Windows undocumented features: registering registry key access events
Starting with Windows 8, users of the operating system may notice the following message in the system event log: “The access history in hive [...] was cleared updating [...] keys and creating [...] modified pages” . What is hidden behind this message?
If someone was following the update of the registry structures in debugging symbols, then he might notice that in Windows 8, in the structure responsible for storing the registry key, a numerical field “Access bits” appeared (“Access bits”, if in Russian); the corresponding memory area has been reserved since Windows NT 3.5 and was previously used in Windows NT 3.1 to store the “Title index” numeric value. In the structure description below, the reserved field, under the name “Spare”, is located at offset + 0x00c, its new name in Windows 8 is “AccessBits”.
As a result of studying the Windows kernel, it was found that this field is updated every time a registry key is opened or changed in most registry bushes, and the one cited at the beginning of the article a message from the log indicates that the specified field is cleared for all registry keys in a particular bush by writing a null value. Clearing access bits occurs when the registry bush is connected, if seven days have passed since the previous clearing of access bits for this bush.
The Access bits field is updated by writing a value into it in accordance with the following bit masks:
Supported bit masks
The NtInitializeRegistry () function call, which changes the current bit mask (from 0x1 to 0x2), which is written to the registry keys when they are opened or changed, occurs after the operating system considers the boot process successful. Thus, registry keys, for example, opened by services during their launch during the boot of the operating system, will have access bits with the 0x1 bit mask set. In addition, if the registry key has not been opened since clearing the access bits, then this key will have a zero value in this field.
This information can be used to select registry keys that could be opened by a malicious program (or any other) operating as a service, or have been opened recently in general, as well as to filter out unused registry keys.
It should be noted that there is not a single function in the Windows kernel that allows you to get the current value of access bits for any registry key, which suggests the debugging nature of access bits.
As an example, consider a registry structure in a hex editor that describes the key \ ControlSet001 \ Services \ RServer3 (registry hive SYSTEM) immediately after installing Radmin software, before rebooting, and after rebooting the operating system.
The structure of the registry key (before rebooting)
The structure of the registry key (after rebooting)
In the illustrations above, the byte of the “Access bits” field, which changed when the operating system was rebooted, is underlined in red (a value of 3 indicates that bit masks 0x1 and 0x2 are set).
Access bits are a small, undocumented functionality of Windows, created most likely for debugging purposes, which can be used to track unused registry keys and to track registry keys that are opened at the stages before and after the launch of the operating system services during boot.
Unfortunately, at present, most programs for viewing the inactive registry do not support the processing and visualization of access bit values.
If someone was following the update of the registry structures in debugging symbols, then he might notice that in Windows 8, in the structure responsible for storing the registry key, a numerical field “Access bits” appeared (“Access bits”, if in Russian); the corresponding memory area has been reserved since Windows NT 3.5 and was previously used in Windows NT 3.1 to store the “Title index” numeric value. In the structure description below, the reserved field, under the name “Spare”, is located at offset + 0x00c, its new name in Windows 8 is “AccessBits”.
+0x000 Signature : Uint2B
+0x002 Flags : Uint2B
+0x004 LastWriteTime : _LARGE_INTEGER
+0x00c Spare : Uint4B
+0x010 Parent : Uint4B
+0x014 SubKeyCounts : [2] Uint4B
+0x01c SubKeyLists : [2] Uint4B
+0x024 ValueList : _CHILD_LIST
+0x01c ChildHiveReference : _CM_KEY_REFERENCE
+0x02c Security : Uint4B
+0x030 Class : Uint4B
+0x034 MaxNameLen : Pos 0, 16 Bits
+0x034 UserFlags : Pos 16, 4 Bits
+0x034 VirtControlFlags : Pos 20, 4 Bits
+0x034 Debug : Pos 24, 8 Bits
+0x038 MaxClassLen : Uint4B
+0x03c MaxValueNameLen : Uint4B
+0x040 MaxValueDataLen : Uint4B
+0x044 WorkVar : Uint4B
+0x048 NameLength : Uint2B
+0x04a ClassLength : Uint2B
+0x04c Name : [1] Wchar
As a result of studying the Windows kernel, it was found that this field is updated every time a registry key is opened or changed in most registry bushes, and the one cited at the beginning of the article a message from the log indicates that the specified field is cleared for all registry keys in a particular bush by writing a null value. Clearing access bits occurs when the registry bush is connected, if seven days have passed since the previous clearing of access bits for this bush.
The Access bits field is updated by writing a value into it in accordance with the following bit masks:
| Bit mask | Description |
|---|---|
| 0x1 | The registry key was accessed before the registry was initialized by calling the NtInitializeRegistry () function at boot time |
| 0x2 | Access to the registry key occurred after the registry was initialized by calling the NtInitializeRegistry () function at boot time |
The NtInitializeRegistry () function call, which changes the current bit mask (from 0x1 to 0x2), which is written to the registry keys when they are opened or changed, occurs after the operating system considers the boot process successful. Thus, registry keys, for example, opened by services during their launch during the boot of the operating system, will have access bits with the 0x1 bit mask set. In addition, if the registry key has not been opened since clearing the access bits, then this key will have a zero value in this field.
This information can be used to select registry keys that could be opened by a malicious program (or any other) operating as a service, or have been opened recently in general, as well as to filter out unused registry keys.
It should be noted that there is not a single function in the Windows kernel that allows you to get the current value of access bits for any registry key, which suggests the debugging nature of access bits.
Demonstration
As an example, consider a registry structure in a hex editor that describes the key \ ControlSet001 \ Services \ RServer3 (registry hive SYSTEM) immediately after installing Radmin software, before rebooting, and after rebooting the operating system.
The structure of the registry key (before rebooting) The structure of the registry key (after rebooting)In the illustrations above, the byte of the “Access bits” field, which changed when the operating system was rebooted, is underlined in red (a value of 3 indicates that bit masks 0x1 and 0x2 are set).
conclusions
Access bits are a small, undocumented functionality of Windows, created most likely for debugging purposes, which can be used to track unused registry keys and to track registry keys that are opened at the stages before and after the launch of the operating system services during boot.
Unfortunately, at present, most programs for viewing the inactive registry do not support the processing and visualization of access bit values.
