winlogon源代码分析之winlogon!notifylist中Winlogon\\Notify\\sclgntfy节点的由来

.//svcdlls/seclogon/notify/sclgntfy.hxx:7: sclgntfy.hxx

.//svcdlls/seclogon/notify/sclgntfy.hxx:11: Header file for sclgntfy.dll

.//svcdlls/seclogon/notify/sclgntfy.cxx:7: sclgntfy.cxx

.//svcdlls/seclogon/notify/sclgntfy.cxx:39:#include "sclgntfy.hxx"

.//svcdlls/seclogon/notify/sclgntfy.cxx:62:#define NOTIFY_PATH TEXT("Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\sclgntfy")

.//svcdlls/seclogon/notify/sclgntfy.cxx:375: lResult = RegSetValueEx (hKey, TEXT("DllName"), 0, REG_EXPAND_SZ, (LPBYTE)TEXT("sclgntfy.dll"),

.//svcdlls/seclogon/notify/sclgntfy.cxx:376: (lstrlen(TEXT("sclgntfy.dll")) + 1) * sizeof(TCHAR));

HINSTANCE g_hDllInstance=NULL;

#define NOTIFY_PATH TEXT("Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\sclgntfy")

/////////////////////////////////////////////////////////////////////////////

// DllRegisterServer - Adds entries to the system registry

STDAPI DllRegisterServer(void)

{

HKEY hKey;

LONG lResult;

DWORD dwDisp, dwTemp;

lResult = RegCreateKeyEx (HKEY_LOCAL_MACHINE, NOTIFY_PATH, 0, NULL,

REG_OPTION_NON_VOLATILE, KEY_WRITE, NULL,

&hKey, &dwDisp);

if (lResult != ERROR_SUCCESS)

{

return lResult;

}

//

// save the return code for EFS registration

//

LONG lEfsResult = DllRegisterServerEFS();

lResult = RegSetValueEx (hKey, TEXT("Logoff"), 0, REG_SZ, (LPBYTE)TEXT("WLEventLogoff"),

(lstrlen(TEXT("WLEventLogoff")) + 1) * sizeof(TCHAR));

if (lResult == ERROR_SUCCESS) {

#if 0

RegSetValueEx (hKey, TEXT("Logon"), 0, REG_SZ, (LPBYTE)TEXT("WLEventLogon"),

(lstrlen(TEXT("WLEventLogon")) + 1) * sizeof(TCHAR));

RegSetValueEx (hKey, TEXT("Startup"), 0, REG_SZ, (LPBYTE)TEXT("WLEventStartup"),

(lstrlen(TEXT("WLEventStartup")) + 1) * sizeof(TCHAR));

RegSetValueEx (hKey, TEXT("Shutdown"), 0, REG_SZ, (LPBYTE)TEXT("WLEventShutdown"),

(lstrlen(TEXT("WLEventShutdown")) + 1) * sizeof(TCHAR));

RegSetValueEx (hKey, TEXT("StartScreenSaver"), 0, REG_SZ, (LPBYTE)TEXT("WLEventStartScreenSaver"),

(lstrlen(TEXT("WLEventStartScreenSaver")) + 1) * sizeof(TCHAR));

RegSetValueEx (hKey, TEXT("StopScreenSaver"), 0, REG_SZ, (LPBYTE)TEXT("WLEventStopScreenSaver"),

(lstrlen(TEXT("WLEventStopScreenSaver")) + 1) * sizeof(TCHAR));

RegSetValueEx (hKey, TEXT("Lock"), 0, REG_SZ, (LPBYTE)TEXT("WLEventLock"),

(lstrlen(TEXT("WLEventLock")) + 1) * sizeof(TCHAR));

RegSetValueEx (hKey, TEXT("Unlock"), 0, REG_SZ, (LPBYTE)TEXT("WLEventUnlock"),

(lstrlen(TEXT("WLEventUnlock")) + 1) * sizeof(TCHAR));

RegSetValueEx (hKey, TEXT("StartShell"), 0, REG_SZ, (LPBYTE)TEXT("WLEventStartShell"),

(lstrlen(TEXT("WLEventStartShell")) + 1) * sizeof(TCHAR));

#endif

dwTemp = 0;

lResult = RegSetValueEx (hKey, TEXT("Impersonate"), 0, REG_DWORD, (LPBYTE)&dwTemp, sizeof(dwTemp));

if (lResult == ERROR_SUCCESS) {

dwTemp = 1;

lResult = RegSetValueEx (hKey, TEXT("Asynchronous"), 0, REG_DWORD, (LPBYTE)&dwTemp, sizeof(dwTemp));

if (lResult == ERROR_SUCCESS) {

lResult = RegSetValueEx (hKey, TEXT("DllName"), 0, REG_EXPAND_SZ, (LPBYTE)TEXT("sclgntfy.dll"),

(lstrlen(TEXT("sclgntfy.dll")) + 1) * sizeof(TCHAR));

}

}

}

RegCloseKey (hKey);

//

// return failure if either seclogon or EFS registration fails.

//

if ( lResult == ERROR_SUCCESS ) {

lResult = lEfsResult;

}

return lResult;

}