how to convert the value returned by zwqueryvaluekey to string

NTDEV
1

Hi,
I am very new to driver developement.
After looking after the code on the net .I have written the driver code to read the
registry value.the value is read sucessfully .I am able to print the value.
But I want to convert the value to string and return it.Can anybody help me to resolve the issue.
the value in registry is LKE02345867(REG_SZ).
Here is the code I have written.I could be a great help to me if part of the code is added to convert it to string

===========================
__declspec(dllexport) ULONG Readreg_SerialNum()
{
NTSTATUS status;
OBJECT_ATTRIBUTES obj;
HANDLE key;
ULONG size;
UNICODE_STRING value,name,reg1;
WCHAR string[20] = L"Serial Number";
PKEY_VALUE_PARTIAL_INFORMATION vpip;
size=0;
RtlInitUnicodeString(&name,L"\Registry\Machine\Software\bmc\insert\configuration\PROM");
InitializeObjectAttributes(&obj, &name, OBJ_CASE_INSENSITIVE, NULL, NULL);
RtlInitUnicodeString(&value, string);
status = ZwOpenKey(&key, KEY_QUERY_VALUE, &obj);
if (NT_SUCCESS(status))
{

status = ZwQueryValueKey(key, &value, KeyValuePartialInformation, NULL, 0,&size);
if ( size == 0)
{
DbgPrint(“First ZwQueryValueKey failed\n”);
}
vpip = (PKEY_VALUE_PARTIAL_INFORMATION)ExAllocatePool(PagedPool, size);
if (!vpip)
{
DbgPrint(“vpip 1 failed\n”);
}
status = ZwQueryValueKey(key,&value, KeyValuePartialInformation,vpip, size,&size);
if (!NT_SUCCESS(status))
{
DbgPrint(“Second ZWquery failed\n”);
}
DbgPrint(“Second ZWquery failed\n %S”,vpip->Data);
ExFreePool(vpip);
ZwClose(key);
}

Regards
Naveen

2

What you’re asking seems like a basic C programming question, not something specific to driver development.

KEY_VALUE_PARTIAL_INFORMATION ends with a variable length array of bytes (Data). You’re already using it to print the string. Why wouldn’t you just call ExAllocatePool to allocate vpip->DataLength bytes of data (i’d add 2 bytes for an extra terminating character, but that’s because i never remember if the registry terminates strings for you) then use RtlCopyMemory to copy from vpip->Data into your new string (and then zero the extra character that i mentioned earlier)?

If you’re wondering about converting it to an ascii string, my first suggestion would be “don’t” - leave all your driver code using wide strings and you’ll be much happier. However if this is the question you’d want you should look at RtlUnicodeStringToAnsiSize & RtlUnicodeStringToAnsiString.

-p

From: xxxxx@lists.osr.com on behalf of xxxxx@rediffmail.com
Sent: Fri 9/22/2006 5:58 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] how to convert the value returned by zwqueryvaluekey to string

Hi,
I am very new to driver developement.
After looking after the code on the net .I have written the driver code to read the
registry value.the value is read sucessfully .I am able to print the value.
But I want to convert the value to string and return it.Can anybody help me to resolve the issue.
the value in registry is LKE02345867(REG_SZ).
Here is the code I have written.I could be a great help to me if part of the code is added to convert it to string

===========================
__declspec(dllexport) ULONG Readreg_SerialNum()
{
NTSTATUS status;
OBJECT_ATTRIBUTES obj;
HANDLE key;
ULONG size;
UNICODE_STRING value,name,reg1;
WCHAR string[20] = L"Serial Number";
PKEY_VALUE_PARTIAL_INFORMATION vpip;
size=0;
RtlInitUnicodeString(&name,L"\Registry\Machine\Software\bmc\insert\configuration\PROM");
InitializeObjectAttributes(&obj, &name, OBJ_CASE_INSENSITIVE, NULL, NULL);
RtlInitUnicodeString(&value, string);
status = ZwOpenKey(&key, KEY_QUERY_VALUE, &obj);
if (NT_SUCCESS(status))
{

status = ZwQueryValueKey(key, &value, KeyValuePartialInformation, NULL, 0,&size);
if ( size == 0)
{
DbgPrint(“First ZwQueryValueKey failed\n”);
}
vpip = (PKEY_VALUE_PARTIAL_INFORMATION)ExAllocatePool(PagedPool, size);
if (!vpip)
{
DbgPrint(“vpip 1 failed\n”);
}
status = ZwQueryValueKey(key,&value, KeyValuePartialInformation,vpip, size,&size);
if (!NT_SUCCESS(status))
{
DbgPrint(“Second ZWquery failed\n”);
}
DbgPrint(“Second ZWquery failed\n %S”,vpip->Data);
ExFreePool(vpip);
ZwClose(key);
}

Regards
Naveen

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

xxxxx@rediffmail.com wrote:

I am very new to driver developement.
After looking after the code on the net .I have written the driver code to read the
registry value.the value is read sucessfully .I am able to print the value.
But I want to convert the value to string and return it.Can anybody help me to resolve the issue.
the value in registry is LKE02345867(REG_SZ).
Here is the code I have written.I could be a great help to me if part of the code is added to convert it to string

===========================
__declspec(dllexport) ULONG Readreg_SerialNum()

Why do you have __declspec(dllexport) here? How are you planning to use
this?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

4

i tried out every possible combination to convert the data returned by ZwQueryValueKey to string but could not sucessd
can somebody please add the code that converts the data to string successfully
without a crash!!!
-Naveen

5

xxxxx@rediffmail.com wrote:

i tried out every possible combination to convert the data returned by ZwQueryValueKey to string but could not sucessd
can somebody please add the code that converts the data to string successfully
without a crash!!!

No, none of us can read your mind. However, if you post the code you’re
trying to use, perhaps we can point out where you have gone wrong. Be
sure to tell us which key you’re trying to read, and what you expect to
find there.

There are 31 examples of the use of ZwQueryValueKey in the DDK. Have
you looked at any of them?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.