The driver I made does the job of verifying the Registry value in Kernel Mode.
The code is below
InitializeObjectAttributes(&ObjAttr,&RegKeyName,OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE | OBJ_OPENIF,NULL, NULL);
ACCESS_MASK access_mask = 0;
Status = ZwOpenKey(&handle, access_mask, &ObjAttr);
if (!NT_SUCCESS(Status))
break;
Status = ZwQueryValueKey(handle, ...);
if (!NT_SUCCESS(Status))
break;
Status = ZwDeleteValueKey(handle, &RegKeyName);
if (!NT_SUCCESS(Status))
break;
// So far, I've also succeeded in reading and deleting the values
I'm using Windows 10 x64 and I get the same result on 7
I don't know why it works like this
Looking at the ZwQueryValueKey document, it says that KEY_QUERY_VALUE is necessary, but now it succeeds even if it is set to 0.
If anyone knows the reason, can you tell me please