{"id":288,"date":"2008-06-16T23:22:17","date_gmt":"2008-06-16T23:22:17","guid":{"rendered":"https:\/\/driverentry.com.br\/en\/2008\/06\/16\/using-the-registry-part-1\/"},"modified":"2026-07-27T20:41:59","modified_gmt":"2026-07-27T20:41:59","slug":"using-the-registry-part-1","status":"publish","type":"post","link":"https:\/\/driverentry.com.br\/en\/2008\/06\/16\/using-the-registry-part-1\/","title":{"rendered":"Using the Registry (Part 1)"},"content":{"rendered":"
\"\"<\/a><\/div>\n

\"\"<\/p>\n

In the last post, in response to a question from a reader, I mentioned a little about how to create and use new IOCTLs<\/a>. After all, the motto of this blog is “To serve well to serve forever.”<\/em> Questions from readers are a great source of suggestions for new posts. I believe that like it is in any other specialty, driver development is a topic that can be broken up into many many parts. No wonder that the smallest book I know about driver development<\/a> has not less than four hundred pages. So, it’s good to know what the reader’s difficulties are to know what subject to post here. Feel free to send further suggestions or questions. Some time ago, I had received an email from Fabio Dias (Fortaleza, CE – BRA), who suggested a post on how to access the Registry<\/a> from a driver. Okay, let’s go.<\/p>\n

HKEY_LOCAL_MACHINE is User-Mode stuff<\/h3>\n

Before going out there saying what APIs you should use to access the registry, let’s first take a look on how the registry is organized. I think the first step here is talk about opening a registry key. As in User Mode<\/em>, we must have a string that informs the key path which we want to open, and thereby obtain a handle to it. Oops! Did I say I handle? Therefore, it is worth mentioning that the registry keys are also resources managed by the Object Manager<\/strong>. Registry keys are all stored under the “\\Registry” <\/strong>namespace. Thus, in User Mode<\/em> we use HKEY_LOCAL_MACHINE name as one of the basic divisions of the registry, whereas in Kernel Mode<\/em> we use “\\Registry\\Machine “<\/strong>. Similarly to HKEY_USERS we have “\\Registry\\Users”<\/strong>. More details can be found here<\/a>.<\/p>\n

Which is the CurrentControlSet?<\/h3>\n

The DriverEntry <\/em>routine of any Windows NT driver receives two input parameters, one being a pointer to the DRIVER_OBJECT<\/a> structure, which represents the instance of our driver, and another parameter is a UNICODE_STRING<\/a> containing the registry path, which indicates where our driver is registered. But how so? Can’t our driver know how it was registered in the registry?<\/strong> Here, in the reference is simple:<\/p>\n

\n

“The registry path string pointed to by RegistryPath is of the form \\Registry\\Machine\\System\\CurrentControlSet\\Services\\DriverName”<\/strong><\/em><\/p><\/blockquote>\n

<\/strong><\/em>Okay, let’s take a ride on any driver and take a look at this using WinDbg<\/a>. Let me open a parenthesis here to say to any new reader of this blog that I’m using a virtual machine to run the tests with a sample driver, as it is explained in this post<\/a>. This allows me to do Kernel Debugging not necessarily having to use two machines. To make the driver replacement easier for each modification I do, I am using WinDbg mapping drivers, as it is explained in another post<\/a>. This feature allows WinDbg to always load a new driver version in the TARGET machine without the need of having to manually replace the driver in it. Close parenthesis.<\/p>\n

Even before the driver be loaded, I have put a breakpoint on its DriverEntry <\/em>routine. Oops! How can you put a breakpoint in a driver that has not been loaded?<\/strong> Oh, OK … You can do this using the bu <\/strong>command, as it is shown below. The breakpoints will be set whenever the driver will be loaded. In the following line, I list the breakpoints, just to…<\/strong> When the driver isloaded, its execution stops at my breakpoint and I use the !ustr <\/strong>extension, which shows the UNICODE_STRING contents, so that we can see the value of its second parameter.<\/p>\n<\/div>\n

