MultiTool/IAT_registry.cpp at master · ShadowKnightMK4/MultiTool · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

#include "IAT_REGISTRY.H"

extern "C"
{
	RegOpenKeyA_Ptr IAT_RegOpenKeyA = 0;
	RegEnumKeyA_Ptr IAT_RegEnumKeyA = 0;
	RegCloseKey_Ptr IAT_RegCloseKey = 0;
	RegEnumValueA_Ptr IAT_RegEnumValueA = 0;
	RegQueryValueExA_Ptr IAT_RegQueryValueExA = 0;

	DWORD IAT_DynamicLinkRegistry_Cleanup()
	{
		DWORD ret =0;

		IAT_RegCloseKey = 0;
		IAT_RegEnumKeyA = 0;
		IAT_RegEnumValueA = 0;
		IAT_RegQueryValueExA = 0;
		IAT_RegOpenKeyA = 0;
		return ret;
	}
	DWORD IAT_DynamicLinkRegistry(DWORD IAT_settings)
	{
		DWORD ret = 0;
		if (iatAdvapi32 == 0)
		{
			iatAdvapi32 = LoadLibraryA("advapi32.dll");
		}
		if (iatAdvapi32 == 0)
		{
			return 0;
		}
		else
		{
			if ( (IAT_settings & IAT_REGISTRY_ENUMKEYA) == IAT_REGISTRY_ENUMKEYA)
			{
				IAT_RegEnumKeyA = (RegEnumKeyA_Ptr)GetProcAddress(iatAdvapi32, "RegEnumKeyA");
				if (IAT_RegEnumKeyA != 0)
				{
					ret |= IAT_REGISTRY_ENUMKEYA;
				}
			}

			if ((IAT_settings & IAT_REGISTRY_OPENKEYA) == IAT_REGISTRY_OPENKEYA)
			{
				IAT_RegOpenKeyA = (RegOpenKeyA_Ptr)GetProcAddress(iatAdvapi32, "RegOpenKeyA");
				if (IAT_RegOpenKeyA != 0)
				{
					ret |= IAT_REGISTRY_OPENKEYA;
				}
			}


			if ((IAT_settings & IAT_REGISTRY_CLOSEKEY) == IAT_REGISTRY_CLOSEKEY)
			{
				IAT_RegCloseKey = (RegCloseKey_Ptr)GetProcAddress(iatAdvapi32, "RegCloseKey");
				if (IAT_RegCloseKey != 0)
				{
					ret |= IAT_REGISTRY_CLOSEKEY;
				}
			}

			if ((IAT_settings & IAT_REGISTRY_ENUMKEYA) == IAT_REGISTRY_ENUMKEYA)
			{
				IAT_RegEnumValueA = (RegEnumValueA_Ptr)GetProcAddress(iatAdvapi32, "RegEnumValueA");
				if (IAT_RegEnumValueA != 0)
				{
					ret |= IAT_REGISTRY_ENUMKEYA;
				}
			}
			if ((IAT_settings & IAT_REGISTRY_QUERYVALUEEXA) == IAT_REGISTRY_QUERYVALUEEXA)
			{
				IAT_RegQueryValueExA = (RegQueryValueExA_Ptr)GetProcAddress(iatAdvapi32, "RegQueryValueExA");
				if (IAT_RegQueryValueExA != 0)
				{
					ret |= IAT_REGISTRY_QUERYVALUEEXA;
				}
			}

			return ret;


		}
	}
}