From 4c4659d2aa45e4560d8a99db293bb246a6defba0 Mon Sep 17 00:00:00 2001
From: wj32 <wj32@21ef857c-d57f-4fe0-8362-d861dc6d29cd>
Date: Mon, 12 Jul 2010 00:59:01 +0000
Subject: [PATCH] added RTL registry routines

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@3344 21ef857c-d57f-4fe0-8362-d861dc6d29cd
---
 2.x/trunk/phlib/hndlinfo.c      |  8 +--
 2.x/trunk/phlib/include/ntrtl.h | 96 +++++++++++++++++++++++++++++++++
 2.x/trunk/phlib/native.c        |  4 +-
 3 files changed, 102 insertions(+), 6 deletions(-)

diff --git a/2.x/trunk/phlib/hndlinfo.c b/2.x/trunk/phlib/hndlinfo.c
index 815af4eba..ae10f9820 100644
--- a/2.x/trunk/phlib/hndlinfo.c
+++ b/2.x/trunk/phlib/hndlinfo.c
@@ -94,7 +94,7 @@ VOID PhHandleInfoInitialization()
 
         if (stringSid)
         {
-            HkcuPrefix = PhConcatStrings2(L"\\REGISTRY\\USER\\", stringSid->Buffer);
+            HkcuPrefix = PhConcatStrings2(L"\\Registry\\User\\", stringSid->Buffer);
             HkcucrPrefix = PhConcatStrings2(HkcuPrefix->Buffer, L"_Classes");
         }
         else
@@ -355,11 +355,11 @@ PPH_STRING PhFormatNativeKeyName(
     __in PPH_STRING Name
     )
 {
-#define HKLM_PREFIX L"\\REGISTRY\\MACHINE"
+#define HKLM_PREFIX L"\\Registry\\Machine"
 #define HKLM_PREFIX_LENGTH 17
-#define HKCR_PREFIX L"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES"
+#define HKCR_PREFIX L"\\Registry\\Machine\\Software\\Classes"
 #define HKCR_PREFIX_LENGTH 34
-#define HKU_PREFIX L"\\REGISTRY\\USER"
+#define HKU_PREFIX L"\\Registry\\User"
 #define HKU_PREFIX_LENGTH 14
 
     PPH_STRING newName;
diff --git a/2.x/trunk/phlib/include/ntrtl.h b/2.x/trunk/phlib/include/ntrtl.h
index 35430236d..1e7d6294f 100644
--- a/2.x/trunk/phlib/include/ntrtl.h
+++ b/2.x/trunk/phlib/include/ntrtl.h
@@ -4017,6 +4017,102 @@ RtlDeleteTimerQueueEx(
     __in HANDLE Event
     );
 
+// Registry access
+
+// begin_wdm
+
+#define RTL_REGISTRY_ABSOLUTE 0
+#define RTL_REGISTRY_SERVICES 1 // \Registry\Machine\System\CurrentControlSet\Services
+#define RTL_REGISTRY_CONTROL 2 // \Registry\Machine\System\CurrentControlSet\Control
+#define RTL_REGISTRY_WINDOWS_NT 3 // \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion
+#define RTL_REGISTRY_DEVICEMAP 4 // \Registry\Machine\Hardware\DeviceMap
+#define RTL_REGISTRY_USER 5 // \Registry\User\CurrentUser
+#define RTL_REGISTRY_MAXIMUM 6
+#define RTL_REGISTRY_HANDLE 0x40000000
+#define RTL_REGISTRY_OPTIONAL 0x80000000
+
+// end_wdm
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlCreateRegistryKey(
+    __in ULONG RelativeTo,
+    __in PWSTR Path
+    );
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlCheckRegistryKey(
+    __in ULONG RelativeTo,
+    __in PWSTR Path
+    );
+
+// begin_wdm
+
+typedef NTSTATUS (NTAPI *PRTL_QUERY_REGISTRY_ROUTINE)(
+    __in PWSTR ValueName,
+    __in ULONG ValueType,
+    __in PVOID ValueData,
+    __in ULONG ValueLength,
+    __in PVOID Context,
+    __in PVOID EntryContext
+    );
+
+typedef struct _RTL_QUERY_REGISTRY_TABLE
+{
+    PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine;
+    ULONG Flags;
+    PWSTR Name;
+    PVOID EntryContext;
+    ULONG DefaultType;
+    PVOID DefaultData;
+    ULONG DefaultLength;
+} RTL_QUERY_REGISTRY_TABLE, *PRTL_QUERY_REGISTRY_TABLE;
+
+#define RTL_QUERY_REGISTRY_SUBKEY 0x00000001
+#define RTL_QUERY_REGISTRY_TOPKEY 0x00000002
+#define RTL_QUERY_REGISTRY_REQUIRED 0x00000004
+#define RTL_QUERY_REGISTRY_NOVALUE 0x00000008
+#define RTL_QUERY_REGISTRY_NOEXPAND 0x00000010
+#define RTL_QUERY_REGISTRY_DIRECT 0x00000020
+#define RTL_QUERY_REGISTRY_DELETE 0x00000040
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlQueryRegistryValues(
+    __in ULONG RelativeTo,
+    __in PWSTR Path,
+    __in PRTL_QUERY_REGISTRY_TABLE QueryTable,
+    __in PVOID Context,
+    __in_opt PVOID Environment
+    );
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlWriteRegistryValue(
+    __in ULONG RelativeTo,
+    __in PWSTR Path,
+    __in PWSTR ValueName,
+    __in ULONG ValueType,
+    __in PVOID ValueData,
+    __in ULONG ValueLength
+    );
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlDeleteRegistryValue(
+    __in ULONG RelativeTo,
+    __in PWSTR Path,
+    __in PWSTR ValueName
+    );
+
+// end_wdm
+
 // Misc.
 
 NTSYSAPI
diff --git a/2.x/trunk/phlib/native.c b/2.x/trunk/phlib/native.c
index ce57f2744..bea721007 100644
--- a/2.x/trunk/phlib/native.c
+++ b/2.x/trunk/phlib/native.c
@@ -3801,7 +3801,7 @@ NTSTATUS PhpUnloadDriver(
 
     if ((win32Result = RegCreateKey(
         HKEY_LOCAL_MACHINE,
-        L"SYSTEM\\CurrentControlSet\\Services",
+        L"System\\CurrentControlSet\\Services",
         &servicesKeyHandle
         )) != ERROR_SUCCESS)
     {
@@ -3842,7 +3842,7 @@ NTSTATUS PhpUnloadDriver(
     }
 
     servicePath = PhConcatStrings2(
-        L"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\\",
+        L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\",
         ServiceKeyName->Buffer
         );
     status = NtUnloadDriver(&servicePath->us);