\n
kd> bu KernelReg!DriverEntry<\/pre>\n
kd> bl<\/pre>\n
 0 eu             0001 (0001) (KernelReg!DriverEntry)<\/pre>\n
 <\/pre>\n
kd> g<\/pre>\n
KD: Accessing 'Z:\\Sources\\DriverEntry\\KernelReg\\objchk_w2k_x86\\i386\\KernelReg.sys'<\/pre>\n
    (\\??\\C:\\WINDOWS\\system32\\drivers\\KernelReg.sys)<\/pre>\n
  File size 2K.<\/pre>\n
MmLoadSystemImage: Pulled \\??\\C:\\WINDOWS\\system32\\drivers\\KernelReg.sys from kd<\/pre>\n
Breakpoint 0 hit<\/pre>\n
KernelReg!DriverEntry:<\/pre>\n
f8d394a0 8bff            mov     edi,edi<\/pre>\n
kd> !ustr poi(pusRegistryPath)<\/pre>\n
String(114,114) at 82302000: \\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001<\/span>\\Services\\KernelReg<\/pre>\n<\/div>\n
Mas n\u00e3o era pra ser CurrentControlSet?<\/strong> Na verdade o CurrentControlSet<\/em> \u00e9 um link para um outro ControlSet<\/em>. No caso observado acima, o CurrentControlSet<\/em> est\u00e1 refletindo o ControlSet001<\/em>, ou seja, as altera\u00e7\u00f5es feitas no ControlSet001<\/em> s\u00e3o vistas no CurrentControlSet<\/em> e vice-versa. O CurrentControlSet<\/em> pode refletir qualquer outro ControlSet<\/em>. Algumas regras determinam quando eles mudam, como em casos de mudan\u00e7as de configura\u00e7\u00f5es de sistema ou instala\u00e7\u00f5es de drivers. Para saber para onde o CurrentControlSet<\/em> est\u00e1 apontando, d\u00ea uma olhada no valor Current<\/strong> que est\u00e1 na chave “\\Registry\\Machine\\System\\Select”<\/em> como mostra a figura abaixo.<\/p>\n
Shouldn’t It be CurrentControlSet?<\/strong> Actually CurrentControlSet<\/em> is a link to another ControlSet<\/em>. In the case noted above, CurrentControlSet<\/em> is reflecting ControlSet001<\/em>, i.e., changes in the ControlSet001<\/em> are seen in CurrentControlSet<\/em> and vice-versa. The CurrentControlSet <\/em>can reflect any ControlSet<\/em>. Some rules determine when they change, like in cases of system configuration changes or driver installation. To know where the CurrentControlSet<\/em> is pointing to, take a look at the Current<\/strong> value, which is in “\\Registry\\Machine\\System\\Select”<\/em> key, as it is shown below.<\/p>\n
\"\"<\/div>\n
But that’s just for the sake of curiosity. When you use CurrentControlSet<\/em> as part of the key path you wish to access, the Object Manager<\/strong> do the translation for you and everyone lives happily ever after.<\/p>\n
Where is \\Registry\\Machine\\Software?<\/h3>\n
It may have already happened to some of you. You write a driver that should read a value in a certain “\\Registry\\Machine\\Software”<\/em> key when the driver get loaded. While you do tests with the driver, which now has its Start<\/em> set to Manual(3), everything works successfuly but, when you change the driver Start<\/em> to Boot(0)<\/em> or System(1)<\/em>, it is not possible to open the same key, the driver receives STATUS_OBJECT_NAME_NOT_FOUND <\/strong>(0xc00000034).<\/p>\n
What did you mean by “name not found”? It was here right now!<\/strong> What happened is that the SOFTWARE key is mounted later. Thus, during the system boot it does not exist yet. To access that key you have to wait a little, perhaps using this post<\/a> idea. Then everything will work like fine.<\/p>\n
Anything to say about HKEY_CURRENT_USER?<\/h3>\n
Well, let’s think. Who is the Current User<\/em>? The user who is making a system call, right? Thus, according to tradition, you start thinking it’s easy and when you are logged in as Paul you manually start your driver. During the call to its DriverEntry <\/em>routine, the driver read settings for the user logged in, which are actually stored in the Paulo’s HKEY_CURRENT_USER. Well, that’s right up here. Yeah, it’s all wrong. For Paul point of view, the settings are right there, but the DriverEntry <\/em>routine is called in system context, which incidentally is not Paul.<\/p>\n
