troubleshooting Question

Help query values from the registry using zwqueryvaluekey

Avatar of msgolez
msgolez asked on
Microsoft Legacy OSCSystem Programming
7 Comments1 Solution3182 ViewsLast Modified:
Hello All

I'm trying to querry a value from the registry using zwqueryvaluekey from a kernel driver. In particular i'm trying to query the start value of driver. My question is, once i get the structure the contains the information, how do i compare the value of the Start key with values such as 0, 1, 2, 3 or 4.

Here is my code:

#include <ntddk.h>

VOID ReadUnload(PDRIVER_OBJECT  pDriverObject);

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING RegistryPath)
{
UNICODE_STRING uPath, uName, uResult;
ANSI_STRING aResult;
HANDLE hFolder = NULL;
OBJECT_ATTRIBUTES objAttribs;
NTSTATUS status = STATUS_SUCCESS;
ULONG dataLength = 0x80;
ULONG structLength = sizeof(KEY_VALUE_BASIC_INFORMATION) + dataLength + sizeof(UNICODE_NULL);
PKEY_VALUE_BASIC_INFORMATION pBasicValue = NULL;
PKEY_VALUE_PARTIAL_INFORMATION pPartialValue = NULL;
PKEY_VALUE_FULL_INFORMATION pFullValue = NULL;
pBasicValue = (PKEY_VALUE_BASIC_INFORMATION) ExAllocatePool(PagedPool, structLength);
pPartialValue = (PKEY_VALUE_PARTIAL_INFORMATION) ExAllocatePool(PagedPool, structLength);
pFullValue = (PKEY_VALUE_FULL_INFORMATION) ExAllocatePool(PagedPool, structLength);

RtlInitUnicodeString(&uPath, L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\ultra" );
RtlInitUnicodeString(&uName, L"Type");

InitializeObjectAttributes(&objAttribs, &uPath, OBJ_CASE_INSENSITIVE, NULL, NULL);

status = ZwOpenKey(&hFolder, KEY_READ, &objAttribs);

if(status != STATUS_SUCCESS)
{
      DbgPrint("Couldn't open key. Ending function.\n");
      return status;
}

//Try to read the value, using the PKEY_VALUE_PARTIAL_INFORMATION.
memset(pPartialValue, 0, structLength);
status = ZwQueryValueKey(hFolder, &uName, KeyValuePartialInformation, pPartialValue, structLength, &dataLength);

switch(status)
{
case STATUS_INVALID_HANDLE: //Always end up here.
      DbgPrint("ZwQueryValueKey(Partial) says the handle is bogus.\n");
      break;
case STATUS_BUFFER_OVERFLOW:
      DbgPrint("Buffer overflow error");
      //Since it failed because of insufficient storage, allocate enough.
      ExFreePool(pPartialValue);
      structLength = sizeof(KEY_VALUE_PARTIAL_INFORMATION) + dataLength + sizeof(UNICODE_NULL);
      pPartialValue = (PKEY_VALUE_PARTIAL_INFORMATION) ExAllocatePool(PagedPool, structLength);
      status = ZwQueryValueKey(hFolder, &uName, KeyValuePartialInformation, pPartialValue, structLength, &dataLength);

      if(status != STATUS_SUCCESS)
      {
            //Just give it up.  Shouldn't get here, either.
            DbgPrint("ZwQueryValueKey(Partial): Still didn't get it."\
                        " Status: %X\n", status);
            break;
      }
      //Fall Through
case STATUS_SUCCESS:
      DbgPrint("Success");
//      my_data =  (PCANSI_STRING)pPartialValue->Data;
//  RtlAnsiStringToUnicodeString( &uResult, my_data, TRUE);
//      RtlInitUnicodeString(&uResult, pPartialValue->Data);
//      DbgPrint(pPartialValue->Data[7]);
      DbgPrint(pPartialValue->Data);
}
ExFreePool(pPartialValue);

Basically when i get pPartialValue->Data, how do i compare it to 0,1,2,3 or 4?

Thanks
ASKER CERTIFIED SOLUTION
Axter
Senior Software Engineer

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Log in to continue reading
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform for $9.99/mo
View membership options
Unlock 1 Answer and 7 Comments.
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
The Value of Experts Exchange in My Daily IT Life

Experts Exchange (EE) has become my company's go-to resource to get answers. I've used EE to make decisions, solve problems and even save customers. OutagesIO has been a challenging project and... Keep reading >>

Mike

Owner of Outages.IO
Phoenix, Arizona, United States
Member Since 2016
Join a full scale community that combines the best parts of other tools into one platform.
Unlock 1 Answer and 7 Comments.
View membership options
“All of life is about relationships, and EE has made a virtual community a real community. It lifts everyone's boat.”
William Peck

Member since 2004