Hidden keys / registry values

Question

After reading this post on SO, I tried to write a small application that I need to read and write hidden keys / key values.
I checked “Manipulating the registry” using the NT Native API and Creating a “Hidden” Value registry .
At first I gave me something to work with, but it is written in C ++, and the second is a Delphi project that works well.
I cannot convert the first, and I could try to convert the second, but I will need to find the code to read the keys / values. For this reason, I would like to know if there is something "ready" and tested in C #.
I also downloaded Hacker v1.11 asks for the source code and used it to partially convert the Delphi example, as shown below, but the hidden registry key is available (while in Delphi it is not) and there are no APIs for writing values.

static void Main(string[] args) { string KeyNameBuffer = @"\Registry\User\S-1-5-21-3979903645-2167650815-2353538381-1001\SOFTWARE"; string NewKeyNameBuffer = "Systems Internals"; string HiddenKeyNameBuffer = "Can't touch me\0"; string HiddenValueNameBuffer = "Hidden Value"; // Apro la chiave di registro IntPtr SoftwareKeyHandle = CreateKey(KeyNameBuffer, IntPtr.Zero); if (SoftwareKeyHandle != IntPtr.Zero) { IntPtr SysKeyHandle = CreateKey(NewKeyNameBuffer, SoftwareKeyHandle); if (SysKeyHandle != IntPtr.Zero) { // This key shouldn't be accessible, but it is IntPtr HiddenKeyHandle = CreateKey(HiddenKeyNameBuffer, SysKeyHandle); if (HiddenKeyHandle != IntPtr.Zero) { // I don't have APIs to write values } } } } static IntPtr CreateKey(string keyName, IntPtr rootKey) { IntPtr res; KeyCreationDisposition disp; ObjectAttributes attributes = new ObjectAttributes(keyName, ObjectFlags.CaseInsensitive, new NativeHandle(rootKey)); NtStatus st = Win32.NtCreateKey(out res, KeyAccess.All, ref attributes, 0, IntPtr.Zero, RegOptions.NonVolatile, out disp); return st == NtStatus.Success ? res : IntPtr.Zero; } 

Finally: from Vista, you cannot write the \Registry\Machine part if you are not using the application as an administrator, so in this example I used my user registry key. Is there a way to use the built-in APIs to write this part of the registry if I need to save a value for each machine?

Answer 1

If you want HKLM and privileges to not allow you, it does not matter what level of API you use, Reg * functions of Nt * ones - this will not allow you to do this with an access denied error.