This is a problem faced even in User Mode<\/em>, where services that run on system account try to open the HKEY_CURRENT_USER key. One thing we must bear in mind is that “The logged user” is not a simple system information. Try to imagine a Terminal Service<\/a>, there may be multiple users logged in at the same time. Even when there is only one user logged into the system, threads can be executed in other user’s context or even in the system context. Drivers do not have its own context. Portions of the driver run in system context, others in arbitrary context. Depending on the driver type and its position within the device stack , it can receive calls in user’s context. That is the case of File System<\/a> drivers for example.<\/p>\n
Ah, OK! HKEY_CURRENT_USER will work!<\/strong> Er… How do I say that? No, it will not work. According to Microsoft’s reference<\/a>, there is no simple translation to HKEY_CURRENT_USER, but there are routines that provide simplifications. After all this chat about context, you will still have to access the HKEY_USERS key, or rather, “\\Registry\\User”<\/em> in the format already familiar to User Mode<\/em> programmers used with HKEY_USERS. An example is: “\\Registry\\User\\S-1-5-21-73586283-1897051121-839522115-500”<\/em>. The equivalent for a system account is the  “\\Registry\\User\\.DEFAULT”<\/em> key.<\/p>\n
OK, ok, ok! An example please<\/h3>\n
Once again, I’m assuming you already know how to build and install a driver as it is explained in this post<\/a>. The example code available for downloading at the end of this post can also be compiled on Visual Studio<\/a> by using DDKBUILD<\/a>, as this post<\/a> explains. In this example I will show how to read two registry values \u200b\u200bthat are in the key which it is shown below. To make the game more fun, when the driver get executed by the first time, it will create the key and its contained values\u200b\u200b when it realizes that it does not exist yet.<\/p>\n
\"\"<\/div>\n
The values will be contained in a subkey of the one you received as a parameter in the DriverEntry <\/em>routine. So our basic work on coding the DriverEntry<\/em> routine is precisely to create the registry full path key that contains these values\u200b\u200b. With this UNICODE_STRING in hand, we will take it to the reading and writing in the registry routines. Below is the DriverEntry <\/em>routine code. It does not contain anything special about the registry. As always, it’s worth a read on the comments.<\/p>\n
\n
\/****<\/span><\/pre>\n
***     DriverEntry<\/span><\/pre>\n
**<\/span><\/pre>\n
**      Our driver's entry point.<\/span><\/pre>\n
**      Knife in the teeth and blood in the eyes.<\/span><\/pre>\n
*\/<\/span><\/pre>\n
extern<\/span> \"C\"<\/span><\/pre>\n
NTSTATUS<\/pre>\n
DriverEntry(__in PDRIVER_OBJECT  pDriverObject,<\/pre>\n
            __in PUNICODE_STRING pusRegistryPath)<\/pre>\n
{<\/pre>\n
    UNICODE_STRING  usParameters = RTL_CONSTANT_STRING(L\"\\\\Parameters\"<\/span>);<\/pre>\n
    UNICODE_STRING  usFullRegPath = {0<\/span>, 0<\/span>, NULL};<\/pre>\n
    PWCHAR          pwzBuffer = NULL;<\/pre>\n
    NTSTATUS        nts = STATUS_SUCCESS;<\/pre>\n
 <\/pre>\n
    \/\/-f--> Here we receive as a parameter the registry path up to<\/span><\/pre>\n
    \/\/      our driver's key. Our parameters live in a<\/span><\/pre>\n
    \/\/      sub-key named \"Parameters\". Let's build the<\/span><\/pre>\n
    \/\/      full path by appending the sub-key name to the<\/span><\/pre>\n
    \/\/      registry path we received as a parameter.<\/span><\/pre>\n
    __try<\/span><\/pre>\n
    {<\/pre>\n
        __try<\/span><\/pre>\n
        {<\/pre>\n
            \/\/-f--> Set the driver's unload callback routine.<\/span><\/pre>\n
            pDriverObject->DriverUnload = OnDriverUnload;<\/pre>\n
 <\/pre>\n
            \/\/-f--> To do this append, we will need a buffer<\/span><\/pre>\n
            \/\/      large enough to store the original string<\/span><\/pre>\n
            \/\/      plus the size of the sub-key. Here we allocate<\/span><\/pre>\n
