloseKey(hKey);

    // Unload
    RegUnLoadKeyW(HKEY_LOCAL_MACHINE, L"TempHive");
    return 0;
}

// Save: requires SeBackupPrivilege
HKEY hKey;
RegOpenKeyExW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\MonApp", 0, KEY_READ, &hKey);
RegSaveKeyExW(hKey, L"C:\\Backup\\monapp.hiv", NULL, REG_LATEST_FORMAT);
// REG_STANDARD_FORMAT = compatible older Windows
// REG_LATEST_FORMAT   = compact, current Windows
// REG_NO_COMPRESSION  = fastest write, largest file
RegCloseKey(hKey);

// Restore: requires SeRestorePrivilege
RegOpenKeyExW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\MonApp", 0, KEY_WRITE, &hKey);
RegRestoreKeyW(hKey, L"C:\\Backup\\monapp.hiv", REG_FORCE_RESTORE);
RegCloseKey(hKey);

// Replace the SYSTEM hive atomically at next reboot
RegReplaceKeyW(HKEY_LOCAL_MACHINE, L"SYSTEM",
    L"C:\\Backup\\system_new.hiv",  // new hive
    L"C:\\Backup\\system_old.hiv"); // backup of current

HKEY hKey;
RegOpenKeyExW(HKEY_LOCAL_MACHINE,
    L"SYSTEM\\CurrentControlSet\\Services\\Spooler", 0, KEY_READ, &hKey);
WCHAR name[256]; DWORD outSize;
RegLoadMUIStringW(hKey, L"DisplayName", name, sizeof(name), &outSize, 0, NULL);
// name = "Print Spooler" (EN) or "Spouleur d'impression" (FR)
RegCloseKey(hKey);

HKEY hAppKey;
RegLoadAppKeyW(L"C:\\MonApp\\settings.dat", &hAppKey, KEY_ALL_ACCESS, 0, 0);
DWORD val = 1;
RegSetValueExW(hAppKey, L"Initialized", 0, REG_DWORD, (LPBYTE)&val, sizeof(val));
RegCloseKey(hAppKey);  // hive auto-unloaded when all handles close

#include <windows.h>
#include <sddl.h>
#include <stdio.h>

void ReadKeySecurity(HKEY hKey) {
    DWORD sdSize = 0;
    RegGetKeySecurity(hKey, DACL_SECURITY_INFORMATION, NULL, &sdSize);
    PSECURITY_DESCRIPTOR pSD = malloc(sdSize);
    RegGetKeySecurity(hKey, DACL_SECURITY_INFORMATION, pSD, &sdSize);

    LPWSTR sddl = NULL;
    ConvertSecurityDescriptorToStringSecurityDescriptorW(
        pSD, SDDL_REVISION_1, DACL_SECURITY_INFORMATION, &sddl, NULL);
    wprintf(L"SDDL: %s\n", sddl);
    LocalFree(sddl); free(pSD);
}

#include <windows.h>
#include <aclapi.h>
#pragma comment(lib, "advapi32.lib")

BOOL SetKeyDacl(HKEY hKey) {
    PSID pAdmin = NULL, pUsers = NULL;
    SID_IDENTIFIER_AUTHORITY ntAuth = SECURITY_NT_AUTHORITY;

    AllocateAndInitializeSid(&ntAuth, 2, SECURITY_BUILTIN_DOMAIN_RID,
        DOMAIN_ALIAS_RID_ADMINS, 0,0,0,0,0,0, &pAdmin);
    AllocateAndInitializeSid(&ntAuth, 2, SECURITY_BUILTIN_DOMAIN_RID,
        DOMAIN_ALIAS_RID_USERS, 0,0,0,0,0,0, &pUsers);

    EXPLICIT_ACCESS ea[2] = {0};
    // Administrators: Full Control
    ea[0].grfAccessPermissions = KEY_ALL_ACCESS;
    ea[0].grfAccessMode = SET_ACCESS;
    ea[0].grfInheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT;
    ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
    ea[0].Trustee.ptstrName = (LPWSTR)pAdmin;
    // Users: Read Only
    ea[1].grfAccessPermissions = KEY_READ;
    ea[1].grfAccessMode = SET_ACCESS;
    ea[1].grfInheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT;
    ea[1].Trustee.TrusteeForm = TRUSTEE_IS_SID;
    ea[1].Trustee.ptstrName = (LPWSTR)pUsers;

