RE: Structure for reading REG_BINARY with RtlQueryRegistr- yValues

Yes, I’ve had the exact same problem. REG_BINARY values aren’t described
anywhere as far as I know. What I found out is the format that seems to
be used for the passed in pointer. The buffer pointer you pass points to
memory that looks like this:

struct {
ULONG Length;
ULONG MaximumLength;
UCHAR Buffer[1];
}

Since RtlQueryRegistryValues() is such a strange sucker regarding
REG_BINARY values. RtlQueryRegistryValues() wants the first ULONG of
the buffer to contain its length and to have another ULONG following
this. So the actual buffer must be at least (n+8) bytes big.

Seems like the first two ULONGs in the buffer are length and max. length
of the buffer. Length and MaximumLength might be the other way around.
Fill in your buffers length in MaximumLength before calling.

RtlQueryRegistryValues() copies the data after the leading ULONGs.

Niraj

-----Original Message-----
From: xxxxx@intel.com
[mailto:xxxxx@intel.com]
Sent: Friday, May 04, 2001 5:53 AM
To: NT Developers Interest List
Subject: [ntdev] Structure for reading REG_BINARY with
RtlQueryRegistryValues

I was wondering if anyone knows how to read a registry value of type
REG_BINARY from within a driver using RtlQueryRegistryValues? I can get it
to work, but it returns some type of structure that appears to be:
struct{
ULONG Length;
ULONG Type;
UCHAR Buffer[1];
}
Does anyone know what the correct structure is?
Thanks,
Chris


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com