Im trying to read a number of REG_EXPAND_SZ values from the registry key
\Registry\Machine\System\CurrentControlSet\Services\FileSystemFilterDriv
er\Directories when the driver starts at boot time.
Using RtlQueryRegistryValues as follows results in an unexpanded string
in expstr ie %UserProfile%
What should the Environment parameter of the function be set to?
queryTable[0].Flags = RTL_QUERY_REGISTRY_DIRECT;
queryTable[0].Name = fullInfo->Name;
queryTable[0].EntryContext = &expStr;
queryTable[0].DefaultType = REG_SZ;
queryTable[0].DefaultData = L"";
queryTable[0].DefaultLength = 0;
status = RtlQueryRegistryValues(RTL_REGISTRY_HANDLE, //RelativeTo
driverParamsRegKey, //Path
queryTable, //QueryTable
NULL, //Context
NULL); //Environment ???
If expanding cant be done at this time, are the values for
%WinDir%,%SystemRoot%,%AllUsersProfile% etc stored elsewhere in the
registry that is accessible by a driver at boot time?
Thanks
Jonathan Oliver
Software Engineer
WinST
BAE Systems Insyte
********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************