    PACL pDacl = NULL;
    SetEntriesInAcl(2, ea, NULL, &pDacl);
    DWORD err = SetSecurityInfo(hKey, SE_REGISTRY_KEY,
        DACL_SECURITY_INFORMATION, NULL, NULL, pDacl, NULL);

    LocalFree(pDacl); FreeSid(pAdmin); FreeSid(pUsers);
    return (err == ERROR_SUCCESS);
}

BOOL TakeKeyOwnership(LPCWSTR keyPath) {
    // 1. Enable SeTakeOwnershipPrivilege (same pattern as EnablePrivilege above)
    HANDLE hToken; TOKEN_PRIVILEGES tp;
    OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
    LookupPrivilegeValueW(NULL, SE_TAKE_OWNERSHIP_NAME, &tp.Privileges[0].Luid);
    tp.PrivilegeCount = 1; tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    AdjustTokenPrivileges(hToken, FALSE, &tp, 0, NULL, NULL);
    CloseHandle(hToken);

    // 2. Open key with WRITE_OWNER
    HKEY hKey;
    RegOpenKeyExW(HKEY_LOCAL_MACHINE, keyPath, 0, WRITE_OWNER, &hKey);

    // 3. Set Administrators as owner
    PSID pAdmin = NULL;
    SID_IDENTIFIER_AUTHORITY ntAuth = SECURITY_NT_AUTHORITY;
    AllocateAndInitializeSid(&ntAuth, 2, SECURITY_BUILTIN_DOMAIN_RID,
        DOMAIN_ALIAS_RID_ADMINS, 0,0,0,0,0,0, &pAdmin);
    DWORD err = SetSecurityInfo(hKey, SE_REGISTRY_KEY,
        OWNER_SECURITY_INFORMATION, pAdmin, NULL, NULL, NULL);
    FreeSid(pAdmin); RegCloseKey(hKey);
    return (err == ERROR_SUCCESS);
}

// Open with SACL access
HKEY hKey;
RegOpenKeyExW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\SensitiveApp",
    0, KEY_READ | ACCESS_SYSTEM_SECURITY, &hKey);
// Read/modify SACL with RegGetKeySecurity / RegSetKeySecurity
// using SACL_SECURITY_INFORMATION flag
RegCloseKey(hKey);

#include <ntddk.h>

LARGE_INTEGER g_Cookie;

NTSTATUS RegistryCallback(PVOID Ctx, PVOID Arg1, PVOID Arg2) {
    UNREFERENCED_PARAMETER(Ctx);
    REG_NOTIFY_CLASS cls = (REG_NOTIFY_CLASS)(ULONG_PTR)Arg1;

    if (cls == RegNtPreSetValueKey) {
        PREG_SET_VALUE_KEY_INFORMATION info = (PREG_SET_VALUE_KEY_INFORMATION)Arg2;
        UNICODE_STRING protected = RTL_CONSTANT_STRING(L"ProtectedValue");
        if (info->ValueName &&
            RtlEqualUnicodeString(info->ValueName, &protected, TRUE)) {
            DbgPrint("[RegFilter] Blocked write to ProtectedValue\n");
            return STATUS_ACCESS_DENIED;
        }
    }
    if (cls == RegNtPreDeleteKey) {
        PREG_DELETE_KEY_INFORMATION info = (PREG_DELETE_KEY_INFORMATION)Arg2;
        DbgPrint("[RegFilter] Delete attempt on %p\n", info->Object);
    }
    if (cls == RegNtPostSetValueKey) {
        PREG_POST_OPERATION_INFORMATION info = (PREG_POST_OPERATION_INFORMATION)Arg2;
        if (NT_SUCCESS(info->Status))
            DbgPrint("[RegFilter] Value write succeeded on %p\n", info->Object);
    }
    return STATUS_SUCCESS;
}

VOID DriverUnload(PDRIVER_OBJECT Drv) {
    UNREFERENCED_PARAMETER(Drv);
    CmUnRegisterCallback(g_Cookie);
}

