Status = CmiCallRegisteredCallbacks(RegNtPreCreateKey, &PreCreateKeyInfo);
if (!NT_SUCCESS(Status))
{
+ PostCreateKeyInfo.Object = NULL;
+ PostCreateKeyInfo.Status = Status;
+ CmiCallRegisteredCallbacks(RegNtPostCreateKey, &PostCreateKeyInfo);
goto Cleanup;
}
PostOperationInfo.Object = (PVOID)KeyObject;
DeleteKeyInfo.Object = (PVOID)KeyObject;
- Status = CmiCallRegisteredCallbacks(RegNtPreSetValueKey, &DeleteKeyInfo);
+ Status = CmiCallRegisteredCallbacks(RegNtPreDeleteKey, &DeleteKeyInfo);
if (!NT_SUCCESS(Status))
{
PostOperationInfo.Status = Status;
- CmiCallRegisteredCallbacks(RegNtDeleteKey, &PostOperationInfo);
+ CmiCallRegisteredCallbacks(RegNtPostDeleteKey, &PostOperationInfo);
ObDereferenceObject(KeyObject);
return Status;
}
EnumerateKeyInfo.Length = Length;
EnumerateKeyInfo.ResultLength = ResultLength;
- Status = CmiCallRegisteredCallbacks(RegNtEnumerateKey, &EnumerateKeyInfo);
+ Status = CmiCallRegisteredCallbacks(RegNtPreEnumerateKey, &EnumerateKeyInfo);
if (!NT_SUCCESS(Status))
{
+ PostOperationInfo.Status = Status;
+ CmiCallRegisteredCallbacks(RegNtPostEnumerateKey, &PostOperationInfo);
ObDereferenceObject(KeyObject);
return Status;
}
ExReleaseResourceLite(&CmiRegistryLock);
KeLeaveCriticalRegion();
PostOperationInfo.Status = STATUS_NO_MORE_ENTRIES;
- CmiCallRegisteredCallbacks(RegNtPostDeleteKey, &PostOperationInfo);
+ CmiCallRegisteredCallbacks(RegNtPostEnumerateKey, &PostOperationInfo);
ObDereferenceObject(KeyObject);
DPRINT("No more volatile entries\n");
return STATUS_NO_MORE_ENTRIES;
PCM_KEY_VALUE ValueCell;
PVOID DataCell;
ULONG NameSize, DataSize;
+ REG_ENUMERATE_VALUE_KEY_INFORMATION EnumerateValueKeyInfo;
+ REG_POST_OPERATION_INFORMATION PostOperationInfo;
PKEY_VALUE_BASIC_INFORMATION ValueBasicInformation;
PKEY_VALUE_PARTIAL_INFORMATION ValuePartialInformation;
PKEY_VALUE_FULL_INFORMATION ValueFullInformation;
return Status;
}
+ PostOperationInfo.Object = (PVOID)KeyObject;
+ EnumerateValueKeyInfo.Object = (PVOID)KeyObject;
+ EnumerateValueKeyInfo.Index = Index;
+ EnumerateValueKeyInfo.KeyValueInformationClass = KeyValueInformationClass;
+ EnumerateValueKeyInfo.KeyValueInformation = KeyValueInformation;
+ EnumerateValueKeyInfo.Length = Length;
+ EnumerateValueKeyInfo.ResultLength = ResultLength;
+
+ Status = CmiCallRegisteredCallbacks(RegNtPreEnumerateValueKey, &EnumerateValueKeyInfo);
+ if (!NT_SUCCESS(Status))
+ {
+ PostOperationInfo.Status = Status;
+ CmiCallRegisteredCallbacks(RegNtPostEnumerateValueKey, &PostOperationInfo);
+ ObDereferenceObject(KeyObject);
+ return Status;
+ }
+
/* Acquire hive lock */
KeEnterCriticalRegion();
ExAcquireResourceSharedLite(&CmiRegistryLock, TRUE);
ExReleaseResourceLite(&CmiRegistryLock);
KeLeaveCriticalRegion();
ObDereferenceObject(KeyObject);
