Re: [PATCH] Conditionally use IoOpenDriverRegistryKey

[Paul Durrant <xadimgnik@xxxxxxxxx>]

On 01/07/2024 11:32, Owen Smith wrote:
> IoOpenDriverRegistryKey is not available in Server 2016 and Windows 10 before 
> 1803.
> Use a conditinal to modify the RegistryOpenParametersKey function to use the
> correct API to open the parameters key.
> Set '#define VERIFIER_REG_ISOLATION' when compiling for Server 2025, and do not
> include this definition when compiling to include support for Server 2016.
>
> Signed-off-by: Owen Smith <owen.smith@xxxxxxxxx>
To remove breakage...

Acked-by: Paul Durrant <paul@xxxxxxx>

But is there a compat story from M$ on this, as with other 'new' APIs? 
Alternatively could we simply use MmGetSystemRoutineAddress() to see if 
the function is available?
> ---
>   src/common/registry.c | 27 +++++++++++++++++++++++++++
>   1 file changed, 27 insertions(+)
>
> diff --git a/src/common/registry.c b/src/common/registry.c
> index 3f45a23..211c177 100644
> --- a/src/common/registry.c
> +++ b/src/common/registry.c
> @@ -100,11 +100,38 @@ RegistryOpenParametersKey(
>       OUT PHANDLE         Key
>       )
>   {
> +#ifdef VERIFIER_REG_ISOLATION
>       return IoOpenDriverRegistryKey(RegistryDriverObject,
>                                      DriverRegKeyParameters,
>                                      DesiredAccess,
>                                      0,
>                                      Key);
> +#else
> +    HANDLE              ServiceKey;
> +    NTSTATUS            status;
> +
> +    status = RegistryOpenKey(NULL, &RegistryPath, DesiredAccess, &ServiceKey);
> +    if (!NT_SUCCESS(status))
> +        goto fail1;
> +
> +    status = RegistryOpenSubKey(ServiceKey, "Parameters", DesiredAccess, Key);
> +    if (!NT_SUCCESS(status))
> +        goto fail2;
> +
> +    RegistryCloseKey(ServiceKey);
> +
> +    return STATUS_SUCCESS;
> +
> +fail2:
> +    Error("fail2\n");
> +
> +    RegistryCloseKey(ServiceKey);
> +
> +fail1:
> +    Error("fail1 %08x\n", status);
> +
> +    return status;
> +#endif
>   }
>   
>   NTSTATUS