NTSTATUS DriverEntry(PDRIVER_OBJECT Drv, PUNICODE_STRING Path) {
    UNREFERENCED_PARAMETER(Path);
    UNICODE_STRING alt = RTL_CONSTANT_STRING(L"380000");
    NTSTATUS s = CmRegisterCallbackEx(RegistryCallback, &alt, Drv, NULL, &g_Cookie, NULL);
    if (NT_SUCCESS(s)) Drv->DriverUnload = DriverUnload;
    return s;
}

#include <windows.h>
#include <winternl.h>
#include <stdio.h>

typedef NTSTATUS (NTAPI *PFN_NtRenameKey)(HANDLE, PUNICODE_STRING);

BOOL RenameRegistryKey(HKEY hParent, LPCWSTR subKey, LPCWSTR newName) {
    HKEY hKey;
    if (RegOpenKeyExW(hParent, subKey, 0, KEY_WRITE, &hKey) != ERROR_SUCCESS)
        return FALSE;

    PFN_NtRenameKey pNtRenameKey = (PFN_NtRenameKey)
        GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtRenameKey");
    if (!pNtRenameKey) { RegCloseKey(hKey); return FALSE; }

    UNICODE_STRING us;
    us.Length = (USHORT)(wcslen(newName) * sizeof(WCHAR));
    us.MaximumLength = us.Length + sizeof(WCHAR);
    us.Buffer = (PWSTR)newName;

    NTSTATUS st = pNtRenameKey(hKey, &us);
    RegCloseKey(hKey);
    return (st == 0);
}

typedef NTSTATUS (NTAPI *PFN_NtNotifyChangeMultipleKeys)(
    HANDLE MasterKeyHandle, ULONG Count,
    OBJECT_ATTRIBUTES SubordinateObjects[],
    HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext,
    PIO_STATUS_BLOCK IoStatusBlock, ULONG CompletionFilter,
    BOOLEAN WatchTree, PVOID Buffer, ULONG BufferSize,
    BOOLEAN Asynchronous);

DWORD value; DWORD size = sizeof(value);
RegGetValueW(HKEY_CURRENT_USER, L"Software\\MonApp", L"Counter",
    RRF_RT_REG_DWORD,  // reject if not DWORD
    NULL, &value, &size);
// Returns ERROR_UNSUPPORTED_TYPE if the value is not REG_DWORD

// WRONG: opens/closes the key 100 times
for (int i = 0; i < 100; i++)
    RegGetValueW(HKEY_CURRENT_USER, L"Software\\MonApp",
                 names[i], RRF_RT_ANY, NULL, &data, &sz);

// RIGHT: open once, read 100 times
HKEY hKey;
RegOpenKeyExW(HKEY_CURRENT_USER, L"Software\\MonApp", 0, KEY_READ, &hKey);
for (int i = 0; i < 100; i++) {
    DWORD s = sizeof(data);
    RegQueryValueExW(hKey, names[i], NULL, NULL, (LPBYTE)&data, &s);
}
RegCloseKey(hKey);
// ~40% faster on large batches

// WRONG: fixed buffer, fails on long values
WCHAR buf[64]; DWORD sz = sizeof(buf);
RegQueryValueExW(hKey, L"LongValue", NULL, NULL, (LPBYTE)buf, &sz);

// RIGHT: query size first, then allocate
DWORD sz = 0;
RegQueryValueExW(hKey, L"LongValue", NULL, NULL, NULL, &sz);
LPBYTE data = malloc(sz);
RegQueryValueExW(hKey, L"LongValue", NULL, NULL, data, &sz);
free(data);

// WRONG: ANSI version truncates non-ASCII
RegQueryValueExA(hKey, "Param", NULL, NULL, (LPBYTE)buf, &sz);
// RIGHT: always use the W (Wide) version
RegQueryValueExW(hKey, L"Param", NULL, NULL, (LPBYTE)buf, &sz);

// 32-bit app reading the real 64-bit hive
RegOpenKeyExW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft",
    0, KEY_READ | KEY_WOW64_64KEY, &hKey);

// 64-bit app reading the 32-bit (WOW6432Node) hive
RegOpenKeyExW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft",
    0, KEY_READ | KEY_WOW64_32KEY, &hKey);