expanding reg values

[arman2]

Hi,

I want to know how someone can expand a reg value which is in type of REG_EXPAND_SZ in kernel-mode.

I have tried RtlQueryRegistryValues, but when it's trying to get a REG_EXPAND_SZ cause a BSOD(0x0000007e).

any idea?

thanks

[And-or]

Are you sure you have set all the parameters right? Take a look here and check your parameters:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/devnotes/winprog/rtlqueryregistryvalues.asp

Also notice you can only call this routine at IRQL=PASSIVE_LEVEL.

And-or

[arman2]

Are you sure you have set all the parameters right? Take a look here and check your parameters:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/devnotes/winprog/rtlqueryregistryvalues.asp

Also notice you can only call this routine at IRQL=PASSIVE_LEVEL.

And-or

thanks for quick reply!

here is my code:



int ReadRegKeyString( PWSTR strKey, PWSTR strValueName, PWSTR OutBuffer, ULONG BufferSize)
{
RTL_QUERY_REGISTRY_TABLE aParamTable[2];
UNICODE_STRING theStringP;
NTSTATUS rc;

if (strKey == NULL) return FALSE;
if (strValueName == NULL) return FALSE;

theStringP.Buffer = OutBuffer;
theStringP.Length = 0;
theStringP.MaximumLength = BufferSize;

RtlZeroMemory( &aParamTable[0], sizeof(aParamTable) );

aParamTable[0].Flags = RTL_QUERY_REGISTRY_DIRECT |
RTL_QUERY_REGISTRY_REQUIRED;
aParamTable[0].Name = strValueName;
aParamTable[0].EntryContext = &theStringP;

KdPrint(("Going for RtlQueryRegistryValues"));

__try
{
// because we are using required & direct, we don't need to set defaults
// IMPORTANT note, the last entry is ALL NULL, required by call to know when it's done. Don't forget!
rc = RtlQueryRegistryValues( RTL_REGISTRY_ABSOLUTE | RTL_REGISTRY_OPTIONAL,
strKey,
&aParamTable[0],
NULL,
NULL );
}
__except (EXCEPTION_EXECUTE_HANDLER) {
KdPrint(("ReadRegKeyString: exception handled"));
}
return 1;
}


and call it like this



ReadRegKeyString( RegPath, ValueName, szData, 0x800 );



I don't know whats wrong with this, because I get the correct data when used for REG_SZ types.

I'm really don't know what to do!!! :(