Windows Registry reading RegQueryValueEx Failure

I have created a registry entry and want to read it through C program.
But the RegQueryValueEx() function is failing and I am not seeing any error.
I directly get the command prompt.

Here is the code snippet:
#define REG_KEY TEXT(“Software\MyCompany\XYZ”) // XYZ is also a key and
has a default value
REG_SZ in it

HKEY hKey;
LONG lResult;
DWORD BufferSize = MAX_PATH;
DWORD dwValue, dwSize = sizeof(dwValue);

_tprintf( _T(“\nInside delOEMInf.”) );

if((RegOpenKeyEx(HKEY_LOCAL_MACHINE,
REG_KEY,
0,
KEY_ALL_ACCESS,
&hKey)) == ERROR_SUCCESS)
{
_tprintf( _T(“\ RegOpenKeyEx OPENED”));

lResult = RegQueryValueEx(hKey, “”, NULL, NULL, (LPBYTE)&dwValue, BufferSize);
_tprintf( _T(“\nRegQueryValueEx %d”), lResult);
RegCloseKey( hKey);
}

I get only the first printf “RegOpenKeyEx OPENED”.
The second printf does not gets printed and I see directly the command prompt.
I am not abel to get the return value of regqueryvalueex().

What might be the issue and how to debug and resolve it?

dwValue is 4 bytes big, you are telling the API it is BufferSize which is MAX_PATH. the last param needs to be a pointer as well

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Sunday, April 22, 2012 11:06 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Windows Registry reading RegQueryValueEx Failure

I have created a registry entry and want to read it through C program.
But the RegQueryValueEx() function is failing and I am not seeing any error.
I directly get the command prompt.

Here is the code snippet:
#define REG_KEY TEXT(“Software\MyCompany\XYZ”) // XYZ is also a key and
has a default value
REG_SZ in it

HKEY hKey;
LONG lResult;
DWORD BufferSize = MAX_PATH;
DWORD dwValue, dwSize = sizeof(dwValue);

_tprintf( _T(“\nInside delOEMInf.”) );

if((RegOpenKeyEx(HKEY_LOCAL_MACHINE,
REG_KEY,
0,
KEY_ALL_ACCESS,
&hKey)) == ERROR_SUCCESS)
{
_tprintf( _T(“\ RegOpenKeyEx OPENED”));

lResult = RegQueryValueEx(hKey, “”, NULL, NULL, (LPBYTE)&dwValue, BufferSize);
_tprintf( _T(“\nRegQueryValueEx %d”), lResult);
RegCloseKey( hKey);
}

I get only the first printf “RegOpenKeyEx OPENED”.
The second printf does not gets printed and I see directly the command prompt.
I am not abel to get the return value of regqueryvalueex().

What might be the issue and how to debug and resolve it?


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Thanks Doron for the inputs.
I did a silly mistake.
The issue was with the last parameter with & missing and it needed an variable address there.

> I have created a registry entry and want to read it through C program.

But the RegQueryValueEx() function is failing and I am not seeing any
error.
I directly get the command prompt.

Here is the code snippet:
#define REG_KEY TEXT(“Software\MyCompany\XYZ”) // XYZ is
also a key and
has a
default
value
REG_SZ in
it

HKEY hKey;
LONG lResult;
DWORD BufferSize = MAX_PATH;
DWORD dwValue, dwSize = sizeof(dwValue);
******
I consider it to be exceptionally bad style to use a comma in a
declaration, and it is very evil to mix initialized and uninitialized
declarations like this. I find this code nearly unreadablee
*****

_tprintf( _T(“\nInside delOEMInf.”) );

if((RegOpenKeyEx(HKEY_LOCAL_MACHINE,
REG_KEY,
0,
KEY_ALL_ACCESS,
&hKey)) == ERROR_SUCCESS)
{
_tprintf( _T(“\ RegOpenKeyEx OPENED”));

lResult = RegQueryValueEx(hKey, “”, NULL, NULL, (LPBYTE)&dwValue,
BufferSize);
*****
I’m surprised this even compiles! From the documentation

LONG WINAPI RegQueryValueEx(
__in HKEY hKey,
__in_opt LPCTSTR lpValueName,
__reserved lpReserved,
__ out_opt LPDWORD lpType,
__out_opt LPBYTE lpData,
__in_out_opt LPDWORD lpCbData)

There are several things wrong with your call. From a rbustness
perspective, you CANNOT set lpType to NULL, because this naively expects
that the type will be REG_DWORD. This is an unwarranted assumption, and
your world will disintegrate quickly if a fumble-fingered user with
regedit has made it something else. This actually happened to me sometime
in the late 1990s, and I NEVER assume the value type. If it is not
REG_DWORD, feel free to complain in some fashion, but do NOT assume that
it is!

