HOWTO: Loading a User's Hive Programmatically

• Microsoft Win32 Application Programming Interface (API) included with: - Microsoft Windows NT versions 3.51, 4.0

SUMMARY

By default, a user's hive is loaded for only the interactive user and services running from a user account (Windows NT 4.0 only). A user's hive contains specific registry information pertaining to the user's application settings, desktop, environment, network connections, and printers. The hive is loaded under the HKEY_USERS key. The name of the hive is based on the SECURITY IDENTIFIER (SID) of the user. A process refers to its hive via the HKEY_CURRENT_USER key. This key is a mapping to the user's hive under HKEY_USERS based upon the user's SID. If the user's hive is not loaded, the system will map references pertaining to HKEY_CURRENT_USER to HKEY_USER\.default. In addition, a process running in the LocalSystem security context references to HKEY_CURRENT_USER will also be mapped to HKEY_USER\.default.

MORE INFORMATION

In order for a process that did not originate from either the interactive logged-on user or from a service (Windows NT 4.0 only) to have access to it's hive, the hive must be loaded programmatically. For example, the CreateProcessAsUser API does not automatically load the user's hive so by default any references to HKEY_CURRENT_USER from the process would map to HKEY_USERS\.default instead of HKEY_USERS\<user's sid> if the hive is not already loaded.

Sample Code

The following sample code requires a user, password and an executable. This sample assumes that the specified user has an existing hive. This means the user must have interactively logged on to the machine at least once. Based on the above information, the sample code loads the user's hive and then launches the .exe given to it by the user. To load a user's hive, the user running the sample code needs to be granted the "Restore files and directories" (SE_RESTORE_NAME) privilege. Once the executable has exited, the sample code unloads the user's hive. You can verify that the user's hive is loaded by using Regedt32.exe. Note that the sample code does not deal with modifying the security on the interactive Windowstation and Desktop. You should specify a user account that belongs to the Administrator group to avoid the User32.dll initialization error. For more information on granting a user access to the interactive Windowstation and Desktop, please see the following article in the Microsoft Knowledge Base:

   ARTICLE-ID: Q165194
   TITLE     : Understanding CreateProcessAsUser, windowstations, and
               desktops

Libraries required: USER32.LIB

                    ADVAPI32.LIB

   #define RTN_OK     0
   #define RTN_ERROR 13

   #include <windows.h>
   #include <stdio.h>
   #include <tchar.h>

   BOOL ConvertSid(PSID pSid, LPTSTR pszSidText, LPDWORD dwBufferLen)
   {
      PSID_IDENTIFIER_AUTHORITY psia;
      DWORD dwSubAuthorities;
      DWORD dwSidRev=SID_REVISION;
      DWORD dwCounter;
      DWORD dwSidSize;

      //
      // test if Sid passed in is valid
      //
      if(!IsValidSid(pSid)) return FALSE;

      // obtain SidIdentifierAuthority
      psia=GetSidIdentifierAuthority(pSid);

      // obtain sidsubauthority count
      dwSubAuthorities=*GetSidSubAuthorityCount(pSid);

      //
      // compute buffer length
      // S-SID_REVISION- + identifierauthority- + subauthorities- + NULL
      //
      dwSidSize=(15 + 12 + (12 * dwSubAuthorities) + 1) * sizeof(TCHAR);

      //
      // check provided buffer length.
      // If not large enough, indicate proper size and setlasterror
      //
      if (*dwBufferLen < dwSidSize){
         *dwBufferLen = dwSidSize;
         SetLastError(ERROR_INSUFFICIENT_BUFFER);
         return FALSE;
      }

      //
      // prepare S-SID_REVISION-
      //
      dwSidSize=wsprintf(pszSidText, TEXT("S-%lu-"), dwSidRev );

      //
      // prepare SidIdentifierAuthority
      //
      if ( (psia->Value[0] != 0) || (psia->Value[1] != 0) ){
         dwSidSize+=wsprintf(pszSidText + lstrlen(pszSidText),
                             TEXT("0x%02hx%02hx%02hx%02hx%02hx%02hx"),
                             (USHORT)psia->Value[0],
                             (USHORT)psia->Value[1],
                             (USHORT)psia->Value[2],
                             (USHORT)psia->Value[3],
                             (USHORT)psia->Value[4],
                             (USHORT)psia->Value[5]);
      }
      else{
         dwSidSize+=wsprintf(pszSidText + lstrlen(pszSidText),
                             TEXT("%lu"),
                             (ULONG)(psia->Value[5]      )   +
                             (ULONG)(psia->Value[4] <<  8)   +
                             (ULONG)(psia->Value[3] << 16)   +
                             (ULONG)(psia->Value[2] << 24)   );
      }

