Jump to content
Sign in to follow this  
joakim

NtCreateKey and DllCall

Recommended Posts

joakim

I am trying to access registry keys by using ntdll.dll, but I'm facing a dreaded ntstatus 0xc0000005 (STATUS_ACCESS_VIOLATION). From the msdn docs; http://msdn.microsoft.com/en-us/library/windows/hardware/ff566425(v=vs.85).aspx it says the RootDirectory can be empty in which case the ObjectName member of the input ObjectAttributes contains the full qualified path, and should start with Registry. A bit stuck, so any help would be appreciated. Here the code;

Global Const $tagIOSTATUSBLOCK = "dword Status;ptr Information"
Global Const $tagOBJECTATTRIBUTES = "ulong Length;hwnd RootDirectory;ptr ObjectName;ulong Attributes;ptr SecurityDescriptor;ptr SecurityQualityOfService"
Global Const $tagUNICODESTRING = "ushort Length;ushort MaximumLength;ptr Buffer"
Global Const $OBJ_CASE_INSENSITIVE = 0x00000040
Global Const $KEY_READ = 0x20019
Global Const $KEY_WRITE = 0x20006
Global Const $KEY_CREATE_LINK = 0x0020
Global Const $KEY_ALL_ACCESS = 0xF003F
Global Const $REG_OPTION_NON_VOLATILE = 0x00000000

$RegKey = "RegistryMachineSOFTWAREClasses"
_NtCreateKey($RegKey)

Func _NtCreateKey($RegKey)
Local $Disposition, $ret, $KeyHandle
Local $hNTDLL = DllOpen("ntdll.dll")
Local $szName = DllStructCreate("wchar[260]")
Local $sUS = DllStructCreate($tagUNICODESTRING)
Local $sOA = DllStructCreate($tagOBJECTATTRIBUTES)
Local $sISB = DllStructCreate($tagIOSTATUSBLOCK)
DllStructSetData($szName, 1, $RegKey)
$ret = DllCall($hNTDLL, "none", "RtlInitUnicodeString", "ptr", DllStructGetPtr($sUS), "ptr", DllStructGetPtr($szName))
DllStructSetData($sOA, "Length", DllStructGetSize($sOA))
DllStructSetData($sOA, "RootDirectory", Chr(0))
DllStructSetData($sOA, "ObjectName", DllStructGetPtr($sUS))
DllStructSetData($sOA, "Attributes", $OBJ_CASE_INSENSITIVE)
DllStructSetData($sOA, "SecurityDescriptor", Chr(0))
DllStructSetData($sOA, "SecurityQualityOfService", Chr(0))
$ret = DllCall($hNTDLL, "int", "NtCreateKey", "hwnd", $KeyHandle, "dword", $KEY_ALL_ACCESS, "ptr", DllStructGetPtr($sOA), "ulong", 0, "ulong", 0, "ulong", $REG_OPTION_NON_VOLATILE, "ptr", $Disposition)
If NT_SUCCESS($ret[0]) Then
Return $ret[1]
Else
ConsoleWrite("Ntstatus: NtCreateKey: 0x" & Hex($ret[0],8) & @CRLF)
ConsoleWrite("System error code: " & _LsaNtStatusToWinError($ret[0]) & @CRLF)
Return SetError(1,0,0)
EndIf
EndFunc

Func NT_SUCCESS($status)
If 0 <= $status And $status <= 0x7FFFFFFF Then
     Return True
Else
     Return False
EndIf
EndFunc

Func _LsaNtStatusToWinError($iNtStatus)
Local $iSysError
$iSysError = DllCall("Advapi32.dll", "ulong", "LsaNtStatusToWinError", "dword", $iNtStatus)
Return $iSysError[0]
EndFunc

Btw, parts of the code is taken from wraithdu's ads sample.