            \/\/      this buffer.<\/span><\/pre>\n
            pwzBuffer = (PWCHAR)ExAllocatePoolWithTag(PagedPool,<\/pre>\n
                                                      pusRegistryPath->Length +<\/pre>\n
                                                      usParameters.Length,<\/pre>\n
                                                      _KRN_REG_TAG);<\/pre>\n
            if<\/span> (pwzBuffer == NULL)<\/pre>\n
                ExRaiseStatus(STATUS_INSUFFICIENT_RESOURCES);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Now that we have the buffer, let's initialize the<\/span><\/pre>\n
            \/\/      UNICODE_STRING structure for the string resulting from this append.<\/span><\/pre>\n
            RtlInitEmptyUnicodeString(&usFullRegPath,<\/pre>\n
                                      pwzBuffer,<\/pre>\n
                                      pusRegistryPath->Length +<\/pre>\n
                                      usParameters.Length);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Copy the string received as a parameter<\/span><\/pre>\n
            RtlCopyUnicodeString(&usFullRegPath,<\/pre>\n
                                 pusRegistryPath);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Concatenate the string \"\\Parameters\"<\/span><\/pre>\n
            RtlAppendUnicodeStringToString(&usFullRegPath,<\/pre>\n
                                           &usParameters);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Using the full path, try to load the parameters<\/span><\/pre>\n
            nts = LoadParams(&usFullRegPath);<\/pre>\n
            if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
            {<\/pre>\n
                \/\/-f--> On failure, check whether the cause was the missing<\/span><\/pre>\n
                \/\/      sub-key in the registry. This should happen when the<\/span><\/pre>\n
                \/\/      driver is run for the first time. But if the failure<\/span><\/pre>\n
                \/\/      is a different one, then each to their own problems.<\/span><\/pre>\n
                if<\/span> (nts != STATUS_OBJECT_NAME_NOT_FOUND)<\/pre>\n
                    ExRaiseStatus(nts);<\/pre>\n
 <\/pre>\n
                \/\/-f--> Let's create the sub-key and write the<\/span><\/pre>\n
                \/\/      pre-defined values.<\/span><\/pre>\n
                nts = CreateParams(&usFullRegPath);<\/pre>\n
                if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
                    ExRaiseStatus(nts);<\/pre>\n
 <\/pre>\n
                \/\/-f--> Try to read the parameters again.<\/span><\/pre>\n
                \/\/      Okay, I know this is silly. After all, if I<\/span><\/pre>\n
                \/\/      just created the parameters, why would I<\/span><\/pre>\n
                \/\/      read them again? Well, just to illustrate.<\/span><\/pre>\n
                nts = LoadParams(&usFullRegPath);<\/pre>\n
                if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
                    ExRaiseStatus(nts);<\/pre>\n
            }<\/pre>\n
        }<\/pre>\n
        __finally<\/span><\/pre>\n
        {<\/pre>\n
            \/\/-f--> Cleaning up the mess.<\/span><\/pre>\n
            if<\/span> (pwzBuffer)<\/pre>\n
                ExFreePool(pwzBuffer);<\/pre>\n
        }<\/pre>\n
    }<\/pre>\n
    __except<\/span>(EXCEPTION_EXECUTE_HANDLER)<\/pre>\n
    {<\/pre>\n
        \/\/-f--> Oops!<\/span><\/pre>\n
        nts = GetExceptionCode();<\/pre>\n
        ASSERT(FALSE);<\/pre>\n
    }<\/pre>\n
 <\/pre>\n
    return<\/span> nts;<\/pre>\n
}<\/pre>\n<\/div>\n
Let’s play with UNICODE_STRING a little more. Let’s look at the routine that writes the registry values\u200b\u200b. This routine does not offer anything much different than we’re used to seeing in User Mode.<\/em> However, it’s like they say: “One example is worthier than a thousand articles.”<\/em> Wow, that was terrible! I need to stop doing this. You must be thinking now: “Wow! What I need to read to have a driver example.”<\/em><\/p>\n