      //
      // loop through SidSubAuthorities
      //
      for (dwCounter=0 ; dwCounter < dwSubAuthorities ; dwCounter++){
         dwSidSize+=wsprintf(pszSidText + dwSidSize, TEXT("-%lu"),
         *GetSidSubAuthority(pSid, dwCounter) );
      }

      return TRUE;
   }

   BOOL ObtainProfilePath(LPTSTR pszSid, LPTSTR pszProfilePath,
                          DWORD dwPathSize)
   {
      TCHAR         szRegKey[1024] = TEXT("SOFTWARE\\Microsoft\\");
      TCHAR         szTemp[256] = TEXT("");
      DWORD         dwSizeProfilePath = dwPathSize;
      DWORD         dwType;
      HKEY          hKey;
      LONG          lErrorCode;

      //
      // concat sid
      //
      lstrcat(szRegKey, TEXT("Windows NT\\CurrentVersion\\ProfileList\\"));
      lstrcat(szRegKey, pszSid);

      //
      // find the hive in the registry
      //
      lErrorCode = RegOpenKeyEx(HKEY_LOCAL_MACHINE, szRegKey, 0,
                                KEY_READ, &hKey);
      if (lErrorCode != ERROR_SUCCESS)
         return FALSE;

      //
      // query the value
      //
      lErrorCode = RegQueryValueEx(hKey, TEXT("ProfileImagePath"), NULL,
                   &dwType, (LPBYTE)pszProfilePath, &dwSizeProfilePath);
      if (lErrorCode != ERROR_SUCCESS)
         return FALSE;

      //
      // fix profile path by replacing "%SystemRoot%" with the actual path
      //
      lstrcpy(szTemp, pszProfilePath);
      ZeroMemory(pszProfilePath, dwPathSize);
      if (!ExpandEnvironmentStrings(szTemp,
                                    pszProfilePath,dwSizeProfilePath))
         return FALSE;

      //
      // determine if it is a file or directory, WinNT 4.0 it is a
      // directory
      // WinNT 3.51 it is a file
      //
      if ((GetFileAttributes(pszProfilePath) & FILE_ATTRIBUTE_DIRECTORY) ==
                             FILE_ATTRIBUTE_DIRECTORY)
         lstrcat(pszProfilePath, TEXT("\\ntuser.dat"));

      //
      // close the key
      //
      lErrorCode = RegCloseKey(hKey);
      if (lErrorCode != ERROR_SUCCESS)
         return FALSE;

      return TRUE;
   }

   BOOL Privilege(LPTSTR pszPrivilege, BOOL bEnable)
   {
      HANDLE           hToken;
      TOKEN_PRIVILEGES tp;

      //
      // obtain the processes token
      //
      if (!OpenProcessToken(GetCurrentProcess(),
           TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
         return FALSE;

      //
      // get the luid
      //
      if (!LookupPrivilegeValue(NULL, pszPrivilege,
                                &tp.Privileges[0].Luid))
         return FALSE;

      tp.PrivilegeCount = 1;

      if (bEnable)
         tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
      else
         tp.Privileges[0].Attributes = 0;

      //
      // enable or disable the privilege
      //
      if (!AdjustTokenPrivileges(hToken, FALSE, &tp, 0,
                                (PTOKEN_PRIVILEGES)NULL, 0))
         return FALSE;

      if (!CloseHandle(hToken))
         return FALSE;

      return TRUE;
   }

   BOOL Hive(LPTSTR pszSid, LPTSTR pszProfilePath, BOOL bLoad)
   {
      LONG lErrorCode;

      if (bLoad){
         lErrorCode = RegLoadKey(HKEY_USERS, pszSid, pszProfilePath);
         if (lErrorCode != ERROR_SUCCESS)
            return FALSE;
      }
      else{
         lErrorCode = RegUnLoadKey(HKEY_USERS, pszSid);
         if (lErrorCode != ERROR_SUCCESS)
            return FALSE;
      }
      return TRUE;
   }