Edited by joakim

Share this post


Link to post
Share on other sites
joakim

Nevermind. Turned out all that was missing was a * behind "hwnd". :)

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

  • Similar Content

    • VADemon
      By VADemon
      I've encountered a problem with a single file where I cannot retrieve it's Date-time. So far my code has worked well for over 30 files, but this one is a mystery I cannot debug myself due to insufficient Au3 knowledge.
      In line 11 "_Date_Time_FileTimeToArray" is called and for this particular file it sets the @error to 10. I don't know what that error code means, but it's not set by the _Date functions themselves I think.
      Overall, it could be a problem caused by any of the functions below, how can I properly debug this? / Does anybody know a what's causing this?
      _WinAPI_CreateFile() / _Date_Time_GetFileTime() / _Date_Time_FileTimeToArray()
      Func _SetFileTimes($sFilePath) Local $monthNumber[13] = ["", "January", "February", "March", "April", "May", "Juny", "July", "August", "September", "October", "November", "December"] Local $dayNumber[7] = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"] Local $fHandle = _WinAPI_CreateFile($sFilePath, 2, 2) ; read-only ; may NOT return a valid date for some reason! TODO Local $fTagFILETIME = _Date_Time_GetFileTime($fHandle) _WinAPI_CloseHandle($fHandle) ; This will return an empty array if theres no valid date $fModTime = _Date_Time_FileTimeToArray($fTagFILETIME[2]) ; last Modified if @error <> 10 then Local $year = $fModTime[2] Local $month = $fModTime[0] Local $day = $fModTime[1] Local $hour = $fModTime[3] Local $min = $fModTime[4] Local $sec = $fModTime[5] Local $ms = $fModTime[6] Local $weekday = $fModTime[7] Global $prettyTimestamp = StringFormat("%s, %s %d, %04d %02d:%02d:%02d", $dayNumber[$weekday], $monthNumber[$month], $day, $year, $hour, $min, $sec) Global $uploadDate = StringFormat("%04d-%02d-%02d", $year, $month, $day) $fModTime = _Date_Time_FileTimeToArray(_Date_Time_FileTimeToLocalFileTime($fTagFILETIME[2])) ; last Modified Local $year = $fModTime[2] Local $month = $fModTime[0] Local $day = $fModTime[1] Local $hour = $fModTime[3] Local $min = $fModTime[4] Local $sec = $fModTime[5] Local $ms = $fModTime[6] Local $weekday = $fModTime[7] ; GetUnixTime accounts for Local time, hence feed it local time Global $unixTimestamp = _GetUnixTime($year &"/"& $month &"/"& $day &" "& $hour&":"& $min &":"& $sec) else Global $prettyTimestamp = "N/A" Global $uploadDate = "" Global $unixTimestamp = "N/A" endif endfunc  
      _GetUnixTime returned the year 1601 start date, showing that $fModTime is probably equal 0. (But Why?)
      The file reports these dates in Explorer, it's on local NTFS drive:
      Created: ‎‎Wednesday, ‎31. ‎Januar ‎2018, ‏‎18:55:02
      Modified: ‎Wednesday, ‎10. ‎Januar ‎2018, ‏‎12:39:23
      Accessed: ‎Wednesday, ‎10. ‎Januar ‎2018, ‏‎12:39:23
    • Yirrlaar
      By Yirrlaar
      Hello All,
      I'm using "ImageSearch2015.au3" and i'm trying to figure out WHY, for the life of me, I can't find an image is hidden.
      So what I came up with, is as follows:
      _ImageSearchAreaHidden("C:\icon.png", 1, 0, 0, 800, 600, $x1, $y1, 80, 0) Func _ImageSearchAreaHidden($findImage, $resultPosition, $x1, $y1, $right, $bottom, ByRef $x, ByRef $y, $tolerance, $transparency = 0) Local $h, $result local $TestScreen = "C:\TestScreen.png" ;previsous screenshot of the image looking for, fully visible If Not FileExists($findImage) Then Return "Image File not found" If $transparency <> 0 Then $findImage = "*" & $transparency & " " & $findImage If $tolerance < 0 Or $tolerance > 255 Then $tolerance = 0 If $h_ImageSearchDLL = -1 Then _ImageSearchStartup() If $tolerance > 0 Then $findImage = "*" & $tolerance & " " & $findImage $result = DllCall($h_ImageSearchDLL, "str", "ImageSearchEx", "str", $TestScreen, "int", $x1, "int", $y1, "int", $right, "int", $bottom, "str", $findImage) If @error Then Return "DllCall Error=" & @error If $result = "0" Then Return False $array = StringSplit($result[0], "|") If (UBound($array) >= 4) Then $x = Int(Number($array[2])) ; Get the x,y location of the match $y = Int(Number($array[3])) If $resultPosition = 1 Then $x = $x + Int(Number($array[4]) / 2) ; Account for the size of the image to compute the centre of search $y = $y + Int(Number($array[5]) / 2) EndIf Return True EndIf EndFunc ;==>_ImageSearchAreaHidden Now when the folder with the icon is completely visible, it finds the icon without any issues, however if I cover up the icon, it no longer finds the image in the folder.
      Any ideas?
    • astrionn
      By astrionn
      Hi Guys,
       
