[NTOS:CM][CMLIB] In PE mode, allow registry hives (except system ones) to use read/write access.

+ Improve related comments.

Registry hives are opened in shared read access when NT is loaded in PE
mode (MININT) or from network (the hives residing on a network share).
This is true in particular for the main system hives (SYSTEM, SOFTWARE,
DEFAULT, ...).

However, in PE mode, we can allow other hives, e.g. those loaded by the
user (with NtLoadKey) to be loaded with full read/write access, since we
boot from a local computer.
This commit is contained in:
Hermès Bélusca-Maïto 2023-12-14 22:02:58 +01:00
parent 793ee786cd
commit feb67576dd
No known key found for this signature in database
GPG key ID: 3B2539C65E7B93D0
4 changed files with 23 additions and 34 deletions

View file

@ -54,11 +54,14 @@ UNICODE_STRING CmSymbolicLinkValueName =
UNICODE_STRING CmpLoadOptions;
/* TRUE if the system hives must be loaded in shared mode */
BOOLEAN CmpShareSystemHives;
/* TRUE when the registry is in PE mode */
BOOLEAN CmpMiniNTBoot;
ULONG CmpBootType;
BOOLEAN CmSelfHeal = TRUE;
BOOLEAN CmpSelfHeal = TRUE;
BOOLEAN CmpMiniNTBoot;
ULONG CmpBootType;
USHORT CmpUnknownBusCount;
ULONG CmpTypeCount[MaximumType + 1];

View file

@ -261,9 +261,14 @@ CmpCmdInit(IN BOOLEAN SetupBoot)
/* Testing: Force Lazy Flushing */
CmpHoldLazyFlush = FALSE;
/* Setup the hive list if this is not a Setup boot */
/* Setup the system hives list if this is not a Setup boot */
if (!SetupBoot)
CmpInitializeHiveList();
/* Now that the system hives are loaded, if we are in PE mode,
* all other hives will be loaded with full access */
if (CmpMiniNTBoot)
CmpShareSystemHives = FALSE;
}
NTSTATUS

View file

@ -332,7 +332,7 @@ CmpInitHiveFromFile(IN PCUNICODE_STRING HiveName,
*New = FALSE;
}
/* Check if we're sharing hives */
/* Check if the system hives are opened in shared mode */
if (CmpShareSystemHives)
{
/* Then force using the primary hive */
@ -928,11 +928,9 @@ CmpInitializeSystemHive(IN PLOADER_PARAMETER_BLOCK LoaderBlock)
if (!RtlCreateUnicodeString(&SystemHive->FileFullPath, L"\\SystemRoot\\System32\\Config\\SYSTEM"))
return FALSE;
/* Manually set the hive as volatile, if in Live CD mode */
/* Load the system hive as volatile, if opened in shared mode */
if (HiveBase && CmpShareSystemHives)
{
SystemHive->Hive.HiveFlags = HIVE_VOLATILE;
}
/* Save the boot type */
CmpBootType = SystemHive->Hive.BaseBlock->BootType;
@ -1508,7 +1506,7 @@ CmpInitializeHiveList(VOID)
/* Make sure the list is set up */
ASSERT(CmpMachineHiveList[i].Name != NULL);
/* Load the hive as volatile, if in LiveCD mode */
/* Load this root hive as volatile, if opened in shared mode */
if (CmpShareSystemHives)
CmpMachineHiveList[i].HHiveFlags |= HIVE_VOLATILE;
@ -1630,7 +1628,7 @@ CmInitSystem1(VOID)
/* Check if this is PE-boot */
if (InitIsWinPEMode)
{
/* Set registry to PE mode */
/* Set the registry in PE mode and load the system hives in shared mode */
CmpMiniNTBoot = TRUE;
CmpShareSystemHives = TRUE;
}