Modify program's registry accesses from HKLM to HKCU in assembly

Question

I have a game on my PC that reads and writes registry keys and values to the HKLM hive. I am trying to see if it is possible to modify the game so that it uses the HKCU hive instead.

The source code for this game isn't available so I am trying to disassemble the game binary and see if the assembly can be modified to accomplish this.

I am seeing sections like this in PE Explorer but I can't figure out what parts of it are used to target the HKLM hive:

 L004036E0:
        lea eax,[esp+1Ch]
        lea ecx,[esp+08h]
        push    eax
        push    00020019h
        push    ebx
        call    SUB_L00401F70
        push    eax
        push    80000002h
        call    [ADVAPI32.dll!RegOpenKeyExA]
        cmp eax,ebx
        jnz L004037E9
        lea ecx,[esp+14h]
        lea edx,[esp+000000A0h]
        push    ecx
        mov ecx,[esp+20h]
        lea eax,[esp+1Ch]
        push    edx
        push    eax
        push    ebx
        push    SSZ00413090_InstallPath
        push    ecx
        mov dword ptr [esp+2Ch],00000104h
        call    [ADVAPI32.dll!RegQueryValueExA]
        cmp eax,ebx
        jnz L004037E9
        cmp dword ptr [esp+18h],00000001h
        jnz L004037E9
        lea edx,[esp+000000A0h]
        push    0000005Ch
        push    edx
        lea esi,[esp+000000A8h]
        call    SUB_L00406310
        add esp,00000008h
        cmp eax,ebx
        jz  L00403775
 L00403763:

Answer 1

You are looking to identify all calls to RegCreateKey/Ex and RegOpenKey/Ex calls, then check their first parameter, then change it to HKCU integer definition (0x80000001) instead of HKLM (0x80000002).

In the above, you quite clearly see it push the first parameter to RegOpenKeyExA, 0x80000002. So, you just change those to 0x80000001.

Answer 2

If you check signature of RegOpenKeyExA you clearly see that the first argument is the HKEY. Since the method is defined as WINAPI (_stdcall) it will be the first argument passed before the call.

Also by checking the HKEY values defined in WinReg.h in Windows SDK can show you that this is the correct assumption as 0x80000002 is defined as HKEY_LOCAL_MACHINE

#define HKEY_CLASSES_ROOT                   (( HKEY ) (ULONG_PTR)((LONG)0x80000000) )
#define HKEY_CURRENT_USER                   (( HKEY ) (ULONG_PTR)((LONG)0x80000001) )
#define HKEY_LOCAL_MACHINE                  (( HKEY ) (ULONG_PTR)((LONG)0x80000002) )
#define HKEY_USERS                          (( HKEY ) (ULONG_PTR)((LONG)0x80000003) )
#define HKEY_PERFORMANCE_DATA               (( HKEY ) (ULONG_PTR)((LONG)0x80000004) )
#define HKEY_PERFORMANCE_TEXT               (( HKEY ) (ULONG_PTR)((LONG)0x80000050) )
#define HKEY_PERFORMANCE_NLSTEXT            (( HKEY ) (ULONG_PTR)((LONG)0x80000060) )
#if(WINVER >= 0x0400)
#define HKEY_CURRENT_CONFIG                 (( HKEY ) (ULONG_PTR)((LONG)0x80000005) )
#define HKEY_DYN_DATA                       (( HKEY ) (ULONG_PTR)((LONG)0x80000006) )
#define HKEY_CURRENT_USER_LOCAL_SETTINGS    (( HKEY ) (ULONG_PTR)((LONG)0x80000007) )