\n
\/****<\/span><\/pre>\n
***     CreateParams<\/span><\/pre>\n
**<\/span><\/pre>\n
**      This routine is called when the key that contains<\/span><\/pre>\n
**      the parameters is not detected. It creates the key and the parameters<\/span><\/pre>\n
**      with pre-defined values.<\/span><\/pre>\n
*\/<\/span><\/pre>\n
NTSTATUS<\/pre>\n
CreateParams(__in    PUNICODE_STRING pusRegistryPath)<\/pre>\n
{<\/pre>\n
    HANDLE              hKey = NULL;<\/pre>\n
    NTSTATUS            nts = STATUS_SUCCESS;<\/pre>\n
    OBJECT_ATTRIBUTES   ObjAttributes;<\/pre>\n
    UNICODE_STRING      usStringParam = RTL_CONSTANT_STRING(L\"String\"<\/span>);<\/pre>\n
    UNICODE_STRING      usDWordParam = RTL_CONSTANT_STRING(L\"DoubleWord\"<\/span>);<\/pre>\n
    ULONG               ulParam = 0x12345678<\/span>;<\/pre>\n
    WCHAR               wzParam[] = L\"DriverEntry.com.br\"<\/span>;<\/pre>\n
 <\/pre>\n
    __try<\/span><\/pre>\n
    {<\/pre>\n
        __try<\/span><\/pre>\n
        {<\/pre>\n
            \/\/-f--> No secret here. It's all quick and easy.<\/span><\/pre>\n
            InitializeObjectAttributes(&ObjAttributes,<\/pre>\n
                                       pusRegistryPath,<\/pre>\n
                                       OBJ_CASE_INSENSITIVE,<\/pre>\n
                                       NULL,<\/pre>\n
                                       NULL);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Create the new key and request<\/span><\/pre>\n
            \/\/      access to set values inside it.<\/span><\/pre>\n
            nts = ZwCreateKey(&hKey,<\/pre>\n
                              KEY_SET_VALUE,<\/pre>\n
                              &ObjAttributes,<\/pre>\n
                              0<\/span>,<\/pre>\n
                              NULL,<\/pre>\n
                              REG_OPTION_NON_VOLATILE,<\/pre>\n
                              NULL);<\/pre>\n
            if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
                ExRaiseStatus(nts);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Set the numeric value<\/span><\/pre>\n
            nts = ZwSetValueKey(hKey,<\/pre>\n
                                &usDWordParam,<\/pre>\n
                                0<\/span>,<\/pre>\n
                                REG_DWORD,<\/pre>\n
                                &ulParam,<\/pre>\n
                                sizeof<\/span>(ulParam));<\/pre>\n
            if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
                ExRaiseStatus(nts);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Set the string value<\/span><\/pre>\n
            nts = ZwSetValueKey(hKey,<\/pre>\n
                                &usStringParam,<\/pre>\n
                                0<\/span>,<\/pre>\n
                                REG_SZ,<\/pre>\n
                                &wzParam,<\/pre>\n
                                sizeof<\/span>(wzParam));<\/pre>\n
            if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
                ExRaiseStatus(nts);<\/pre>\n
        }<\/pre>\n
        __finally<\/span><\/pre>\n
        {<\/pre>\n
            \/\/-f--> Close the handle of the newly created key<\/span><\/pre>\n
            if<\/span> (hKey)<\/pre>\n
                ZwClose(hKey);<\/pre>\n
        }<\/pre>\n
    }<\/pre>\n
    __except<\/span>(EXCEPTION_EXECUTE_HANDLER)<\/pre>\n
    {<\/pre>\n
        \/\/-f--> Oops!<\/span><\/pre>\n
        nts = GetExceptionCode();<\/pre>\n
        ASSERT(FALSE);<\/pre>\n
    }<\/pre>\n
    return<\/span> nts;<\/pre>\n
}<\/pre>\n<\/div>\n
Finally the funny part of this story. I believe that most of the fun is concentrated in the ZwQueryValueKey<\/a> routine, which performs the reading of values \u200b\u200bin the registry.<\/p>\n
\n
NTSTATUS <\/pre>\n
  ZwQueryValueKey(<\/pre>\n
    IN HANDLE  KeyHandle,<\/pre>\n
    IN PUNICODE_STRING  ValueName,<\/pre>\n
    IN KEY_VALUE_INFORMATION_CLASS  KeyValueInformationClass,<\/pre>\n
