1

I am analyzing an executable based on its execution trace. I have obtained the execution trace using NtTrace tool. The output is a sequence of native api calls with arguments. I have managed to interpret most of the API calls except the following ones:

NtQueryKey( KeyHandle=0x46a, KeyInformationClass=7 [KeyHandleTagsInformation], KeyInformation=0x312c4e0, Length=4, ResultLength=0x312c4dc [4] ) => 0

NtDeviceIoControlFile( FileHandle=0xbe4, Event=0xce8, ApcRoutine=null, ApcContext=null, IoStatusBlock=0x124cf2b0 [0/0xffc], IoControlCode=0x00012017, InputBuffer=0x124cf298, InputBufferLength=0x10, OutputBuffer=null, OutputBufferLength=0 ) => 0

In NtQueryKey, how can I map the KeyHandle=0x46a to an actual registry key. Further, in NtDeviceIoControlFile based on IoControlCode=0x00012017 is it possible to find whether it is a TCP_RECV, TCP_SEND, etc...

Thank you.

4

2 回答 2

1

Sysinternals（现在是 Microsoft 的一部分）的 Process Monitor 将在显示注册表活动时向您显示实际的密钥路径。它还可以监控网络活动。

系统内部工具

于 2013-01-15T21:10:37.650 回答
0

只需在跟踪中回顾一下，即可找到所处理的密钥被打开的点。如果该键是相对于另一个键打开的，则您可能必须递归地重复此过程。将来，我建议使用来自 sysinternals 的 procmon。输出要好得多。

于 2013-01-15T21:09:38.930 回答