关于注册表权限问题

前段时间用注册表完整模块写了一个软件遇到了些问题就是在
使用API读写导出导入注册表时在遇到有些地方没有SYSTEM权限时行不通
比如在读写导出导入“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum”
就不行请问哪位高手能提高读写导出导入注册表的权限使其能正常工作

22 个解决方案

#1

修改注册表子键权限可以用RegSetKeySecurity

由于觉得权限API离软件核心设计太远，我对权限API也不熟

#2

我也知道这个函数就是不知道怎么用。有这个函数的列子吗

#3

http://www.vbcode.com/Asp/showsn.asp?theID=5559

#4

谢谢楼上的这位朋友
我去看了下好像不能用哦
不知道楼上的朋友试了没有

#5

你什么系统啊,98下不能用这个函数

#6

我的是2K系统
好像一些对象不存在吧

#7

了解一下那些权限API就好了，没什么特别的东西。

#8

楼上的朋友能给出代码吗

#9

我看了http://www.vbcode.com/Asp/showsn.asp?theID=5559这个网站的那个其实还是不行
它需要的前提是有权限的情况下设置其他权限问题是现在就没权限我要的是打开权限
应该要使用到“EnablePrivilege”查看终止系统进程我知道怎么写但是读写注册表的“EnablePrivilege”不清楚了
哪位朋友了解EnablePrivilege帮忙写下

#10

我用的是这个模块其中有个EnablePrivilege好象也存在问题
Option Explicit

Option Compare Text

'---------------------------------------------------------------
'- 注册表 API 声明...
'---------------------------------------------------------------
Private Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long
Private Declare Function RegCreateKeyEx Lib "advapi32.dll" Alias "RegCreateKeyExA" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal Reserved As Long, ByVal lpClass As String, ByVal dwOptions As Long, ByVal samDesired As Long, lpSecurityAttributes As SECURITY_ATTRIBUTES, phkResult As Long, lpdwDisposition As Long) As Long
Private Declare Function RegDeleteKey Lib "advapi32.dll" Alias "RegDeleteKeyA" (ByVal hKey As Long, ByVal lpSubKey As String) As Long
Private Declare Function RegDeleteValue Lib "advapi32.dll" Alias "RegDeleteValueA" (ByVal hKey As Long, ByVal lpValueName As String) As Long
Private Declare Function RegOpenKeyEx Lib "advapi32.dll" Alias "RegOpenKeyExA" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, phkResult As Long) As Long
Private Declare Function RegQueryValueEx Lib "advapi32.dll" Alias "RegQueryValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal lpReserved As Long, lpType As Long, lpData As Any, lpcbData As Long) As Long
Private Declare Function RegRestoreKey Lib "advapi32.dll" Alias "RegRestoreKeyA" (ByVal hKey As Long, ByVal lpFile As String, ByVal dwFlags As Long) As Long
Private Declare Function RegSaveKey Lib "advapi32.dll" Alias "RegSaveKeyA" (ByVal hKey As Long, ByVal lpFile As String, lpSecurityAttributes As SECURITY_ATTRIBUTES) As Long
Private Declare Function RegSetValueEx Lib "advapi32.dll" Alias "RegSetValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, lpData As Any, ByVal cbData As Long) As Long
Private Declare Function RegQueryInfoKey Lib "advapi32.dll" Alias "RegQueryInfoKeyA" (ByVal hKey As Long, ByVal lpClass As String, lpcbClass As Long, ByVal lpReserved As Long, lpcSubKeys As Long, lpcbMaxSubKeyLen As Long, lpcbMaxClassLen As Long, lpcValues As Long, lpcbMaxValueNameLen As Long, lpcbMaxValueLen As Long, lpcbSecurityDescriptor As Long, lpftLastWriteTime As FILETIME) As Long
Private Declare Function RegEnumValue Lib "advapi32.dll" Alias "RegEnumValueA" (ByVal hKey As Long, ByVal dwIndex As Long, ByVal lpValueName As String, lpcbValueName As Long, ByVal lpReserved As Long, lpType As Long, lpData As Byte, lpcbData As Long) As Long
Private Declare Function RegEnumKeyEx Lib "advapi32.dll" Alias "RegEnumKeyExA" (ByVal hKey As Long, ByVal dwIndex As Long, ByVal lpName As String, lpcbName As Long, ByVal lpReserved As Long, ByVal lpClass As String, lpcbClass As Long, lpftLastWriteTime As FILETIME) As Long
Private Declare Function RegOpenKey Lib "advapi32.dll" Alias "RegOpenKeyA" (ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long
Private Declare Function RegEnumKey Lib "advapi32.dll" Alias "RegEnumKeyA" (ByVal hKey As Long, ByVal dwIndex As Long, ByVal lpName As String, ByVal cbName As Long) As Long

