working with the register , i got a confusion about the register value types, that obviously matter at the time to read it... so
looking around the internet i found an example that works...
include \masm32\include\advapi32.inc
includelib \masm32\lib\advapi32.lib
....
..data
RegSubKey db "SOFTWARE\Microsoft\Windows\CurrentVersion",0
RegValue db "ProductId",0
RegBuffer db 256 dup(?)
RegSize dd 256
..data?
RegType DWORD ?
hSubKey HINSTANCE ?
....
invoke RegOpenKeyExA, HKEY_LOCAL_MACHINE,\
addr RegSubKey, 0, KEY_READ, addr hSubKey
invoke RegQueryValueExA, hSubKey,\
addr RegValue, NULL, addr RegType,\
addr RegBuffer, addr RegSize
invoke RegCloseKey, hSubKey
....
but the value types still bugging me ... the way than i have to manage the output RegBuffer value
which is the relationship between RegType,RegBuffer,RegSize? , specially RegType and the value type below
REG_BINARY ;
REG_DWORD ; THese ones are the most common
REG_SZ ;
REG_MULTI_SZ ;
REG_DWORD_LITTLE_ENDIAN
REG_DWORD_BIG_ENDIAN
REG_EXPAND_SZ
REG_LINK
REG_NONE
REG_QWORD
REG_QWORD_LITTLE_ENDIAN
REG_RESOURCE_LIST
looking around the internet i found an example that works...
include \masm32\include\advapi32.inc
includelib \masm32\lib\advapi32.lib
....
..data
RegSubKey db "SOFTWARE\Microsoft\Windows\CurrentVersion",0
RegValue db "ProductId",0
RegBuffer db 256 dup(?)
RegSize dd 256
..data?
RegType DWORD ?
hSubKey HINSTANCE ?
....
invoke RegOpenKeyExA, HKEY_LOCAL_MACHINE,\
addr RegSubKey, 0, KEY_READ, addr hSubKey
invoke RegQueryValueExA, hSubKey,\
addr RegValue, NULL, addr RegType,\
addr RegBuffer, addr RegSize
invoke RegCloseKey, hSubKey
....
but the value types still bugging me ... the way than i have to manage the output RegBuffer value
which is the relationship between RegType,RegBuffer,RegSize? , specially RegType and the value type below
REG_BINARY ;
REG_DWORD ; THese ones are the most common
REG_SZ ;
REG_MULTI_SZ ;
REG_DWORD_LITTLE_ENDIAN
REG_DWORD_BIG_ENDIAN
REG_EXPAND_SZ
REG_LINK
REG_NONE
REG_QWORD
REG_QWORD_LITTLE_ENDIAN
REG_RESOURCE_LIST
So, what is your question? How would you handle the different data types returned?
You can look for an example in the masm32 directory.
Here is a hint...
You can look for an example in the masm32 directory.
Here is a hint...
mov RegSize, 256 ; the buffer size
lea eax, RegSize
push eax
lea ecx, RegBuffer
push ecx
lea eax, RegType
push eax
push 0
push offset RegValue
push hSubKey
call RegQueryValueEx
test eax, eax
jnz Error
.if RegType == REG_SZ
; Do string stuff with buffer here
.elseif RegType == REG_DWORD
; Convert string to dword first (if you want) then use number here
.elseif RegType == REG_BINARY
; Do Binary stuff here, example in the masm32 directory
.elseif RegType == REG_MULTI_SZ
; String has the format %programfiles%\somedir\somefile,
; Use ExpandEnvironmentStrings on RegBuffer first to return full path
.endif
Error:
push hSubKey
call RegCloseValue
ret
i mean ...but example...The RegBuffer (the read buffer) it's always a db (byte) or depend of the value type?
Well no, it does not always have to be a BYTE. If you are only expecting DWORDs, then your buffer can be a DWORD, if you are enumerating values and you don't know if they are going to be strings or dwords, then make your buffer a BYTE and convert the string to a number for REG_DWORD
the thing than i don't understand is :
with the code than i put here , when i use
invoke SetWindowText,hwndEdit,addr RegBuffer
to see the buffer well read from a REG_SZ in a editbox ,the edit box shows me the value...but when i use the same code to read a REG_DWORD the edit box don't show anything
what 's the reason?
with the code than i put here , when i use
invoke SetWindowText,hwndEdit,addr RegBuffer
to see the buffer well read from a REG_SZ in a editbox ,the edit box shows me the value...but when i use the same code to read a REG_DWORD the edit box don't show anything
what 's the reason?
Ah phewy, where is my mind.
If you know what value your going to grab is a dword, then use a dword buffer, if you know the value is a string, use a byte buffer.
If you don't know the data type of the value you ar querying (you should know since you know what you are grabbing) then you should call RegQueryValueEx twice like so:
first to get the value datatype then second with the correct buffer, in the example I am quering a string and dword
is this what you are after?
If you are enumerating the values, it is a bit more simple..
If you know what value your going to grab is a dword, then use a dword buffer, if you know the value is a string, use a byte buffer.
If you don't know the data type of the value you ar querying (you should know since you know what you are grabbing) then you should call RegQueryValueEx twice like so:
first to get the value datatype then second with the correct buffer, in the example I am quering a string and dword
TestReg proc
LOCAL lpcbData:DWORD
LOCAL lpData[150]:BYTE
LOCAL lpDataD:DWORD
LOCAL hRegKey:DWORD
LOCAL RegType:DWORD
lea eax, hRegKey
push eax
push KEY_QUERY_VALUE
push 0
push offset ZoneRegPath
push HKEY_CURRENT_USER
call RegOpenKeyEx
test eax, eax
jnz Done
; Check the data type
push 0
push 0
lea eax, RegType
push eax
push 0
push offset RegValDescription
push hRegKey
call RegQueryValueEx
; in this case it will be a string
.if RegType == REG_SZ
; call it again with correct buffer
mov lpcbData, 150
lea eax, lpcbData
push eax
lea ecx, lpData
push ecx
push 0
push 0
push offset RegValDescription
push hRegKey
call RegQueryValueEx
.endif
lea eax, lpData
PrintStringByAddr eax
; Check the data type
push 0
push 0
lea eax, RegType
push eax
push 0
push offset RegValFlags
push hRegKey
call RegQueryValueEx
; in this case it will be a DWORD
.if RegType == REG_DWORD
; call it again with correct buffer
mov lpcbData, 4
lea eax, lpcbData
push eax
lea ecx, lpDataD
push ecx
push 0
push 0
push offset RegValFlags
push hRegKey
call RegQueryValueEx
.endif
PrintDec lpDataD
;Turn it into a string for your setwindow text
lea eax, lpData
push eax
push lpDataD
call dwtoa
;now you can use lpdata for your setwindow text
lea eax, lpData
PrintStringByAddr eax
Done:
push hRegKey
call RegCloseKey
ret
TestReg endp
is this what you are after?
If you are enumerating the values, it is a bit more simple..