{"id":318,"date":"2008-06-23T16:38:29","date_gmt":"2008-06-23T16:38:29","guid":{"rendered":"https:\/\/driverentry.com.br\/en\/2008\/06\/23\/using-the-registry-part-2\/"},"modified":"2026-07-29T14:41:25","modified_gmt":"2026-07-29T14:41:25","slug":"using-the-registry-part-2","status":"publish","type":"post","link":"https:\/\/driverentry.com.br\/en\/2008\/06\/23\/using-the-registry-part-2\/","title":{"rendered":"Using the Registry (Part 2)"},"content":{"rendered":"
\"\"<\/a><\/div>\n

Well, as I was saying in the first part of this post<\/a>. That is a lot of code. This whole thing looks like a lot of work, doesn’t it? Building a UNICODE_STRING<\/a> for the path of the key you want to access, building an OBJECT_ATTRIBUTES<\/a> with it, opening a handle, determining the size of the values to be read, allocating a large enough buffer, reading the value you want, freeing any temporary buffer used in the process, and finally closing the handle to the registry key. You can check how much code we used in our example from the previous post<\/a> to read two values from the registry. Today we will look at a group of registry-manipulation routines that make this process easier.<\/p>\n

RTL Registry Routines<\/h3>\n

There are only five routines that make up this little group. In the reference<\/a> you will find a description of each one. A common trait of this group of routines is that we do not have to use handles for the keys. The handles are opened and closed for each operation. Another common trait is that you do not need to compose the full name of the key where the values you want to read or write are. These routines work with a key-name scheme relative to some pre-defined place. Confusing? Let us take a look at one of the routines so we have a more practical example. Trying to follow the same idea as the example given in the previous post, we first need to check whether the key where the values are stored actually exists. There is a little function<\/a> just for that.<\/p>\n

