RE: [Plugins-writers] Writing to the registry_open_hkcu function.

Previous message: Michael Scheidell: "RE: [Plugins-writers] Writing to the registry_open_hkcu function."
Maybe in reply to: tom@private: "[Plugins-writers] Writing to the registry_open_hkcu function."
Next in thread: Nicolas Pouvesle: "RE: [Plugins-writers] Writing to the registry_open_hkcu function."
Reply: Nicolas Pouvesle: "RE: [Plugins-writers] Writing to the registry_open_hkcu function."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

tom@private

>> After a lot of scratching my head I realized that the function
>> RegOpenKey() only
>> works with HKEY_LOCAL_MACHINE.
>
> Wrong.
> You can open HKLM/HKU/HKCR/HKCU.

Maybe we were both wrong? I realized that I had only tried to use RegOpenKey()
for HKLM and HKCU. Turns out when I try to query HKCU it actually opens HKU. I
verified this several times. Here is my code:

hkey = RegConnectRegistry(hkey:HKEY_CURRENT_USER);
if ( isnull(hkey) )
{
 NetUseDel();
 exit(0);
}

## Key below is from HKEY_USERS
key = ".DEFAULT";
## Key Below is from HKEY_CURRENT_USER
## key = "Control Panel"

key_h = RegOpenKey(handle:hkey, key:key, mode:MAXIMUM_ALLOWED);

As you can see I attempt to open HKCU but what it actually does is open HKU. I
verified it by successfully querying HKU and not HKCU. I also have the Ethereal
traces if you would like to see them.

Anything you can do to point me in the right direction to get the function to
work or figure out how to fix it is appreciated.

_______________________________________________
Plugins-writers mailing list
Plugins-writers@private
http://mail.nessus.org/mailman/listinfo/plugins-writers