Index: sandbox/win/sandbox_poc/pocdll/registry.cc |
diff --git a/sandbox/win/sandbox_poc/pocdll/registry.cc b/sandbox/win/sandbox_poc/pocdll/registry.cc |
index d26620d0ca58b90c516d5de4a9a7d1a409fe66b5..5784db65d0b5dbb12576d7ed72a81af9793f3eda 100644 |
--- a/sandbox/win/sandbox_poc/pocdll/registry.cc |
+++ b/sandbox/win/sandbox_poc/pocdll/registry.cc |
@@ -7,29 +7,12 @@ |
// This file contains the tests used to verify the security of the registry. |
-// Converts an HKEY to a string. This is using the lazy way and works only |
-// for the main hives. |
-// "key" is the hive to convert to string. |
-// The return value is the string corresponding to the hive or "unknown" |
-const wchar_t *HKEYToString(const HKEY key) { |
- switch (reinterpret_cast<LONG_PTR>(key)) { |
- case reinterpret_cast<LONG_PTR>(HKEY_CLASSES_ROOT): |
- return L"HKEY_CLASSES_ROOT"; |
- case reinterpret_cast<LONG_PTR>(HKEY_CURRENT_CONFIG): |
- return L"HKEY_CURRENT_CONFIG"; |
- case reinterpret_cast<LONG_PTR>(HKEY_CURRENT_USER): |
- return L"HKEY_CURRENT_USER"; |
- case reinterpret_cast<LONG_PTR>(HKEY_LOCAL_MACHINE): |
- return L"HKEY_LOCAL_MACHINE"; |
- case reinterpret_cast<LONG_PTR>(HKEY_USERS): |
- return L"HKEY_USERS"; |
- } |
- return L"unknown"; |
-} |
- |
// Tries to open the key hive\path and outputs the result. |
// "output" is the stream used for logging. |
-void TryOpenKey(const HKEY hive, const wchar_t *path, FILE *output) { |
+void TryOpenKey(const HKEY hive, |
+ const wchar_t* hive_name, |
+ const wchar_t* path, |
+ FILE* output) { |
HKEY key; |
LONG err_code = ::RegOpenKeyEx(hive, |
path, |
@@ -37,14 +20,16 @@ void TryOpenKey(const HKEY hive, const wchar_t *path, FILE *output) { |
MAXIMUM_ALLOWED, |
&key); |
if (ERROR_SUCCESS == err_code) { |
- fprintf(output, "[GRANTED] Opening key \"%S\\%S\". Handle 0x%p\r\n", |
- HKEYToString(hive), |
+ fprintf(output, |
+ "[GRANTED] Opening key \"%S\\%S\". Handle 0x%p\r\n", |
+ hive_name, |
path, |
key); |
::RegCloseKey(key); |
} else { |
- fprintf(output, "[BLOCKED] Opening key \"%S\\%S\". Error %ld\r\n", |
- HKEYToString(hive), |
+ fprintf(output, |
+ "[BLOCKED] Opening key \"%S\\%S\". Error %ld\r\n", |
+ hive_name, |
path, |
err_code); |
} |
@@ -54,10 +39,11 @@ void POCDLL_API TestRegistry(HANDLE log) { |
HandleToFile handle2file; |
FILE *output = handle2file.Translate(log, "w"); |
- TryOpenKey(HKEY_LOCAL_MACHINE, NULL, output); |
- TryOpenKey(HKEY_CURRENT_USER, NULL, output); |
- TryOpenKey(HKEY_USERS, NULL, output); |
+ TryOpenKey(HKEY_LOCAL_MACHINE, L"HKEY_LOCAL_MACHINE", NULL, output); |
+ TryOpenKey(HKEY_CURRENT_USER, L"HKEY_CURRENT_USER", NULL, output); |
+ TryOpenKey(HKEY_USERS, L"HKEY_USERS", NULL, output); |
TryOpenKey(HKEY_LOCAL_MACHINE, |
+ L"HKEY_LOCAL_MACHINE", |
L"Software\\Microsoft\\Windows NT\\CurrentVersion\\WinLogon", |
output); |
} |