+ PostOperationInfo.Status = Status;
+ CmiCallRegisteredCallbacks(RegNtPostEnumerateValueKey, &PostOperationInfo);
return Status;
}
ExReleaseResourceLite(&CmiRegistryLock);
KeLeaveCriticalRegion();
ObDereferenceObject(KeyObject);
+ PostOperationInfo.Status = Status;
+ CmiCallRegisteredCallbacks(RegNtPostEnumerateValueKey, &PostOperationInfo);
return Status;
}
Status = CmiCallRegisteredCallbacks(RegNtPreOpenKey, &PreOpenKeyInfo);
if (!NT_SUCCESS(Status))
{
+ PostOpenKeyInfo.Object = NULL;
+ PostOpenKeyInfo.Status = Status;
+ CmiCallRegisteredCallbacks (RegNtPostOpenKey, &PostOpenKeyInfo);
ObpReleaseCapturedAttributes(&ObjectCreateInfo);
if (ObjectName.Buffer) ObpReleaseCapturedName(&ObjectName);
return Status;
QueryKeyInfo.Length = Length;
QueryKeyInfo.ResultLength = ResultLength;
- Status = CmiCallRegisteredCallbacks(RegNtQueryKey, &QueryKeyInfo);
+ Status = CmiCallRegisteredCallbacks(RegNtPreQueryKey, &QueryKeyInfo);
if (!NT_SUCCESS(Status))
{
+ PostOperationInfo.Status = Status;
+ CmiCallRegisteredCallbacks(RegNtPostQueryKey, &PostOperationInfo);
ObDereferenceObject(KeyObject);
return Status;
}
Status = CmiCallRegisteredCallbacks(RegNtPreQueryValueKey, &QueryValueKeyInfo);
if (!NT_SUCCESS(Status))
{
+ PostOperationInfo.Status = Status;
+ CmiCallRegisteredCallbacks(RegNtPostQueryValueKey, &PostOperationInfo);
ObDereferenceObject(KeyObject);
return Status;
}
Status = CmiCallRegisteredCallbacks(RegNtPreSetValueKey, &SetValueKeyInfo);
if (!NT_SUCCESS(Status))
{
+ PostOperationInfo.Status = Status;
+ CmiCallRegisteredCallbacks(RegNtPostSetValueKey, &PostOperationInfo);
ObDereferenceObject(KeyObject);
return Status;
}
Status = CmiCallRegisteredCallbacks(RegNtPreDeleteValueKey, &DeleteValueKeyInfo);
if (!NT_SUCCESS(Status))
{
+ PostOperationInfo.Object = (PVOID)KeyObject;
+ PostOperationInfo.Status = Status;
+ CmiCallRegisteredCallbacks(RegNtPostDeleteValueKey, &PostOperationInfo);
ReleaseCapturedUnicodeString(&CapturedValueName,
PreviousMode);
Fail:
Status = CmiCallRegisteredCallbacks(RegNtPreQueryMultipleValueKey, &QueryMultipleValueKeyInfo);
if (!NT_SUCCESS(Status))
{
+ PostOperationInfo.Status = Status;
+ CmiCallRegisteredCallbacks(RegNtPostQueryMultipleValueKey, &PostOperationInfo);
ObDereferenceObject(KeyObject);
return Status;
}
SetInformationKeyInfo.KeySetInformation = KeyInformation;
SetInformationKeyInfo.KeySetInformationLength = KeyInformationLength;
- Status = CmiCallRegisteredCallbacks(RegNtSetInformationKey, &SetInformationKeyInfo);
+ Status = CmiCallRegisteredCallbacks(RegNtPreSetInformationKey, &SetInformationKeyInfo);
if (!NT_SUCCESS(Status))
{
+ PostOperationInfo.Status = Status;
+ CmiCallRegisteredCallbacks(RegNtPostSetInformationKey, &PostOperationInfo);
ObDereferenceObject (KeyObject);
return Status;
}