      I`m trying to record with my webcam in 5s intervalls and do some stuff between starting to record and stoping.
      I took code from here: https://www.autoitscript.com/forum/topic/27925-webcam-example/
      and took what looked relevant to me.
      I use 3 different files:
       Is called WMS.au3 and contains all the constants for the dll calls is called rec.au3 and does all necessary dll calls to start a webcam recording to a file Is called stopcam.exe and does the dll calls to stop recording into a file WMS.au3  :
      $WM_CAP_START = 0x400 $WM_CAP_UNICODE_START = $WM_CAP_START +100 $WM_CAP_PAL_SAVEA = $WM_CAP_START + 81 $WM_CAP_PAL_SAVEW = $WM_CAP_UNICODE_START + 81 $WM_CAP_UNICODE_END = $WM_CAP_PAL_SAVEW $WM_CAP_ABORT = $WM_CAP_START + 69 $WM_CAP_DLG_VIDEOCOMPRESSION = $WM_CAP_START + 46 $WM_CAP_DLG_VIDEODISPLAY = $WM_CAP_START + 43 $WM_CAP_DLG_VIDEOFORMAT = $WM_CAP_START + 41 $WM_CAP_DLG_VIDEOSOURCE = $WM_CAP_START + 42 $WM_CAP_DRIVER_CONNECT = $WM_CAP_START + 10 $WM_CAP_DRIVER_DISCONNECT = $WM_CAP_START + 11 $WM_CAP_DRIVER_GET_CAPS = $WM_CAP_START + 14 $WM_CAP_DRIVER_GET_NAMEA = $WM_CAP_START + 12 $WM_CAP_DRIVER_GET_NAMEW = $WM_CAP_UNICODE_START + 12 $WM_CAP_DRIVER_GET_VERSIONA = $WM_CAP_START + 13 $WM_CAP_DRIVER_GET_VERSIONW = $WM_CAP_UNICODE_START + 13 $WM_CAP_EDIT_COPY = $WM_CAP_START + 30 $WM_CAP_END = $WM_CAP_UNICODE_END $WM_CAP_FILE_ALLOCATE = $WM_CAP_START + 22 $WM_CAP_FILE_GET_CAPTURE_FILEA = $WM_CAP_START + 21 $WM_CAP_FILE_GET_CAPTURE_FILEW = $WM_CAP_UNICODE_START + 21 $WM_CAP_FILE_SAVEASA = $WM_CAP_START + 23 $WM_CAP_FILE_SAVEASW = $WM_CAP_UNICODE_START + 23 $WM_CAP_FILE_SAVEDIBA = $WM_CAP_START + 25 $WM_CAP_FILE_SAVEDIBW = $WM_CAP_UNICODE_START + 25 $WM_CAP_FILE_SET_CAPTURE_FILEA = $WM_CAP_START + 20 $WM_CAP_FILE_SET_CAPTURE_FILEW = $WM_CAP_UNICODE_START + 20 $WM_CAP_FILE_SET_INFOCHUNK = $WM_CAP_START + 24 $WM_CAP_GET_AUDIOFORMAT = $WM_CAP_START + 36 $WM_CAP_GET_CAPSTREAMPTR = $WM_CAP_START + 1 $WM_CAP_GET_MCI_DEVICEA = $WM_CAP_START + 67 $WM_CAP_GET_MCI_DEVICEW = $WM_CAP_UNICODE_START + 67 $WM_CAP_GET_SEQUENCE_SETUP = $WM_CAP_START + 65 $WM_CAP_GET_STATUS = $WM_CAP_START + 54 $WM_CAP_GET_USER_DATA = $WM_CAP_START + 8 $WM_CAP_GET_VIDEOFORMAT = $WM_CAP_START + 44 $WM_CAP_GRAB_FRAME = $WM_CAP_START + 60 $WM_CAP_GRAB_FRAME_NOSTOP = $WM_CAP_START + 61 $WM_CAP_PAL_AUTOCREATE = $WM_CAP_START + 83 $WM_CAP_PAL_MANUALCREATE = $WM_CAP_START + 84 $WM_CAP_PAL_OPENA = $WM_CAP_START + 80 $WM_CAP_PAL_OPENW = $WM_CAP_UNICODE_START + 80 $WM_CAP_PAL_PASTE = $WM_CAP_START + 82 $WM_CAP_SEQUENCE = $WM_CAP_START + 62 $WM_CAP_SEQUENCE_NOFILE = $WM_CAP_START + 63 $WM_CAP_SET_AUDIOFORMAT = $WM_CAP_START + 35 $WM_CAP_SET_CALLBACK_CAPCONTROL = $WM_CAP_START + 85 $WM_CAP_SET_CALLBACK_ERRORA = $WM_CAP_START + 2 $WM_CAP_SET_CALLBACK_ERRORW = $WM_CAP_UNICODE_START + 2 $WM_CAP_SET_CALLBACK_FRAME = $WM_CAP_START + 5 $WM_CAP_SET_CALLBACK_STATUSA = $WM_CAP_START + 3 $WM_CAP_SET_CALLBACK_STATUSW = $WM_CAP_UNICODE_START + 3 $WM_CAP_SET_CALLBACK_VIDEOSTREAM = $WM_CAP_START + 6 $WM_CAP_SET_CALLBACK_WAVESTREAM = $WM_CAP_START + 7 $WM_CAP_SET_CALLBACK_YIELD = $WM_CAP_START + 4 $WM_CAP_SET_MCI_DEVICEA = $WM_CAP_START + 66 $WM_CAP_SET_MCI_DEVICEW = $WM_CAP_UNICODE_START + 66 $WM_CAP_SET_OVERLAY = $WM_CAP_START + 51 $WM_CAP_SET_PREVIEW = $WM_CAP_START + 50 $WM_CAP_SET_PREVIEWRATE = $WM_CAP_START + 52 $WM_CAP_SET_SCALE = $WM_CAP_START + 53 $WM_CAP_SET_SCROLL = $WM_CAP_START + 55 $WM_CAP_SET_SEQUENCE_SETUP = $WM_CAP_START + 64 $WM_CAP_SET_USER_DATA = $WM_CAP_START + 9 $WM_CAP_SET_VIDEOFORMAT = $WM_CAP_START + 45 $WM_CAP_SINGLE_FRAME = $WM_CAP_START + 72 $WM_CAP_SINGLE_FRAME_CLOSE = $WM_CAP_START + 71 $WM_CAP_SINGLE_FRAME_OPEN = $WM_CAP_START + 70 $WM_CAP_STOP = $WM_CAP_START + 68 rec.au3  :
       
