The 4th parameter to ZwQueryValueKey must match KeyValueInformationClass
value and not the raw ULONG point you are passing
KeyValueBasicInformation - PKEY_VALUE_BASIC_INFORMATION
KeyValueFullInformation - PKEY_VALUE_FULL_INFORMATION
KeyValuePartialInformation - PKEY_VALUE_PARTIAL_INFORMATION
Here is some more correct code to read a ULONG
PKEY_VALUE_PARTIAL_INFORMATION pPartial;
UNICODE_STRING name;
NTSTATUS status;
ULONG length, valueToRead;
PAGED_CODE();
RtlInitUnicodeString(&name, L"ValueName");
length = sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(ULONG);
pPartial = (PKEY_VALUE_PARTIAL_INFORMATION)
ExAllocatePool(PagedPool, length);
if (pPartial == NULL) {
return STATUS_INSUFFICIENT_RESOURCES;
}
status = ZwQueryValueKey(Key,
&name,
KeyValuePartialInformation,
pPartial,
length,
&length);
if (NT_SUCCESS(status) && pPartial->Type == REG_DWORD) {
RtlCopyMemory(&valueToRead, &pPartial->Data[0],
pPartial->DataLength);
}
ExFreePool(pPartial);
return valueToRead;
d
-----Original Message-----
From: Galchin Vasili [mailto:xxxxx@yahoo.com]
Sent: Thursday, April 10, 2003 12:56 PM
To: NT Developers Interest List
Subject: [ntdev] Reading a (var,value) pair under Parameters subkey …
Hello,
I have populated under Parameters subkey a (SIBaseAddress, 0xca8)
ordered pair. I saved the RegistryPath (DriverEntry) in a struct called
state. Below is my code which doesn’t work because the value when I
print out is not 0xca8. Help?!
Regards, Vasili
{
OBJECT_ATTRIBUTES oa;
UNICODE_STRING string;
HANDLE hService;
HANDLE hParameters;
InitializeObjectAttributes (&oa,
&(State->ServiceKey),
OBJ_CASE_INSENSITIVE,
NULL,
(PSECURITY_DESCRIPTOR)NULL);
if (NT_SUCCESS (ZwOpenKey (&hService,
KEY_ALL_ACCESS,
&oa)))
{
RtlInitUnicodeString (&string, L"Parameters");
InitializeObjectAttributes (&oa,
&string,
OBJ_CASE_INSENSITIVE,
hService,
(PSECURITY_DESCRIPTOR)NULL);
if (NT_SUCCESS (ZwOpenKey (&hParameters,
KEY_ALL_ACCESS,
&oa)))
{
UNICODE_STRING KeyName;
ULONG SIBaseAddress;
ULONG ActualLength;
NTSTATUS Status;
RtlInitUnicodeString (&KeyName, L"SIBaseAddress");
Status = ZwQueryValueKey (hParameters,
&KeyName,
KeyValueFullInformation,
&SIBaseAddress,
sizeof (SIBaseAddress),
&ActualLength);
if (!NT_SUCCESS (Status))
{
DebugPrint (“Oops!!! Query failed!!! %d\n”, Status);
}
DebugPrint (“SIBaseAddress %x\n”, SIBaseAddress);
} // end if
} // end if
Do you Yahoo!?
Yahoo! Tax Center - File online, calculators, forms, and more — You
are currently subscribed to ntdev as: xxxxx@windows.microsoft.com To
unsubscribe send a blank email to xxxxx@lists.osr.com