   BOOL ObtainSid(HANDLE hToken, LPTSTR pszSid, LPDWORD pdwBufferLen)
   {
      DWORD                   dwReturnLength     = 0;
      DWORD                   dwTokenUserLength  = 0;
      TOKEN_INFORMATION_CLASS tic                = TokenUser;
      TOKEN_USER              *ptu               = NULL;

      //
      // query info in the token
      //
      if (!GetTokenInformation(hToken, tic, (LPVOID)ptu, dwTokenUserLength,
                               &dwReturnLength)){
         if (GetLastError() == ERROR_INSUFFICIENT_BUFFER){
            ptu = (TOKEN_USER *)HeapAlloc(GetProcessHeap(),
                     HEAP_ZERO_MEMORY, dwReturnLength);
            if (ptu == NULL)
               return FALSE;

            dwTokenUserLength = dwReturnLength;
            dwReturnLength    = 0;

            if (!GetTokenInformation(hToken, tic, (LPVOID)ptu,
                              dwTokenUserLength, &dwReturnLength))
               return FALSE;
         }
         else
            return FALSE;
      }

      //
      // convert the sid to textural form
      //
      if (!ConvertSid((ptu->User).Sid, pszSid, pdwBufferLen))
         return FALSE;;

      if (!HeapFree(GetProcessHeap(), 0, (LPVOID)ptu))
         return FALSE;

      return TRUE;
   }

   int _tmain(int argc, TCHAR *argv[])
   {
      TCHAR               szComputerName[256];
      TCHAR               szProfilePath[256];
      TCHAR               szSid[256];
      DWORD               dwBufferLen;
      DWORD               dwComputerLen;
      HANDLE              hToken = NULL;
      int                 iSuccess = RTN_ERROR;
      PROCESS_INFORMATION pi;
      STARTUPINFO         si;

      __try
         {
         if (argc != 4){
            _tprintf(TEXT("Usage: [account name] [password] [exe]\n"));
            return RTN_ERROR;
         }

         dwComputerLen = sizeof(szComputerName)/sizeof(TCHAR);

         if (!GetComputerName(szComputerName, &dwComputerLen))
            __leave;

         if (!LogonUser(argv[1], szComputerName, argv[2],
                         LOGON32_LOGON_INTERACTIVE,
                         LOGON32_PROVIDER_DEFAULT, &hToken))
            __leave;

         //
         // initialize buffers
         //
         ZeroMemory(szSid, (sizeof(szSid)/sizeof(TCHAR)));
         ZeroMemory(szProfilePath, (sizeof(szProfilePath)/sizeof(TCHAR)));
         dwBufferLen = (sizeof(szSid)/sizeof(TCHAR));

         //
         // obtain the sid
         //
         if (!ObtainSid(hToken, szSid, &dwBufferLen))
            __leave;

         //
         // obtain profile path
         //
         if (!ObtainProfilePath(szSid, szProfilePath,
                                 (sizeof(szProfilePath)/sizeof(TCHAR))))
            __leave;

         //
         // enable privilege
         //
         if (!Privilege(SE_RESTORE_NAME, TRUE))
            __leave;

         //
         // load the hive
         //
         if (!Hive(szSid, szProfilePath, TRUE))
            __leave;

         ZeroMemory(&si, sizeof(STARTUPINFO));
         si.cb        = sizeof(STARTUPINFO);
         si.lpDesktop = TEXT("winsta0\\default");

         if (!CreateProcessAsUser(hToken, NULL, argv[3], NULL, NULL,
               FALSE, CREATE_NEW_CONSOLE | NORMAL_PRIORITY_CLASS, NULL,
               NULL, &si, &pi))
            __leave;

         if (WaitForSingleObject(pi.hProcess, INFINITE) == WAIT_FAILED)
            __leave;

         //
         // unload the hive
         //
         if (!Hive(szSid, szProfilePath, FALSE))
            __leave;

         //
         // disable the privilege
         //
         if (!Privilege(SE_RESTORE_NAME, FALSE))
            __leave;

         iSuccess = RTN_OK;
         }
      __finally
         {
         if (hToken != NULL)
            CloseHandle(hToken);

         if (pi.hProcess != NULL)
            CloseHandle(hToken);

         if (pi.hThread != NULL)
            CloseHandle(hToken);
         }

      return iSuccess;
   }

REFERENCES