Private Declare Function AdjustTokenPrivileges Lib "advapi32.dll" (ByVal TokenHandle As Long, ByVal DisableAllPriv As Long, NewState As TOKEN_PRIVILEGES, ByVal BufferLength As Long, PreviousState As TOKEN_PRIVILEGES, ReturnLength As Long) As Long                'Used to adjust your program's security privileges, can't restore without it!
Private Declare Function LookupPrivilegeValue Lib "advapi32.dll" Alias "LookupPrivilegeValueA" (ByVal lpSystemName As Any, ByVal lpName As String, lpLuid As LUID) As Long          'Returns a valid LUID which is important when making security changes in NT.
Private Declare Function OpenProcessToken Lib "advapi32.dll" (ByVal ProcessHandle As Long, ByVal DesiredAccess As Long, TokenHandle As Long) As Long
Private Declare Function GetCurrentProcess Lib "kernel32" () As Long

'---------------------------------------------------------------
'- 注册表 Api 常数...
'---------------------------------------------------------------
' 注册表创建类型值...
Const REG_OPTION_NON_VOLATILE = 0        ' 当系统重新启动时，关键字被保留

' 注册表关键字安全选项...
Const READ_CONTROL = &H20000
Const KEY_QUERY_VALUE = &H1
Const KEY_SET_VALUE = &H2
Const KEY_CREATE_SUB_KEY = &H4
Const KEY_ENUMERATE_SUB_KEYS = &H8
Const KEY_NOTIFY = &H10
Const KEY_CREATE_LINK = &H20
Const KEY_READ = KEY_QUERY_VALUE + KEY_ENUMERATE_SUB_KEYS + KEY_NOTIFY + READ_CONTROL
Const KEY_WRITE = KEY_SET_VALUE + KEY_CREATE_SUB_KEY + READ_CONTROL
Const KEY_EXECUTE = KEY_READ
Const KEY_ALL_ACCESS = KEY_QUERY_VALUE + KEY_SET_VALUE + KEY_CREATE_SUB_KEY + KEY_ENUMERATE_SUB_KEYS + KEY_NOTIFY + KEY_CREATE_LINK + READ_CONTROL

' 返回值...
Const ERROR_NONE = 0
Const ERROR_BADKEY = 2
Const ERROR_ACCESS_DENIED = 8
Const ERROR_SUCCESS = 0

' 有关导入/导出的常量
Const REG_FORCE_RESTORE As Long = 8&
Const TOKEN_QUERY As Long = &H8&
Const TOKEN_ADJUST_PRIVILEGES As Long = &H20&
Const SE_PRIVILEGE_ENABLED As Long = &H2
Const SE_RESTORE_NAME = "SeRestorePrivilege"
Const SE_BACKUP_NAME = "SeBackupPrivilege"

'---------------------------------------------------------------
'- 注册表类型...
'---------------------------------------------------------------
Private Type SECURITY_ATTRIBUTES
    nLength As Long
    lpSecurityDescriptor As Long
    bInheritHandle As Boolean
End Type

Private Type FILETIME
    dwLowDateTime As Long
    dwHighDateTime As Long
End Type

Private Type LUID
    lowpart As Long
    highpart As Long
End Type

Private Type LUID_AND_ATTRIBUTES
    pLuid As LUID
    Attributes As Long
End Type

Private Type TOKEN_PRIVILEGES
    PrivilegeCount As Long
    Privileges As LUID_AND_ATTRIBUTES
End Type

'---------------------------------------------------------------
'- 自定义枚举类型...
'---------------------------------------------------------------
' 注册表数据类型...
Public Enum ValueType
    REG_SZ = 1                         ' 字符串值
    REG_EXPAND_SZ = 2                  ' 可扩充字符串值
    REG_BINARY = 3                     ' 二进制值
    REG_DWORD = 4                      ' DWORD值
    REG_MULTI_SZ = 7                   ' 多字符串值
End Enum