      #include <WMS.au3> #include <GUIConstants.au3> if not FileExists(@ScriptDir&"\vid\"&string(@MON)&"\"&string(@mday)) Then DirCreate(@ScriptDir&"\vid\"&"\"&string(@MON)&"\"&string(@mday)) EndIf $moviefile = @ScriptDir&"\vid"&"\"&string(@MON)&"\"&string(@mday)&"\test.avi" $avi = DllOpen("avicap32.dll") $user = DllOpen("user32.dll") FileWrite(@scriptdir&"\clop.clop",$user) $Main = GUICreate("Camera",350,270) $moviefile=@ScriptDir&"\test.avi" $cap = DllCall($avi, "int", "capCreateCaptureWindow", "str", "cap", "int", BitOR($WS_CHILD,$WS_VISIBLE), "int", 15, "int", 15, "int", 320, "int", 240, "hwnd", $Main, "int", 1) FileWrite(@scriptdir&"\clip.clip",$cap[0]) run(@scriptdir&"\stopcam.exe") DllCall($user, "int", "SendMessage", "hWnd", $cap[0], "int", $WM_CAP_DRIVER_CONNECT, "int", 0, "int", 0) DllCall($user, "int", "SendMessage", "hWnd", $cap[0], "int", $WM_CAP_SET_SCALE, "int", 1, "int", 0) DllCall($user, "int", "SendMessage", "hWnd", $cap[0], "int", $WM_CAP_SET_OVERLAY, "int", 1, "int", 0) DllCall($user, "int", "SendMessage", "hWnd", $cap[0], "int", $WM_CAP_SET_PREVIEW, "int", 1, "int", 0) DllCall($user, "int", "SendMessage", "hWnd", $cap[0], "int", $WM_CAP_SET_PREVIEWRATE, "int", 1, "int", 0) DllCall($user, "int", "SendMessage", "hWnd", $cap[0], "int", $WM_CAP_FILE_SET_CAPTURE_FILEA, "int", 0, "str", $moviefile) DllCall($user, "int", "SendMessage", "hWnd", $cap[0], "int", $WM_CAP_SEQUENCE, "int", 0, "int", 0) Stopcam.exe is the compiled version of this:
      #include "WMS.au3" #include <GUIConstants.au3> $cap = Int(FileRead(@scriptdir&"\clip.clip")) $user = int(fileread(@scriptdir&"\clop.clop")) Sleep(10000) DllCall($user, "int", "SendMessage", "hWnd", $cap, "int", $WM_CAP_STOP, "int", 0, "int", 0) DllCall($user, "int", "SendMessage", "hWnd", $cap, "int", $WM_CAP_END, "int", 0, "int", 0) DllCall($user, "int", "SendMessage", "hWnd", $cap, "int", $WM_CAP_DRIVER_DISCONNECT, "int", 0, "int", 0) DllClose($user) FileDelete(@scriptdir&"\clip.clip") FileDelete(@scriptdir&"\clop.clop")  
      Unfortunately this is not working as I thought it would be working.
      Does someone see what I´m doing wrong?
      It should record the webcam for about 10 seconds ( a little less) and save that to an .avi file.
      It does not stop the recording , I have to stop the process manually...
      Secondly, which confuses me more is that it creates the test.avi not in the location is specified in the script... its stored in the ScriptDir for whatever reason haha
      I hope you can help me
       