    OUT PVOID  KeyValueInformation,<\/pre>\n
    IN ULONG  Length,<\/pre>\n
    OUT PULONG  ResultLength<\/pre>\n
    );<\/pre>\n<\/div>\n
The point that differs from the API used in User Mode<\/em> to do the same task is the third parameter KEY_VALUE_INFORMATION_CLASS<\/a>. An enum that tells what information we would get on a particular value in the registry. One of them asks only the name while another asks all the information and the latest all the partial information referring to the value.<\/p>\n
\n
typedef<\/span> enum<\/span> _KEY_VALUE_INFORMATION_CLASS {<\/pre>\n
  KeyValueBasicInformation,<\/pre>\n
  KeyValueFullInformation,<\/pre>\n
  KeyValuePartialInformation<\/pre>\n
} KEY_VALUE_INFORMATION_CLASS;<\/pre>\n<\/div>\n
For each enum value, a different structure is returned. Always in a single block, the structure can bring a variety of information using offsets <\/em>telling where to find the data within that single memory allocation.<\/p>\n
In the example, I used the KeyValuePartialInformation<\/a>, which I imagine to be the most used. Once again my tip is to read the comments at the excerpt below.<\/p>\n
\n
\/****<\/span><\/pre>\n
***     LoadParams<\/span><\/pre>\n
**<\/span><\/pre>\n
**      This routine loads the global variables with the<\/span><\/pre>\n
**      values retrieved from the registry.<\/span><\/pre>\n
*\/<\/span><\/pre>\n
NTSTATUS<\/pre>\n
LoadParams(__in PUNICODE_STRING pusRegistryPath)<\/pre>\n
{<\/pre>\n
    HANDLE              hKey = NULL;<\/pre>\n
    NTSTATUS            nts = STATUS_SUCCESS;<\/pre>\n
    OBJECT_ATTRIBUTES   ObjAttributes;<\/pre>\n
    UNICODE_STRING      usStringParam = RTL_CONSTANT_STRING(L\"String\"<\/span>);<\/pre>\n
    UNICODE_STRING      usDWordParam = RTL_CONSTANT_STRING(L\"DoubleWord\"<\/span>);<\/pre>\n
    ULONG               ulBytes = 0<\/span>;<\/pre>\n
    PWCHAR              pwzBuffer = NULL;<\/pre>\n
    PKEY_VALUE_PARTIAL_INFORMATION  pValueInfo = NULL;<\/pre>\n
 <\/pre>\n
    __try<\/span><\/pre>\n
    {<\/pre>\n
        __try<\/span><\/pre>\n
        {<\/pre>\n
            \/\/-f--> Build the ObjectAttribute<\/span><\/pre>\n
            InitializeObjectAttributes(&ObjAttributes,<\/pre>\n
                                       pusRegistryPath,<\/pre>\n
                                       OBJ_CASE_INSENSITIVE,<\/pre>\n
                                       NULL,<\/pre>\n
                                       NULL);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Try to open the registry key<\/span><\/pre>\n
            nts = ZwOpenKey(&hKey,<\/pre>\n
                            GENERIC_READ,<\/pre>\n
                            &ObjAttributes);<\/pre>\n
            if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
                ExRaiseStatus(nts);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Since the value has a fixed size, we can determine<\/span><\/pre>\n
            \/\/      the buffer size needed to read the value from the<\/span><\/pre>\n
            \/\/      registry.<\/span><\/pre>\n
            ulBytes = sizeof<\/span>(KEY_VALUE_PARTIAL_INFORMATION) + <\/pre>\n
                      sizeof<\/span>(ULONG) - sizeof<\/span>(UCHAR);<\/pre>\n
 <\/pre>\n
            \/\/-F--> Allocate the buffer for the read.<\/span><\/pre>\n
            pValueInfo = (PKEY_VALUE_PARTIAL_INFORMATION)<\/pre>\n
                ExAllocatePoolWithTag(PagedPool,<\/pre>\n
                                      ulBytes,<\/pre>\n
                                      _KRN_REG_TAG);<\/pre>\n
            if<\/span> (!pValueInfo)<\/pre>\n
                ExRaiseStatus(STATUS_INSUFFICIENT_RESOURCES);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Here we do the read.<\/span><\/pre>\n
            nts = ZwQueryValueKey(hKey,<\/pre>\n
                                  &usDWordParam,<\/pre>\n
                                  KeyValuePartialInformation,<\/pre>\n
                                  pValueInfo,<\/pre>\n
                                  ulBytes,<\/pre>\n
