winreg-rs
winreg-rs copied to clipboard
Unable to open key created with Sysinternals reghide.exe
Registry malicious trickery and Reghide.exe: https://www.tripwire.com/state-of-security/mitre-framework/evade-detection-hiding-registry/
Key is created here on x64 Windows: HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\WOW6432Node\Systems Internals\Can’t touch me!
I can use error catching with a match statement to find this evil but would love to be able to open that and keys like it and read all values.
If I can help in any way with this crate I would love to. Just have never worked with crates and Rust Win API access directly either.
Thanks