'How to Manipulate the registry in wdftimer callback

I tried to manipulate the registry in the wdfTimer callback to read a value, it threw a blue screen with the error code invalid_process_attach_attempt. When I look at the blue screen reason with windbg, it always prompts for problems with the operation registry,but whether I using ZwOpenKey Or ZwQueryValueKey, it always has a blue screen. I can read the data by calling the same function elsewhere, but it's the blue screen in the callback, when I comment out operations on the registry, there is no blue screen. I guess this error should not be the cause of the interrupt priority, I consulted a lot of information but still couldn't find a solution.

Here's my code in the timer:

VOID EvtTimerFunc(WDFTIMER timer){
    TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_QUEUE, "ENTRY TIMER CALLBACK");
    HANDLE regHandle = nullptr;
    PUCHAR pathBuf = nullptr;
    OBJECT_ATTRIBUTES objAttr = {0};
    NTSTATUS status = STATUS_UNSUCCESSFUL;
    UNICODE_STRING Regpath = {0};
    RtlInitUnicodeString(&Regpath, CONFREGPATH);
    InitializeObjectAttributes(&objAttr, &regPath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
    status = ZwOpenKey(&regHandle, GENERIC_ALL, &objAttr);
    if(!NT_SUCCESS(status))
        return;
    ZwClose(regHandle);
}

Windbg locates the error in the ZwOpenKey line. My timer settings are executed every 3 seconds.



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source