Access Hidden Registry Keys?

sbabineauMay 1, 2007 at 9:50 PM#

It doesn't appear that I can get access to hidden registry keys using the built-in Registry functions. Is this true? If so, is there another way?

-Steve.

BrummelchenMay 1, 2007 at 10:37 PM#

http://www.codeproject.com/tools/NtRegEdit.asp

sbabineauMay 2, 2007 at 6:54 PM#

Thanks for the link! It is helpful. However, I would like to add/remove hidden registry keys with NSIS. Is there a way to access the registry without using WindowsAPI (The System plugin, perhaps?)?

Red WineMay 2, 2007 at 7:04 PM#

Have you tried the registry plugin?

http://nsis.sourceforge.net/Registry_plug-in

BrummelchenMay 2, 2007 at 7:30 PM#

Red Wine - plugin cant do this cause it only uses the API
which cannot handle direkt read/write to registry.

sbabineauMay 2, 2007 at 7:44 PM#

Exactly 🙁

BrummelchenMay 2, 2007 at 9:25 PM#

normally that shit is used for copy protection or avoiding change of serial numbers. i dont use any software with it - in case of it gets kicked immediately.

kichikMay 3, 2007 at 3:59 PM#

Use the System plug-in to call NtCreateKey and friends.

DimitarSergOctober 17, 2011 at 11:00 AM#

Give me sample source please

Originally Posted by kichik View Post

Use the System plug-in to call NtCreateKey and friends.

Can anybody shows or shares a sample a part of source how to do this ?

LoRd_MuldeROctober 17, 2011 at 4:10 PM#

This won't be that easy, because Nt/ZwCreateKey needs a pointer to a OBJECT_ATTRIBUTES structure.

Might be easier to write a simple plug-in for that purpose...

AndersOctober 17, 2011 at 7:12 PM#

Using structs with the system plugin is possible, but anyone can just set a breakpoint on System::Call and watch your calls as plain strings so you are not going to hide anything from people by using NSIS...