Now look at the last parameter. It is SUPPOSED to be a pointer to a DWORD
that contains the maximum buffer size, and on completion, this variable
will reflect the ACTUAL buffer size used. You do not pass in an LPDWORD;
you pass in a DWORD. The compiler should complain. But let’s guess that
you had actually written &Buffersize. Then it is still wrong, because
lpData is the address of a DWORD and is certainly NOT going to be able to
accomodate MAX_PATH bytes. In fact you have just created a potential
security hole, since you ignore the type and give an absurd size; knowing
this, I could create a REG_BINARY value that could get me control in your
program. This Is Not A Pretty Sight.

In addition, I always check the size used after the call. You should set
it to sizeof(dwValue) before the call, and make sure that upon completion
it is ==sizeof(dwValue). I learned that Registry types and lengths are
never to be trusted.

And I have no idea why you used an 8-bit string literal for the name. Use
TEXT(“”) or _T(“”) or, since you want the unnamed default value, just
NULL.

As for debugging it, the very first thing you try is single-step
execution. Debug print statements are sometimes very convenient, but
there’s no substitute for seeing what’s really happening!
*****

_tprintf( _T(“\nRegQueryValueEx %d”), lResult);
RegCloseKey( hKey);
}

I get only the first printf “RegOpenKeyEx OPENED”.
The second printf does not gets printed and I see directly the command
prompt.
I am not abel to get the return value of regqueryvalueex().

What might be the issue and how to debug and resolve it?


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

#include <stdio.h>
#include <windows.h>

int main(void)
{
HKEY Mykey;
DWORD Data;
BYTE lpData[MAX_PATH];
LONG Result;
DWORD lpType;

printf(
“testing RegOpenKeyEx\n”
);
if ( (RegOpenKeyEx (
HKEY_LOCAL_MACHINE,
L"software\microsoft\windows\CurrentVersion\Run",
0,
KEY_ALL_ACCESS,
&Mykey
) ) == ERROR_SUCCESS) {
printf(“RegopenKeyEx ok\n” );

Result = RegQueryValueEx (
Mykey,
L"“,
NULL,
&lpType,
lpData,
&Data
);
printf(
“Result is %x %x %ws %x \n” ,
Result,
lpType,
lpData,
Data
);
RegCloseKey(Mykey);
}
return 0;
}

testing RegOpenKeyEx
RegopenKeyEx ok
Result is 0 1 rupeshkp728 18
Press any key to continue . . .

On 4/23/12, Doron Holan wrote:
> dwValue is 4 bytes big, you are telling the API it is BufferSize which is
> MAX_PATH. the last param needs to be a pointer as well
>
> d
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of
> xxxxx@gmail.com
> Sent: Sunday, April 22, 2012 11:06 PM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] Windows Registry reading RegQueryValueEx Failure
>
> I have created a registry entry and want to read it through C program.
> But the RegQueryValueEx() function is failing and I am not seeing any error.
> I directly get the command prompt.
>
> Here is the code snippet:
> #define REG_KEY TEXT(“Software\MyCompany\XYZ”) // XYZ is also
> a key and
> has a
> default value
> REG_SZ in it
>
> HKEY hKey;
> LONG lResult;
> DWORD BufferSize = MAX_PATH;
> DWORD dwValue, dwSize = sizeof(dwValue);
>
> _tprintf( _T(”\nInside delOEMInf.“) );
>
> if((RegOpenKeyEx(HKEY_LOCAL_MACHINE,
> REG_KEY,
> 0,
> KEY_ALL_ACCESS,
> &hKey)) == ERROR_SUCCESS)
> {
> _tprintf( _T(”\ RegOpenKeyEx OPENED"));
>
> lResult = RegQueryValueEx(hKey, “”, NULL, NULL, (LPBYTE)&dwValue,
> BufferSize);
> _tprintf( _T(“\nRegQueryValueEx %d”), lResult);
> RegCloseKey( hKey);
> }
>
>
> I get only the first printf “RegOpenKeyEx OPENED”.
> The second printf does not gets printed and I see directly the command
> prompt.
> I am not abel to get the return value of regqueryvalueex().
>
> What might be the issue and how to debug and resolve it?
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
></windows.h></stdio.h>