                                  &ulBytes);<\/pre>\n
            if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
                ExRaiseStatus(nts);<\/pre>\n
 <\/pre>\n
            \/\/-f--> We make sure we read a DWORD<\/span><\/pre>\n
            ASSERT(pValueInfo->Type == REG_DWORD);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Here we load our global variable<\/span><\/pre>\n
            \/\/      with the value read from the registry.<\/span><\/pre>\n
            g_ulParam = *(PULONG)pValueInfo->Data;<\/pre>\n
 <\/pre>\n
            \/\/-f--> Free the read buffer and zero the pointer.<\/span><\/pre>\n
            \/\/      You may decide to allocate the read buffer<\/span><\/pre>\n
            \/\/      based on the largest value you need to read,<\/span><\/pre>\n
            \/\/      and thus use the same buffer to read all<\/span><\/pre>\n
            \/\/      the smaller values. Here, once again, I am<\/span><\/pre>\n
            \/\/      redoing everything to demonstrate.<\/span><\/pre>\n
            ExFreePool(pValueInfo);<\/pre>\n
            pValueInfo = NULL;<\/pre>\n
 <\/pre>\n
            \/\/-f--> Since the string can have any size in the registry,<\/span><\/pre>\n
            \/\/      we will offer zero bytes of read buffer so that<\/span><\/pre>\n
            \/\/      the API tells us how much it needs for the whole buffer.<\/span><\/pre>\n
            nts = ZwQueryValueKey(hKey,<\/pre>\n
                                  &usStringParam,<\/pre>\n
                                  KeyValuePartialInformation,<\/pre>\n
                                  NULL,<\/pre>\n
                                  0<\/span>,<\/pre>\n
                                  &ulBytes);<\/pre>\n
 <\/pre>\n
            \/\/-f--> We must get one of these errors.<\/span><\/pre>\n
            ASSERT(nts == STATUS_BUFFER_OVERFLOW ||<\/pre>\n
                   nts == STATUS_BUFFER_TOO_SMALL);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Here we allocate a buffer of the size<\/span><\/pre>\n
            \/\/      requested by the API.<\/span><\/pre>\n
            pValueInfo = (PKEY_VALUE_PARTIAL_INFORMATION)<\/pre>\n
                ExAllocatePoolWithTag(PagedPool,<\/pre>\n
                                      ulBytes,<\/pre>\n
                                      _KRN_REG_TAG);<\/pre>\n
            if<\/span> (!pValueInfo)<\/pre>\n
                ExRaiseStatus(STATUS_INSUFFICIENT_RESOURCES);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Now we will do the read again, but this time<\/span><\/pre>\n
            \/\/      offering a buffer of a decent size.<\/span><\/pre>\n
            nts = ZwQueryValueKey(hKey,<\/pre>\n
                                  &usStringParam,<\/pre>\n
                                  KeyValuePartialInformation,<\/pre>\n
                                  pValueInfo,<\/pre>\n
                                  ulBytes,<\/pre>\n
                                  &ulBytes);<\/pre>\n
            if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
                ExRaiseStatus(nts);<\/pre>\n
 <\/pre>\n
            \/\/-f--> We must have read a string.<\/span><\/pre>\n
            ASSERT(pValueInfo->Type == REG_SZ);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Now let's allocate the buffer that will be used to hold<\/span><\/pre>\n
            \/\/     the string read from the registry. So we can discard the buffer<\/span><\/pre>\n
            \/\/     used by the read. The DataLength field brings the size of the<\/span><\/pre>\n
            \/\/     unicode string with the zero terminator. Note that this structure<\/span><\/pre>\n
            \/\/     does not bring a UNICODE_STRING, but a WCHAR array.<\/span><\/pre>\n
            pwzBuffer = (PWCHAR)ExAllocatePoolWithTag(PagedPool,<\/pre>\n
                                                      pValueInfo->DataLength,<\/pre>\n
                                                      _KRN_REG_TAG);<\/pre>\n
            if<\/span> (!pwzBuffer)<\/pre>\n
