🚀 go-pugleaf

I'm use folowing code for this:


function GetRegistryKeySecurityDescriptor(Key:HKEY;Path:string;var
lsd:DWORD):PSecurityDescriptor;
var
 tsd:PSecurityDescriptor;
 h:HKEY;
begin
 lsd:=0;
 Result:=nil;
 if RegOpenKey(key,PChar(Path),h)=ERROR_SUCCESS then
  begin
   lsd:=SizeOf(TSecurityDescriptor);
   tsd:=AllocMem(lsd);
   InitializeSecurityDescriptor(tsd,SECURITY_DESCRIPTOR_REVISION);
   if
RegGetKeySecurity(h,GROUP_SECURITY_INFORMATION,tsd,lsd)=ERROR_INSUFFICIENT_B
UFFER then
    begin
     ReAllocMem(tsd,lsd);
     if
RegGetKeySecurity(h,GROUP_SECURITY_INFORMATION,tsd,lsd)=ERROR_SUCCESS then
      if IsValidSecurityDescriptor(tsd) then Result:=tsd;
    end;
   RegCloseKey(h);
  end;
end;

and

function GetRegistryKeyAccess(sd:PSecurityDescriptor;const
DesiredAccess:DWORD):Boolean;
var
 th:THandle;
 dwPrivilegeLength,dwGrantedAccess,dwDesiredAccess:DWORD;
 gmMapping:TGenericMapping;
 psPrivilege:TPrivilegeSet;
 fStatus:LongBool;
begin
 Result:=False;
 ImpersonateSelf(SecurityImpersonation);
 if OpenThreadToken(GetCurrentThread,TOKEN_QUERY,False,th) then
  begin
   dwPrivilegeLength:=SizeOf(TPrivilegeSet);
   dwGrantedAccess:=0;
   dwDesiredAccess:=2;
   fStatus:=FALSE;
   gmMapping.GenericRead:=1;
   gmMapping.GenericWrite:=2;
   gmMapping.GenericExecute:=0;
   gmMapping.GenericAll:=1 or 2;
   if IsValidSecurityDescriptor(sd) then
    begin
     if
AccessCheck(sd,th,dwDesiredAccess,gmMapping,psPrivilege,dwPrivilegeLength,dw
GrantedAccess,fStatus) then
      begin
       Result:=fStatus;
      end
     else
MessageBox(GetDesktopWindow,PChar(SysErrorMessage(GetLastError)),nil,0);
    end;
   CloseHandle(th);
  end;
  RevertToSelf;
end;



and use in code


function IsKeyProtected(Key:HKEY;RegPath:string):Boolean;
var
 sd:PSecurityDescriptor;
 lsd:DWORD;
begin
 Result:=False;
 if Win32Platform<>VER_PLATFORM_WIN32_NT then Exit; // under Win9x/Me all
keys unprotected
 if not KeyExists(Key,RegPath) then Exit;
 sd:=GetRegistryKeySecurityDescriptor(Key,RegPath,lsd);
 Result:=not GetRegistryKeyAccess(sd,KEY_WRITE);
 FreeRegistryKeySecurityDescriptor(sd,lsd);
end;


____________________________________________________________________________
__

Last function says that SecurityDesctriptor is invalid. ???????????  What?
Why  IsValidSecurityDescriptor() say OK but I got error in result ????


Does Anybody know what wrong in code above?

Alex