注册表也LINK—REG_LINK 's

作者：MJ0011

NTFS有HARDLINK~ 注册表也有个REG_LINK类型
顾名思义，就是可以把一个真实存在的注册表映射成一个symbolic link类似的注册表~

实 际过程是使用ZwCreateKey创建一个REG_OPTION_CREATE_LINK的注册表键，然后给其设置SymbolicLinkValue 键值，DATA即是要创建连接的注册表名，然后就能自动link上了，操作被LINK的注册表项同操作原注册表项实质上一样，系统的SAM ControlSet等映射都是通过这个实现的~

原理说了.下[面附上创建注册表Services键到注册表System/123的LINK的代码，能干什么就不用我说了吧~~

HMODULE hlib = LoadLibrary("ntdll.dll"); PVOID p = GetProcAddress(hlib , "RtlInitUnicodeString"); PVOID p2 = GetProcAddress(hlib , "ZwCreateKey"); PVOID p3 = GetProcAddress(hlib , "ZwSetValueKey"); WCHAR KeyName1[] = L"//Registry//Machine//System//123"; LPCWSTR pKeyName1 = KeyName1 ; UNICODE_STRING KeyString ; OBJECT_ATTRIBUTES oba ;  __asm { push pKeyName1 lea eax , KeyString push eax call p }  InitializeObjectAttributes(&oba , &KeyString , 0X40 , 0 ,0 );  ULONG dispostion ; HANDLE linkhandle ; LONG stat ;  __asm{ lea eax , dispostion push eax  push 3  push 0  push 0  lea eax , oba  push eax  push 0x22  lea eax , linkhandle  push eax  call p2  mov stat ,eax }  CHAR xxx[100];  sprintf(xxx , "create stat = %08x/n" , stat); MessageBox(xxx , 0 , 0 );  WCHAR KeyName2[] = L"//Registry//Machine//System//CurrentControlSet//Services"; PVOID pdata = KeyName2 ; ULONG len = wcslen(KeyName2) * sizeof(WCHAR); WCHAR ValueName[]= L"SymbolicLinkValue"; LPCWSTR pvaluename = ValueName ; UNICODE_STRING valuestring ;  __asm { push pvaluename lea eax , valuestring push eax call p } __asm{ push len push pdata push 6 push 0 lea eax , valuestring push eax  push linkhandle call p3 mov stat ,eax } sprintf(xxx , "setvalue stat = %08x/n" , stat); MessageBox(xxx , 0 , 0 );