when i replied i didnt have the posts by Dr newcomer and Rupesh’s
answer to Dolon Holon
only 2 posts viz op’s OP and Doron holons post were available :slight_smile:

but i now see two posts inbetween in forum display and 1 post
inbetween in my gmail thread :frowning:

was there any listserver delay ?

xxxxx@gmail.com Mon, Apr 23, 2012 at 11:35 AM
Doron Holan Mon, Apr 23, 2012 at 11:46 AM
raj_r Mon, Apr 23, 2012 at 3:06 PM
xxxxx@gmail.com Mon, Apr 23, 2012 at 6:07 PM
xxxxx@flounder.com> Mon, Apr 23, 2012 at 1:21 PM
Reply-To: Windows System Software Devs Interest List

On 4/23/12, xxxxx@flounder.com wrote:
>> I have created a registry entry and want to read it through C program.
>> But the RegQueryValueEx() function is failing and I am not seeing any
>> error.
>> I directly get the command prompt.
>>
>> Here is the code snippet:
>> #define REG_KEY TEXT(“Software\MyCompany\XYZ”) // XYZ is
>> also a key and
>> has a
>> default
>> value
>> REG_SZ in
>> it
>>
>> HKEY hKey;
>> LONG lResult;
>> DWORD BufferSize = MAX_PATH;
>> DWORD dwValue, dwSize = sizeof(dwValue);
> *
> I consider it to be exceptionally bad style to use a comma in a
> declaration, and it is very evil to mix initialized and uninitialized
> declarations like this. I find this code nearly unreadablee
>

>>
>> _tprintf( _T(“\nInside delOEMInf.”) );
>>
>> if((RegOpenKeyEx(HKEY_LOCAL_MACHINE,
>> REG_KEY,
>> 0,
>> KEY_ALL_ACCESS,
>> &hKey)) == ERROR_SUCCESS)
>> {
>> _tprintf( _T(“\ RegOpenKeyEx OPENED”));
>>
>> lResult = RegQueryValueEx(hKey, “”, NULL, NULL, (LPBYTE)&dwValue,
>> BufferSize);
>
> I’m surprised this even compiles! From the documentation
>
> LONG WINAPI RegQueryValueEx(
> in HKEY hKey,
>
in_opt LPCTSTR lpValueName,
> reserved lpReserved,
>
out_opt LPDWORD lpType,
> out_opt LPBYTE lpData,
>
in_out_opt LPDWORD lpCbData)
>
> There are several things wrong with your call. From a rbustness
> perspective, you CANNOT set lpType to NULL, because this naively expects
> that the type will be REG_DWORD. This is an unwarranted assumption, and
> your world will disintegrate quickly if a fumble-fingered user with
> regedit has made it something else. This actually happened to me sometime
> in the late 1990s, and I NEVER assume the value type. If it is not
> REG_DWORD, feel free to complain in some fashion, but do NOT assume that
> it is!
>
> Now look at the last parameter. It is SUPPOSED to be a pointer to a DWORD
> that contains the maximum buffer size, and on completion, this variable
> will reflect the ACTUAL buffer size used. You do not pass in an LPDWORD;
> you pass in a DWORD. The compiler should complain. But let’s guess that
> you had actually written &Buffersize. Then it is still wrong, because
> lpData is the address of a DWORD and is certainly NOT going to be able to
> accomodate MAX_PATH bytes. In fact you have just created a potential
> security hole, since you ignore the type and give an absurd size; knowing
> this, I could create a REG_BINARY value that could get me control in your
> program. This Is Not A Pretty Sight.
>
> In addition, I always check the size used after the call. You should set
> it to sizeof(dwValue) before the call, and make sure that upon completion
> it is ==sizeof(dwValue). I learned that Registry types and lengths are
> never to be trusted.
>
> And I have no idea why you used an 8-bit string literal for the name. Use
> TEXT(“”) or _T(“”) or, since you want the unnamed default value, just
> NULL.
>
> As for debugging it, the very first thing you try is single-step
> execution. Debug print statements are sometimes very convenient, but
> there’s no substitute for seeing what’s really happening!
>

