Access Hidden Registry Keys?

sbabineau
2nd May 2007 00:50 UTC

Access Hidden Registry Keys?
It doesn't appear that I can get access to hidden registry keys using the built-in Registry functions. Is this true? If so, is there another way?

-Steve.

Brummelchen
2nd May 2007 01:37 UTC

http://www.codeproject.com/tools/NtRegEdit.asp

sbabineau
2nd May 2007 21:54 UTC

Thanks for the link! It is helpful. However, I would like to add/remove hidden registry keys with NSIS. Is there a way to access the registry without using WindowsAPI (The System plugin, perhaps?)?

Red Wine
2nd May 2007 22:04 UTC

Have you tried the registry plugin?

http://nsis.sourceforge.net/Registry_plug-in

Brummelchen
2nd May 2007 22:30 UTC

Red Wine - plugin cant do this cause it only uses the API
which cannot handle direkt read/write to registry.

sbabineau
2nd May 2007 22:44 UTC

Exactly :(

Brummelchen
3rd May 2007 00:25 UTC

normally that shit is used for copy protection or avoiding change of serial numbers. i dont use any software with it - in case of it gets kicked immediately.

kichik
3rd May 2007 18:59 UTC

Use the System plug-in to call NtCreateKey and friends.

DimitarSerg
17th October 2011 14:00 UTC

Give me sample source please

Originally posted by kichik
Use the System plug-in to call NtCreateKey and friends.

Can anybody shows or shares a sample a part of source how to do this ?

LoRd_MuldeR
17th October 2011 19:10 UTC

This won't be that easy, because Nt/ZwCreateKey needs a pointer to a OBJECT_ATTRIBUTES structure.

Might be easier to write a simple plug-in for that purpose...

Anders
17th October 2011 22:12 UTC

Using structs with the system plugin is possible, but anyone can just set a breakpoint on System::Call and watch your calls as plain strings so you are not going to hide anything from people by using NSIS...