' 注册表关键字根类型...
Public Enum KeyRoot
    HKEY_CLASSES_ROOT = &H80000000
    HKEY_CURRENT_USER = &H80000001
    HKEY_LOCAL_MACHINE = &H80000002
    HKEY_USERS = &H80000003
    HKEY_PERFORMANCE_DATA = &H80000004
    HKEY_CURRENT_CONFIG = &H80000005
    HKEY_DYN_DATA = &H80000006
End Enum

#11

//我看了http://www.vbcode.com/Asp/showsn.asp?theID=5559这个网站的那个其实还是不行

测试了一下,主要的问题就是直接粘贴过来,格式丢失,慢慢改吧,另外它还有一个类模块,你要注意一下

#12

我看了
那个是更改权限的但是前提是需要有权限啊“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum“是特殊的项里面的值都是无法读写的
就是一开始权限就不够别说设置权限了

#13

你照着http://www.vbcode.com/Asp/showsn.asp?theID=5559做过了吗？

#14

我试到没试过但是我看过代码
肯定是不行的
在“RegOpenKeyEx”这句里当出错了就直接退出过程了
也问题就是出在这个键上~
它的程序没有提高权限的函数必须提高权限才能

我这里的这个
Private Function EnablePrivilege(seName As String) As Boolean
    On Error Resume Next

    Dim p_lngRtn As Long
    Dim p_lngToken As Long
    Dim p_lngBufferLen As Long
    Dim p_typLUID As LUID
    Dim p_typTokenPriv As TOKEN_PRIVILEGES
    Dim p_typPrevTokenPriv As TOKEN_PRIVILEGES

    p_lngRtn = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES Or TOKEN_QUERY, p_lngToken)
    If p_lngRtn = 0 Then
        EnablePrivilege = False
        Exit Function
    End If
    If err.LastDllError <> 0 Then
        EnablePrivilege = False
        Exit Function
    End If

    p_lngRtn = LookupPrivilegeValue(0&, seName, p_typLUID)
    If p_lngRtn = 0 Then
        EnablePrivilege = False
        Exit Function
    End If

    p_typTokenPriv.PrivilegeCount = 1
    p_typTokenPriv.Privileges.Attributes = SE_PRIVILEGE_ENABLED
    p_typTokenPriv.Privileges.pLuid = p_typLUID

    EnablePrivilege = (AdjustTokenPrivileges(p_lngToken, False, p_typTokenPriv, Len(p_typPrevTokenPriv), p_typPrevTokenPriv, p_lngBufferLen) <> 0)
End Function

