Registry Question - ZwSetValueKey Vs. RtlWriteRegistryValue

NTDEV
1

Hi,

In some kernel driver I am writing I tried to write a value to the registry.
Since I am used to use the ZwXXX functions I used the ZwSetValueKey to set
the value on a freshly created registry key. But then I got Bugcheck code 51
with a very scary “analysis” - “Something has gone really bad with the
registry” or something to the same effect. After I searched my code for the
cause of this BSOD I replaced the implementation of the value setting to use
RtlWriteRegistryValue. To my surprise it worked. Nothing else has changed.
Does anyone have a clue why the first failed with a BSOD and the second is
working?

G.

“Now, my good man, this is no time for making enemies.”

Voltair On His Deathbed In Response To A Priest Asking That He Renounce
Satan

2

Registry Question - ZwSetValueKey Vs. RtlWriteRegistryValueThis looks like a
bug in the documentation. File a bug report in the BugBash at OSR. Even
though the constest is over, the bug will get submitted to the DDK docs
team.

http://www.osr.com/resources_bugbash.shtml

“Gilad Ben-Zeev” wrote in message news:xxxxx@ntdev…
Well, I stepped into the ZwSetValueKey and saw that the function tries to
de-reference the ValueName I passed it. No check is done to the parameter.
Since in the documentation it says that this parameter CAN be NULL I pass it
a NULL parameter. RtlWriteRegistryValue behaves in a more expected way - if
you do not supply a name it gives a default one instead - “(default)”.

G.