'How to Manipulate the registry in wdftimer callback
I tried to manipulate the registry in the wdfTimer callback to read a value, it threw a blue screen with the error code invalid_process_attach_attempt. When I look at the blue screen reason with windbg, it always prompts for problems with the operation registry,but whether I using ZwOpenKey Or ZwQueryValueKey, it always has a blue screen. I can read the data by calling the same function elsewhere, but it's the blue screen in the callback, when I comment out operations on the registry, there is no blue screen. I guess this error should not be the cause of the interrupt priority, I consulted a lot of information but still couldn't find a solution.
Here's my code in the timer:
VOID EvtTimerFunc(WDFTIMER timer){
TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_QUEUE, "ENTRY TIMER CALLBACK");
HANDLE regHandle = nullptr;
PUCHAR pathBuf = nullptr;
OBJECT_ATTRIBUTES objAttr = {0};
NTSTATUS status = STATUS_UNSUCCESSFUL;
UNICODE_STRING Regpath = {0};
RtlInitUnicodeString(&Regpath, CONFREGPATH);
InitializeObjectAttributes(&objAttr, ®Path, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
status = ZwOpenKey(®Handle, GENERIC_ALL, &objAttr);
if(!NT_SUCCESS(status))
return;
ZwClose(regHandle);
}
Windbg locates the error in the ZwOpenKey line. My timer settings are executed every 3 seconds.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