>
>> _tprintf( _T(“\nRegQueryValueEx %d”), lResult);
>> RegCloseKey( hKey);
>> }
>>
>>
>> I get only the first printf “RegOpenKeyEx OPENED”.
>> The second printf does not gets printed and I see directly the command
>> prompt.
>> I am not abel to get the return value of regqueryvalueex().
>>
>> What might be the issue and how to debug and resolve it?
>>
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>>
>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

See comments I added to the code, below. What is odd is that you mix
8-bit and 16-bit characters here; use _T() or TEXT() for literals,
_tprintf to print.

#include <stdio.h>
> #include <windows.h>
>
> int main(void)
> {
> HKEY Mykey;
> DWORD Data;
> BYTE lpData[MAX_PATH];
> LONG Result;
> DWORD lpType;
>
> printf(
> “testing RegOpenKeyEx\n”
> );
> if ( (RegOpenKeyEx (
> HKEY_LOCAL_MACHINE,
> L"software\microsoft\windows\CurrentVersion\Run",
> 0,
> KEY_ALL_ACCESS,
> &Mykey
> ) ) == ERROR_SUCCESS) {
> printf(“RegopenKeyEx ok\n” );
>
> Result = RegQueryValueEx (
> Mykey,
> L"“,
> NULL,
> &lpType,
> lpData,
> &Data
> );
> printf(
> “Result is %x %x %ws %x \n” ,
> Result,
> lpType, // Note that if there was an error, lpType is undefined
> lpData, //
Note that if there was an error, you CANNOT treat
this as %s or %ws compatible
> Data // **** Note that to improve readability, instead of %x
you should use 0x%08x (0x%p for addresses)
> );
> RegCloseKey(Mykey);
> }
> return 0;
> }
>
> testing RegOpenKeyEx
> RegopenKeyEx ok
> Result is 0 1 rupeshkp728 18
> Press any key to continue . . .
>
> On 4/23/12, Doron Holan wrote:
>> dwValue is 4 bytes big, you are telling the API it is BufferSize which
>> is
>> MAX_PATH. the last param needs to be a pointer as well
>>
>> d
>>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com
>> [mailto:xxxxx@lists.osr.com] On Behalf Of
>> xxxxx@gmail.com
>> Sent: Sunday, April 22, 2012 11:06 PM
>> To: Windows System Software Devs Interest List
>> Subject: [ntdev] Windows Registry reading RegQueryValueEx Failure
>>
>> I have created a registry entry and want to read it through C program.
>> But the RegQueryValueEx() function is failing and I am not seeing any
>> error.
>> I directly get the command prompt.
>>
>> Here is the code snippet:
>> #define REG_KEY TEXT(“Software\MyCompany\XYZ”) // XYZ is
>> also
>> a key and
>> has a
>> default value
>> REG_SZ
>> in it
>>
>> HKEY hKey;
>> LONG lResult;
>> DWORD BufferSize = MAX_PATH;
>> DWORD dwValue, dwSize = sizeof(dwValue);
>>
>> _tprintf( _T(”\nInside delOEMInf.“) );
>>
>> if((RegOpenKeyEx(HKEY_LOCAL_MACHINE,
>> REG_KEY,
>> 0,
>> KEY_ALL_ACCESS,
>> &hKey)) == ERROR_SUCCESS)
>> {
>> _tprintf( _T(”\ RegOpenKeyEx OPENED"));
>>
>> lResult = RegQueryValueEx(hKey, “”, NULL, NULL, (LPBYTE)&dwValue,
>> BufferSize);
>> _tprintf( _T(“\nRegQueryValueEx %d”), lResult);
>> RegCloseKey( hKey);
>> }
>>
>>
>> I get only the first printf “RegOpenKeyEx OPENED”.
>> The second printf does not gets printed and I see directly the command
>> prompt.
>> I am not abel to get the return value of regqueryvalueex().
>>
>> What might be the issue and how to debug and resolve it?
>>
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>>
>>
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
></windows.h></stdio.h>

Thanks Joseph and raj for your valuable inputs.