Cannot Access Registry

NTDEV
1

Whenever I attempt to access the registry using ZwOpenKey I keep getting and error code 0xC000003A back from the call

the following code seems to have the error:

RtlInitUnicodeString(&subKey,L"\Registry\Machine\System\ControlSet001\Services\MyDriverServiceName");
InitializeObjectAttributes(&ObjectAttrib, &subKey, OBJ_KERNEL_HANDLE, NULL, NULL);

ntStatus = ZwOpenKey(&hCapabilityKeyHandle,
KEY_READ | KEY_QUERY_VALUE,
&ObjectAttrib);

ntStatus is 0xC000003A. In ntstatus.h this translates to STATUS_OBJECT_PATH_NOT_FOUND. I have checked the registry using RegEdit and the HKLM\System\ControlSet001\Services\MyDriverServiceName key definitely exists (I put it there).

Anyone here know what I am missing or doing wrong?

I am using Vista and kdmf to write a filter driver.

My function is here:

NTSTATUS
GetDriverSettings(IN PNS_FILTER_SETTINGS FilterSettings)
{
//This routine can only be called at IRQL = PASSIVE_LEVEL
NTSTATUS ntStatus;
OBJECT_ATTRIBUTES ObjectAttrib;
UNICODE_STRING subKey;
UNICODE_STRING DrvSet1;
ULONG Set1 = 0x00000000;
HANDLE hCapabilityKeyHandle = 0;

strcpy(&err[0], TEXT(“No Error”));

RtlInitUnicodeString(&subKey,L"\Registry\Machine\System\ControlSet001\Services\MyDriverServiceName");
InitializeObjectAttributes(&ObjectAttrib, &subKey, OBJ_KERNEL_HANDLE, NULL, NULL);

ntStatus = ZwOpenKey(&hCapabilityKeyHandle,
KEY_READ | KEY_QUERY_VALUE,
&ObjectAttrib);

if ( STATUS_INVALID_HANDLE == ntStatus ) {
strcpy(&err[0], TEXT(“Opening Key Failed: Invlaid Handle”));
}

if ( STATUS_ACCESS_DENIED == ntStatus ) {
strcpy(&err[0], TEXT(“Opening Key Failed: Acess Denied”));
}

if ( !NT_SUCCESS(ntStatus) ) {
sprintf(err, “Opening Key Failed: Error Code 0x%x”, ntStatus);
}

if ( NT_SUCCESS(ntStatus) )
{
OBJECT_ATTRIBUTES objAttribDwordKeyVal;
UNICODE_STRING subValDword;

RtlInitUnicodeString(&DrvSet1,L"MyDWordKey");

ntStatus = ZwQueryValueKey(hCapabilityKeyHandle, &DrvSet1, 0, REG_DWORD, &Set1, sizeof(ULONG));

if ( !NT_SUCCESS(ntStatus) ) {
sprintf(err, “Querying Value Failed: Error Code 0x%x”, ntStatus);
}

//Do my setup here

}

return STATUS_SUCCESS;
}

2

I always set OBJ_CASE_INSENSITIVE.

Bill Wandel

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com]
On Behalf Of xxxxx@yahoo.com
Sent: Wednesday, November 07, 2007 2:49 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Cannot Access Registry

Whenever I attempt to access the registry using ZwOpenKey I keep getting and
error code 0xC000003A back from the call

the following code seems to have the error:

RtlInitUnicodeString(&subKey,L"\Registry\Machine\System\ControlSet001\S
ervices\MyDriverServiceName");
InitializeObjectAttributes(&ObjectAttrib, &subKey, OBJ_KERNEL_HANDLE,
NULL, NULL);

ntStatus = ZwOpenKey(&hCapabilityKeyHandle,
KEY_READ | KEY_QUERY_VALUE,
&ObjectAttrib);

ntStatus is 0xC000003A. In ntstatus.h this translates to
STATUS_OBJECT_PATH_NOT_FOUND. I have checked the registry using RegEdit and
the HKLM\System\ControlSet001\Services\MyDriverServiceName key definitely
exists (I put it there).

Anyone here know what I am missing or doing wrong?

I am using Vista and kdmf to write a filter driver.

