There is also another check later in IopQueryRegistryKeySystemPath that ensures the ImagePath is under the "System" key
Antonio Cocomazzi
@splintercode.bsky.social
374 followers 275 following 12 posts
offensive security - windows internals - reverse engineering | X: x.com/splinter_code | Mastodon: infosec.exchange/@splinter_code | GitHub: github.com/antonioCoco | Blog: splintercod3.blogspot.com