ZwOpenKey Problem-Please Help

[Shalini]

My ZwOpenKey does not succeeed at all.. It succeeds only when the parameter
passes is
\\Registry\\Machine\\System and its subtreee

if its \\Registry\\machine\\software it does not succeeed at ll..
Actually i want to obtain one registry key called SystemRoot from
HKLM\SOFTWARE\\MICROSOFT\\WINDOWS NT \\CURRENTVERSION

TO have that i open the above key as
\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion

But it gives an error saying ERROR_FILE_NOT_FOUND (Win32 Error code=2)

Does it mean that Registry keys under SYSTEM can only be accessed
I am writing the code in DriverEntry function..

Code snippet:

OBJECT_ATTRIBUTES oa;
RtlInitUnicodeString(&RegistryPath1,
L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion");
InitializeObjectAttributes(&oa,RegistryPath1,OBJ_KERNEL_HANDLE|OBJ_CASE_INSE
NSITIVE,NULL,NULL);
HANDLE hKey=NULL;
NTSTATUS rc=ZwOpenKey(&hKey,KEY_READ,&oa);
if(NT_SUCCESS(rc))
{
ZwClose(hKey);
}

Expecting ur reply.
Regards,
Shal

 

[Brian Catlin]

My ZwOpenKey does not succeeed at all.. It succeeds only when the parameter
passes is
\\Registry\\Machine\\System and its subtreee

if its \\Registry\\machine\\software it does not succeeed at ll..
Actually i want to obtain one registry key called SystemRoot from
HKLM\SOFTWARE\\MICROSOFT\\WINDOWS NT \\CURRENTVERSION

TO have that i open the above key as
\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion

But it gives an error saying ERROR_FILE_NOT_FOUND (Win32 Error code=2)

Does it mean that Registry keys under SYSTEM can only be accessed
I am writing the code in DriverEntry function..

Code snippet:

OBJECT_ATTRIBUTES oa;
RtlInitUnicodeString(&RegistryPath1,
L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion");
InitializeObjectAttributes(&oa,RegistryPath1,OBJ_KERNEL_HANDLE|OBJ_CASE_INSE

^
|
----------------------------------
You need to pass the address of the registry path string descriptor. You forgot
to put an '&' before RegistryPath1 above

-Brian

Brian Catlin, Sannas Consulting 310-944-9492
Windows Network, Video, WDM Device Driver Training & Consulting
See WWW.AZIUS.COM.bad for courses and scheduling
REMOVE .BAD FROM EMAIL AND WEB ADDRESS

 

[Shalini]

Thanks Brian for ur response. But i get the same thing when i put that.
This is my exact code snippet;


OBJECT_ATTRIBUTES oa;
UNICODE_STRING RegistryPath1;
RtlInitUnicodeString(&RegistryPath1,L"\\Registry\\Machine\\SOFTWARE\\Microso
ft\\Windows NT\\CurrentVersion");

InitializeObjectAttributes(&oa,&RegistryPath1,OBJ_KERNEL_HANDLE|OBJ_CASE_INS
ENSITIVE,NULL,NULL);
HANDLE hKey=NULL;
NTSTATUS rc=ZwOpenKey(&hKey,KEY_READ,&oa);

rc is -1073741772

Any updates???
Waiting for reply..

 

[Pavel A.]

Does it mean that Registry keys under SYSTEM can only be accessed
I am writing the code in DriverEntry function..

Does your driver start early at boot time?
During certain time of system startup, only System branch can be accessed.

--PA

 

[Shalini]

yes i have written it in the DriverEntry function
Yes it is at the boot time..

 

[Shalini]

Is there anyway i can determine the Box is windows 2000 or windows xp????
I currently do that by reading explorer.exe if its in \windows it is windows
xp or else it is windows 2000.
Is there any other professional way of doing this?

 

[Maxim S. Shatskih]

GetVersionEx in user mode.
RtlGetVersion or PsGetVersion on kernel mode.

 

[Shalini]

how can i know whether the OS is installed in c:\ or d:\ or any other...???
I get the os version using RtlGetVersion.....

 

[Maxim S. Shatskih]

In kernel mode code, you do not need this in most cases. Just use
\SystemRoot\system32\... path to access the files in the system folder.

 

[Shalini]

Oh ok..
Can i use
RtlInitUnicodeString(&filenameunicodestring,"\\SystemRoot\\System32\\Somefil
e.txt")
ZwCreateFile()
then i create the file in c:\windows\system32 in windows xp and in
WINNT\system32 in windows 2000.??
Regards

 

[Alexander Grigoriev]

Yes.

Oh ok..
Can i use
RtlInitUnicodeString(&filenameunicodestring,"\\SystemRoot\\System32\\Somefil
e.txt")
ZwCreateFile()
then i create the file in c:\windows\system32 in windows xp and in
WINNT\system32 in windows 2000.??
Regards

 

[Shalini]

Thanks Alexander and Maxim.

Yes.


RtlInitUnicodeString(&filenameunicodestring,"\\SystemRoot\\System32\\Somefil it

 

[Shalini]

It works like a charm ..
thanks once again

Thanks Alexander and Maxim.



RtlInitUnicodeString(&filenameunicodestring,"\\SystemRoot\\System32\\Somefil can