Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


HELP...how to access registry's HKEY_CURRENT_USER

hi kernel folks,

i'm having some problem accessing the HKEY_CURRENT_USER key in
registry under kernel mode. I tried using RtlQueryRegistryValues and it
returns STATUS_OBJECT_NAME_NOT_FOUND.

i'm sure the path and key are there in the registry. Is there some
thing to take note in order to access HKEY_CURRENT_USER? Here's my code
snippet:


BOOLEAN
NmUsb_GetRegistryDword(
IN PWCHAR RegPath,
IN PWCHAR ValueName,
IN OUT PULONG Value
)

UNICODE_STRING path;
RTL_QUERY_REGISTRY_TABLE paramTable[ 2 ];
ULONG lDef = *Value;
NTSTATUS status;
BOOLEAN fres;
WCHAR wbuf[ MAXIMUM_FILENAME_LENGTH ];

path.Length = 0;
path.MaximumLength = MAXIMUM_FILENAME_LENGTH * sizeof( WCHAR );
path.Buffer = wbuf;

RtlZeroMemory(path.Buffer, path.MaximumLength);
RtlMoveMemory(path.Buffer, RegPath, wcslen( RegPath) * sizeof( WCHAR
));

RtlZeroMemory(paramTable, sizeof(paramTable));

paramTable[0].Flags = RTL_QUERY_REGISTRY_DIRECT;
paramTable[0].Name = (PWSTR)ValueName;
paramTable[0].EntryContext = Value;
paramTable[0].DefaultType = REG_DWORD;
paramTable[0].DefaultData = &lDef;
paramTable[0].DefaultLength = sizeof(ULONG);

status = RtlQueryRegistryValues( RTL_REGISTRY_USER |
RTL_REGISTRY_OPTIONAL, path.Buffer, paramTable, NULL, NULL);
* snip *

hope somebody can give me some pointers
thanx in advance

Comments

  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    > i'm having some problem accessing the HKEY_CURRENT_USER key in
    > registry under kernel mode. I tried using RtlQueryRegistryValues and it
    > returns STATUS_OBJECT_NAME_NOT_FOUND.

    I don't think it is possible. Imagine Terminal Server with 100 different
    users :-)
    Also - HKCU is mounted (by shell32.dll?) at interactive logon only. No such
    key
    even for services - not to mention kmode drivers.

    Max
  • if it's impossible, then why is it that in the DDKunder RtlQueryRegistryValues
    the definition
    "RTL_REGISTRY_USER:
    Path is relative to \Registry\User\CurrentUser" is being mentioned ?


    Maxim S. Shatskih wrote:

    > > i'm having some problem accessing the HKEY_CURRENT_USER key in
    > > registry under kernel mode. I tried using RtlQueryRegistryValues and it
    > > returns STATUS_OBJECT_NAME_NOT_FOUND.
    >
    > I don't think it is possible. Imagine Terminal Server with 100 different
    > users :-)
    > Also - HKCU is mounted (by shell32.dll?) at interactive logon only. No such
    > key
    > even for services - not to mention kmode drivers.
    >
    > Max
    >
    > ---
    > You are currently subscribed to ntdev as: [email protected]
    > To unsubscribe send a blank email to $subst('Email.Unsub')
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Try reading the HKEY_USERS sub-key, which name contains SID of the logged on
    user. This key contains the same info as HKEY_CURRENT_USER. I'm not sure how
    this works on Terminal Server, but on regular NT Workstation/Server this
    works fine - I can read this key from a service, so probably this will work
    for kernel mode driver as well...

    serge

    -----Original Message-----
    From: kengleng [mailto:[email protected]]
    Sent: Thursday, August 03, 2000 5:16 PM
    To: NT Developers Interest List
    Subject: [ntdev] Re: HELP...how to access registry's HKEY_CURRENT_USER


    if it's impossible, then why is it that in the DDKunder
    RtlQueryRegistryValues
    the definition
    "RTL_REGISTRY_USER:
    Path is relative to \Registry\User\CurrentUser" is being mentioned ?


    Maxim S. Shatskih wrote:

    > > i'm having some problem accessing the HKEY_CURRENT_USER key in
    > > registry under kernel mode. I tried using RtlQueryRegistryValues and it
    > > returns STATUS_OBJECT_NAME_NOT_FOUND.
    >
    > I don't think it is possible. Imagine Terminal Server with 100 different
    > users :-)
    > Also - HKCU is mounted (by shell32.dll?) at interactive logon only. No
    such
    > key
    > even for services - not to mention kmode drivers.
    >
    > Max
    >
    > ---
    > You are currently subscribed to ntdev as: [email protected]
    > To unsubscribe send a blank email to $subst('Email.Unsub')




    ---
    You are currently subscribed to ntdev as: [email protected]
    To unsubscribe send a blank email to $subst('Email.Unsub')
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 13-17 May 2024 Live, Online
Developing Minifilters 1-5 Apr 2024 Live, Online
Internals & Software Drivers 11-15 Mar 2024 Live, Online
Writing WDF Drivers 20-24 May 2024 Live, Online