                ExRaiseStatus(STATUS_INSUFFICIENT_RESOURCES);<\/pre>\n
 <\/pre>\n
            \/\/-f--> After some time programming, you get quick with some<\/span><\/pre>\n
            \/\/      things. I bet someone, and that includes myself, will one day<\/span><\/pre>\n
            \/\/      Copy-Paste this function to use somewhere else. Here,<\/span><\/pre>\n
            \/\/      anticipating that the registry read may happen several times,<\/span><\/pre>\n
            \/\/      and so, if there is an allocation from a previous read, we will<\/span><\/pre>\n
            \/\/      deallocate it.<\/span><\/pre>\n
            if<\/span> (g_usParam.Length)<\/pre>\n
                RtlFreeUnicodeString(&g_usParam);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Initialize the global string with the buffer we just allocated.<\/span><\/pre>\n
            \/\/      Even though we set a buffer for this UNICODE_STRING, it is<\/span><\/pre>\n
            \/\/      still empty (Length=0)<\/span><\/pre>\n
            RtlInitEmptyUnicodeString(&g_usParam,<\/pre>\n
                                      pwzBuffer,<\/pre>\n
                                      (USHORT)pValueInfo->DataLength);<\/pre>\n
 <\/pre>\n
            \/\/-f--> Here we append the WCSTR (zero-terminated WCHAR array), read<\/span><\/pre>\n
            \/\/      from the registry into our empty buffer. This is similar to a copy,<\/span><\/pre>\n
            \/\/      but with an incredible advantage: not using wcslen().<\/span><\/pre>\n
            \/\/      Never mind, it's purist paranoia. So we leave it to the API to<\/span><\/pre>\n
            \/\/      determine the Length and MaximumLength of the UNICODE_STRING. Remember<\/span><\/pre>\n
            \/\/      that the zero terminator is not counted as part of the UNICODE_STRING.<\/span><\/pre>\n
            RtlAppendUnicodeToString(&g_usParam,<\/pre>\n
                                     (PCWSTR)pValueInfo->Data);<\/pre>\n
        }<\/pre>\n
        __finally<\/span><\/pre>\n
        {<\/pre>\n
            \/\/-f--> General cleanup<\/span><\/pre>\n
            if<\/span> (pValueInfo)<\/pre>\n
                ExFreePool(pValueInfo);<\/pre>\n
 <\/pre>\n
            if<\/span> (hKey)<\/pre>\n
                ZwClose(hKey);<\/pre>\n
        }<\/pre>\n
    }<\/pre>\n
    __except<\/span>(EXCEPTION_EXECUTE_HANDLER)<\/pre>\n
    {<\/pre>\n
        \/\/-f--> Oops! I did it again.<\/span><\/pre>\n
        nts = GetExceptionCode();<\/pre>\n
        ASSERT(FALSE);<\/pre>\n
    }<\/pre>\n
 <\/pre>\n
    return<\/span> nts;<\/pre>\n
}<\/pre>\n<\/div>\n
Phew! What a big code! In this first part of the issue I have used the APIs that most closely resemble the User Mode <\/em>ones. In the next post I will bring a different way of doing the same thing we did here.<\/p>\n
I hope I could help.<\/p>\n
CYA…<\/p>\n
KernelReg.zip<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
In the last post, in response to a question from a reader, I mentioned a little about how to create and use new IOCTLs. After all, the motto of this blog is “To serve well to serve forever.” Questions from readers are a great source of suggestions for new posts. I believe that like it […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pagelayer_contact_templates":[],"_pagelayer_content":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-288","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts\/288","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/comments?post=288"}],"version-history":[{"count":6,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts\/288\/revisions"}],"predecessor-version":[{"id":294,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts\/288\/revisions\/294"}],"wp:attachment":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/media?parent=288"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/categories?post=288"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/tags?post=288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}