Registry Key path using DDK Registry Callback?

NTDEV
1

I’ve got a kernel mode driver working correctly using CmRegisterCallback
from the Win2003 DDK (on XP and 2k3). What I’m struggling with is how to
get the registry key’s full path (e.g. Machine\Registry.…) from a
pointer to a registry key object in the callback (see code below).

I.e. The PREG_SET_VALUE_KEY_INFORMATION structure below contains a PVOID
“Pointer to the registry key object for the key whose value entry is about
to be changed” - how do get the key’s path from the PVOID pointer?

NTSTATUS RegistryCallback(
IN PVOID CallbackContext,
IN PVOID Argument1,
IN PVOID Argument2)
{
NTSTATUS ntStatus;
REG_NOTIFY_CLASS Type;

Type=(REG_NOTIFY_CLASS)Argument1;
switch(Type){
case RegNtSetValueKey: // PRE_SET_KEY
{
PREG_SET_VALUE_KEY_INFORMATION
pSetValue=(PREG_SET_VALUE_KEY_INFORMATION)Argument2;
// Q: How to we get the key’s path from pSetValue->Object?
__try {
DbgPrint(“REG_SET_VALUE: current info = %wZ\n”,
pSetValue->ValueName);
} __except(EXCEPTION_EXECUTE_HANDLER) {
DbgPrint(“Handling exception\n”);
}
}
break;

…
…
…

default:
break;
}

…

return ntStatus;
}

Sorry if this is a simple beginner question but I just can’t seem to figure
this out.

Cheers for any help - Mike