| Index: sandbox/win/sandbox_poc/pocdll/registry.cc
|
| diff --git a/sandbox/win/sandbox_poc/pocdll/registry.cc b/sandbox/win/sandbox_poc/pocdll/registry.cc
|
| index d26620d0ca58b90c516d5de4a9a7d1a409fe66b5..5784db65d0b5dbb12576d7ed72a81af9793f3eda 100644
|
| --- a/sandbox/win/sandbox_poc/pocdll/registry.cc
|
| +++ b/sandbox/win/sandbox_poc/pocdll/registry.cc
|
| @@ -7,29 +7,12 @@
|
|
|
| // This file contains the tests used to verify the security of the registry.
|
|
|
| -// Converts an HKEY to a string. This is using the lazy way and works only
|
| -// for the main hives.
|
| -// "key" is the hive to convert to string.
|
| -// The return value is the string corresponding to the hive or "unknown"
|
| -const wchar_t *HKEYToString(const HKEY key) {
|
| - switch (reinterpret_cast<LONG_PTR>(key)) {
|
| - case reinterpret_cast<LONG_PTR>(HKEY_CLASSES_ROOT):
|
| - return L"HKEY_CLASSES_ROOT";
|
| - case reinterpret_cast<LONG_PTR>(HKEY_CURRENT_CONFIG):
|
| - return L"HKEY_CURRENT_CONFIG";
|
| - case reinterpret_cast<LONG_PTR>(HKEY_CURRENT_USER):
|
| - return L"HKEY_CURRENT_USER";
|
| - case reinterpret_cast<LONG_PTR>(HKEY_LOCAL_MACHINE):
|
| - return L"HKEY_LOCAL_MACHINE";
|
| - case reinterpret_cast<LONG_PTR>(HKEY_USERS):
|
| - return L"HKEY_USERS";
|
| - }
|
| - return L"unknown";
|
| -}
|
| -
|
| // Tries to open the key hive\path and outputs the result.
|
| // "output" is the stream used for logging.
|
| -void TryOpenKey(const HKEY hive, const wchar_t *path, FILE *output) {
|
| +void TryOpenKey(const HKEY hive,
|
| + const wchar_t* hive_name,
|
| + const wchar_t* path,
|
| + FILE* output) {
|
| HKEY key;
|
| LONG err_code = ::RegOpenKeyEx(hive,
|
| path,
|
| @@ -37,14 +20,16 @@ void TryOpenKey(const HKEY hive, const wchar_t *path, FILE *output) {
|
| MAXIMUM_ALLOWED,
|
| &key);
|
| if (ERROR_SUCCESS == err_code) {
|
| - fprintf(output, "[GRANTED] Opening key \"%S\\%S\". Handle 0x%p\r\n",
|
| - HKEYToString(hive),
|
| + fprintf(output,
|
| + "[GRANTED] Opening key \"%S\\%S\". Handle 0x%p\r\n",
|
| + hive_name,
|
| path,
|
| key);
|
| ::RegCloseKey(key);
|
| } else {
|
| - fprintf(output, "[BLOCKED] Opening key \"%S\\%S\". Error %ld\r\n",
|
| - HKEYToString(hive),
|
| + fprintf(output,
|
| + "[BLOCKED] Opening key \"%S\\%S\". Error %ld\r\n",
|
| + hive_name,
|
| path,
|
| err_code);
|
| }
|
| @@ -54,10 +39,11 @@ void POCDLL_API TestRegistry(HANDLE log) {
|
| HandleToFile handle2file;
|
| FILE *output = handle2file.Translate(log, "w");
|
|
|
| - TryOpenKey(HKEY_LOCAL_MACHINE, NULL, output);
|
| - TryOpenKey(HKEY_CURRENT_USER, NULL, output);
|
| - TryOpenKey(HKEY_USERS, NULL, output);
|
| + TryOpenKey(HKEY_LOCAL_MACHINE, L"HKEY_LOCAL_MACHINE", NULL, output);
|
| + TryOpenKey(HKEY_CURRENT_USER, L"HKEY_CURRENT_USER", NULL, output);
|
| + TryOpenKey(HKEY_USERS, L"HKEY_USERS", NULL, output);
|
| TryOpenKey(HKEY_LOCAL_MACHINE,
|
| + L"HKEY_LOCAL_MACHINE",
|
| L"Software\\Microsoft\\Windows NT\\CurrentVersion\\WinLogon",
|
| output);
|
| }
|
|
|