My function is here:

NTSTATUS
GetDriverSettings(IN PNS_FILTER_SETTINGS FilterSettings) {
//This routine can only be called at IRQL = PASSIVE_LEVEL
NTSTATUS ntStatus;
OBJECT_ATTRIBUTES ObjectAttrib;
UNICODE_STRING subKey;
UNICODE_STRING DrvSet1;
ULONG Set1 = 0x00000000;
HANDLE hCapabilityKeyHandle = 0;

strcpy(&err[0], TEXT(“No Error”));

RtlInitUnicodeString(&subKey,L"\Registry\Machine\System\ControlSet001\S
ervices\MyDriverServiceName");
InitializeObjectAttributes(&ObjectAttrib, &subKey, OBJ_KERNEL_HANDLE,
NULL, NULL);

ntStatus = ZwOpenKey(&hCapabilityKeyHandle,
KEY_READ | KEY_QUERY_VALUE,
&ObjectAttrib);

if ( STATUS_INVALID_HANDLE == ntStatus ) {
strcpy(&err[0], TEXT(“Opening Key Failed: Invlaid Handle”));
}

if ( STATUS_ACCESS_DENIED == ntStatus ) {
strcpy(&err[0], TEXT(“Opening Key Failed: Acess Denied”));
}

if ( !NT_SUCCESS(ntStatus) ) {
sprintf(err, “Opening Key Failed: Error Code 0x%x”, ntStatus);
}

if ( NT_SUCCESS(ntStatus) )
{
OBJECT_ATTRIBUTES objAttribDwordKeyVal;
UNICODE_STRING subValDword;

RtlInitUnicodeString(&DrvSet1,L"MyDWordKey");

ntStatus = ZwQueryValueKey(hCapabilityKeyHandle, &DrvSet1, 0,
REG_DWORD, &Set1, sizeof(ULONG));

if ( !NT_SUCCESS(ntStatus) ) {
sprintf(err, “Querying Value Failed: Error Code 0x%x”, ntStatus);
}

//Do my setup here

}

return STATUS_SUCCESS;
}

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

Magic. OBJ_CASE_INSENSITIVE did the trick.

Thanks Bill.

However Now the

ZwQueryValueKey(hCapabilityKeyHandle, &DrvSet1, 0, REG_DWORD, &Set1, sizeof(ULONG));

Line is failing with STATUS_ACCESS_VIOLATION. I don’t suppose you know what that is?

(PS I am also a bit of a C neophyte).

4

The parameters you are using don’t match the ZwQueryValueKey definition. It
should not have compiled or should have compiled with warnings.

Bill Wandel

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com]
On Behalf Of xxxxx@yahoo.com
Sent: Wednesday, November 07, 2007 3:21 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Cannot Access Registry

Magic. OBJ_CASE_INSENSITIVE did the trick.

Thanks Bill.

However Now the

ZwQueryValueKey(hCapabilityKeyHandle, &DrvSet1, 0, REG_DWORD, &Set1,
sizeof(ULONG));

Line is failing with STATUS_ACCESS_VIOLATION. I don’t suppose you know what
that is?

(PS I am also a bit of a C neophyte).

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

5

xxxxx@yahoo.com wrote:

Magic. OBJ_CASE_INSENSITIVE did the trick.

Thanks Bill.

However Now the

ZwQueryValueKey(hCapabilityKeyHandle, &DrvSet1, 0, REG_DWORD, &Set1, sizeof(ULONG));

Line is failing with STATUS_ACCESS_VIOLATION. I don’t suppose you know what that is?

(PS I am also a bit of a C neophyte).

Maybe, but you can read documentation, can’t you? ZwQueryValueKey is
not like the RegQueryValue API. In fact, I’m surprised you didn’t get
compilation errors.

In the third parameter, you need to tell ZwQueryValueKey what kind of
information you want. By specifying 0, you gave it
KeyValueBasicInformation, which returns the name of the value, not the
data. You want KeyValuePartialInformation. That returns a structure
(KEY_VALUE_PARTIAL_INFORMATION), which tells you the type you are
getting and the length of the data value. So, more like this:

unsigned long Size = sizeof(KEY_VALUE_PARTIAL_INFORMATION) - 1 +
sizeof(ULONG);
KEY_VALUE_PARTIAL_INFORMATION* pkvpi = ExAllocatePool( NonPagedPool,
Size );
ZwQueryValueKey( hCapabilityHandle, &DrvSet1,
KeyValuePartialInformation, pkvpi, Size, &Size );

Then, your value is in *(PULONG)(pkvpi->Data). Don’t forget to
ExFreePool( pkvpi ).

