SYSREVEAL

If you have seen the WRK, you will find out that the NtLoadKeyEx prototype is as following:

NTSTATUS __stdcall NtLoadKeyEx
(
__in POBJECT_ATTRIBUTES TargetKey,
__in POBJECT_ATTRIBUTES SourceFile,
__in ULONG Flags,
__in_opt HANDLE TrustClassKey
);

But when you attempt to hook this function as this prototype, there must be a critical error.
What’s wrong?

Yeah, the real windows system does not use this prototype.
The real one is:

NTSTATUS __stdcall NtLoadKeyEx
(
__in POBJECT_ATTRIBUTES TargetKey,
__in POBJECT_ATTRIBUTES SourceFile,
__in ULONG Flags,
__in_opt HANDLE TrustClassKey,
__in PVOID Reserved,
__in PVOID ObjectContext,
__in PVOID CallbackReserved,
__out PIO_STATUS_BLOCK IoStatusBlock
);

I will ignore the first 4 parameters and describe the last 4 ones.

Reserved :
must be NULL;

ObjectContext:
The “ObjectContext” Parameter in REG_LOAD_KEY_INFORMATION structure which is passed when you register the RegNtPreLoadKey call back routine of CmRegisterCallback;

CallbackReserved:
The “Reserved” Parameter in REG_LOAD_KEY_INFORMATION structure which is passed when you register the RegNtPreLoadKey call back routine of CmRegisterCallback(must be NULL);

IoStatusBlock:
return the status for openning source file(NULL is not acceptable);

Okay, that’s the end!