肯定不行我测试了其实只需要把这个权限打开了就行了但是我不知道seName是什么还有这个函数本来写的就有问题

我用Exescope查看了REG。EXE里面有操作相关函数的引用证实了我的想法是正确的

#15

应该是
SE_ASSIGNPRIMARYTOKEN_NAME  = 'SeAssignPrimaryTokenPrivilege';
  SE_AUDIT_NAME                              = 'SeAuditPrivilege';
  SE_BACKUP_NAME                         = 'SeBackupPrivilege';
  SE_CHANGE_NOTIFY_NAME            = 'SeChangeNotifyPrivilege';
  SE_CREATE_GLOBAL_NAME           = 'SeCreateGlobalPrivilege'; // *
  SE_CREATE_PAGEFILE_NAME        = 'SeCreatePagefilePrivilege';
  SE_CREATE_PERMANENT_NAME    = 'SeCreatePermanentPrivilege';
  SE_CREATE_TOKEN_NAME              = 'SeCreateTokenPrivilege';
  SE_DEBUG_NAME                            = 'SeDebugPrivilege';
  SE_ENABLE_DELEGATION_NAME     = 'SeEnableDelegationPrivilege';
  SE_IMPERSONATE_NAME                 = 'SeImpersonatePrivilege'; // *
  SE_INC_BASE_PRIORITY_NAME        = 'SeIncreaseBasePriorityPrivilege';
  SE_INCREASE_QUOTA_NAME           = 'SeIncreaseQuotaPrivilege';
  SE_LOAD_DRIVER_NAME                  = 'SeLoadDriverPrivilege';
  SE_LOCK_MEMORY_NAME               = 'SeLockMemoryPrivilege';
  SE_MACHINE_ACCOUNT_NAME         = 'SeMachineAccountPrivilege';
  SE_MANAGE_VOLUME_NAME           = 'SeManageVolumePrivilege';
  SE_PROF_SINGLE_PROCESS_NAME = 'SeProfileSingleProcessPrivilege';
  SE_REMOTE_SHUTDOWN_NAME       = 'SeRemoteShutdownPrivilege';
  SE_RESTORE_NAME                         = 'SeRestorePrivilege';
  SE_SECURITY_NAME                          = 'SeSecurityPrivilege';
  SE_SHUTDOWN_NAME                       = 'SeShutdownPrivilege';        // 当前要提交的内容
  SE_SYNC_AGENT_NAME                    = 'SeSyncAgentPrivilege';
  SE_SYSTEM_ENVIRONMENT_NAME   = 'SeSystemEnvironment';
  SE_SYSTEM_PROFILE_NAME             = 'SeSystemProfilePrivilege';
  SE_SYSTEMTIME_NAME                     = 'SeSystemtimePrivilege';
  SE_TAKE_OWNERSHIP_NAME            = 'SeTakeOwnershipPrivilege';
  SE_TCB_NAME                                    = 'SeTcbPrivilege';
  SE_UNDOCK_NAME                            = 'SeUndockPrivilege';
  SE_UNSOLICITED_INPUT_NAME          = 'SeUnsolicitedInputPrivilege'
这里面的其中一个
还有我不知道操作注册表的“EnablePrivilege ”怎么写
我写进程的是这样
Public Function EnablePrivilege() As Boolean
    Dim hdlProcessHandle As Long
    Dim hdlTokenHandle As Long
    Dim tmpLuid As LUID
    Dim tkp As TOKEN_PRIVILEGES
    Dim tkpNewButIgnored As TOKEN_PRIVILEGES
    Dim lBufferNeeded As Long
    Dim lp As Long
    hdlProcessHandle = GetCurrentProcess()
    lp = OpenProcessToken(hdlProcessHandle, TOKEN_ALL_ACCESS, hdlTokenHandle)
    lp = LookupPrivilegeValue(vbNullString, "SeDebugPrivilege", tmpLuid)
    tkp.PrivilegeCount = 1
    tkp.Privileges(0).pLuid = tmpLuid
    tkp.Privileges(0).Attributes = SE_PRIVILEGE_ENABLED
    EnablePrivilege = AdjustTokenPrivileges(hdlTokenHandle, False, tkp, Len(tkpNewButIgnored), tkpNewButIgnored, lBufferNeeded)
End Function

#16

不知道是不是你要的，这东西是满费劲了我折腾了两个星期

'下面过程是修改带权限注册表键的范例,演示了给键增加权限，修改注册表，最后在恢复的范例
Function AddAccess(ByVal lpObjectName) As Boolean
    Dim dwRes               As Long
    Dim pOldDACL            As Long
    Dim pNewDACL            As Long
    Dim pSD                 As Long
    Dim ea                  As EXPLICIT_ACCESS
    Dim eaNull1             As EXPLICIT_ACCESS
    Dim eaNull2             As EXPLICIT_ACCESS

    '建立一个空的ACL用来存放备份DACL;
    dwRes = SetEntriesInAcl(0, eaNull1, 0&, pOldDACL)

    If dwRes <> 0 Then
       Call SetError(dwRes)
       AddAccess = False: GoTo CleanUp
    End If

    '建立一个空的ACL用来存放新的DACL;
    dwRes = SetEntriesInAcl(0, eaNull2, 0&, pNewDACL)

    If dwRes <> 0 Then
       Call SetError(dwRes)
       AddAccess = False: GoTo CleanUp
    End If

    '获取现有的ACL列表到OldDACL
    dwRes = GetNamedSecurityInfo(lpObjectName, SE_REGISTRY_KEY, _
       DACL_SECURITY_INFORMATION, _
       0&, 0&, pOldDACL, 0&, pSD)

    If dwRes <> 0 Then
        'MessageBox("指定的键不存在！","提示",MB_OK)
        Call SetError(dwRes)
        AddAccess = False: GoTo CleanUp
    End If

    '//设置用户名"Everyone"对指定的键有所有操作权到结构ea (GENERIC_ALL 表示所有权限)
    'SUB_CONTAINERS_AND_OBJECTS_INHERIT 表示全部继承,NO_INHERITANCE为不继承
    Call ZeroMemory(ea, Len(ea))
    Call BuildExplicitAccessWithName(ea, "Everyone" & vbNullChar, GENERIC_ALL, _
     SET_ACCESS, NO_INHERITANCE)

    '//合并结构ea和OldDACL的权限列表到新的NewDACL
    dwRes = SetEntriesInAcl(1, ea, pOldDACL, pNewDACL)

    If dwRes <> 0 Then
       Call SetError(dwRes)
       AddAccess = False: GoTo CleanUp
    End If

    '更新SAM主键的DACL,//把新的ACL pNewDACL写入到指定的键
    dwRes = SetNamedSecurityInfo(lpObjectName, SE_REGISTRY_KEY, DACL_SECURITY_INFORMATION, _
                                0&, 0&, pNewDACL, 0&)

    '///////开始操作注册表//////////////////////////////////////////////////////////

    '...................................................

    '////////////////////////////////////////////////////////////////////////////

    '//恢复注册表的权限; 设置为只读/不继承
    Call BuildExplicitAccessWithName(ea, "Everyone" & vbNullChar, GENERIC_READ, _
                                     SET_ACCESS, NO_INHERITANCE)

    '//合并恢复后的结构ea和到OldDACL的权限
    dwRes = SetEntriesInAcl(1, ea, pOldDACL, pNewDACL)

    If dwRes <> 0 Then
       Call SetError(dwRes)
       AddAccess = False: GoTo CleanUp
    End If

    '把旧的ACL写入到指定的键
    dwRes = SetNamedSecurityInfo(lpObjectName, SE_REGISTRY_KEY, DACL_SECURITY_INFORMATION, _
                                0&, 0&, pNewDACL, 0&)

    If dwRes <> 0 Then
       Call SetError(dwRes)
       AddAccess = False: GoTo CleanUp
    End If

    AddAccess = True

CleanUp:
    '//释放指针
    If pSD <> 0 Then dwRes = LocalFree(pSD)
    If pNewDACL <> 0 Then dwRes = LocalFree(pNewDACL)
    If pOldDACL <> 0 Then dwRes = LocalFree(pOldDACL)
End Function

#17

//它的程序没有提高权限的函数必须提高权限才能

无语，不知道你认为SetSecurityDescriptorDacl是干什么用的？

#18

rise139() 你给的代码怎么没有API的申明和类型的申明啊我在API浏览器里找不到啊

#19

rainstormmaster(暴风雨 v2.0)
是我没注意
我等下再试下看可以吗

#20

Public moPath As lilRegistryPermissions.cKeyAddresses

Public moLogWriter As lilLogWriter.clsLogWriter
这2句就有问题啊类中根本没有“cKeyAddresses”和“clsLogWriter”等
不知道暴风雨你运行通过了那个程序没有

#21

//Public moPath As lilRegistryPermissions.cKeyAddresses

这个有

//Public moLogWriter As lilLogWriter.clsLogWriter

这个没有,不过这个class就是读写日志的,应该可以从别的地方找到

不过这些不是关键,关键是要看看在vb中是如何调用SetSecurityDescriptorDacl的

#22

觉得这个方法不是很好很麻烦~
其实我用EXESCOPE查看REG发现里面其实获取权限是利用“OpenProcessToken”，“LookupPrivilegeValue”，“AdjustTokenPrivileges”这3个API就是我说的那个
Public Function EnablePrivilege() As Boolean
    Dim hdlProcessHandle As Long
    Dim hdlTokenHandle As Long
    Dim tmpLuid As LUID
    Dim tkp As TOKEN_PRIVILEGES
    Dim tkpNewButIgnored As TOKEN_PRIVILEGES
    Dim lBufferNeeded As Long
    Dim lp As Long
    hdlProcessHandle = GetCurrentProcess()
    lp = OpenProcessToken(hdlProcessHandle, TOKEN_ALL_ACCESS, hdlTokenHandle)
    lp = LookupPrivilegeValue(vbNullString, "SeDebugPrivilege", tmpLuid)
    tkp.PrivilegeCount = 1
    tkp.Privileges(0).pLuid = tmpLuid
    tkp.Privileges(0).Attributes = SE_PRIVILEGE_ENABLED
    EnablePrivilege = AdjustTokenPrivileges(hdlTokenHandle, False, tkp, Len(tkpNewButIgnored), tkpNewButIgnored, lBufferNeeded)
End Function

但是不知道提高注册表权限的“LookupPrivilegeValue(vbNullString, "SeDebugPrivilege", tmpLuid)”的格式还有就是"SeDebugPrivilege"这个关键字是哪个我估计格式都差不多问题是"SeDebugPrivilege"这个关键字这样提高的权限就方便不管是读写导出导入

#1