0

A post provides a method to create a hidden registry key:

The eaysiest way to hide a key or a value is to create a key/value having '\0' inside of the name. You can do this wth respect of the native functions NtCreateKey (see http://msdn.microsoft.com/en-us/library/ff556468.aspx) NtSetValueKey (see http://msdn.microsoft.com/en-us/library/ff557688.aspx) which use UNICODE_STRING as parameters instead of LPCTSTR. You can read more about usage of native registry API in http://www.codeproject.com/kb/system/NtRegistry.aspx for example. A Delphi code you will find here http://www.delphi3000.com/articles/article_3539.asp.

First, I try to manully modify the registry key with \0, but it is still visible:

enter image description here

Currently, I create the registry key with python using the following code:

    RegistryKey = winreg.OpenKey(winreg.HKEY_CURRENT_USER, RegeditPath, 0, winreg.KEY_WRITE)
    winreg.SetValueEx(RegistryKey, key, 0, winreg.REG_SZ, val)
    winreg.CloseKey(RegistryKey)

I wonder how to create a hidden key?

Qiang Zhang
  • 820
  • 8
  • 32

0 Answers0