re:
registry notification callbacks and what versions of the O/S they work on…
and:
The interface has been around for sometime
> but it will occasionally BSOD the system or just not work.
> Pete
> www.KernelDrivers.com
Oi Vey.
Do you (anyone) know what was fixed with the Server 2003 SP 1 version?
On my XP SP 2 system, this stuff has been sort of working but I’ve been
chasing gopher problems - get a little close here and it pops up over
there…
F’instance:
An attempt to set a registry value gives me one of these in the
callback:
struct _REG_SET_VALUE_KEY_INFORMATION {
PVOID Object; // IN
PUNICODE_STRING ValueName; // IN
ULONG TitleIndex; // IN
ULONG Type; // IN
PVOID Data; // IN
ULONG DataSize; // IN
};
I use the Object pointer to get a HANDLE to the value:
NtStatus = ObOpenObjectByPointer (
Object,
OBJ_KERNEL_HANDLE,
0,
0,
0,
KernelMode,
&KeyHandle);
(This always returns STATUS_SUCCESS)
Then I use the handle to see what the existing value of the key is
NtStatus = ZwQueryValueKey (
KeyHandle,
PtrToValueName, // points to a copy of ValueName above
KeyValuePartialInformation,
UmPtr,
UmBufferSizeInBytes,
&ResultLength);
Most of the time this gives me a status of 0x8061AA47 but it does work
every once in a while.
When it works, I go on with:
NtStatus = ZwQueryKey (
KeyHandle,
KeyNodeInformation,
UmPtr,
UmBufferSizeInBytes,
&ResultLength);
Sometimes this fails with a status of 0x80577F00.
I’ll spring for a whole bunch of e-beers for anyone who makes some good
suggestions.
Regards,
Mickey.
