One Day Sec

How can you hide registry value names (not just keys) and what extra steps are needed?

To hide registry value names, prepend `\0` to the value name, similar to hiding keys. However, because the value name includes a null character, standard string conversion functions like `RtlAnsiStringToUnicodeString` fail. You must manually convert the ANSI string to a UNICODE string by doubling the length and filling the buffer correctly, then call `NtSetValueKey`. The full implementation is described in the Penetration Techniques - Creating "Hidden" Registry Entries article.
hidden registry valueNtSetValueKeyUNICODE_STRINGmanual conversionnull character

Browse all Q&A →