RtlQueryRegistryValues problem

NTFSD
1

Hi…

I am trying to query the registry for a string value in my DriverEntry routine.For this i have used RtlQueryRegistryValues. The function returns successfully but the string passed to EntryContext of RTL_QUERY_REGISTRY_TABLE is NULL. How do i go about this. Am i on the right track.

Foll is the code.

WCHAR RegistryPath = L"\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\App Paths\MYAPP.EXE" ;
WCHAR Path[MAX_PATH] ;
PWCHAR registryPath;
RTL_QUERY_REGISTRY_TABLE paramTable[2] ;
UNICODE_STRING RegistryPathUnicodeString ;
NTSTATUS ntstatus ;

RtlInitUnicodeString( &RegistryPathUnicodeString, RegistryPath );

registryPath = ExAllocatePool( PagedPool,
RegistryPathUnicodeString.Length + sizeof(WCHAR));

if(!registryPath)
{
return FALSE;
}

RtlZeroMemory( Path, sizeof(Path)) ;
RtlZeroMemory( &paramTable[0], sizeof(paramTable));
RtlZeroMemory( registryPath, RegistryPathUnicodeString.Length + sizeof(WCHAR) );
RtlMoveMemory( registryPath, RegistryPathUnicodeString.Buffer,
RegistryPathUnicodeString.Length );

paramTable[0].Flags = RTL_QUERY_REGISTRY_DIRECT ;
paramTable[0].Name = L"(Default)";
paramTable[0].EntryContext = &Path;

ntstatus = RtlQueryRegistryValues( RTL_REGISTRY_ABSOLUTE ,
registryPath,
paramTable,
NULL,
NULL );
if (!NT_SUCCESS(ntstatus))
{
if (registryPath)
{
ExFreePool(registryPath) ;
}
return FALSE ;
}

if (registryPath)
{
ExFreePool(registryPath) ;
}
return TRUE ;

Thanks…

Do You Yahoo!?
Yahoo! Health - your guide to health and wellness

2

“Deena Muley” wrote in message news:xxxxx@ntfsd…

[snip]
>> WCHAR RegistryPath =
L"\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\App
Paths\MYAPP.EXE" ;
[snip]

You only get the Software hive very late in the boot process, so unless you
are able to defer load until after the GUI starts, use the registry key
named in Argument 2 as the base for your registry path.