[ASM] Edit Registry Problem

[R4k0Z]

Hi everyone,


Today's menu is: RegOpenKeyExA, we'll call it ROK for simplicity


So, i want to execute X file on startup. I'm actually trying to add it to the HKLM-Run register, and in the process ROK wont cooperate and keeps throwing Access Violation Errors


This is the part that matters:

Code: [Select]


kHandle dd 0
kDir db "SOFTWARE\Microsoft\Windows\CurrentVersion\Run",0


lea edx, [ebp+kHandle] ;ebp is the delta offset, here im getting the pointer to my keyhandler
push edx ;pass the handler
push 0x00000010 ;Ask for reading rights (so i dont get permissions errors)
xor edx, edx
push edx ;push NULL (reserved)
lea edx, [ebp+kDir]
push edx ;subkey string pointer
push 0x80000002 ;HKEY_LOCAL_MACHINE
call 0x75334887 ;Call ROK (i can get it dynamically, but i hardcoded the address to
;reduce error vectors)



Thanks in advance

[R4k0Z]

after an enormous amount of searching i solved it

i have win7 64 bits, which redirects 32bits register calls to another subkey, i think that was the mayor problem. Its solved with the KEY_WOW64_64KEY flag

plus i found a bug wich led to a call to nul

<3 OllyDbg <3