内核操作注册表例子

void GetComputerName()
{
NTSTATUS status;
    HANDLE hRegKey;
UNICODE_STRING RegPath;
    OBJECT_ATTRIBUTES attributes;
    PKEY_VALUE_PARTIAL_INFORMATION pValInfo;
    
RtlInitUnicodeString(&RegPath, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\ComputerName" );
    InitializeObjectAttributes(&attributes, &RegPath, OBJ_CASE_INSENSITIVE,NULL,NULL);
    status = ZwOpenKey( &hRegKey,KEY_READ,&attributes);
    if(NT_SUCCESS(status))
    {
   ULONG dataSize = 0;
   UNICODE_STRING valueName;
   
   RtlInitUnicodeString(&valueName, L"ComputerName");
   status = ZwQueryValueKey(hRegKey,&valueName,KeyValuePartialInformation,NULL,0,&dataSize);
if(status==STATUS_BUFFER_TOO_SMALL)
{
   pValInfo = ExAllocatePool( NonPagedPool, dataSize );
   if(pValInfo!=NULL)
   {
   status = ZwQueryValueKey(hRegKey,&valueName,KeyValuePartialInformation,pValInfo,dataSize,&dataSize);
if(NT_SUCCESS(status) && pValInfo->Type==REG_SZ)
{
ANSI_STRING sComputerName;
UNICODE_STRING szComputerName;
RtlInitUnicodeString(&szComputerName, (WCHAR*)pValInfo->Data);
if(STATUS_SUCCESS==RtlUnicodeStringToAnsiString(&sComputerName,&szComputerName,TRUE))
{
RtlStringCchCopyA(gHostName,16,sComputerName.Buffer);
RtlFreeAnsiString(&sComputerName);
}
}
ExFreePool( pValInfo );
   }
}
        ZwClose(hRegKey);
    }
}

你可能感兴趣的:(注册表)