\n
NTSTATUS<\/pre>\n
  RtlCheckRegistryKey(<\/pre>\n
    IN ULONG  RelativeTo,<\/pre>\n
    IN PWSTR  Path<\/pre>\n
    );<\/pre>\n<\/div>\n
Note that the first parameter of this routine is a constant that indicates what reference will be applied to the second parameter. Look at the table below, which was taken from the reference.<\/p>\n
\"\"<\/div>\n
An example would be the following: If we use RTL_REGISTRY_ABSOLUTE as the first parameter, the second must be the full path of the registry key. After all, we have to pass the key’s absolute path. On the other hand, if we use RTL_REGISTRY_SERVICES, the second parameter should be only the path complement relative to the Services<\/em> key. That was the option I used in this post’s example. See how our routine for creating the parameters in the registry turned out.<\/p>\n
\n
\/****<\/span><\/pre>\n
***     CreateParams<\/span><\/pre>\n
**<\/span><\/pre>\n
**      This routine is called when the key that contains<\/span><\/pre>\n
**      the parameters is not detected. It creates the key and the parameters<\/span><\/pre>\n
**      with pre-defined values.<\/span><\/pre>\n
*\/<\/span><\/pre>\n
NTSTATUS<\/pre>\n
CreateParams(VOID)<\/pre>\n
{<\/pre>\n
    NTSTATUS        nts = STATUS_SUCCESS;<\/pre>\n
    WCHAR           wzParam[] = L\"DriverEntry.com.br\"<\/span>;<\/pre>\n
    ULONG           ulParam = 0x12345678<\/span>;<\/pre>\n
 <\/pre>\n
    __try<\/span><\/pre>\n
    {<\/pre>\n
        \/\/-f--> Create the key where the parameters will be stored.<\/span><\/pre>\n
        \/\/      Just like that.<\/span><\/pre>\n
        nts = RtlCreateRegistryKey(RTL_REGISTRY_SERVICES,<\/pre>\n
                                   L\"KernelReg2\\\\Parameters\"<\/span>);<\/pre>\n
        if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
            ExRaiseStatus(nts);<\/pre>\n
 <\/pre>\n
        \/\/-f--> Here we write the numeric value<\/span><\/pre>\n
        nts = RtlWriteRegistryValue(RTL_REGISTRY_SERVICES,<\/pre>\n
                                    L\"KernelReg2\\\\Parameters\"<\/span>,<\/pre>\n
                                    L\"DoubleWord\"<\/span>,<\/pre>\n
                                    REG_DWORD,<\/pre>\n
                                    &ulParam,<\/pre>\n
                                    sizeof<\/span>(ulParam));<\/pre>\n
        if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
            ExRaiseStatus(nts);<\/pre>\n
 <\/pre>\n
        \/\/-f--> And here the String. Note that it was not necessary<\/span><\/pre>\n
        \/\/      to create a UNICODE_STRING for this.<\/span><\/pre>\n
        nts = RtlWriteRegistryValue(RTL_REGISTRY_SERVICES,<\/pre>\n
                                    L\"KernelReg2\\\\Parameters\"<\/span>,<\/pre>\n
                                    L\"String\"<\/span>,<\/pre>\n
                                    REG_SZ,<\/pre>\n
                                    wzParam,<\/pre>\n
                                    sizeof<\/span>(wzParam));<\/pre>\n
    }<\/pre>\n
    __except<\/span>(EXCEPTION_EXECUTE_HANDLER)<\/pre>\n
    {<\/pre>\n
        \/\/-f--> Oops!<\/span><\/pre>\n
        nts = GetExceptionCode();<\/pre>\n
        ASSERT(FALSE);<\/pre>\n
    }<\/pre>\n
 <\/pre>\n
    return<\/span> nts;<\/pre>\n
}<\/pre>\n<\/div>\n
Once again, the code shown here is available for download at the end of this post.<\/p>\n
When easy gets complicated<\/h3>\n
From what we have seen so far, this group of routines has already made our life a little easier. But it is in the read routine that we can see the code savings really happen. The cost of that comes down to understanding how the read routine<\/a> works.<\/p>\n
\n
NTSTATUS<\/pre>\n
  RtlQueryRegistryValues(<\/pre>\n
    IN ULONG  RelativeTo,<\/pre>\n
    IN PCWSTR  Path,<\/pre>\n
    IN PRTL_QUERY_REGISTRY_TABLE  QueryTable,<\/pre>\n
    IN PVOID  Context,<\/pre>\n
    IN PVOID  Environment  OPTIONAL<\/pre>\n
    );<\/pre>\n<\/div>\n
Looking at it like this, it does not even seem like it bites, but if you take a look at the reference, you will see it can be quite flexible. Flexibility is sometimes translated as “Hard to get the right way to use it”<\/em>. The first two parameters are the ones already known from before. Things start to change with the third parameter, which is a table that contains the details of the values to be read from the registry. I will not go into the details of each parameter of this routine in this post. I will just write the code equivalent to the previous post’s example.<\/p>\n
\n
\/****<\/span><\/pre>\n
***     LoadParams<\/span><\/pre>\n
**<\/span><\/pre>\n
**      This routine loads the global variables with the<\/span><\/pre>\n
**      values retrieved from the registry.<\/span><\/pre>\n
*\/<\/span><\/pre>\n
NTSTATUS<\/pre>\n
LoadParams(VOID)<\/pre>\n
{<\/pre>\n
    NTSTATUS                    nts = STATUS_SUCCESS;<\/pre>\n
    RTL_QUERY_REGISTRY_TABLE    QueryTable[] =<\/pre>\n
    {<\/pre>\n
        { NULL, RTL_QUERY_REGISTRY_DIRECT | RTL_QUERY_REGISTRY_REQUIRED,<\/pre>\n
          L\"DoubleWord\"<\/span>, &g_ulParam, REG_NONE, NULL, 0<\/span> },<\/pre>\n
        { NULL, RTL_QUERY_REGISTRY_DIRECT | RTL_QUERY_REGISTRY_REQUIRED,<\/pre>\n
          L\"String\"<\/span>, &g_usParam, REG_NONE, NULL, 0<\/span> },<\/pre>\n
        { NULL, 0<\/span>, NULL, NULL, REG_NONE, 0<\/span>, NULL }<\/pre>\n
    };<\/pre>\n
 <\/pre>\n
    __try<\/span><\/pre>\n
    {<\/pre>\n
        \/\/-f--> If this routine is called more than once, let's free<\/span><\/pre>\n
        \/\/      the buffer of this parameter.<\/span><\/pre>\n
        if<\/span> (g_usParam.Buffer)<\/pre>\n
            RtlFreeUnicodeString(&g_usParam);<\/pre>\n
 <\/pre>\n
        \/\/-f--> Here all the table's values are read<\/span><\/pre>\n
        nts = RtlQueryRegistryValues(RTL_REGISTRY_SERVICES,<\/pre>\n
                                     L\"KernelReg2\\\\Parameters\"<\/span>,<\/pre>\n
                                     QueryTable,<\/pre>\n
                                     NULL,<\/pre>\n
                                     NULL);<\/pre>\n
        if<\/span> (!NT_SUCCESS(nts))<\/pre>\n
            ExRaiseStatus(nts);<\/pre>\n
    }<\/pre>\n
    __except<\/span>(EXCEPTION_EXECUTE_HANDLER)<\/pre>\n
    {<\/pre>\n
        \/\/-f--> Oops!<\/span><\/pre>\n
        nts = GetExceptionCode();<\/pre>\n
        ASSERT(FALSE);<\/pre>\n
    }<\/pre>\n
 <\/pre>\n
    return<\/span> nts;<\/pre>\n
}<\/pre>\n<\/div>\n
No, nothing is missing. That is really all there is. Let us take a closer look at what we did here. The table we filled in has the data for the reads to be performed and is defined as shown below.<\/p>\n
\n
typedef<\/span> struct<\/span> _RTL_QUERY_REGISTRY_TABLE {<\/pre>\n
    PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine;<\/pre>\n
    ULONG Flags;<\/pre>\n
    PWSTR Name;<\/pre>\n
    PVOID EntryContext;<\/pre>\n
    ULONG DefaultType;<\/pre>\n
    PVOID DefaultData;<\/pre>\n
    ULONG DefaultLength;<\/pre>\n
} RTL_QUERY_REGISTRY_TABLE, *PRTL_QUERY_REGISTRY_TABLE;<\/pre>\n<\/div>\n
Looking at each of its members we have:<\/p>\n