The more proper way to do this is to specify a short buffer to begin
with, which will return the actual size in the ResultLength parameter.
Then you allocate the KEY_VALUE_PARTIAL_INFORMATION and call it again.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

6

Thanks for your replies. Your right I’m not using it properly (probably because I found an example for setting the value and changed the function name). Thanks Tim for the code above. I am working on it now.

7

You should use CurrentControlSet instead of the hardcoded control set number (ControlSet001 in this case). Why not use the string that is passed to you on DriverEntry instead of hardcoding a string?

You really should be storing your parameters under a “Parameters” key under your service name. If you do this you can call WdfDriverOpenParametersRegistryKey to open the key and then use the WdfRegistry* APIs to query for values. You still have not looked at the documentation for using ZwQueryValueKey. You need to ask for partial or full information. Look in src\input\kbdclass\kbdclass.c, KeyboardQueryDeviceKey on how to query for full information. If you use the KMDF APIs, this complexity is hidden from you and you can pass in pointer types that you expect and do not have to deal with raw arrays of bytes as return values

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@yahoo.com
Sent: Wednesday, November 07, 2007 11:49 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Cannot Access Registry

Whenever I attempt to access the registry using ZwOpenKey I keep getting and error code 0xC000003A back from the call

the following code seems to have the error:

RtlInitUnicodeString(&subKey,L"\Registry\Machine\System\ControlSet001\Services\MyDriverServiceName");
InitializeObjectAttributes(&ObjectAttrib, &subKey, OBJ_KERNEL_HANDLE, NULL, NULL);

ntStatus = ZwOpenKey(&hCapabilityKeyHandle,
KEY_READ | KEY_QUERY_VALUE,
&ObjectAttrib);

ntStatus is 0xC000003A. In ntstatus.h this translates to STATUS_OBJECT_PATH_NOT_FOUND. I have checked the registry using RegEdit and the HKLM\System\ControlSet001\Services\MyDriverServiceName key definitely exists (I put it there).

Anyone here know what I am missing or doing wrong?

I am using Vista and kdmf to write a filter driver.

My function is here:

NTSTATUS
GetDriverSettings(IN PNS_FILTER_SETTINGS FilterSettings)
{
//This routine can only be called at IRQL = PASSIVE_LEVEL
NTSTATUS ntStatus;
OBJECT_ATTRIBUTES ObjectAttrib;
UNICODE_STRING subKey;
UNICODE_STRING DrvSet1;
ULONG Set1 = 0x00000000;
HANDLE hCapabilityKeyHandle = 0;

strcpy(&err[0], TEXT(“No Error”));

RtlInitUnicodeString(&subKey,L"\Registry\Machine\System\ControlSet001\Services\MyDriverServiceName");
InitializeObjectAttributes(&ObjectAttrib, &subKey, OBJ_KERNEL_HANDLE, NULL, NULL);

ntStatus = ZwOpenKey(&hCapabilityKeyHandle,
KEY_READ | KEY_QUERY_VALUE,
&ObjectAttrib);

if ( STATUS_INVALID_HANDLE == ntStatus ) {
strcpy(&err[0], TEXT(“Opening Key Failed: Invlaid Handle”));
}

if ( STATUS_ACCESS_DENIED == ntStatus ) {
strcpy(&err[0], TEXT(“Opening Key Failed: Acess Denied”));
}

if ( !NT_SUCCESS(ntStatus) ) {
sprintf(err, “Opening Key Failed: Error Code 0x%x”, ntStatus);
}

if ( NT_SUCCESS(ntStatus) )
{
OBJECT_ATTRIBUTES objAttribDwordKeyVal;
UNICODE_STRING subValDword;

RtlInitUnicodeString(&DrvSet1,L"MyDWordKey");

ntStatus = ZwQueryValueKey(hCapabilityKeyHandle, &DrvSet1, 0, REG_DWORD, &Set1, sizeof(ULONG));

if ( !NT_SUCCESS(ntStatus) ) {
sprintf(err, “Querying Value Failed: Error Code 0x%x”, ntStatus);
}

//Do my setup here

}

return STATUS_SUCCESS;
}

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer