Registry Query Issue in Thread

NTFSD
1

Hi all,

I m getting error “STATUS_OBJECT_NAME_NOT_FOUND” when I call RtlQueryRegistryValues" in thread.

RTL_QUERY_REGISTRY_TABLE QueryTable[2];
UNICODE_STRING DomainPart;
NTSTATUS ntStatus;
BOOLEAN bProtect = FALSE;
LONG regTime = 0;

RtlZeroMemory(&QueryTable[0], sizeof(QueryTable));

DomainPart.Length = 0 ;
DomainPart.MaximumLength = 512;
DomainPart.Buffer = (PWSTR)ExAllocatePool(PagedPool,512);

QueryTable[0].Name = L"MyData";
QueryTable[0].Flags = RTL_QUERY_REGISTRY_DIRECT;
QueryTable[0].EntryContext = &DomainPart;

ntStatus = RtlQueryRegistryValues(RTL_REGISTRY_USER,
L"\Software\MySoftware\Name",
&QueryTable[0],
NULL,
NULL);

if(ntStatus == STATUS_SUCCESS)
DbgPrint(“STATUS_SUCCESS…\n”);
else if(ntStatus == STATUS_INVALID_PARAMETER)
DbgPrint(“STATUS_INVALID_PARAMETER …\n”);
else if(ntStatus == STATUS_OBJECT_NAME_NOT_FOUND )
DbgPrint(“STATUS_OBJECT_NAME_NOT_FOUND…\n”);
else if(ntStatus == STATUS_BUFFER_TOO_SMALL )
DbgPrint(“STATUS_BUFFER_TOO_SMALL …\n”);

RtlUnicodeStringToInteger(&DomainPart,10, &regTime);

ExFreePool(DomainPart.Buffer);

But when I call in PreOperation callback then I getting SUCCESS.

Help me if anybody knows.

Thanks

2

You say that it succeeds in PreOperation callback but don’t say where it
fails or what operation (Create, Read/Write, Close, etc.), so I assume it is
a non-Create Post-Op.

You are trying to read RTL_REGISTRY_USER, which is user-specific. In
PreOperation callbacks, you are in the context of the user; in Post-op, you
are usually in an arbitrary thread context. So if you’re in anything but the
original user context, the call will fail.

Post-Create is still in the user’s context (at PASSIVE_LEVEL), so it should
work. You can also complete a pre-op callback with FLT_PREOP_SYNCHRONIZE and
the post-op will be in the user’s context (with associated performance hit),
but it will be at IRQL <= APC_LEVEL and registry operations must be done at
PASSIVE_LEVEL, so be careful.

HTH,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@yahoo.com
Sent: Thursday, July 01, 2010 6:30 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Registry Query Issue in Thread

Hi all,

I m getting error “STATUS_OBJECT_NAME_NOT_FOUND” when I call
RtlQueryRegistryValues" in thread.

RTL_QUERY_REGISTRY_TABLE QueryTable[2];
UNICODE_STRING DomainPart;
NTSTATUS ntStatus;
BOOLEAN bProtect = FALSE;
LONG regTime = 0;

RtlZeroMemory(&QueryTable[0], sizeof(QueryTable));

DomainPart.Length = 0 ;
DomainPart.MaximumLength = 512;
DomainPart.Buffer = (PWSTR)ExAllocatePool(PagedPool,512);

QueryTable[0].Name = L"MyData";
QueryTable[0].Flags = RTL_QUERY_REGISTRY_DIRECT;
QueryTable[0].EntryContext = &DomainPart;

ntStatus = RtlQueryRegistryValues(RTL_REGISTRY_USER,
L"\Software\MySoftware\Name",

&QueryTable[0],
NULL,
NULL);

if(ntStatus == STATUS_SUCCESS)
DbgPrint(“STATUS_SUCCESS…\n”);
else if(ntStatus == STATUS_INVALID_PARAMETER)
DbgPrint(“STATUS_INVALID_PARAMETER …\n”);
else if(ntStatus == STATUS_OBJECT_NAME_NOT_FOUND )
DbgPrint(“STATUS_OBJECT_NAME_NOT_FOUND…\n”);
else if(ntStatus == STATUS_BUFFER_TOO_SMALL )
DbgPrint(“STATUS_BUFFER_TOO_SMALL …\n”);

RtlUnicodeStringToInteger(&DomainPart,10, &regTime);

ExFreePool(DomainPart.Buffer);

But when I call in PreOperation callback then I getting SUCCESS.

Help me if anybody knows.

Thanks

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer