This commit is contained in:
love-code-yeyixiao 2024-05-26 19:18:37 +08:00
parent 8ac2b3ef9a
commit ec8a23a7cf
1 changed files with 20 additions and 0 deletions

View File

@ -210,6 +210,26 @@ _FX NTSTATUS SysInfo_NtQuerySystemInformation(
HKEY hKey=NULL; HKEY hKey=NULL;
PVOID lpData=NULL; PVOID lpData=NULL;
DWORD dwLen = 0; DWORD dwLen = 0;
typedef LSTATUS
(*ROK)(
_In_ HKEY hKey,
_In_opt_ LPCWSTR lpSubKey,
_In_opt_ DWORD ulOptions,
_In_ REGSAM samDesired,
_Out_ PHKEY phkResult
);
typedef LSTATUS
(*RQVEW)(
HKEY hKey,
LPCWSTR lpValueName,
LPDWORD lpReserved,
LPDWORD lpType,
LPBYTE lpData,
LPDWORD lpcbData
);
ROK RegOpenKeyExW=Ldr_GetProcAddrOld(L"Advapi32.dll",L"RegOpenKeyExW");
RQVEW RegQueryValueExW = Ldr_GetProcAddrOld(L"Advapi32.dll", L"RegQueryValueExW");
if (RegOpenKeyExW(HKEY_CURRENT_USER, L"SOFTWARE\\SandboxieHide\\", 0, KEY_READ, hKey)) if (RegOpenKeyExW(HKEY_CURRENT_USER, L"SOFTWARE\\SandboxieHide\\", 0, KEY_READ, hKey))
RegQueryValueExW(hKey, "FalseFirewareValue", 0, REG_SZ, lpData, &dwLen); RegQueryValueExW(hKey, "FalseFirewareValue", 0, REG_SZ, lpData, &dwLen);
if (dwLen != 0) { if (dwLen != 0) {