Comments (4)
Revision 224:
Major rework of registry virtualization implementation, includes the following:
- Reworked RegistryHelper and moved some of its functionality to the new
HiveHelper
class.
- Moved methods from RegistryBase to RegistryHelper.
- Updated the IRegistryProvider interface to use NativeResultCode as return
values.
- Merged VirtualRegistry with RegistryProvider.
- Renamed VirtualRegistryData to VirtualRegistry.
- Reworked RegistryBase so all its class variables are kept private.
- Clean up and minor bug fixes for all classes related to registry
virtualization.
Results:
- Virtualization engine provides its own handles now, starting at 21
- Logs still contain duplicate lines, like:
2010-03-10 11:03:35.179919 [Debug] [Guest 5656] [9]
OpenKey(-2147483646\\Software
\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile
\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}) => 23
2010-03-10 11:03:35.179919 [Debug] [Guest 5656] [9] QueryValue
2010-03-10 11:03:35.180919 [Debug] [Guest 5656] [9]
OpenKey(-2147483646\\software
\microsoft\ctf\tip\{0000897b-83df-4b96-be07-0fb58b01c4a4}\languageprofile
\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}) => 23
2010-03-10 11:03:35.346919 [Debug] [Guest 5656] [9] QueryValue(HKey=23
ValueName=Enable) => FileNotFound
2010-03-10 11:03:35.347919 [Debug] [Guest 5656] [9] CloseKey(HKey=23)
- Target processes start but might (rarely) run into an access violation
exception,
which isn't caught the visual studio debugger
Original comment by [email protected]
on 10 Mar 2010 at 9:22
- Changed state: Started
from appstract.
Correction on comment 1:
Target processes don't run into an access violation exception,
the exceptions were caused by pending changes of this revision (see last item
of the
results summary)
Revision 228:
Introduced a thread management system for the API hook handlers.
Results:
- Hook handlers are not interrupted anymore by other API hooks.
- No more duplicate lines in the logs.
- The management system uses native thread id's (acquired with
AppDomain.GetCurrentThreadId()), which is not 100% reliable for managed threads
- The target process crashes whenever the handler for RegQueryValueEx is able
to
retrieve a value
RegQueryValueEx, extracted log lines:
2010-03-11 16:14:59.010919 [Debug] [Guest 17092] [8]
OpenKey(2147483648\\Directory)
=> 30
... irrelevant lines ...
2010-03-11 16:14:59.463919 [Debug] [Guest 17092] [8] QueryValue(HKey=30
ValueName=AlwaysShowExt) => Succes
#End of log, process crashes without being able to report an exception to the
attached debugger
After extensive debugging the cause of the issue is tracked to
MarshallingHelpers.ToByteArray(object)
Original comment by [email protected]
on 11 Mar 2010 at 2:42
from appstract.
Revision 231:
Added Object.ToByteArray() and IntPtr.Write() extension methods.
Added support for enum types to all extension methods.
Revision 233:
Registry virtualization engine now makes use of the IntPtrExtensions-class in
stead of the MarshallingHelpers-class.
Results:
- All output data is passed reliably to the hooked functions
- All input data is serialized correctly to byte arrays
- The virtualization engine seems to work now
Considerations:
- Support for managed targets is broken, the main method can't be invoked while
the
API hooks are active
- Installers are in some cases able to read the host's registry (depending on
AccessMechanism), thereby they might detect they are "already installed" (eg
the VLC
media player installer)
Original comment by [email protected]
on 12 Mar 2010 at 9:04
from appstract.
The registry virtualization engine is now considered to be functional and
stable.
The last two considerations are moved to Issue 14
Original comment by [email protected]
on 1 Apr 2010 at 3:22
- Changed state: Fixed
from appstract.
Related Issues (20)
- Remove the warning shown in the pre-packaging-wizard's final page
- System writes duplicate values to the databases HOT 1
- Send guest's log messages async to the host HOT 2
- Development of a third registry provider HOT 3
- Recover from unknown registry key handles HOT 2
- Engine Rules Framework HOT 4
- AccessMechanism.Virtual HOT 2
- Support for managed targets is broken HOT 1
- Clean up of the virtualization engine. HOT 4
- Implement RegDeleteKey and RegDeleteKeyValue HOT 1
- Rework the File System Virtualization Engine HOT 3
- Revise project architecture HOT 2
- Implement RegEnumKeyEx and RegEnumValue
- Implement DeleteFile HOT 2
- Create a more efficient and reliable system to interact with the GAC HOT 3
- Corrupted data when marshalling HOT 1
- Access violation when target is a managed console application HOT 1
- Implement Unit Tests HOT 1
- Data read and written from SQLite for VirtualRegistryValue.Data is inconsistent HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from appstract.