      ~HappyCoding
    • badcoder123
      By badcoder123
      I was looking around the help file and I came across _GDIPlus_GraphicsDrawRect and _WinAPI_DrawLine and I seem to be having the same "problem" where every time it draws into a window and you lose or gain focus it has to redraw itself. Is there anyway around this? 
      #include <WindowsConstants.au3> #include <WinAPI.au3> #Include <GDIPlus.au3> _GDIPlus_Startup() Run("notepad.exe") $hWnd = WinWait("Untitled") $hGraphic = _GDIPlus_GraphicsCreateFromHWND($hWnd) $Color = 0xFFFF0000 $hPen = _GDIPlus_PenCreate($Color, 2) For $i = 1 To 10 _GDIPlus_GraphicsDrawRect($hGraphic, 200, 200, 25 ,25, $hPen) ToolTip($i) Sleep(1000) Next _WinAPI_RedrawWindow($hWnd, 0, 0, $RDW_INVALIDATE + $RDW_ALLCHILDREN) _GDIPlus_GraphicsDispose($hGraphic) _GDIPlus_PenDispose($hPen) _GDIPlus_Shutdown()  
    • ScriptJunky
      By ScriptJunky
      I noticed a lack of a constants file for _WinAPI_GetSystemMetrics() so I made this for anyone who wants to add it to their library. Enjoy!  (file attached below)
      #include-once ; #INDEX# ======================================================================================================================= ; Title .........: WinAPI GetSystemMetrics Constants ; AutoIt Version : 3.3.14.5 ; Language ......: English ; Description ...: Constants for _WinAPI_GetSystemMetrics(). ; Author(s) .....: ScriptJunky ; =============================================================================================================================== ; #CONSTANTS# =================================================================================================================== ; _WinAPI_GetSystemMetrics() Global Const $ARRANGE = 56 Global Const $CLEANBOOT = 67 Global Const $CMONITORS = 80 Global Const $CMOUSEBUTTONS = 43 Global Const $CONVERTIBLESLATEMODE = 0x2003 Global Const $CXBORDER = 5 Global Const $CXCURSOR = 13 Global Const $CXDLGFRAME = 7 Global Const $CXDOUBLECLK = 36 Global Const $CXDRAG = 68 Global Const $CXEDGE = 45 Global Const $CXFIXEDFRAME = 7 Global Const $CXFOCUSBORDER = 83 Global Const $CXFRAME = 32 Global Const $CXFULLSCREEN = 16 Global Const $CXHSCROLL = 21 Global Const $CXHTHUMB = 10 Global Const $CXICON = 11 Global Const $CXICONSPACING = 38 Global Const $CXMAXIMIZED = 61 Global Const $CXMAXTRACK = 59 Global Const $CXMENUCHECK = 71 Global Const $CXMENUSIZE = 54 Global Const $CXMIN = 28 Global Const $CXMINIMIZED = 57 Global Const $CXMINSPACING = 47 Global Const $CXMINTRACK = 34 Global Const $CXPADDEDBORDER = 92 Global Const $CXSCREEN = 0 Global Const $CXSIZE = 30 Global Const $CXSIZEFRAME = 32 Global Const $CXSMICON = 49 Global Const $CXSMSIZE = 52 Global Const $CXVIRTUALSCREEN = 78 Global Const $CXVSCROLL = 2 Global Const $CYBORDER = 6 Global Const $CYCAPTION = 4 Global Const $CYCURSOR = 14 Global Const $CYDLGFRAME = 8 Global Const $CYDOUBLECLK = 37 Global Const $CYDRAG = 69 Global Const $CYEDGE = 46 Global Const $CYFIXEDFRAME = 8 Global Const $CYFOCUSBORDER = 84 Global Const $CYFRAME = 33 Global Const $CYFULLSCREEN = 17 Global Const $CYHSCROLL = 3 Global Const $CYICON = 12 Global Const $CYICONSPACING = 39 Global Const $CYKANJIWINDOW = 18 Global Const $CYMAXIMIZED = 62 Global Const $CYMAXTRACK = 60 Global Const $CYMENU = 15 Global Const $CYMENUCHECK = 72 Global Const $CYMENUSIZE = 55 Global Const $CYMIN = 29 Global Const $CYMINIMIZED = 58 Global Const $CYMINSPACING = 48 Global Const $CYMINTRACK = 35 Global Const $CYSCREEN = 1 Global Const $CYSIZE = 31 Global Const $CYSIZEFRAME = 33 Global Const $CYSMCAPTION = 51 Global Const $CYSMICON = 50 Global Const $CYSMSIZE = 53 Global Const $CYVIRTUALSCREEN = 79 Global Const $CYVSCROLL = 20 Global Const $CYVTHUMB = 9 Global Const $DBCSENABLED = 42 Global Const $DEBUG = 22 Global Const $DIGITIZER = 94 Global Const $IMMENABLED = 82 Global Const $MAXIMUMTOUCHES = 95 Global Const $MEDIACENTER = 87 Global Const $MENUDROPALIGNMENT = 40 Global Const $MIDEASTENABLED = 74 Global Const $MOUSEPRESENT = 19 Global Const $MOUSEHORIZONTALWHEELPRESENT = 91 Global Const $MOUSEWHEELPRESENT = 75 Global Const $NETWORK = 63 Global Const $PENWINDOWS = 41 Global Const $REMOTECONTROL = 0x2001 Global Const $REMOTESESSION = 0x1000 Global Const $SAMEDISPLAYFORMAT = 81 Global Const $SECURE = 44 Global Const $SERVERR = 289 Global Const $SHOWSOUNDS = 70 Global Const $SHUTTINGDOWN = 0x2000 Global Const $SLOWMACHINE = 73 Global Const $STARTER = 88 Global Const $SWAPBUTTON = 23 Global Const $TABLETPC = 86 Global Const $XVIRTUALSCREEN = 76 Global Const $YVIRTUALSCREEN = 77  
      WinAPISystemMetricsConstants.au3
×