ZwRegistryOpen rule (wdm)

The ZwRegistryOpen rule specifies that after calling ZwOpenKey, the driver calls the following registry functions only while holding an open handle to a registry key (that is, before calling ZwClose or ZwDeleteKey):

This rule also specifies that the driver must not call ZwOpenKey if it is already holding an open handle to that registry key.

Finally, this rule specifies that the driver must not return from the dispatch routine or cancel routine while holding an open handle to a registry key.

This rule does not verify that the driver is holding an open handle to the correct registry key when it calls ZwClose or ZwDeleteKey.

Driver modelWDM

How to test

At compile time

Run Static Driver Verifier and specify the ZwRegistryOpen rule.

Use the following steps to run an analysis of your code:
  1. Prepare your code (use role type declarations).
  2. Run Static Driver Verifier.
  3. View and analyze the results.

For more information, see Using Static Driver Verifier to Find Defects in Drivers.

Applies to

ZwClose
ZwDeleteKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwFlushKey
ZwOpenKey
ZwQueryKey
ZwQueryValueKey
ZwSetValueKey

See also

ZwRegistryCreate

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft. All rights reserved.