Reading registry value in boot time

NTFSD
1

Hi all,

I’m writing a file system filter and I can’t read a value in registry
when DriverEntry is running (boot time).
This value is in \REGISTRY\Machine\Software\MyKey and I get
STATUS_OBJECT_NAME_NOT_FOUND on call ZwOpenKey. However, when then system is
running, my application send a DeviceIoControl and my driver can open this
key successfully.
How can I read this value at boot time?

Any help is welcome,
Thanks in advance,
Fernando.

2

You can’t not all hives are mounted at boot time.

Don Burn
Windows 2k/XP/2k3 Filesystem and Driver Consulting

----- Original Message -----
From: Fernando Roberto da Silva
To: File Systems Developers
Sent: Wednesday, April 16, 2003 3:19 PM
Subject: [ntfsd] Reading registry value in boot time

Hi all,

I’m writing a file system filter and I can’t read a value in registry
when DriverEntry is running (boot time).
This value is in \REGISTRY\Machine\Software\MyKey and I get
STATUS_OBJECT_NAME_NOT_FOUND on call ZwOpenKey. However, when then system is
running, my application send a DeviceIoControl and my driver can open this
key successfully.
How can I read this value at boot time?

Any help is welcome,
Thanks in advance,
Fernando.

You are currently subscribed to ntfsd as: xxxxx@acm.org
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

The software hive is not available when boot-drivers get initialized.

----- Original Message -----
From: “Fernando Roberto da Silva”
To: “File Systems Developers”
Sent: Wednesday, April 16, 2003 9:19 PM
Subject: [ntfsd] Reading registry value in boot time

> Hi all,
>
> I’m writing a file system filter and I can’t read a value in registry
> when DriverEntry is running (boot time).
> This value is in \REGISTRY\Machine\Software\MyKey and I get
> STATUS_OBJECT_NAME_NOT_FOUND on call ZwOpenKey. However, when then system
is
> running, my application send a DeviceIoControl and my driver can open this
> key successfully.
> How can I read this value at boot time?
>
> Any help is welcome,
> Thanks in advance,
> Fernando.

4

If I move my value to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MyDriver\Parameters,
how can I read my value at boot time. At NT4 this value is equal to
\REGISTRY\System\ControlSet001\Services\MyDriver\Parameters and I can read
this value successfully. However, when my driver is running in W2K, this is
not true. I did try use RegistryPath from DriverEntry argument and does not
works.
How can I know where is my value in boot time?

Thanks for your help,
Fernando.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Tobias
Sent: quarta-feira, 16 de abril de 2003 16:27
To: File Systems Developers
Subject: [ntfsd] Re: Reading registry value in boot time

The software hive is not available when boot-drivers get initialized.

----- Original Message -----
From: “Fernando Roberto da Silva”
To: “File Systems Developers”
Sent: Wednesday, April 16, 2003 9:19 PM
Subject: [ntfsd] Reading registry value in boot time

> Hi all,
>
> I’m writing a file system filter and I can’t read a value in registry
> when DriverEntry is running (boot time).
> This value is in \REGISTRY\Machine\Software\MyKey and I get
> STATUS_OBJECT_NAME_NOT_FOUND on call ZwOpenKey. However, when then system
is
> running, my application send a DeviceIoControl and my driver can open this
> key successfully.
> How can I read this value at boot time?
>
> Any help is welcome,
> Thanks in advance,
> Fernando.

—
You are currently subscribed to ntfsd as: xxxxx@scuasecurity.com.br
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

You can choose the correct hive from the values in:
HKEY_LOCAL_MACHINE\SYSTEM\Select

These values determine which hive is linked as:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet

Regards,

Oliver

If I move my value to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MyDriver\Parameters,
how can I read my value at boot time. At NT4 this value is equal to
\REGISTRY\System\ControlSet001\Services\MyDriver\Parameters and I can read
this value successfully. However, when my driver is running in W2K, this
is
not true. I did try use RegistryPath from DriverEntry argument and does
not
works.
How can I know where is my value in boot time?

Thanks for your help,
Fernando.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Tobias
Sent: quarta-feira, 16 de abril de 2003 16:27
To: File Systems Developers
Subject: [ntfsd] Re: Reading registry value in boot time

The software hive is not available when boot-drivers get initialized.

----- Original Message -----
From: “Fernando Roberto da Silva”
> To: “File Systems Developers”
> Sent: Wednesday, April 16, 2003 9:19 PM
> Subject: [ntfsd] Reading registry value in boot time
>
>
> > Hi all,
> >
> > I’m writing a file system filter and I can’t read a value in
> registry
> > when DriverEntry is running (boot time).
> > This value is in \REGISTRY\Machine\Software\MyKey and I get
> > STATUS_OBJECT_NAME_NOT_FOUND on call ZwOpenKey. However, when then
> system
> is
> > running, my application send a DeviceIoControl and my driver can open
> this
> > key successfully.
> > How can I read this value at boot time?
> >
> > Any help is welcome,
> > Thanks in advance,
> > Fernando.
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@scuasecurity.com.br
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@gmx.info
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–
---------------------------------------------------
May the source be with you, stranger :wink:

Contacts / Kontakte
eMail: xxxxx@gmx.net|info|de|com
ICQ UIN #281645
AIM: “nixahnungnicht” & “nixlosheute”
Y! aka YIM: “sherlock_holmes_and_dr_watson”
MSNM (Passport): “xxxxx@ePost.de”
http://assarbad.org & http://assarbad.net

6

> If I move my value to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MyDriver\Parameters,
how can I read my value at boot time. At NT4 this value is equal to
\REGISTRY\System\ControlSet001\Services\MyDriver\Parameters and I can read
this value successfully. However, when my driver is running in W2K, this
is
not true. I did try use RegistryPath from DriverEntry argument and does
not
works.

This is what we do and it works.